{"id":"700ec1ee2269d8ac","repo":"mongodb/node-mongodb-native","slug":"token-resource-must-be-set-in-the-auth-mechanism-p-700ec1","errorCode":null,"errorMessage":"TOKEN_RESOURCE must be set in the auth mechanism properties when ENVIRONMENT is azure.","messagePattern":"TOKEN_RESOURCE must be set in the auth mechanism properties when ENVIRONMENT is azure\\.","errorType":"exception","errorClass":"MongoAzureError","httpStatus":null,"severity":"error","filePath":"src/cmap/auth/mongodb_oidc/azure_machine_workflow.ts","lineNumber":28,"sourceCode":"const ENDPOINT_RESULT_ERROR =\n  'Azure endpoint did not return a value with only access_token and expires_in properties';\n\n/** Error for when the token audience is missing in the environment. */\nconst TOKEN_RESOURCE_MISSING_ERROR =\n  'TOKEN_RESOURCE must be set in the auth mechanism properties when ENVIRONMENT is azure.';\n\n/**\n * The callback function to be used in the automated callback workflow.\n * @param params - The OIDC callback parameters.\n * @returns The OIDC response.\n */\nexport const azureCallback: OIDCCallbackFunction = async (\n  params: OIDCCallbackParams\n): Promise<OIDCResponse> => {\n  const tokenAudience = params.tokenAudience;\n  const username = params.username;\n  if (!tokenAudience) {\n    throw new MongoAzureError(TOKEN_RESOURCE_MISSING_ERROR);\n  }\n  const response = await getAzureTokenData(tokenAudience, username);\n  if (!isEndpointResultValid(response)) {\n    throw new MongoAzureError(ENDPOINT_RESULT_ERROR);\n  }\n  return response;\n};\n\n/**\n * Hit the Azure endpoint to get the token data.\n */\nasync function getAzureTokenData(tokenAudience: string, username?: string): Promise<OIDCResponse> {\n  const url = new URL(AZURE_BASE_URL);\n  addAzureParams(url, tokenAudience, username);\n  const response = await get(url, {\n    headers: AZURE_HEADERS\n  });\n  if (response.status !== 200) {","sourceCodeStart":10,"sourceCodeEnd":46,"githubUrl":"https://github.com/mongodb/node-mongodb-native/blob/3366c21a6311e02f1be91da982f9b93d3cce99a0/src/cmap/auth/mongodb_oidc/azure_machine_workflow.ts#L10-L46","documentation":"Thrown by the Azure machine OIDC workflow when ENVIRONMENT is set to 'azure' but the TOKEN_RESOURCE mechanism property is missing (src/cmap/auth/mongodb_oidc/azure_machine_workflow.ts:27). TOKEN_RESOURCE becomes the token audience passed to the Azure IMDS endpoint and is required to request a token scoped for the MongoDB cluster. Surfaced as a MongoAzureError.","triggerScenarios":"Connecting with MONGODB-OIDC and authMechanismProperties=ENVIRONMENT:azure but omitting TOKEN_RESOURCE, or misspelling the property name. The azureCallback checks params.tokenAudience (derived from TOKEN_RESOURCE) and throws before contacting Azure IMDS.","commonSituations":"Copy-paste error from docs that omitted TOKEN_RESOURCE, assumption that Azure IMDS does not require an audience, or using the wrong property casing (Token-Resource, token_resource) in the connection string.","solutions":["Add TOKEN_RESOURCE to authMechanismProperties, e.g. ENVIRONMENT:azure,TOKEN_RESOURCE:<mongodb-cluster-audience>.","Confirm the TOKEN_RESOURCE value matches the audience configured on the MongoDB server for OIDC.","Use the exact property names and casing shown in the driver documentation; separate multiple properties with commas."],"exampleFix":"// before\nconst c = new MongoClient('mongodb://host/?authMechanism=MONGODB-OIDC&authMechanismProperties=ENVIRONMENT:azure');\n\n// after\nconst c = new MongoClient(\n  'mongodb://host/?authMechanism=MONGODB-OIDC&authMechanismProperties=ENVIRONMENT:azure,TOKEN_RESOURCE:https://cluster.example.com'\n);","handlingStrategy":"validation","validationCode":"function validateAzureOidcProps(props: Record<string, unknown>): void {\n  if (props.ENVIRONMENT === 'azure' && !props.TOKEN_RESOURCE) {\n    throw new Error('TOKEN_RESOURCE is required when ENVIRONMENT=azure');\n  }\n}\nvalidateAzureOidcProps(parsedMechanismProperties);","typeGuard":"function isAzureOidcConfig(props: unknown): props is { ENVIRONMENT: 'azure'; TOKEN_RESOURCE: string } {\n  return !!props && typeof props === 'object'\n    && (props as any).ENVIRONMENT === 'azure'\n    && typeof (props as any).TOKEN_RESOURCE === 'string';\n}","tryCatchPattern":null,"preventionTips":["Build authMechanismProperties from a typed config object so missing fields are caught at compile time.","Document the required TOKEN_RESOURCE for Azure deployments in your runbook.","Unit-test connection-string construction for OIDC environments."],"tags":["auth","oidc","azure","configuration","validation"],"analyzedSha":"3366c21a6311e02f1be91da982f9b93d3cce99a0","analyzedAt":"2026-08-04T13:40:15.335Z","schemaVersion":2}