googleapis/mcp-toolbox · error

failed to discover OIDC config: %w

Error message

failed to discover OIDC config: %w

What it means

This error wraps any failure that occurs while fetching and parsing the OpenID Connect discovery document (<authorizationServer>/.well-known/openid-configuration) during AuthService initialization. The generic auth service needs the issuer, jwks_uri, and introspection_endpoint from the discovery document before it can verify tokens, so if discovery fails the whole auth service cannot start. The underlying cause (URL parse error, network failure, bad status, missing fields) is preserved via %w.

Source

Thrown at internal/auth/generic/generic.go:83

		if cfg.IntrospectionEndpoint != "" {
			return nil, fmt.Errorf("`introspectionEndpoint` is not allowed when `mcpEnabled` is false")
		}
		if cfg.IntrospectionMethod != "" {
			return nil, fmt.Errorf("`introspectionMethod` is not allowed when `mcpEnabled` is false")
		}
		if cfg.IntrospectionParamName != "" {
			return nil, fmt.Errorf("`introspectionParamName` is not allowed when `mcpEnabled` is false")
		}
		if len(cfg.ScopesRequired) > 0 {
			return nil, fmt.Errorf("`scopesRequired` is not allowed when `mcpEnabled` is false")
		}
	}
	httpClient := newSecureHTTPClient()

	// Discover OIDC endpoints
	jwksURL, introspectionURL, issuer, err := discoverOIDCConfig(httpClient, cfg.AuthorizationServer)
	if err != nil {
		return nil, fmt.Errorf("failed to discover OIDC config: %w", err)
	}

	// Override introspection URL if configured
	if cfg.IntrospectionEndpoint != "" {
		introspectionURL = cfg.IntrospectionEndpoint
	}

	// Create the keyfunc to fetch and cache the JWKS in the background
	kf, err := keyfunc.NewDefault([]string{jwksURL})
	if err != nil {
		return nil, fmt.Errorf("failed to create keyfunc from JWKS URL %s: %w", jwksURL, err)
	}

	a := &AuthService{
		Config:           cfg,
		kf:               kf,
		client:           httpClient,
		introspectionURL: introspectionURL,

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Verify the authorizationServer value in your YAML is a reachable base URL of an OIDC provider (e.g. https://accounts.google.com)
2. Test discovery manually with curl <authorizationServer>/.well-known/openid-configuration and confirm it returns JSON with issuer and jwks_uri
3. Check network/DNS/proxy connectivity from the machine running toolbox
4. Inspect the wrapped cause in the error chain to identify whether it was fetch, status, or parse failure
5. If the provider lacks discovery, consider an auth service type that accepts explicit endpoints

Example fix

// before
authServices:
  - name: myauth
    type: generic
    authorizationServer: auth.example.com
// after
authServices:
  - name: myauth
    type: generic
    authorizationServer: https://auth.example.com

u, err := url.Parse(cfg.AuthorizationServer)
if err != nil || u.Scheme == "" || u.Host == "" {
    return fmt.Errorf("authorizationServer %q is not a valid absolute URL", cfg.AuthorizationServer)
}
resp, err := http.Get(u.String() + "/.well-known/openid-configuration")
if err != nil || resp.StatusCode != 200 {
    return fmt.Errorf("authorizationServer discovery unreachable: %v", err)
}

svc, err := cfg.Initialize()
if err != nil {
    var dnErr error
    if errors.As(err, &dnErr) && strings.Contains(err.Error(), "failed to discover OIDC config") {
        log.Fatalf("check authorizationServer config/network: %v", err)
    }
    return err
}

When it happens

Trigger: cfg.AuthorizationServer is unreachable or misconfigured when Config.Initialize() runs at server startup: unparseable URL, DNS/connection failure, non-200 discovery response, or discovery document missing issuer/jwks_uri.

Common situations: Typo in the authorizationServer YAML field (e.g. missing scheme or trailing path), auth server down or firewalled at boot, pointing at a non-OIDC endpoint that returns 404, or a corporate proxy blocking the outbound request.

Related errors

• failed to fetch OIDC config: %w
• unable to initialize logger: %w
• error setting up OpenTelemetry: %w
• unable to create telemetry instrumentation: %w
• failed to create keyfunc from JWKS URL %s: %w

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/a96f49471f8a005e. Report an issue: GitHub.