googleapis/mcp-toolbox · error

failed to fetch OIDC config: %w

Error message

failed to fetch OIDC config: %w

What it means

This error wraps the transport-level failure of the HTTP GET request to the OIDC discovery document URL (<authorizationServer>/.well-known/openid-configuration). It means the request never completed: DNS failure, connection refused, TLS error, or the 10-second timeout of the secure HTTP client was exceeded.

Source

Thrown at internal/auth/generic/generic.go:139

}

func discoverOIDCConfig(client *http.Client, AuthorizationServer string) (jwksURI string, introspectionEndpoint string, issuer string, err error) {
	u, err := url.Parse(AuthorizationServer)
	if err != nil {
		return "", "", "", fmt.Errorf("invalid auth URL")
	}
	if u.Scheme != "https" {
		log.Printf("WARNING: HTTP instead of HTTPS is being used for AuthorizationServer: %s", AuthorizationServer)
	}

	oidcConfigURL, err := url.JoinPath(AuthorizationServer, ".well-known/openid-configuration")
	if err != nil {
		return "", "", "", err
	}

	resp, err := client.Get(oidcConfigURL)
	if err != nil {
		return "", "", "", fmt.Errorf("failed to fetch OIDC config: %w", err)
	}
	defer resp.Body.Close()

	if resp.StatusCode != http.StatusOK {
		return "", "", "", fmt.Errorf("unexpected status: %d", resp.StatusCode)
	}

	// Limit read size to 1MB to prevent memory exhaustion
	body, err := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
	if err != nil {
		return "", "", "", err
	}

	var config struct {
		Issuer                string `json:"issuer"`
		JwksUri               string `json:"jwks_uri"`
		IntrospectionEndpoint string `json:"introspection_endpoint"`
	}

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Confirm network reachability: curl -v <authorizationServer>/.well-known/openid-configuration from the toolbox host
2. Check DNS resolution and firewall/proxy rules
3. If using TLS with a private CA, install the CA cert into the system trust store
4. Check for slow responses hitting the 10s client timeout
5. Verify the scheme is https and the port is correct

Example fix

// before (unreachable internal host)
authorizationServer: "https://internal-auth:9999"
// after (correct port and host)
authorizationServer: "https://internal-auth:8443"

req, _ := http.NewRequest("GET", cfg.AuthorizationServer+"/.well-known/openid-configuration", nil)
resp, err := (&http.Client{Timeout: 10 * time.Second}).Do(req)
if err != nil {
    return fmt.Errorf("discovery endpoint unreachable: %v", err)
}
resp.Body.Close()

for attempt := 0; attempt < 3; attempt++ {
    svc, err := cfg.Initialize()
    if err == nil {
        break
    }
    if strings.Contains(err.Error(), "failed to fetch OIDC config") {
        time.Sleep(time.Duration(attempt+1) * time.Second) // transient network/timeout
        continue
    }
    return err
}

When it happens

Trigger: client.Get(oidcConfigURL) returns a non-nil error during Initialize() — server unreachable, TLS handshake failure, redirect policy, or timeout (10s).

Common situations: Authorization server is behind a firewall, wrong port, DNS not resolvable from the toolbox host, self-signed certificate not trusted, or the auth server is slow to respond at boot.

Understand the failure class

Background: 'Something went wrong' / 'Request failed (500)' / 'HTTP error! status: 404' — what failed HTTP requests actually mean and how to find the real cause — this error's family across 28 libraries.

Related errors

• failed to discover OIDC config: %w
• unexpected status: %d
• failed to execute request: %w
• failed to execute pipeline request: %w
• failed to create keyfunc from JWKS URL %s: %w

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/cd0e84635a6887c1. Report an issue: GitHub.