{"record":{"id":"fbac6fb3cf247add","repo":"fatedier/frp","slug":"auth-oidc-clientid-is-required-auth-oidc-tokenend","errorCode":null,"errorMessage":"auth.oidc.clientID is required; auth.oidc.tokenEndpointURL is required","messagePattern":"auth\\.oidc\\.clientID is required; auth\\.oidc\\.tokenEndpointURL is required","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/config/v1/validation/oidc.go","lineNumber":56,"sourceCode":"\t\t} else if tokenURL.Scheme != \"http\" && tokenURL.Scheme != \"https\" {\n\t\t\terrs = append(errs, \"auth.oidc.tokenEndpointURL must use http or https\")\n\t\t}\n\t}\n\n\tif _, ok := c.AdditionalEndpointParams[\"scope\"]; ok {\n\t\terrs = append(errs, \"auth.oidc.additionalEndpointParams.scope is not allowed; use auth.oidc.scope instead\")\n\t}\n\n\tif c.Audience != \"\" {\n\t\tif _, ok := c.AdditionalEndpointParams[\"audience\"]; ok {\n\t\t\terrs = append(errs, \"cannot specify both auth.oidc.audience and auth.oidc.additionalEndpointParams.audience\")\n\t\t}\n\t}\n\n\tif len(errs) == 0 {\n\t\treturn nil\n\t}\n\treturn errors.New(strings.Join(errs, \"; \"))\n}\n","sourceCodeStart":38,"sourceCodeEnd":58,"githubUrl":"https://github.com/fatedier/frp/blob/6c8a8d0a97d03b44e9528d30b30c70cb9d61b405/pkg/config/v1/validation/oidc.go#L38-L58","documentation":"Aggregate validation error from ValidateOIDCClientCredentialsConfig: OIDC client authentication is enabled but both auth.oidc.clientID and auth.oidc.tokenEndpointURL are unset. When frpc or frps uses oidc as the auth method, these two fields are the minimum required to obtain tokens from the identity provider; all individual failures are collected and joined with '; '. The combined message here means exactly two checks failed: empty ClientID and empty TokenEndpointURL.","triggerScenarios":"Config with auth.method = \"oidc\" (or auth.additionalScopes including oidc) where the [auth.oidc] section is absent, empty, or only sets optional fields like scope/audience — so both ClientID and TokenEndpointURL stay at their zero values. Validation runs at config load of frpc/frps and returns the joined error.","commonSituations":"Enabling OIDC auth after copying a minimal example config that never filled in the oidc section; switching from token auth to oidc and forgetting provider credentials; secrets sourced from files/exec that fail to load and silently resolve to empty strings; misnesting the TOML so [auth.oidc] keys land under the wrong table.","solutions":["Set both auth.oidc.clientID and auth.oidc.tokenEndpointURL (absolute http/https URL) in the config that enables auth.method = \"oidc\".","If using ValueSource (file/exec) for these fields, verify the files exist and commands succeed — an unresolvable source yields an empty string and this error.","Check TOML table nesting: keys must be inside [auth.oidc], not under [auth] or [auth.token].","If OIDC was not intended, change auth.method back to \"token\" (default) and remove the oidc block."],"exampleFix":"# before\n[auth]\nmethod = \"oidc\"\ntoken = \"abc\"\n\n# after\n[auth]\nmethod = \"oidc\"\n[auth.oidc]\nclientID = \"frp-client\"\nclientSecret = \"...\"\ntokenEndpointURL = \"https://idp.example.com/oauth2/token\"","handlingStrategy":"validation","validationCode":"// before enabling OIDC in a config\nif cfg.Auth.Method == \"oidc\" {\n    if cfg.Auth.OIDC.ClientID == \"\" || cfg.Auth.OIDC.TokenEndpointURL == \"\" {\n        return fmt.Errorf(\"auth.method=oidc requires auth.oidc.clientID and auth.oidc.tokenEndpointURL\")\n    }\n}","typeGuard":"func oidcConfigComplete(a v1.AuthClientConfig) bool {\n    return a.OIDC.ClientID != \"\" && a.OIDC.TokenEndpointURL != \"\"\n}","tryCatchPattern":"if err := validation.ValidateOIDCClientCredentialsConfig(&cfg.Auth.OIDC); err != nil {\n    if strings.Contains(err.Error(), \"clientID is required\") || strings.Contains(err.Error(), \"tokenEndpointURL is required\") {\n        // fill the missing oidc fields or fall back to token auth\n    }\n    return err\n}","preventionTips":["Keep OIDC credentials in a dedicated template and render clientID/tokenEndpointURL from a secret store.","Run `frpc verify` / config validation in CI for every config change.","When using ValueSource for oidc fields, test that the source resolves before starting frp."],"tags":["config","auth","oidc","validation","security"],"backgroundTag":null,"analyzedSha":"6c8a8d0a97d03b44e9528d30b30c70cb9d61b405","analyzedAt":"2026-08-15T06:53:27.215Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}