{"record":{"id":"fac0855b6d36ffb6","repo":"fatedier/frp","slug":"invalid-auth-oidc-tokensource-v","errorCode":null,"errorMessage":"invalid auth.oidc.tokenSource: %v","messagePattern":"invalid auth\\.oidc\\.tokenSource: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/config/v1/validation/client.go","lineNumber":138,"sourceCode":"\nfunc (v *ConfigValidator) validateOIDCConfig(c *v1.AuthOIDCClientConfig) error {\n\tif c.TokenSource == nil {\n\t\treturn nil\n\t}\n\tvar errs error\n\t// Validate oidc.tokenSource mutual exclusivity with other fields of oidc\n\tif c.ClientID != \"\" || c.ClientSecret != \"\" || c.Audience != \"\" ||\n\t\tc.Scope != \"\" || c.TokenEndpointURL != \"\" || len(c.AdditionalEndpointParams) > 0 ||\n\t\tc.TrustedCaFile != \"\" || c.InsecureSkipVerify || c.ProxyURL != \"\" {\n\t\terrs = AppendError(errs, fmt.Errorf(\"cannot specify both auth.oidc.tokenSource and any other field of auth.oidc\"))\n\t}\n\tif c.TokenSource.Type == \"exec\" {\n\t\tif err := v.ValidateUnsafeFeature(security.TokenSourceExec); err != nil {\n\t\t\terrs = AppendError(errs, err)\n\t\t}\n\t}\n\tif err := c.TokenSource.Validate(); err != nil {\n\t\terrs = AppendError(errs, fmt.Errorf(\"invalid auth.oidc.tokenSource: %v\", err))\n\t}\n\treturn errs\n}\n\nfunc validateTransportConfig(c *v1.ClientTransportConfig) (Warning, error) {\n\tvar (\n\t\twarnings Warning\n\t\terrs     error\n\t)\n\n\tif c.HeartbeatTimeout > 0 && c.HeartbeatInterval > 0 {\n\t\tif c.HeartbeatTimeout < c.HeartbeatInterval {\n\t\t\terrs = AppendError(errs, fmt.Errorf(\"invalid transport.heartbeatTimeout, heartbeat timeout should not less than heartbeat interval\"))\n\t\t}\n\t}\n\n\tif !lo.FromPtr(c.TLS.Enable) {\n\t\tcheckTLSConfig := func(name string, value string) Warning {","sourceCodeStart":120,"sourceCodeEnd":156,"githubUrl":"https://github.com/fatedier/frp/blob/6c8a8d0a97d03b44e9528d30b30c70cb9d61b405/pkg/config/v1/validation/client.go#L120-L156","documentation":"The auth.oidc.tokenSource block itself failed its own Validate() call, and this wrapper reports the underlying cause. Typical sub-causes are an empty command/exec args for type \"exec\" or an unsupported tokenSource type. The %v in the message carries the original error text.","triggerScenarios":"auth.oidc.tokenSource.type = \"exec\" with command missing/empty, wrong tokenSource type string, or invalid fields per v1.AuthOIDCTokenSource.Validate(). Also fires only after the exec gate check (ValidateUnsafeFeature for TokenSourceExec) passed.","commonSituations":"Writing a tokenSource block from memory and omitting 'command'; using a type value not implemented by this frp build; exec plugin path that is whitespace-only.","solutions":["Read the inner %v error — it names the exact invalid field","For type = \"exec\", ensure command is a non-empty executable path and args are well-formed","Ensure tokenSource.type matches a supported value (\"exec\") for your frp version","Verify featureGates/unsafeFeatures allows TokenSourceExec if you also see gate errors"],"exampleFix":"# before\n[auth.oidc.tokenSource]\ntype = \"exec\"\n# command missing\n\n# after\n[auth.oidc.tokenSource]\ntype = \"exec\"\ncommand = \"/usr/local/bin/oidc-helper\"\nargs = [\"--audience\", \"frp\"]","handlingStrategy":"validation","validationCode":"if cfg.Auth.OIDC.TokenSource != nil {\n    if err := cfg.Auth.OIDC.TokenSource.Validate(); err != nil {\n        // fix tokenSource fields before full validation\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := validation.ValidateAllClientConfig(cc, proxies, visitors, uf); err != nil {\n    if idx := strings.Index(err.Error(), \"invalid auth.oidc.tokenSource:\"); idx >= 0 {\n        inner := strings.TrimSpace(err.Error()[idx+len(\"invalid auth.oidc.tokenSource:\"):])\n        // branch on inner (\"command is empty\" etc.)\n    }\n}","preventionTips":["Always set `command` for exec token sources; test the helper binary standalone","Run `frpc verify` in CI to catch tokenSource mistakes early"],"tags":["frp","config","oidc","token-source","go"],"backgroundTag":null,"analyzedSha":"6c8a8d0a97d03b44e9528d30b30c70cb9d61b405","analyzedAt":"2026-08-15T06:53:27.215Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}