different-ai/openwork · error

OIDC discovery failed with ${response.status}. Enter manual

Error message

OIDC discovery failed with ${response.status}. Enter manual OIDC endpoints or enable skip discovery.

What it means

When not skipping discovery, resolveOidcEndpoints fetches the issuer's OpenID Connect discovery document (with a 10s timeout). Any non-OK HTTP status aborts setup with this Error, instructing the admin to enter endpoints manually or enable skipDiscovery.

Source

Thrown at ee/apps/den-api/src/sso.ts:122

      throw new Error("Manual OIDC configuration requires authorization, token, and JWKS endpoints.")
    }

    return {
      skipDiscovery: true,
      authorizationEndpoint: input.authorizationEndpoint,
      tokenEndpoint: input.tokenEndpoint,
      jwksEndpoint: input.jwksEndpoint,
      userInfoEndpoint: input.userInfoEndpoint ?? undefined,
      tokenEndpointAuthentication: input.tokenEndpointAuthentication ?? undefined,
    }
  }

  const response = await fetch(getOidcDiscoveryUrl(input.issuer), {
    headers: { accept: "application/json" },
    signal: AbortSignal.timeout(10_000),
  })
  if (!response.ok) {
    throw new Error(`OIDC discovery failed with ${response.status}. Enter manual OIDC endpoints or enable skip discovery.`)
  }

  const parsed = oidcDiscoverySchema.safeParse(await response.json())
  if (!parsed.success) {
    throw new Error("OIDC discovery document is missing required endpoints.")
  }
  if (normalizeIssuer(parsed.data.issuer) !== normalizeIssuer(input.issuer)) {
    throw new Error("OIDC discovery issuer does not match the configured issuer.")
  }

  return {
    skipDiscovery: true,
    authorizationEndpoint: parsed.data.authorization_endpoint,
    tokenEndpoint: parsed.data.token_endpoint,
    jwksEndpoint: parsed.data.jwks_uri,
    userInfoEndpoint: parsed.data.userinfo_endpoint,
    tokenEndpointAuthentication: input.tokenEndpointAuthentication ?? undefined,
  }

View on GitHub (pinned to 2b7df46e8a)

Solutions

1. Check the issuer URL and confirm <issuer>/.well-known/openid-configuration returns 200 in a browser or curl
2. If the provider does not publish a discovery document, configure the endpoints manually with skipDiscovery: true
3. Retry if the IdP had a transient outage; check network/proxy/TLS trust if the IdP is internal

Example fix

// before
{ issuer: 'https://idp.example.com', skipDiscovery: false } // no well-known doc, 404
// after
{ issuer: 'https://idp.example.com', skipDiscovery: true, authorizationEndpoint: 'https://idp.example.com/authorize', tokenEndpoint: 'https://idp.example.com/token', jwksEndpoint: 'https://idp.example.com/.well-known/jwks.json' }

const url = getOidcDiscoveryUrl(issuer)
const res = await fetch(url, { headers: { accept: 'application/json' } })
if (!res.ok) throw new Error(`Discovery document ${url} returned ${res.status}; enter endpoints manually`)

try {
  await resolveOidcEndpoints(input)
} catch (e) {
  if (e instanceof Error && e.message.startsWith('OIDC discovery failed with')) {
    // fall back to manual endpoint entry / show guidance in SSO setup UI
  } else throw e
}

When it happens

Trigger: fetch(getOidcDiscoveryUrl(issuer)) returns 404/500/403 etc. — issuer URL wrong, well-known path not exposed, IdP temporarily down, or a proxy/WAF blocking the request.

Common situations: Issuer entered with wrong path (discovery URL not derivable); IdP behind VPN/private network unreachable from server; on-prem IdP with self-signed certs failing TLS; transient IdP outage.

Related errors

• OIDC discovery document is missing required endpoints.
• Failed to save SSO settings (${response.status}).
• Failed to fetch latest-mac.yml (${response.status} ${respons
• Managed MCP outbound request exceeded the guarded redirect l
• Manual OIDC configuration requires authorization, token, and

AI-assisted analysis of different-ai/openwork@2b7df46e8a (2026-09-01). Data as JSON: /api/errors/ea3e6e82739cc3cd. Report an issue: GitHub.