{"id":"9283ac9ba7b763da","repo":"redis/node-redis","slug":"invalid-authority-configuration","errorCode":null,"errorMessage":"Invalid authority configuration","messagePattern":"Invalid authority configuration","errorType":"validation","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/entraid/lib/entra-id-credentials-provider-factory.ts","lineNumber":258,"sourceCode":"        return new EntraidCredentialsProvider(tm, idp, {\n          onReAuthenticationError: params.onReAuthenticationError,\n          credentialsMapper: params.credentialsMapper ?? DEFAULT_CREDENTIALS_MAPPER,\n          onRetryableError: params.onRetryableError\n        });\n      }\n    };\n  }\n\n  static getAuthority(config: AuthorityConfig): string {\n    switch (config.type) {\n      case 'multi-tenant':\n        return `https://login.microsoftonline.com/${config.tenantId}`;\n      case 'custom':\n        return config.authorityUrl;\n      case 'default':\n        return 'https://login.microsoftonline.com/common';\n      default:\n        throw new Error('Invalid authority configuration');\n    }\n  }\n\n}\n\nexport const REDIS_SCOPE_DEFAULT = 'https://redis.azure.com/.default';\nexport const REDIS_SCOPE = 'https://redis.azure.com'\n\nexport type AuthorityConfig =\n  | { type: 'multi-tenant'; tenantId: string }\n  | { type: 'custom'; authorityUrl: string }\n  | { type: 'default' };\n\nexport type PKCEParams = {\n  code: string;\n  verifier: string;\n  clientInfo?: string;\n}","sourceCodeStart":240,"sourceCodeEnd":276,"githubUrl":"https://github.com/redis/node-redis/blob/bb5beb56578573910e2ee8f39681edc214c41398/packages/entraid/lib/entra-id-credentials-provider-factory.ts#L240-L276","documentation":"Thrown by EntraIdCredentialsProviderFactory.getAuthority() in its default branch (entra-id-credentials-provider-factory.ts:257). AuthorityConfig is a TypeScript discriminated union of {type:'multi-tenant'}, {type:'custom'}, {type:'default'}; the default branch only fires when config.type is none of those. Under strict TypeScript this is prevented at compile time, so at runtime it implies the value bypassed the type system (any, JS caller, malformed config).","triggerScenarios":"Passing authorityConfig = { type: 'organizations' } or any unrecognized type literal; calling getAuthority from JavaScript without types; loading authority config from a JSON/env source that produced a different type string.","commonSituations":"Hard-coding an authority type copied from MSAL/Azure docs (e.g. 'organizations', 'single-tenant') that is not part of this library's AuthorityConfig union; env-driven config that defaults to an undefined type.","solutions":["Use one of the supported types: 'default', { type:'multi-tenant', tenantId }, or { type:'custom', authorityUrl }.","If you have a tenant id, prefer { type:'multi-tenant', tenantId } which builds https://login.microsoftonline.com/<tenantId>.","Validate the type field at the config-loading boundary before passing it in.","If calling from JS, add a runtime check matching the union."],"exampleFix":"// before\nauthorityConfig: { type: 'organizations' }\n// after\nauthorityConfig: { type: 'multi-tenant', tenantId: process.env.MSAL_TENANT_ID }","handlingStrategy":"type-guard","validationCode":"function buildAuthorityConfig(raw) {\n  if (raw === undefined) return { type: 'default' };\n  if (raw.type === 'default') return { type: 'default' };\n  if (raw.type === 'multi-tenant' && raw.tenantId) return { type: 'multi-tenant', tenantId: raw.tenantId };\n  if (raw.type === 'custom' && raw.authorityUrl) return { type: 'custom', authorityUrl: raw.authorityUrl };\n  throw new Error('Unsupported authority config: ' + JSON.stringify(raw));\n}","typeGuard":"function isAuthorityConfig(c: unknown): c is\n  | { type: 'default' }\n  | { type: 'multi-tenant'; tenantId: string }\n  | { type: 'custom'; authorityUrl: string } {\n  if (typeof c !== 'object' || c === null) return false;\n  const t = (c as any).type;\n  if (t === 'default') return true;\n  if (t === 'multi-tenant') return typeof (c as any).tenantId === 'string';\n  if (t === 'custom') return typeof (c as any).authorityUrl === 'string';\n  return false;\n}","tryCatchPattern":"try {\n  const provider = EntraIdCredentialsProviderFactory.createForClientCredentials({ ...params, authorityConfig });\n} catch (e) {\n  if (e instanceof Error && /Invalid authority configuration/.test(e.message)) {\n    // authorityConfig.type is wrong; fall back to { type: 'default' }\n  }\n  throw e;\n}","preventionTips":["Always construct authorityConfig through a typed builder, not from raw JSON/env.","Validate env-derived authority type strings at the config-loading boundary.","Prefer { type: 'multi-tenant', tenantId } for single-tenant apps."],"tags":["configuration","entraid","typescript","authentication"],"analyzedSha":"bb5beb56578573910e2ee8f39681edc214c41398","analyzedAt":"2026-08-03T19:09:15.686Z","schemaVersion":2}