mongodb/node-mongodb-native · error · MongoOIDCError

OIDC callback timed out after ${AUTOMATED_TIMEOUT_MS}ms.

Error message

OIDC callback timed out after ${AUTOMATED_TIMEOUT_MS}ms.

What it means

Thrown by the automated (machine) OIDC callback workflow when the OIDC callback function does not return within AUTOMATED_TIMEOUT_MS (60000ms / 1 minute) - see src/cmap/auth/mongodb_oidc/automated_callback_workflow.ts:81 and callback_workflow.ts:20. The driver aborts the callback via AbortController and surfaces this as a MongoOIDCError. The automated workflow is used for non-interactive (machine) environments like Azure/GCP/k8s/test.

Source

Thrown at src/cmap/auth/mongodb_oidc/automated_callback_workflow.ts:81

  protected async fetchAccessToken(credentials: MongoCredentials): Promise<OIDCResponse> {
    const controller = new AbortController();
    const params: OIDCCallbackParams = {
      timeoutContext: controller.signal,
      version: OIDC_VERSION
    };
    if (credentials.username) {
      params.username = credentials.username;
    }
    if (credentials.mechanismProperties.TOKEN_RESOURCE) {
      params.tokenAudience = credentials.mechanismProperties.TOKEN_RESOURCE;
    }
    const timeout = Timeout.expires(AUTOMATED_TIMEOUT_MS);
    try {
      return await Promise.race([this.executeAndValidateCallback(params), timeout]);
    } catch (error) {
      if (TimeoutError.is(error)) {
        controller.abort();
        throw new MongoOIDCError(`OIDC callback timed out after ${AUTOMATED_TIMEOUT_MS}ms.`);
      }
      throw error;
    } finally {
      timeout.clear();
    }
  }
}

View on GitHub (pinned to 3366c21a63)

Solutions

1. Ensure the cloud metadata endpoint is reachable from the host (Azure IMDS 169.254.169.254, GCP metadata.google.internal, k8s service account token file).
2. In a custom automated callback, honor params.timeoutContext: abort outstanding HTTP requests when the signal aborts and resolve quickly.
3. Reduce callback latency (avoid extra round trips, cache tokens within their lifetime).
4. If 60s is genuinely too short for your IdP, switch to a workflow that uses a faster token source or pre-fetch the token.

Example fix

// before: callback ignores the abort signal
const cb = async (params) => {
  const r = await fetch(idpUrl); // may hang indefinitely
  return { accessToken: await r.json() };
};

// after: callback honors timeoutContext
const cb = async (params) => {
  const r = await fetch(idpUrl, { signal: params.timeoutContext });
  return { accessToken: (await r.json()).token };
};

function assertOidcAutomatedCallbackReady(callback: (p: any) => Promise<any>): void {
  // Smoke test the callback resolves quickly with a dummy AbortSignal
  const ac = new AbortController();
  const t = setTimeout(() => ac.abort(), 5000);
  callback({ timeoutContext: ac.signal, version: 1 })
    .then(r => { if (!r?.accessToken) console.warn('OIDC callback returned no accessToken'); })
    .catch(e => console.warn('OIDC callback smoke test failed', e))
    .finally(() => clearTimeout(t));
}

try {
  await client.connect();
} catch (e) {
  if (e instanceof MongoOIDCError && /OIDC callback timed out/.test(e.message)) {
    // Check metadata endpoint reachability, then retry with backoff
    log.warn('OIDC automated callback timed out; verify metadata endpoint');
  }
  throw e;
}

When it happens

Trigger: Calling MongoClient.connect with MONGODB-OIDC and ENVIRONMENT set to azure/gcp/k8s/test, or a custom automated callback, where the callback takes longer than 60 seconds to resolve. Also triggered if the callback hangs on a network call that ignores the provided timeoutContext (AbortSignal).

Common situations: The metadata endpoint (Azure IMDS, GCP metadata, k8s token file) is slow or unreachable, a custom machine callback performs slow synchronous work without honoring the AbortSignal, or the network to the cloud metadata service is blocked/firewalled causing the callback to spin.

Related errors

• TOKEN_RESOURCE must be set in the auth mechanism properties
• TOKEN_RESOURCE must be set in the auth mechanism properties
• Azure endpoint did not return a value with only access_token
• Status code ${response.status} returned from the Azure endpo
• TOKEN_RESOURCE must be set in the auth mechanism properties

AI-assisted analysis of mongodb/node-mongodb-native@3366c21a63 (2026-08-04). Data as JSON: /data/errors/665986603799ccc3.json. Report an issue: GitHub.