dagger/dagger · error

timed out waiting for Vault OIDC callback

Error message

timed out waiting for Vault OIDC callback

What it means

vaultOIDCLogin gave up because the local OIDC callback HTTP server received no completed callback within vaultOIDCWaitTimeout. The user never finished (or never started) browser authentication, so no authorization code arrived on callbackCh before waitCtx expired.

Source

Thrown at engine/client/secretprovider/vault_oidc.go:106

	}

	fmt.Fprintln(os.Stderr, "Opening browser for Vault OIDC authentication...")
	if os.Getenv("VAULT_OIDC_SKIP_BROWSER") != "" {
		fmt.Fprintf(os.Stderr, "Open this URL to authenticate: %s\n", authURL)
	} else if err := vaultOpenURL(authURL); err != nil {
		fmt.Fprintf(os.Stderr, "Failed to open browser: %v\n", err)
		fmt.Fprintf(os.Stderr, "Open this URL to authenticate: %s\n", authURL)
	}
	fmt.Fprintln(os.Stderr, "Waiting for Vault OIDC authentication callback...")

	waitCtx, waitCancel := context.WithTimeout(ctx, vaultOIDCWaitTimeout)
	defer waitCancel()

	var callback vaultOIDCCallback
	select {
	case <-waitCtx.Done():
		if errors.Is(waitCtx.Err(), context.DeadlineExceeded) {
			return 0, fmt.Errorf("timed out waiting for Vault OIDC callback")
		}
		return 0, waitCtx.Err()
	case serveErr := <-serveErrCh:
		if serveErr != nil {
			return 0, fmt.Errorf("oidc callback server error: %w", serveErr)
		}
	case callback = <-callbackCh:
		if callback.Err != nil {
			return 0, callback.Err
		}
	}

	secret, err := client.Logical().ReadWithDataWithContext(waitCtx, "auth/"+mount+"/oidc/callback", vaultOIDCCallbackQuery(callback.State, callback.Code, nonce))
	if err != nil {
		return 0, fmt.Errorf("vault OIDC callback exchange failed: %w", err)
	}
	if secret == nil || secret.Auth == nil || secret.Auth.ClientToken == "" {
		return 0, fmt.Errorf("vault OIDC callback returned no token")

View on GitHub (pinned to 82ba2681db)

Solutions

1. Complete the Vault OIDC login in the opened browser (or via the URL printed to stderr) before the wait timeout elapses
2. Check that the callback URL host/port is reachable from the browser (VPN, firewall, remote SSH port-forward) and retry the login
3. On a machine with no browser, set VAULT_OIDC_SKIP_BROWSER and authenticate from a device that can reach the callback listener

When it happens

Trigger: Thrown at engine/client/secretprovider/vault_oidc.go:106 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Timeouts: ETIMEDOUT, deadlines, and hung requests — what actually expires when a request times out.

AI-assisted analysis of dagger/dagger@82ba2681db (2026-09-05). Data as JSON: /api/errors/c588ada44740d8c6. Report an issue: GitHub.