netbirdio/netbird · error

identity provider type is required

Error message

identity provider type is required

What it means

Sentinel error types.ErrIdentityProviderTypeRequired (management/server/types/identity_provider.go:11), returned by IdentityProvider.Validate when Type is the empty string. NetBird needs the type to dispatch to the correct IdP driver (OIDC, Zitadel, Entra, ...), so a missing type is rejected before any network call is made.

Source

Thrown at management/server/types/identity_provider.go:11

package types

import (
	"errors"
	"net/url"
)

// Identity provider validation errors
var (
	ErrIdentityProviderNameRequired      = errors.New("identity provider name is required")
	ErrIdentityProviderTypeRequired      = errors.New("identity provider type is required")
	ErrIdentityProviderTypeUnsupported   = errors.New("unsupported identity provider type")
	ErrIdentityProviderIssuerRequired    = errors.New("identity provider issuer is required")
	ErrIdentityProviderIssuerInvalid     = errors.New("identity provider issuer must be a valid URL")
	ErrIdentityProviderIssuerUnreachable = errors.New("identity provider issuer is unreachable")
	ErrIdentityProviderIssuerMismatch    = errors.New("identity provider issuer does not match the issuer returned by the provider")
	ErrIdentityProviderClientIDRequired  = errors.New("identity provider client ID is required")
)

// IdentityProviderType is the type of identity provider
type IdentityProviderType string

const (
	// IdentityProviderTypeOIDC is a generic OIDC identity provider
	IdentityProviderTypeOIDC IdentityProviderType = "oidc"
	// IdentityProviderTypeZitadel is the Zitadel identity provider
	IdentityProviderTypeZitadel IdentityProviderType = "zitadel"
	// IdentityProviderTypeEntra is the Microsoft Entra (Azure AD) identity provider
	IdentityProviderTypeEntra IdentityProviderType = "entra"

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. Set Type to one of the supported values: oidc, zitadel, entra, google, okta, pocketid, microsoft, authentik, keycloak, adfs
2. Check for typos in the JSON key (it must be exactly the type field the server unmarshals)

Example fix

// before
idp := &types.IdentityProvider{Name: "SSO", Issuer: "https://sso.example.com", ClientID: "abc"}

// after
idp := &types.IdentityProvider{Name: "SSO", Type: types.IdentityProviderTypeOIDC, Issuer: "https://sso.example.com", ClientID: "abc"}

if idp.Type == "" {
    return types.ErrIdentityProviderTypeRequired
}

if err := idp.Validate(); err != nil {
    if errors.Is(err, types.ErrIdentityProviderTypeRequired) {
        // default to types.IdentityProviderTypeOIDC or prompt for a choice
    }
    return err
}

When it happens

Trigger: Saving an IdP configuration where the type field is omitted or empty, e.g. {"name": "idp", "issuer": "...", "client_id": "..."}.

Common situations: Config templates that were written before the multi-type IdP support existed; JSON keys changed case between client and server; hand-built payloads in setup scripts.

Related errors

• identity provider name is required
• unsupported identity provider type
• identity provider issuer is required
• identity provider issuer must be a valid URL
• identity provider issuer does not match the issuer returned

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/65ce2803eb58813e. Report an issue: GitHub.