What causes "identity provider name is required" in netbirdio/netbird?

Provide a non-empty Name (any human-readable label, e.g. "Corporate Okta") in the IdP payload

identity provider name is required

Error message

identity provider name is required

What it means

Sentinel error types.ErrIdentityProviderNameRequired (management/server/types/identity_provider.go:10), returned by IdentityProvider.Validate when Name is empty. It is the first check when an admin saves an identity provider configuration for an account, and the management API surfaces it as an InvalidArgument status.

Source

Thrown at management/server/types/identity_provider.go:10

package types

import (
	"errors"
	"net/url"
)

// Identity provider validation errors
var (
	ErrIdentityProviderNameRequired      = errors.New("identity provider name is required")
	ErrIdentityProviderTypeRequired      = errors.New("identity provider type is required")
	ErrIdentityProviderTypeUnsupported   = errors.New("unsupported identity provider type")
	ErrIdentityProviderIssuerRequired    = errors.New("identity provider issuer is required")
	ErrIdentityProviderIssuerInvalid     = errors.New("identity provider issuer must be a valid URL")
	ErrIdentityProviderIssuerUnreachable = errors.New("identity provider issuer is unreachable")
	ErrIdentityProviderIssuerMismatch    = errors.New("identity provider issuer does not match the issuer returned by the provider")
	ErrIdentityProviderClientIDRequired  = errors.New("identity provider client ID is required")
)

// IdentityProviderType is the type of identity provider
type IdentityProviderType string

const (
	// IdentityProviderTypeOIDC is a generic OIDC identity provider
	IdentityProviderTypeOIDC IdentityProviderType = "oidc"
	// IdentityProviderTypeZitadel is the Zitadel identity provider
	IdentityProviderTypeZitadel IdentityProviderType = "zitadel"
	// IdentityProviderTypeEntra is the Microsoft Entra (Azure AD) identity provider

View on GitHub (pinned to 93e97f4bf1)

Solutions

Provide a non-empty Name (any human-readable label, e.g. "Corporate Okta") in the IdP payload
If generating config from environment files, assert the name variable is set before calling the API

Example fix

// before
idp := &types.IdentityProvider{Type: "okta", Issuer: "https://okta.example.com", ClientID: "abc"}

// after
idp := &types.IdentityProvider{Name: "Corporate Okta", Type: "okta", Issuer: "https://okta.example.com", ClientID: "abc"}

Defensive patterns

Strategy: validation

Validate before calling

if idp.Name == "" {
    return types.ErrIdentityProviderNameRequired // or a client-side equivalent
}

Try / catch

if err := idp.Validate(); err != nil {
    if errors.Is(err, types.ErrIdentityProviderNameRequired) {
        // prompt for the IdP display name
    }
    return err
}

Prevention

Reuse types.IdentityProvider.Validate() client-side when your tooling imports the management types package
Make name required in config schemas (JSON schema/Terraform) used to build IdP payloads
Smoke-test IdP provisioning in a pipeline so empty-template bugs fail fast

When it happens

Trigger: Creating or updating an IdP configuration (admin API/handler that calls validateIdentityProviderConfig) with an empty name field.

Common situations: Programmatic setup of self-hosted management that copies an IdP JSON template and forgets the name; migrating IdP config between accounts where name was optional in the old tooling.

Related errors

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/d3b519ec6d313882. Report an issue: GitHub.