{"record":{"id":"e7e58e0d16bdfb4e","repo":"rancher/rancher","slug":"failed-to-get-provider-configuration","errorCode":null,"errorMessage":"Failed to get provider configuration","messagePattern":"Failed to get provider configuration","errorType":"http","errorClass":null,"httpStatus":400,"severity":"error","filePath":"pkg/auth/handler/handler.go","lineNumber":89,"sourceCode":"// Security considerations:\n//   - The redirect URL is constructed from trusted authConfig data stored in the cluster\n//   - User-provided state and scope are passed as query parameters but do not control the redirect destination\n//   - PKCE is used when configured to prevent authorization code interception attacks\n//   - The PKCE verifier is stored in a secure cookie when PKCE is enabled\nfunc (p *AuthProviderServer) redirectToIdP(w http.ResponseWriter, req *http.Request) {\n\tprovider := req.PathValue(\"provider\")\n\n\tlogrus.Debugf(\"[oidc] Redirecting to IdP for provider: %s\", provider)\n\n\tauthConfig, err := p.authConfigs.Get(provider, metav1.GetOptions{})\n\tif err != nil {\n\t\tif apierrors.IsNotFound(err) {\n\t\t\tlogrus.Debugf(\"[oidc] Provider not found: %s\", provider)\n\t\t\thttp.NotFound(w, req)\n\t\t\treturn\n\t\t}\n\t\tlogrus.Errorf(\"[oidc] Failed to get provider configuration for %s: %v\", provider, err)\n\t\thttp.Error(w, \"Failed to get provider configuration\", http.StatusBadRequest)\n\t\treturn\n\t}\n\n\tauthConfigData, ok := authConfig.(runtime.Unstructured)\n\tif !ok {\n\t\tlogrus.Errorf(\"[oidc] Invalid auth config format for provider %s: expected runtime.Unstructured\", provider)\n\t\thttp.Error(w, \"Invalid auth config format\", http.StatusInternalServerError)\n\t\treturn\n\t}\n\tdata := authConfigData.UnstructuredContent()\n\tlogrus.Debugf(\"[oidc] Retrieved auth config for provider: %s\", provider)\n\n\t// Validate that the provider is enabled\n\tif enabledRaw := data[client.GenericOIDCConfigFieldEnabled]; enabledRaw != nil {\n\t\tenabled, ok := enabledRaw.(bool)\n\t\tif !ok {\n\t\t\tlogrus.Errorf(\"[oidc] Invalid enabled field type for provider %s: expected bool, got %T\", provider, enabledRaw)\n\t\t\thttp.Error(w, \"Invalid provider configuration\", http.StatusInternalServerError)","sourceCodeStart":71,"sourceCodeEnd":107,"githubUrl":"https://github.com/rancher/rancher/blob/932558d4e68565aff2d2f36e89ec4a391b06e7c5/pkg/auth/handler/handler.go#L71-L107","documentation":"The OIDC login redirect handler fetches the provider's AuthConfig (management.cattle.io/v3) via p.authConfigs.Get(provider) using the {provider} path value. Any error other than NotFound — apiserver unavailable, RBAC denial, cache/informer failure, timeout — is masked to the client as 400 \"Failed to get provider configuration\"; the real cause only appears in the log line \"[oidc] Failed to get provider configuration for <provider>: <err>\". Note the 400 status is misleading: the failure is server-side.","triggerScenarios":"GET on the oidc redirect route (handler reading req.PathValue(\"provider\")) while the authconfig read fails for a non-NotFound reason: apiserver/etcd disruption, RBAC blocking the handler's client on authconfigs, or an unsynced informer cache.","commonSituations":"During apiserver or etcd instability or recovery-from-backup; after CRD/authconfig schema breakage from a partial upgrade; custom deployments where the handler's backing client lacks read permissions. A typo'd provider name usually yields 404 (NotFound) instead — hitting this 400 means the config read itself failed.","solutions":["Check rancher logs for \"[oidc] Failed to get provider configuration for <provider>\" — the underlying error is only logged there","Verify the AuthConfig exists and the provider path segment matches: kubectl get authconfig <provider>","If the underlying error is apiserver/RBAC related, fix apiserver health or the handler client's permissions on authconfigs, then retry the redirect","If it was transient (apiserver restart), simply retry after the control plane recovers"],"exampleFix":null,"handlingStrategy":"retry","validationCode":"// Before directing users at the login URL, confirm the provider exists:\n// kubectl get authconfig <provider>  (exit 0 = exists; NotFound gives 404, not this error)\nif !authConfigExists(provider) {\n    return fmt.Errorf(\"provider %s not configured\", provider)\n}","typeGuard":null,"tryCatchPattern":"resp, err := client.Get(redirectURL)\n// ...\nif resp.StatusCode == http.StatusBadRequest {\n    body, _ := io.ReadAll(resp.Body)\n    if strings.Contains(string(body), \"Failed to get provider configuration\") {\n        // server-side read failure masked as 400: check rancher logs; retry after apiserver recovery\n        time.Sleep(backoff())\n        return retry() // safe: state was not mutated\n    }\n}","preventionTips":["Pre-check provider existence with kubectl/API before shipping login links","Treat this 400 as server-side: look for '[oidc] Failed to get provider configuration' in rancher logs before blaming client config","Keep authconfig reads healthy: verify RBAC and apiserver stability during upgrade windows"],"tags":["rancher","oidc","authconfig","kubernetes","login"],"backgroundTag":null,"analyzedSha":"932558d4e68565aff2d2f36e89ec4a391b06e7c5","analyzedAt":"2026-08-16T04:37:02.125Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}