{"record":{"id":"cf0f971579f2e5c3","repo":"alibaba/nacos","slug":"jwks-uri-is-not-configured-or-discovered","errorCode":null,"errorMessage":"JWKS URI is not configured or discovered","messagePattern":"JWKS URI is not configured or discovered","errorType":"exception","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/token/JwksProvider.java","lineNumber":105,"sourceCode":"            return cached;\n        }\n    }\n    \n    /**\n     * Force a JWKS refresh for key rotation recovery.\n     *\n     * @return refreshed JWK set\n     * @throws IOException if fetching fails\n     */\n    public JWKSet refreshJwkSet() throws IOException {\n        jwksCache.invalidateAll();\n        return getJwkSet();\n    }\n    \n    private JWKSet fetchJwkSet() throws IOException {\n        String jwksUri = metadataProvider.getMetadata().getJwksUri();\n        if (StringUtils.isBlank(jwksUri)) {\n            throw new IOException(\"JWKS URI is not configured or discovered\");\n        }\n        LOGGER.info(\"Fetching JWKS from: {}\", jwksUri);\n        HttpRequest request = HttpRequest.newBuilder().uri(URI.create(jwksUri))\n            .header(\"Accept\", \"application/json\").GET().build();\n        try {\n            HttpResponse<String> response =\n                httpClient.send(request, HttpResponse.BodyHandlers.ofString());\n            if (response.statusCode() != OidcProtocolConstants.HTTP_STATUS_OK) {\n                throw new IOException(\"Failed to fetch JWKS, status: \" + response.statusCode());\n            }\n            JWKSet result = JWKSet.parse(response.body());\n            LOGGER.info(\"Successfully fetched JWKS with {} keys\", result.getKeys().size());\n            return result;\n        } catch (InterruptedException e) {\n            Thread.currentThread().interrupt();\n            throw new IOException(\"JWKS fetch interrupted\", e);\n        } catch (ParseException e) {\n            throw new IOException(\"Failed to parse JWKS\", e);","sourceCodeStart":87,"sourceCodeEnd":123,"githubUrl":"https://github.com/alibaba/nacos/blob/9b989acdf181d00898f2e8839257bb2b2a3cefe3/plugin-default-impl/nacos-oidc-auth-plugin/src/main/java/com/alibaba/nacos/plugin/auth/impl/oidc/token/JwksProvider.java#L87-L123","documentation":"Thrown by JwksProvider.fetchJwkSet() when the discovered provider metadata's jwks_uri is blank. JWT validation requires the JWKS endpoint to fetch signing keys; without it tokens cannot be signature-verified.","triggerScenarios":"JWT token validation is active (token-validation-method=jwt, the default) and the IdP discovery document omitted jwks_uri, or discovery hasn't populated it. Triggered on the first token validation that needs to fetch keys.","commonSituations":"IdP discovery doc lacks jwks_uri (non-compliant); discovery partially failed leaving jwks_uri null; using an IdP that exposes keys under a non-standard field; switching to introspection-only but the default jwt mode is still active.","solutions":["Verify the discovery document contains a non-empty jwks_uri field (curl and inspect JSON).","If the IdP genuinely lacks discovery-hosted JWKS, switch token-validation-method to 'introspection' (nacos.plugin.auth.oidc.token-validation-method=introspection) so JWKS is not required.","Confirm discovery succeeded (log line 'OIDC configuration discovered: jwksUri=...'); a null jwksUri in the log indicates the field was missing."],"exampleFix":"// before: IdP has no jwks_uri but default jwt validation is used\nnacos.plugin.auth.oidc.token-validation-method=jwt\n// after: switch to introspection if no JWKS endpoint exists\nnacos.plugin.auth.oidc.token-validation-method=introspection","handlingStrategy":"validation","validationCode":"// Before JWT validation, confirm jwks_uri is available; else switch validation mode\nOidcProviderMetadata meta = metadataProvider.getMetadata();\nif (config.isJwtValidation() && StringUtils.isBlank(meta.getJwksUri())) {\n    throw new IllegalStateException(\n        \"token-validation-method=jwt requires jwks_uri in discovery; \"\n        + \"set token-validation-method=introspection if absent\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    jwksProvider.getJwkSet();\n} catch (IOException e) {\n    if (\"JWKS URI is not configured or discovered\".equals(e.getMessage())) {\n        // either fix discovery to include jwks_uri or switch to introspection mode\n        log.error(\"No jwks_uri discovered; consider token-validation-method=introspection\");\n    }\n    throw e;\n}","preventionTips":["Confirm the discovery doc publishes jwks_uri before using jwt validation.","Switch to token-validation-method=introspection if the IdP has no JWKS endpoint.","Log discovered metadata at startup to catch a null jwks_uri early."],"tags":["oidc","config","jwks","discovery"],"backgroundTag":null,"analyzedSha":"9b989acdf181d00898f2e8839257bb2b2a3cefe3","analyzedAt":"2026-08-14T07:17:31.569Z","schemaVersion":2},"datasetVersion":"2026-08-14T10:17:34.591Z"}