{"record":{"id":"cf8d5b89697b7da8","repo":"kubesphere/kubesphere","slug":"failed-to-exchange-identity-for-s-error-v","errorCode":null,"errorMessage":"failed to exchange identity for %s, error: %v","messagePattern":"failed to exchange identity for (.+?), error: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/models/auth/oauth.go","lineNumber":49,"sourceCode":"\t}\n\treturn authenticator\n}\n\nfunc (o *oauthAuthenticator) Authenticate(ctx context.Context, provider string, req *http.Request) (authuser.Info, error) {\n\tproviderConfig, err := o.idpConfigurationGetter.GetConfiguration(ctx, provider)\n\t// identity provider not registered\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to get identity provider configuration for %s, error: %v\", provider, err)\n\t}\n\n\toauthIdentityProvider, exist := identityprovider.SharedIdentityProviderController.GetOAuthProvider(provider)\n\tif !exist {\n\t\treturn nil, fmt.Errorf(\"identity provider %s not exist\", provider)\n\t}\n\n\tidentity, err := oauthIdentityProvider.IdentityExchangeCallback(req)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to exchange identity for %s, error: %v\", provider, err)\n\t}\n\n\treturn authByIdentityProvider(ctx, o.client, o.userMapper, providerConfig, identity)\n}\n","sourceCodeStart":31,"sourceCodeEnd":54,"githubUrl":"https://github.com/kubesphere/kubesphere/blob/04a29b5c601470fa6bc2f2e92358dcb802a0d414/pkg/models/auth/oauth.go#L31-L54","documentation":"oauthAuthenticator.Authenticate calls oauthIdentityProvider.IdentityExchangeCallback(req) to swap the OAuth code for a user identity (token exchange + userinfo call). If the external IdP rejects the exchange, the underlying error is wrapped as this message. The root cause is in the %v suffix.","triggerScenarios":"OAuth callback with an invalid/expired/already-used authorization code, mismatched client_secret or redirect_uri, unreachable IdP endpoint, or the IdP rejecting the access-token request.","commonSituations":"User double-submits the callback (code reuse); wrong clientSecret/redirectURI in the IdentityProvider CR; IdP TLS certificate not trusted by the cluster; network egress blocked to the IdP.","solutions":["Retry the login flow from the beginning to get a fresh authorization code","Verify clientSecret, redirectURI, and endpoint settings in the IdentityProvider CR","Check egress connectivity and TLS trust to the external IdP; inspect the wrapped %v cause in apiserver logs"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"user, err := oauthAuth.Authenticate(ctx, provider, req)\nif err != nil {\n  if strings.Contains(err.Error(), \"failed to exchange identity\") {\n    // restart the OAuth dance: redirect to authorize URL for a fresh code\n    http.Redirect(w, req, authorizeURL(provider), http.StatusFound)\n    return\n  }\n  http.Error(w, \"login failed\", http.StatusUnauthorized)\n}","preventionTips":["Never reuse authorization codes; always start a fresh authorize redirect","Double-check clientSecret and redirectURI in the IdentityProvider CR","Ensure cluster egress and CA trust for the external IdP endpoints"],"tags":["oauth","token-exchange","network"],"backgroundTag":"oauth-callback-exchange-failed","analyzedSha":"04a29b5c601470fa6bc2f2e92358dcb802a0d414","analyzedAt":"2026-09-03T18:33:15.017Z","contentChangedAt":"2026-09-03T18:33:15.017Z","schemaVersion":2},"datasetVersion":"2026-09-11T00:17:11.886Z"}