{"record":{"id":"f59b25d73f5f713f","repo":"Dokploy/dokploy","slug":"internal-server-error-f59b25","errorCode":"INTERNAL_SERVER_ERROR","errorMessage":"Failed to parse the SSO provider OIDC configuration","messagePattern":"Failed to parse the SSO provider OIDC configuration","errorType":"exception","errorClass":"TRPCError","httpStatus":500,"severity":"error","filePath":"packages/server/src/services/proprietary/forward-auth.ts","lineNumber":45,"sourceCode":"import { findDomainById, updateDomainById } from \"../domain\";\n\nconst resolveOidcConfig = (provider: {\n\tissuer: string;\n\toidcConfig: string | null;\n}): ForwardAuthOidcConfig => {\n\tif (!provider.oidcConfig) {\n\t\tthrow new TRPCError({\n\t\t\tcode: \"BAD_REQUEST\",\n\t\t\tmessage:\n\t\t\t\t\"Forward-auth requires an OIDC provider — SAML is not supported.\",\n\t\t});\n\t}\n\n\tlet parsed: any;\n\ttry {\n\t\tparsed = JSON.parse(provider.oidcConfig);\n\t} catch {\n\t\tthrow new TRPCError({\n\t\t\tcode: \"INTERNAL_SERVER_ERROR\",\n\t\t\tmessage: \"Failed to parse the SSO provider OIDC configuration\",\n\t\t});\n\t}\n\n\tif (!parsed?.clientId || !parsed?.clientSecret) {\n\t\tthrow new TRPCError({\n\t\t\tcode: \"BAD_REQUEST\",\n\t\t\tmessage: \"SSO provider OIDC config is missing clientId/clientSecret\",\n\t\t});\n\t}\n\n\treturn {\n\t\tclientId: parsed.clientId,\n\t\tclientSecret: parsed.clientSecret,\n\t\tissuer: provider.issuer,\n\t\tscopes: parsed.scopes,\n\t\tskipDiscovery: parsed.skipDiscovery,","sourceCodeStart":27,"sourceCodeEnd":63,"githubUrl":"https://github.com/Dokploy/dokploy/blob/546686ea3587f12ec5652217dedd9f7960fb6d15/packages/server/src/services/proprietary/forward-auth.ts#L27-L63","documentation":"resolveOidcConfig stores the provider's OIDC settings as a JSON string in the oidcConfig column. When JSON.parse of that stored string throws, the service responds with INTERNAL_SERVER_ERROR because the persisted configuration is corrupt. This is a server-side data integrity issue, not a caller error.","triggerScenarios":"The ssoProvider.oidcConfig column contains invalid JSON (truncated during save, manually edited, encoding issue), and any forward-auth oidc call attempts to parse it.","commonSituations":"OIDC config was saved incompletely (request aborted mid-write); manual DB edit broke the JSON; character encoding/escaping issue when the clientId or clientSecret contained quotes or unicode characters.","solutions":["Re-save the OIDC provider configuration through the SSO settings UI to rewrite valid JSON","If editing the DB directly, validate the oidc_config value with a JSON linter before saving","Inspect the column (SELECT oidc_config FROM sso_provider ...) and run it through JSON.parse to confirm"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"try { JSON.parse(provider.oidcConfig ?? '') } catch { /* re-save provider config before using forward-auth */ }","typeGuard":null,"tryCatchPattern":"try { await oidc(provider) } catch (e) { if (e instanceof TRPCError && e.code === 'INTERNAL_SERVER_ERROR') { /* flag provider config as corrupt, force re-setup */ } }","preventionTips":["Validate JSON before persisting oidcConfig","Never hand-edit provider config columns"],"tags":["json-parse","oidc","sso","data-corruption"],"backgroundTag":"invalid-stored-json-config","analyzedSha":"546686ea3587f12ec5652217dedd9f7960fb6d15","analyzedAt":"2026-08-27T05:18:58.095Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}