crewAIInc/crewAI · error · ValueError

Missing authentication provider required fields in OAuth2 co

Error message

Missing authentication provider required fields in OAuth2 configuration: [{', '.join(missing_provider_specific_fields)}] (Configured provider: '{oauth_config['provider']}')

What it means

Validation error from enterprise OAuth2 discovery: the top-level fields are present, but the provider-specific required fields inside oauth_config['extra'] are missing. The CLI builds the provider via ProviderFactory.from_settings and calls get_required_fields(); any field that provider demands (e.g. tenant_id for Azure AD style providers) absent from `extra` triggers this. The message lists missing fields and names the configured provider.

Source

Thrown at lib/cli/src/crewai_cli/enterprise/main.py:116

            "extra",
        ]

        missing_basic_fields = [
            field for field in required_fields if field not in oauth_config
        ]
        missing_provider_specific_fields = [
            field
            for field in self._get_provider_specific_fields(oauth_config["provider"])
            if field not in oauth_config.get("extra", {})
        ]

        if missing_basic_fields:
            raise ValueError(
                f"Missing required fields in OAuth2 configuration: [{', '.join(missing_basic_fields)}]"
            )

        if missing_provider_specific_fields:
            raise ValueError(
                f"Missing authentication provider required fields in OAuth2 configuration: [{', '.join(missing_provider_specific_fields)}] (Configured provider: '{oauth_config['provider']}')"
            )

    def _get_provider_specific_fields(self, provider_name: str) -> list[str]:
        provider = ProviderFactory.from_settings(
            Oauth2Settings(provider=provider_name, client_id="dummy", domain="dummy")
        )

        return provider.get_required_fields()

View on GitHub (pinned to 754d7323be)

Solutions

1. Read the message: it names the exact missing fields and the configured provider
2. Have the enterprise admin add those fields to the `extra` section of the discovery endpoint response
3. If the CLI was recently upgraded and the server is older, align versions (upgrade server or pin CLI)
4. Verify with curl that extra now contains the listed fields, then re-run connect

def extra_fields_sufficient(doc: dict) -> bool:
    provider = doc.get("provider")
    extra = doc.get("extra") or {}
    # mirror the CLI: provider factories declare their required fields
    from crewai_cli.authentication.providers.factory import ProviderFactory
    from crewai_cli.authentication.schemas import Oauth2Settings
    needed = ProviderFactory.from_settings(Oauth2Settings(provider=provider, client_id="x", domain="x")).get_required_fields()
    return all(f in extra for f in needed)

def provider_extra_valid(provider: str, extra: object) -> bool:
    return isinstance(extra, dict)  # full check requires the provider factory's field list

try:
    enterprise_cmd.connect(url)
except ValueError as e:
    if "authentication provider required fields" in str(e):
        # parse missing field names and the provider from the message for the admin
        ...

When it happens

Trigger: `crewai enterprise connect <url>` where the discovery document declares provider X but the `extra` object lacks the fields provider X requires — typical when an enterprise adds a new OAuth provider (Okta, Azure AD, Keycloak...) but does not populate provider-specific claims in the discovery response.

Common situations: Enterprise admins enabling a new IdP without completing provider-specific config; CLI updated with stricter/newer per-provider requirements than the server emits; discovery documents reused across environments where tenant/auth-url specifics differ.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Error fetching OAuth2 configuration: {e!s}
• Missing required fields in OAuth2 configuration: [{', '.join
• Invalid JSON response from {oauth_endpoint}
• Failed to connect to enterprise URL: {e!s}
• Failed to update OAuth2 settings: {e!s}

AI-assisted analysis of crewAIInc/crewAI@754d7323be (2026-08-15). Data as JSON: /api/errors/81fc678f5601f6de. Report an issue: GitHub.