kubesphere/kubesphere · error

failed to exchange identity for %s, error: %v

Error message

failed to exchange identity for %s, error: %v

What it means

oauthAuthenticator.Authenticate calls oauthIdentityProvider.IdentityExchangeCallback(req) to swap the OAuth code for a user identity (token exchange + userinfo call). If the external IdP rejects the exchange, the underlying error is wrapped as this message. The root cause is in the %v suffix.

Source

Thrown at pkg/models/auth/oauth.go:49

	}
	return authenticator
}

func (o *oauthAuthenticator) Authenticate(ctx context.Context, provider string, req *http.Request) (authuser.Info, error) {
	providerConfig, err := o.idpConfigurationGetter.GetConfiguration(ctx, provider)
	// identity provider not registered
	if err != nil {
		return nil, fmt.Errorf("failed to get identity provider configuration for %s, error: %v", provider, err)
	}

	oauthIdentityProvider, exist := identityprovider.SharedIdentityProviderController.GetOAuthProvider(provider)
	if !exist {
		return nil, fmt.Errorf("identity provider %s not exist", provider)
	}

	identity, err := oauthIdentityProvider.IdentityExchangeCallback(req)
	if err != nil {
		return nil, fmt.Errorf("failed to exchange identity for %s, error: %v", provider, err)
	}

	return authByIdentityProvider(ctx, o.client, o.userMapper, providerConfig, identity)
}

View on GitHub (pinned to 04a29b5c60)

Solutions

1. Retry the login flow from the beginning to get a fresh authorization code
2. Verify clientSecret, redirectURI, and endpoint settings in the IdentityProvider CR
3. Check egress connectivity and TLS trust to the external IdP; inspect the wrapped %v cause in apiserver logs

user, err := oauthAuth.Authenticate(ctx, provider, req)
if err != nil {
  if strings.Contains(err.Error(), "failed to exchange identity") {
    // restart the OAuth dance: redirect to authorize URL for a fresh code
    http.Redirect(w, req, authorizeURL(provider), http.StatusFound)
    return
  }
  http.Error(w, "login failed", http.StatusUnauthorized)
}

When it happens

Trigger: OAuth callback with an invalid/expired/already-used authorization code, mismatched client_secret or redirect_uri, unreachable IdP endpoint, or the IdP rejecting the access-token request.

Common situations: User double-submits the callback (code reuse); wrong clientSecret/redirectURI in the IdentityProvider CR; IdP TLS certificate not trusted by the cluster; network egress blocked to the IdP.

Related errors

• UserInfoResp.Message
• no id_token in token response
• the OAuth client was not found
• redirect URL is not allowed
• resp.Status

AI-assisted analysis of kubesphere/kubesphere@04a29b5c60 (2026-09-03). Data as JSON: /api/errors/cf8d5b89697b7da8. Report an issue: GitHub.