{"record":{"id":"f85d932d2fef50ef","repo":"rancher/rancher","slug":"finding-oauth-token-for-provider-s-w","errorCode":null,"errorMessage":"finding oauth token for provider %s: %w","messagePattern":"finding oauth token for provider (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/auth/providers/keycloakoidc/keycloak_provider.go","lineNumber":255,"sourceCode":"\n\tif !reflect.DeepEqual(oauthToken, reusedToken) {\n\t\tif err := k.UpdateToken(reusedToken, token.GetUserID()); err != nil {\n\t\t\tlogrus.Errorf(\"updating cached oauth token for user %s: %s\", token.GetUserID(), err)\n\t\t}\n\t}\n\n\treturn reusedToken, nil\n}\n\nfunc (k *keyCloakOIDCProvider) getClientCredentialsToken(ctx context.Context, provider *gooidc.Provider, config *apiv3.OIDCConfig) (*oauth2.Token, error) {\n\tvar oauthToken *oauth2.Token\n\tsecretExists := true\n\tstoredOauthToken, err := k.TokenMgr.GetSecret(k.GetName(), k.GetName(), nil)\n\tif err != nil {\n\t\tif apierrors.IsNotFound(err) {\n\t\t\tsecretExists = false\n\t\t} else {\n\t\t\treturn nil, fmt.Errorf(\"finding oauth token for provider %s: %w\", k.GetName(), err)\n\t\t}\n\t}\n\tif storedOauthToken != \"\" {\n\t\tif err := json.Unmarshal([]byte(storedOauthToken), &oauthToken); err != nil {\n\t\t\treturn nil, fmt.Errorf(\"unmarshalling cached oauth token for provider %s: %w\", k.GetName(), err)\n\t\t}\n\t}\n\toauthConfig := oidc.ConfigToOauthConfig(provider.Endpoint(), config)\n\tclientConf := clientcredentials.Config{\n\t\tClientID:     oauthConfig.ClientID,\n\t\tClientSecret: oauthConfig.ClientSecret,\n\t\tTokenURL:     provider.Endpoint().TokenURL,\n\t\tAuthStyle:    oauth2.AuthStyleInParams,\n\t\tScopes:       oauthConfig.Scopes,\n\t}\n\tif oauthToken != nil && (!oauthToken.Valid() || oauthToken.AccessToken == \"\") {\n\t\tlogrus.Debugf(\"[keycloak oidc] RefreshAndUpdateToken: attempting to refresh access token from client credentials\")\n\t\ttok, err := clientConf.Token(ctx)","sourceCodeStart":237,"sourceCodeEnd":273,"githubUrl":"https://github.com/rancher/rancher/blob/932558d4e68565aff2d2f36e89ec4a391b06e7c5/pkg/auth/providers/keycloakoidc/keycloak_provider.go#L237-L273","documentation":"Thrown by getClientCredentialsToken when reading the provider's cached client-credentials token secret via TokenMgr.GetSecret(name, name, nil) fails with an error other than NotFound. This is an infrastructure error talking to the Kubernetes API (or the secret store), not an auth failure - NotFound is handled by design, everything else surfaces here.","triggerScenarios":"The secret GET for the provider-named secret returns a 500/timeout, RBAC denies the service account reading secrets in the namespace, or the API server is temporarily unreachable while the Keycloak client-credentials flow initializes.","commonSituations":"Management cluster API server briefly unavailable; RBAC role bindings for the Rancher service account on secrets changed; etcd/secret-store latency causing request failures.","solutions":["Check Kubernetes API server health and events for the management cluster at the time of the error","Verify the service account running the auth provider can get secrets in the namespace where token secrets live","Retry the operation - transient API errors resolve; if persistent, inspect the wrapped error for authorization (403) messages"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"finding oauth token for provider\") {\n    // infra error against the k8s API, not auth: safe to retry\n    return retryWithBackoff(op)\n}","preventionTips":["Verify RBAC allows get on secrets in the token namespace before deploying","Treat secret-read failures differently from OAuth failures in dashboards","Keep management-cluster API availability alerts wired to auth subsystem health"],"tags":["keycloak","kubernetes","secrets","rbac","api-server"],"backgroundTag":null,"analyzedSha":"932558d4e68565aff2d2f36e89ec4a391b06e7c5","analyzedAt":"2026-08-16T04:37:02.125Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}