kataras/iris · error

auth: signin: %w

Error message

auth: signin: %w

What it means

Auth.Signin returns 'auth: signin: %w' wrapping the underlying error only when the LAST registered provider fails. Earlier providers are skipped silently ('keep searching'); if the final provider also errors, its error is wrapped and propagated. The %w wrap means callers can inspect the provider error with errors.Is/As.

Source

Thrown at auth/auth.go:234

}

// Signin signs a token based on the provided username and password
// and returns a pair of access and refresh tokens.
//
// Signin calls the Provider.Signin method to check if a user
// is authenticated by the given username and password combination.
func (s *Auth[T]) Signin(ctx stdContext.Context, username, password string) ([]byte, []byte, error) {
	var t T

	// get "t" from a valid provider.
	if n := len(s.providers); n > 0 {
		for i := 0; i < n; i++ {
			p := s.providers[i]

			v, err := p.Signin(ctx, username, password)
			if err != nil {
				if i == n-1 { // last provider errored.
					return nil, nil, fmt.Errorf("auth: signin: %w", err)
				}
				// keep searching.
				continue
			}

			// found.
			t = v
			break
		}
	} else {
		return nil, nil, fmt.Errorf("auth: signin: no provider")
	}

	// sign the tokens.
	accessToken, refreshToken, err := s.sign(t)
	if err != nil {
		return nil, nil, fmt.Errorf("auth: signin: %w", err)
	}

View on GitHub (pinned to 7bedaf55a0)

Solutions

1. Inspect the wrapped cause with errors.Is/As or %v on the error to see the last provider's failure reason
2. Fix the last provider's configuration or backing store
3. Reorder providers so the most reliable one is last (or handles the common case first)
4. Log each provider's attempt to identify which one ultimately failed

Example fix

// before
_, _, err := a.Signin(ctx, username, password)
return err
// after
_, _, err := a.Signin(ctx, username, password)
if err != nil {
    log.Printf("signin failed: %v", err) // shows last provider cause
    return err
}

// pre-validate credentials shape before hitting providers
if username == "" || password == "" { return errors.New("missing credentials") }

func isSigninProviderErr(err error) bool { return err != nil && strings.HasPrefix(err.Error(), "auth: signin: ") && !strings.Contains(err.Error(), "no provider") }

_, _, err := a.Signin(ctx, user, pass)
if err != nil {
    var target error
    if errors.As(err, &target) || errors.Unwrap(err) != nil {
        log.Printf("last provider failed: %v", errors.Unwrap(err))
    }
    http.Error(w, "invalid credentials", http.StatusUnauthorized)
}

When it happens

Trigger: Calling auth.Signin (or the SigninHandler endpoint) with credentials that fail against every provider, and the last provider returns an error such as invalid credentials or an internal provider failure.

Common situations: Wrong username/password on the last-configured provider (e.g. a local DB provider after a broken LDAP one); a provider's backing store being down; provider misconfiguration (bad DSN, wrong user table).

Related errors

• auth: signin: no provider
• access: %w
• auth: configuration: %s access token is missing from the con

AI-assisted analysis of kataras/iris@7bedaf55a0 (2026-08-30). Data as JSON: /api/errors/674c10803ef9958a. Report an issue: GitHub.