mongodb/node-mongodb-native · error · MongoInvalidArgumentError

No workflow provided to the OIDC auth provider.

Error message

No workflow provided to the OIDC auth provider.

What it means

Thrown by the MongoDBOIDC auth provider constructor when no Workflow instance is supplied (src/cmap/auth/mongodb_oidc.ts:140). The provider requires a workflow to know how to obtain tokens. Surfaced as a MongoInvalidArgumentError. In normal operation the driver selects a workflow from OIDC_WORKFLOWS based on ENVIRONMENT; this error indicates the provider was instantiated directly without one.

Source

Thrown at src/cmap/auth/mongodb_oidc.ts:141

export const OIDC_WORKFLOWS: Map<EnvironmentName, () => Workflow> = new Map();
OIDC_WORKFLOWS.set('test', () => new AutomatedCallbackWorkflow(new TokenCache(), testCallback));
OIDC_WORKFLOWS.set('azure', () => new AutomatedCallbackWorkflow(new TokenCache(), azureCallback));
OIDC_WORKFLOWS.set('gcp', () => new AutomatedCallbackWorkflow(new TokenCache(), gcpCallback));
OIDC_WORKFLOWS.set('k8s', () => new AutomatedCallbackWorkflow(new TokenCache(), k8sCallback));

/**
 * OIDC auth provider.
 */
export class MongoDBOIDC extends AuthProvider {
  workflow: Workflow;

  /**
   * Instantiate the auth provider.
   */
  constructor(workflow?: Workflow) {
    super();
    if (!workflow) {
      throw new MongoInvalidArgumentError('No workflow provided to the OIDC auth provider.');
    }
    this.workflow = workflow;
  }

  /**
   * Authenticate using OIDC
   */
  override async auth(authContext: AuthContext): Promise<void> {
    const { connection, reauthenticating, response } = authContext;
    if (response?.speculativeAuthenticate?.done && !reauthenticating) {
      return;
    }
    const credentials = getCredentials(authContext);
    if (reauthenticating) {
      await this.workflow.reauthenticate(connection, credentials);
    } else {
      await this.workflow.execute(connection, credentials, response);
    }

View on GitHub (pinned to 3366c21a63)

Solutions

1. Do not construct MongoDBOIDC directly; configure OIDC via MongoClient options and let the driver pick the workflow.
2. If you must instantiate it, pass a Workflow implementation as the constructor argument.
3. Ensure ENVIRONMENT is set to one of the supported values (azure/gcp/k8s/test) so the driver can select a workflow.

function assertOidcEnvironment(env: string | undefined): void {
  const supported = new Set(['azure', 'gcp', 'k8s', 'test']);
  if (env && !supported.has(env)) {
    throw new Error(`Unsupported OIDC ENVIRONMENT '${env}'. Supported: ${[...supported].join(', ')}`);
  }
}
assertOidcEnvironment(parsedMechanismProperties.ENVIRONMENT);

try {
  await client.connect();
} catch (e) {
  if (e instanceof MongoInvalidArgumentError && /No workflow provided to the OIDC auth provider/.test(e.message)) {
    throw new Error('OIDC could not select a workflow - set a supported ENVIRONMENT in authMechanismProperties.');
  }
  throw e;
}

When it happens

Trigger: Internal/programmatic: constructing 'new MongoDBOIDC()' with no argument. Not triggered by standard MongoClient usage, since the driver's auth provider registry always supplies a workflow derived from the configured ENVIRONMENT.

Common situations: User code instantiating the internal MongoDBOIDC provider directly (advanced/integration use), or a driver regression where the provider registry fails to map ENVIRONMENT to a workflow factory.

Related errors

• TOKEN_RESOURCE must be set in the auth mechanism properties
• User provided OIDC callbacks must return a valid object with
• TOKEN_RESOURCE must be set in the auth mechanism properties
• AuthContext must provide credentials.
• username and ENVIRONMENT '${this.mechanismProperties.ENVIRON

AI-assisted analysis of mongodb/node-mongodb-native@3366c21a63 (2026-08-04). Data as JSON: /data/errors/25287c78df073729.json. Report an issue: GitHub.