{"record":{"id":"d5c03aa6efaf2537","repo":"rancher/rancher","slug":"invalid-data-for-auth-store-update","errorCode":null,"errorMessage":"invalid data for auth store update","messagePattern":"invalid data for auth store update","errorType":"validation","errorClass":null,"httpStatus":500,"severity":"error","filePath":"pkg/auth/api/secrets/store.go","lineNumber":29,"sourceCode":"\twcorev1 \"github.com/rancher/wrangler/v3/pkg/generated/controllers/core/v1\"\n)\n\nfunc Wrap(store types.Store, secrets wcorev1.SecretController) types.Store {\n\treturn &Store{\n\t\tStore:   store,\n\t\tSecrets: secrets,\n\t}\n}\n\ntype Store struct {\n\ttypes.Store\n\tSecrets wcorev1.SecretController\n}\n\nfunc (s *Store) Update(apiContext *types.APIContext, schema *types.Schema, data map[string]interface{}, id string) (map[string]interface{}, error) {\n\tauthType, found := values.GetValue(data, \"type\")\n\tif !found {\n\t\treturn nil, fmt.Errorf(\"invalid data for auth store update\")\n\t}\n\n\tkind := convert.ToString(authType)\n\tfields, ok := TypeToFields[kind]\n\tsubFields, subOk := SubTypeToFields[kind]\n\tif !ok && !subOk {\n\t\treturn s.Store.Update(apiContext, schema, data, id)\n\t}\n\n\tvar err error\n\tfor _, field := range fields {\n\t\tif val, ok := data[field]; ok {\n\t\t\tdata[field], err = s.CreateOrUpdateSecrets(convert.ToString(val), field, kind)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, err\n\t\t\t}\n\t\t}\n\t}","sourceCodeStart":11,"sourceCodeEnd":47,"githubUrl":"https://github.com/rancher/rancher/blob/932558d4e68565aff2d2f36e89ec4a391b06e7c5/pkg/auth/api/secrets/store.go#L11-L47","documentation":"Rancher wraps every authconfig schema store with a secrets store (pkg/auth/api/secrets). On Update it first reads the top-level 'type' key from the request data to look up TypeToFields/SubTypeToFields, which decide which credential fields must be stripped from the body and stored in Kubernetes Secrets. If 'type' is absent it rejects the request with this error before any field extraction happens.","triggerScenarios":"PUT /v3/authconfigs/{azuread|openldap|okta|...} whose JSON body omits the 'type' key — typically a partial document containing only the changed fields, or a rebuilt body from a GET-modify-PUT pipeline that drops 'type'.","commonSituations":"Automation/curl/Terraform that PUTs a minimal payload; client code that constructs the body from scratch instead of merging with the current resource; UI extensions posting custom payloads.","solutions":["Add 'type' matching the provider (e.g. \"type\":\"azuread\") to the PUT body","GET the authconfig first, merge your changes into the returned document, and PUT the merged body","In client code, assert the payload contains 'type' before sending and cover it with a test"],"exampleFix":"// before\nPUT /v3/authconfigs/azuread\n{\"applicationSecret\":\"new-secret\"}\n// after\nPUT /v3/authconfigs/azuread\n{\"type\":\"azuread\",\"applicationSecret\":\"new-secret\"}","handlingStrategy":"validation","validationCode":"// Go client: verify the payload carries the discriminator before updating\nif _, ok := data[\"type\"]; !ok {\n    return fmt.Errorf(\"payload missing required 'type' field for authconfig update\")\n}\n_, err := apiClient.Update(\"authconfigs\", id, data)","typeGuard":null,"tryCatchPattern":"if err != nil {\n    if strings.Contains(err.Error(), \"invalid data for auth store update\") {\n        // re-fetch the resource, merge 'type' and other required fields, retry once\n    }\n}","preventionTips":["Always GET-then-merge-then-PUT authconfig resources","Treat 'type' as a required field in client-side payload validation","Add an integration test that PUTs a minimal authconfig body"],"tags":["rancher","go","authconfig","rest-api","kubernetes","secrets"],"backgroundTag":null,"analyzedSha":"932558d4e68565aff2d2f36e89ec4a391b06e7c5","analyzedAt":"2026-08-16T04:37:02.125Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}