{"record":{"id":"f9ac66392960b77b","repo":"rancher/rancher","slug":"searchprincipals-no-authprovider-specified-in-to","errorCode":null,"errorMessage":"[SearchPrincipals] no authProvider specified in token","messagePattern":"\\[SearchPrincipals\\] no authProvider specified in token","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/auth/providers/providers.go","lineNumber":189,"sourceCode":"\n\tprincipal, err := p.GetPrincipal(principalID, myToken)\n\tif err != nil && myToken.GetAuthProvider() != local.Name {\n\t\tp2, e2 := lp.GetPrincipal(principalID, myToken)\n\t\tif e2 == nil {\n\t\t\treturn p2, nil\n\t\t}\n\t}\n\n\treturn principal, err\n}\n\n// SearchPrincipals searches for principals by name using the token's auth\n// provider, appending the local results so that users who can log in locally\n// remain findable under any provider.\nfunc SearchPrincipals(name, principalType string, myToken accessor.TokenAccessor) ([]apiv3.Principal, error) {\n\tap := myToken.GetAuthProvider()\n\tif ap == \"\" {\n\t\treturn []apiv3.Principal{}, fmt.Errorf(\"[SearchPrincipals] no authProvider specified in token\")\n\t}\n\n\tmu.RLock()\n\tp := providers[ap]\n\tlp := providers[local.Name]\n\tmu.RUnlock()\n\n\tif p == nil {\n\t\treturn []apiv3.Principal{}, fmt.Errorf(\"[SearchPrincipals] authProvider %v not initialized\", ap)\n\t}\n\tprincipals, err := p.SearchPrincipals(name, principalType, myToken)\n\tif err != nil {\n\t\treturn principals, err\n\t}\n\tif ap != local.Name && lp != nil {\n\t\tlocalPrincipals, err := lp.SearchPrincipals(name, principalType, myToken)\n\t\tif err != nil {\n\t\t\treturn principals, err","sourceCodeStart":171,"sourceCodeEnd":207,"githubUrl":"https://github.com/rancher/rancher/blob/932558d4e68565aff2d2f36e89ec4a391b06e7c5/pkg/auth/providers/providers.go#L171-L207","documentation":"SearchPrincipals dispatches the search to the auth provider recorded on the caller's token (myToken.GetAuthProvider()). If that field is empty the function cannot decide which backend to search and returns this error immediately. Tokens that carry no authProvider include API bearer tokens and other tokens minted outside a provider login flow.","triggerScenarios":"Calling the principal-search path (e.g. GET /v3/principals?action=search with a search term) while authenticating with a Rancher API key/bearer token whose authProvider attribute is empty, or any token created programmatically (kubectl-style kubeconfig token, system token) that never went through an auth provider login.","commonSituations":"Scripts or CI using personal API keys to drive user/group search; tooling that authenticates with a service token; a login flow that failed to stamp authProvider on the minted token.","solutions":["Authenticate with a token produced by an actual provider login (including local login, which sets authProvider=\"local\") instead of an API bearer token.","Inspect the token (kubectl get secret -n cattle-system or the tokens management resource) and confirm its authProvider field is populated.","If you own the caller, short-circuit: when myToken.GetAuthProvider() is empty, search only the local provider instead of erroring."],"exampleFix":"// before\nprincipals, err := providers.SearchPrincipals(name, userType, myToken)\n\n// after\nif ap := myToken.GetAuthProvider(); ap == \"\" {\n    local, err := providers.GetProvider(local.Name)\n    if err != nil {\n        return nil, err\n    }\n    return local.SearchPrincipals(name, userType, myToken)\n}\nprincipals, err := providers.SearchPrincipals(name, userType, myToken)","handlingStrategy":"validation","validationCode":"if myToken.GetAuthProvider() == \"\" {\n    // token has no provider context (API key, system token)\n    lp, err := providers.GetProvider(local.Name)\n    if err != nil {\n        return nil, err\n    }\n    return lp.SearchPrincipals(name, principalType, myToken)\n}\nreturn providers.SearchPrincipals(name, principalType, myToken)","typeGuard":null,"tryCatchPattern":"principals, err := providers.SearchPrincipals(name, principalType, myToken)\nif err != nil && strings.Contains(err.Error(), \"no authProvider specified in token\") {\n    // caller context lacks a provider: retry scoped to local\n    lp, lerr := providers.GetProvider(local.Name)\n    if lerr != nil {\n        return nil, err\n    }\n    return lp.SearchPrincipals(name, principalType, myToken)\n}","preventionTips":["Drive principal-search APIs with tokens obtained through a provider login (including local), not API bearer keys.","When minting custom tokens, always populate the authProvider attribute.","Wrap search endpoints with a pre-check on GetAuthProvider() and a documented fallback policy."],"tags":["go","auth","tokens","principal-search","rancher"],"backgroundTag":null,"analyzedSha":"932558d4e68565aff2d2f36e89ec4a391b06e7c5","analyzedAt":"2026-08-16T04:37:02.125Z","schemaVersion":2},"datasetVersion":"2026-08-16T08:17:34.114Z"}