{"record":{"id":"f5575071c4479187","repo":"xai-org/grok-build","slug":"idtokenvalidationfailed","errorCode":"IdTokenValidationFailed","errorMessage":"OidcError::IdTokenValidationFailed(e.to_string())","messagePattern":"OidcError::IdTokenValidationFailed\\(e\\.to_string\\(\\)\\)","errorType":"error_code","errorClass":"OidcError","httpStatus":null,"severity":"error","filePath":"crates/codegen/xai-grok-shell/src/auth/oidc/protocol.rs","lineNumber":764,"sourceCode":"    }\n    let token = id_token.ok_or_else(|| anyhow::Error::new(OidcError::MissingIdToken))?;\n    validate_and_extract_user_info(\n        token,\n        discovery,\n        expected_issuer,\n        expected_client_id,\n        expected_nonce,\n    )\n    .await\n    .map(|mut user_info| {\n        user_info.principal_type = principal_type.map(ToOwned::to_owned);\n        user_info.principal_id = principal_id.map(ToOwned::to_owned);\n        if user_info.team_id.is_none() {\n            user_info.team_id = fallback_team_id;\n        }\n        user_info\n    })\n    .map_err(|e| anyhow::Error::new(OidcError::IdTokenValidationFailed(e.to_string())))\n}\n#[cfg(test)]\nmod tests {\n    use super::super::test_helpers::*;\n    use super::*;\n    #[test]\n    fn pkce_s256_challenge_matches_verifier() {\n        let pkce = generate_pkce();\n        assert_eq!(pkce.code_verifier.len(), 43);\n        let expected = URL_SAFE_NO_PAD.encode(Sha256::digest(pkce.code_verifier.as_bytes()));\n        assert_eq!(pkce.code_challenge, expected);\n    }\n    #[test]\n    fn authorize_url_includes_required_oidc_params() {\n        let config = OidcAuthConfig {\n            issuer: \"https://example.okta.com\".into(),\n            client_id: TEST_CLIENT_ID.into(),\n            scopes: vec![\"openid\".into(), \"profile\".into()],","sourceCodeStart":746,"sourceCodeEnd":782,"githubUrl":"https://github.com/xai-org/grok-build/blob/bc7f02eddd3d84085849dc19ed216f11c23b0571/crates/codegen/xai-grok-shell/src/auth/oidc/protocol.rs#L746-L782","documentation":"OidcError::IdTokenValidationFailed(String) is a wrapper applied by extract_user_info: any error produced by validate_and_extract_user_info (signature failure, expired token, JwkNotFound, IssuerMismatch, etc.) is flattened via e.to_string() into this single error type at protocol.rs:764. The original specific cause is preserved only as a string message.","triggerScenarios":"Any failure inside validate_and_extract_user_info — JWKS fetch failure, missing kid, unsupported alg, jsonwebtoken::decode errors (expired/invalid signature/missing claims), issuer/audience/nonce mismatch — then re-wrapped as IdTokenValidationFailed.","commonSituations":"Clock skew making tokens appear expired; IdP key rotation invalidating signatures; misconfigured issuer/client_id/nonce; network failure reaching jwks_uri; debug builds altering token handling.","solutions":["Read the inner message of IdTokenValidationFailed to identify the root cause (expired, signature, issuer, nonce, etc.) and fix that specific issue.","Sync system clock (NTP) if the message indicates expiration/immature-token errors.","Re-run the login flow to get a fresh token; verify issuer/client_id/nonce configuration matches the IdP.","Check network access to the discovery jwks_uri endpoint."],"exampleFix":"// before: opaque wrapper loses typed context\n.map_err(|e| anyhow::Error::new(OidcError::IdTokenValidationFailed(e.to_string())))\n// after (caller): log full chain for diagnosis\nif let Err(e) = result {\n    tracing::error!(chain = ?e, \"id token validation failed\"); // inspect root cause\n}","handlingStrategy":"try-catch","validationCode":"// pre-validate the JWT well before the flow: header, kid, exp\nlet header = jsonwebtoken::decode_header(token)?;\nif header.kid.is_none() { eprintln!(\"token has no kid; validation will fail\"); }","typeGuard":null,"tryCatchPattern":"if let Err(e) = extract_user_info(...).await {\n    let msg = e.to_string();\n    if let Some(inner) = msg.strip_prefix(\"IdTokenValidationFailed(\").and_then(|s| s.strip_suffix(')')) {\n        tracing::error!(cause = inner, \"id token validation failed\"); // inspect root cause\n    }\n}","preventionTips":["Keep clocks NTP-synced to avoid spurious exp errors.","Log the full anyhow chain, not just the wrapper message.","Validate config (issuer, client_id, nonce) with a smoke-test login in CI.","Ensure jwks_uri is reachable from the runtime environment."],"tags":["oidc","jwt-validation","id-token","auth"],"backgroundTag":"jwt-validation-failed","analyzedSha":"bc7f02eddd3d84085849dc19ed216f11c23b0571","analyzedAt":"2026-08-31T04:59:42.031Z","schemaVersion":2},"datasetVersion":"2026-08-31T09:17:48.483Z"}