conductor-oss/conductor · error · RuntimeException

Failed to acquire OAuth token from {tokenEndpointUrl}

Error message

Failed to acquire OAuth token from {tokenEndpointUrl}

What it means

Thrown by OAuthTokenProvider.refresh when the HTTP request to the token endpoint raises an IOException (caught in the same try block). The original IOException is wrapped as the cause of this RuntimeException, and the message echoes the tokenEndpointUrl. Unlike error 142 (an HTTP status rejection by the IdP), this is a transport-level failure: the request never completed.

Source

Thrown at ai/src/main/java/org/conductoross/conductor/ai/agent/credentials/OAuthTokenProvider.java:102

                        .add("grant_type", "client_credentials")
                        .add("client_id", clientId)
                        .add("client_secret", clientSecret)
                        .add("scope", scope)
                        .build();

        Request request = new Request.Builder().url(tokenEndpointUrl).post(body).build();

        try (Response response = httpClient.newCall(request).execute()) {
            if (!response.isSuccessful() || response.body() == null) {
                throw new RuntimeException("OAuth token request failed: HTTP " + response.code());
            }
            JsonNode json = MAPPER.readTree(response.body().string());
            cachedToken = json.get("access_token").asText();
            long expiresIn = json.has("expires_in") ? json.get("expires_in").asLong() : 3600L;
            expiresAt = Instant.now().plusSeconds(expiresIn);
            log.debug("OAuth token refreshed, expires at {}", expiresAt);
        } catch (IOException e) {
            throw new RuntimeException("Failed to acquire OAuth token from " + tokenEndpointUrl, e);
        }
    }
}

View on GitHub (pinned to cf7c3e4a8a)

Solutions

1. Inspect the wrapped cause (getCause()) — UnknownHostException means DNS, SSLHandshakeException means cert/trust, SocketTimeoutException means timeout/egress.
2. Add an egress allow-rule / proxy for the token endpoint host on the host/container/VPC.
3. If behind a TLS-intercepting proxy, import the proxy's root CA into the JVM truststore (or the OkHttpClient used by OAuthTokenProvider).
4. Increase connect/read timeouts on the OkHttpClient passed into OAuthTokenProvider if the IdP is slow.

// Validate egress reachability at startup (conceptual)
// InetSocketAddress.createUnresolved(host, 443) + a connect probe belongs in a health check

// Network/transport failures are often transient — retry with backoff
int attempts = 0;
while (true) {
    try {
        return tokenProvider.getToken();
    } catch (RuntimeException e) {
        if (!(e.getCause() instanceof java.io.IOException) || ++attempts >= MAX_ATTEMPTS) throw e;
        backoff(attempts);
    }
}

When it happens

Trigger: Network-layer failure reaching the token endpoint: DNS cannot resolve the host, connection refused/timeout, TLS handshake failure (expired CA, untrusted cert), a proxy/firewall blocking egress, or the OkHttpClient misconfigured with too-short timeouts.

Common situations: Running in a locked-down network/VPC without an egress allow-rule for login.microsoftonline.com; a corporate MITM proxy whose CA is not in the JVM truststore; the tokenEndpointUrl host typo; intermittent connectivity in CI containers.

Related errors

• OAuth token request failed: HTTP {code}
• A2A stream to {endpoint} failed: {message}
• A2A call '{method}' to {endpoint} failed: {message}
• token must not be blank
• HTTP %d error from MCP server: %s

AI-assisted analysis of conductor-oss/conductor@cf7c3e4a8a (2026-08-14). Data as JSON: /api/errors/07bc86e4b0b9554f. Report an issue: GitHub.