{"record":{"id":"ea3e6e82739cc3cd","repo":"different-ai/openwork","slug":"oidc-discovery-failed-with-response-status-ent","errorCode":null,"errorMessage":"OIDC discovery failed with ${response.status}. Enter manual OIDC endpoints or enable skip discovery.","messagePattern":"OIDC discovery failed with (.+?)\\. Enter manual OIDC endpoints or enable skip discovery\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"ee/apps/den-api/src/sso.ts","lineNumber":122,"sourceCode":"      throw new Error(\"Manual OIDC configuration requires authorization, token, and JWKS endpoints.\")\n    }\n\n    return {\n      skipDiscovery: true,\n      authorizationEndpoint: input.authorizationEndpoint,\n      tokenEndpoint: input.tokenEndpoint,\n      jwksEndpoint: input.jwksEndpoint,\n      userInfoEndpoint: input.userInfoEndpoint ?? undefined,\n      tokenEndpointAuthentication: input.tokenEndpointAuthentication ?? undefined,\n    }\n  }\n\n  const response = await fetch(getOidcDiscoveryUrl(input.issuer), {\n    headers: { accept: \"application/json\" },\n    signal: AbortSignal.timeout(10_000),\n  })\n  if (!response.ok) {\n    throw new Error(`OIDC discovery failed with ${response.status}. Enter manual OIDC endpoints or enable skip discovery.`)\n  }\n\n  const parsed = oidcDiscoverySchema.safeParse(await response.json())\n  if (!parsed.success) {\n    throw new Error(\"OIDC discovery document is missing required endpoints.\")\n  }\n  if (normalizeIssuer(parsed.data.issuer) !== normalizeIssuer(input.issuer)) {\n    throw new Error(\"OIDC discovery issuer does not match the configured issuer.\")\n  }\n\n  return {\n    skipDiscovery: true,\n    authorizationEndpoint: parsed.data.authorization_endpoint,\n    tokenEndpoint: parsed.data.token_endpoint,\n    jwksEndpoint: parsed.data.jwks_uri,\n    userInfoEndpoint: parsed.data.userinfo_endpoint,\n    tokenEndpointAuthentication: input.tokenEndpointAuthentication ?? undefined,\n  }","sourceCodeStart":104,"sourceCodeEnd":140,"githubUrl":"https://github.com/different-ai/openwork/blob/2b7df46e8ae1517d64c896c7793d2d52ec845669/ee/apps/den-api/src/sso.ts#L104-L140","documentation":"When not skipping discovery, resolveOidcEndpoints fetches the issuer's OpenID Connect discovery document (with a 10s timeout). Any non-OK HTTP status aborts setup with this Error, instructing the admin to enter endpoints manually or enable skipDiscovery.","triggerScenarios":"fetch(getOidcDiscoveryUrl(issuer)) returns 404/500/403 etc. — issuer URL wrong, well-known path not exposed, IdP temporarily down, or a proxy/WAF blocking the request.","commonSituations":"Issuer entered with wrong path (discovery URL not derivable); IdP behind VPN/private network unreachable from server; on-prem IdP with self-signed certs failing TLS; transient IdP outage.","solutions":["Check the issuer URL and confirm <issuer>/.well-known/openid-configuration returns 200 in a browser or curl","If the provider does not publish a discovery document, configure the endpoints manually with skipDiscovery: true","Retry if the IdP had a transient outage; check network/proxy/TLS trust if the IdP is internal"],"exampleFix":"// before\n{ issuer: 'https://idp.example.com', skipDiscovery: false } // no well-known doc, 404\n// after\n{ issuer: 'https://idp.example.com', skipDiscovery: true, authorizationEndpoint: 'https://idp.example.com/authorize', tokenEndpoint: 'https://idp.example.com/token', jwksEndpoint: 'https://idp.example.com/.well-known/jwks.json' }","handlingStrategy":"try-catch","validationCode":"const url = getOidcDiscoveryUrl(issuer)\nconst res = await fetch(url, { headers: { accept: 'application/json' } })\nif (!res.ok) throw new Error(`Discovery document ${url} returned ${res.status}; enter endpoints manually`)","typeGuard":null,"tryCatchPattern":"try {\n  await resolveOidcEndpoints(input)\n} catch (e) {\n  if (e instanceof Error && e.message.startsWith('OIDC discovery failed with')) {\n    // fall back to manual endpoint entry / show guidance in SSO setup UI\n  } else throw e\n}","preventionTips":["Verify <issuer>/.well-known/openid-configuration is reachable from the server before saving SSO config","Check network egress, proxies, and TLS trust for on-prem IdPs","Have a manual-endpoint fallback ready for IdPs without discovery"],"tags":["oidc","sso","http","discovery","network"],"backgroundTag":"oidc-discovery-failed","analyzedSha":"2b7df46e8ae1517d64c896c7793d2d52ec845669","analyzedAt":"2026-09-01T07:59:23.713Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}