{"record":{"id":"eebb6f990ed15a8e","repo":"pulumi/pulumi","slug":"unknown-auth-context-grant-type-s","errorCode":null,"errorMessage":"unknown auth context grant type: %s","messagePattern":"unknown auth context grant type: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/cmd/pulumi/backend/login_manager.go","lineNumber":137,"sourceCode":"\tctx context.Context,\n\tsink diag.Sink,\n\turl string,\n\tproject *workspace.Project,\n\tsetCurrent bool,\n\tinsecure bool,\n\tauthContext workspace.AuthContext,\n) (backend.Backend, error) {\n\tif authContext.GrantType == workspace.AuthContextGrantTypeTokenExchange {\n\t\tlm := httpstate.NewLoginManager()\n\t\t_, err := lm.LoginWithOIDCToken(\n\t\t\tctx, sink, url, insecure, authContext.Token, authContext.Organization, authContext.Scope,\n\t\t\tauthContext.Expiration, setCurrent)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\t\treturn httpstate.New(ctx, sink, url, project, insecure)\n\t}\n\treturn nil, fmt.Errorf(\"unknown auth context grant type: %s\", authContext.GrantType)\n}\n\ntype MockLoginManager struct {\n\tCurrentF func(\n\t\tctx context.Context,\n\t\tws pkgWorkspace.Context,\n\t\tsink diag.Sink,\n\t\turl string,\n\t\tproject *workspace.Project,\n\t\tsetCurrent bool,\n\t) (backend.Backend, error)\n\n\tLoginF func(\n\t\tctx context.Context,\n\t\tws pkgWorkspace.Context,\n\t\tsink diag.Sink,\n\t\turl string,\n\t\tproject *workspace.Project,","sourceCodeStart":119,"sourceCodeEnd":155,"githubUrl":"https://github.com/pulumi/pulumi/blob/793f7b2e160db4321fb7fb6b0607461e01cb251e/pkg/cmd/pulumi/backend/login_manager.go#L119-L155","documentation":"`LoginFromAuthContext` logs into a backend using a pre-built auth context, currently supporting only the `token-exchange` (OIDC) grant type. If the auth context carries any other grant type, the function returns this error naming the unrecognized value. It's a guard against extending AuthContext with grant types the login manager does not yet implement.","triggerScenarios":"Calling `LoginManager.LoginFromAuthContext` with a `workspace.AuthContext` whose `GrantType` is anything other than `workspace.AuthContextGrantTypeTokenExchange` (including empty string).","commonSituations":"Custom tooling or automation building an AuthContext programmatically with a wrong/empty GrantType; a new grant type added to workspace.AuthContext but not yet handled by the login manager; Pulumi Deployments/agent integrations passing unexpected credentials.","solutions":["Populate `authContext.GrantType` with `workspace.AuthContextGrantTypeTokenExchange` and a valid OIDC token","If a different grant type is genuinely needed, add a handler branch in `LoginFromAuthContext` before calling it with that type","Check the caller constructing the AuthContext (e.g. PULUMI_ACCESS_TOKEN or agent credential parsing) for why the grant type is unset"],"exampleFix":"// before\nauthCtx := workspace.AuthContext{Token: tok}\nbackend, err := lm.LoginFromAuthContext(ctx, sink, url, proj, true, false, authCtx)\n// unknown auth context grant type: \n// after\nauthCtx := workspace.AuthContext{GrantType: workspace.AuthContextGrantTypeTokenExchange, Token: tok}\nbackend, err := lm.LoginFromAuthContext(ctx, sink, url, proj, true, false, authCtx)","handlingStrategy":"validation","validationCode":"// validate the grant type before calling LoginFromAuthContext\nif authContext.GrantType != workspace.AuthContextGrantTypeTokenExchange {\n    return fmt.Errorf(\"unsupported grant type %q; only token-exchange is supported\", authContext.GrantType)\n}","typeGuard":"func isTokenExchangeAuth(ac workspace.AuthContext) bool {\n    return ac.GrantType == workspace.AuthContextGrantTypeTokenExchange && ac.Token != \"\"\n}","tryCatchPattern":"b, err := lm.LoginFromAuthContext(ctx, sink, url, project, true, false, ac)\nif err != nil && strings.HasPrefix(err.Error(), \"unknown auth context grant type\") {\n    return fmt.Errorf(\"upgrade the CLI or use token-exchange auth: %w\", err)\n}","preventionTips":["Only construct AuthContext with workspace.AuthContextGrantTypeTokenExchange","Check the grant type constant set in the workspace package before use","Handle empty GrantType explicitly at the credential-parsing layer"],"tags":["auth","oidc","login","pulumi"],"backgroundTag":"unknown-grant-type","analyzedSha":"793f7b2e160db4321fb7fb6b0607461e01cb251e","analyzedAt":"2026-08-31T09:36:43.099Z","schemaVersion":2},"datasetVersion":"2026-09-01T08:17:40.651Z"}