googleapis/mcp-toolbox · error

unexpected status: %d

Error message

unexpected status: %d

What it means

The OIDC discovery endpoint responded, but with an HTTP status other than 200 OK. The library treats any non-200 discovery response as fatal because the discovery document was not reliably delivered.

Source

Thrown at internal/auth/generic/generic.go:144

		return "", "", "", fmt.Errorf("invalid auth URL")
	}
	if u.Scheme != "https" {
		log.Printf("WARNING: HTTP instead of HTTPS is being used for AuthorizationServer: %s", AuthorizationServer)
	}

	oidcConfigURL, err := url.JoinPath(AuthorizationServer, ".well-known/openid-configuration")
	if err != nil {
		return "", "", "", err
	}

	resp, err := client.Get(oidcConfigURL)
	if err != nil {
		return "", "", "", fmt.Errorf("failed to fetch OIDC config: %w", err)
	}
	defer resp.Body.Close()

	if resp.StatusCode != http.StatusOK {
		return "", "", "", fmt.Errorf("unexpected status: %d", resp.StatusCode)
	}

	// Limit read size to 1MB to prevent memory exhaustion
	body, err := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
	if err != nil {
		return "", "", "", err
	}

	var config struct {
		Issuer                string `json:"issuer"`
		JwksUri               string `json:"jwks_uri"`
		IntrospectionEndpoint string `json:"introspection_endpoint"`
	}
	if err := json.Unmarshal(body, &config); err != nil {
		return "", "", "", err
	}

	if config.Issuer == "" {

View on GitHub (pinned to 8cc6e09de2)

Solutions

1. Check the status code in the error message and match it to the cause (404=wrong URL, 403=auth/WAF block, 5xx=server problem)
2. Verify the authorizationServer base URL is exactly the issuer root (no extra path segments)
3. Remove trailing-slash or scheme mismatches that cause redirects — the secure client does not follow redirects
4. Check auth-server/proxy logs for why the discovery route failed

Example fix

// before (extra path causes 404 on discovery)
authorizationServer: "https://auth.example.com/realms/myrealm/v2"
// after
authorizationServer: "https://auth.example.com/realms/myrealm"

resp, err := http.Get(cfg.AuthorizationServer + "/.well-known/openid-configuration")
if err == nil && resp.StatusCode != 200 {
    return fmt.Errorf("discovery returned %d; check authorizationServer path and redirects", resp.StatusCode)
}

svc, err := cfg.Initialize()
if err != nil {
    var statusErr string
    if m := regexp.MustCompile(`unexpected status: (\d+)`).FindStringSubmatch(err.Error()); m != nil {
        statusErr = m[1]
    }
    if statusErr == "502" || statusErr == "503" {
        time.Sleep(2 * time.Second) // transient upstream: retry
    }
    return err
}

When it happens

Trigger: client.Get on .well-known/openid-configuration succeeded but returned e.g. 404 (wrong base URL/path), 403 (blocked), 502/503 (gateway down), or 301/302 (the secure client does not follow redirects, surfacing the redirect status).

Common situations: authorizationServer points at the wrong path depth so discovery 404s; auth server redirects http->https or adds a trailing slash and the client refuses to follow; a reverse proxy returns 502 while the auth backend is down.

Related errors

• failed to fetch OIDC config: %w
• failed to discover OIDC config: %w
• failed to create keyfunc from JWKS URL %s: %w
• issuer not found in config
• jwks_uri not found in config

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/0abf585597fc61a1. Report an issue: GitHub.