googleapis/mcp-toolbox · error

issuer not found in config

Error message

issuer not found in config

What it means

The discovery document was fetched and parsed as JSON, but the required 'issuer' field was empty or absent. OIDC discovery mandates an issuer claim; without it the library cannot later validate token iss values, so initialization fails.

Source

Thrown at internal/auth/generic/generic.go:163

	}

	// Limit read size to 1MB to prevent memory exhaustion
	body, err := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
	if err != nil {
		return "", "", "", err
	}

	var config struct {
		Issuer                string `json:"issuer"`
		JwksUri               string `json:"jwks_uri"`
		IntrospectionEndpoint string `json:"introspection_endpoint"`
	}
	if err := json.Unmarshal(body, &config); err != nil {
		return "", "", "", err
	}

	if config.Issuer == "" {
		return "", "", "", fmt.Errorf("issuer not found in config")
	}

	if config.JwksUri == "" {
		return "", "", "", fmt.Errorf("jwks_uri not found in config")
	}

	// Sanitize the resulting JWKS URI before returning it
	parsedJWKS, err := url.Parse(config.JwksUri)
	if err != nil {
		return "", "", "", fmt.Errorf("invalid jwks_uri detected")
	}
	if parsedJWKS.Scheme != "https" {
		log.Printf("WARNING: HTTP instead of HTTPS is being used for JWKS URI: %s", config.JwksUri)
	}

	return config.JwksUri, config.IntrospectionEndpoint, config.Issuer, nil
}

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. curl the discovery URL and confirm the JSON contains a non-empty "issuer" field
2. Point authorizationServer at the actual OIDC provider root, not an API base path
3. Fix or replace the non-compliant auth server configuration
4. Verify no proxy is rewriting/stripping the response body

Example fix

// before (endpoint serves non-OIDC JSON)
authorizationServer: "https://api.example.com"
// after
authorizationServer: "https://auth.example.com"

body, err := http.Get(cfg.AuthorizationServer + "/.well-known/openid-configuration")
// then decode and check:
var doc struct{ Issuer string `json:"issuer"` }
json.NewDecoder(body.Body).Decode(&doc)
if doc.Issuer == "" {
    return fmt.Errorf("discovery doc from %s has no issuer; not a valid OIDC provider", cfg.AuthorizationServer)
}

_, err := cfg.Initialize()
if err != nil && strings.Contains(err.Error(), "issuer not found in config") {
    log.Fatalf("authorizationServer is not serving a compliant OIDC discovery doc: %v", err)
}

When it happens

Trigger: The response body from .well-known/openid-configuration unmarshals successfully but config.Issuer == "" — the endpoint returned JSON without an issuer key, or returned valid JSON that is not an OIDC discovery document (e.g. an HTML-to-JSON error page would actually fail earlier at json.Unmarshal).

Common situations: Pointing authorizationServer at a URL that serves some other JSON (API root, error JSON); a non-standard auth server that omits issuer; a proxy serving a cached/empty document.

Related errors

• jwks_uri not found in config
• failed to initialize resources: %w
• tool %q not found
• unable to retrieve source for tool %s
• failed to initialize resources: %w

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/0a216cdf2ba57bd6. Report an issue: GitHub.