netbirdio/netbird · error

invalid provider configuration received from management: %s

Error message

invalid provider configuration received from management: %s value is empty. Contact your NetBird administrator

What it means

Raised by validatePKCEConfig when the PKCE provider configuration delivered by management has an empty ClientID (client/internal/auth/pkce_flow.go:69-71). The IdP application's client ID is the first mandatory field of PKCEAuthProviderConfig; an empty value means management handed the client an incomplete SSO provider configuration. This is an administrator-side configuration problem, not something the end user can fix locally.

Source

Thrown at client/internal/auth/pkce_flow.go:70

	RedirectURLs []string
	// UseIDToken indicates if the id token should be used for authentication
	UseIDToken bool
	// ClientCertPair is used for mTLS authentication to the IDP
	ClientCertPair *tls.Certificate
	// DisablePromptLogin makes the PKCE flow to not prompt the user for login
	DisablePromptLogin bool
	// LoginFlag is used to configure the PKCE flow login behavior
	LoginFlag common.LoginFlag
	// LoginHint is used to pre-fill the email/username field during authentication
	LoginHint string
}

// validatePKCEConfig validates PKCE provider configuration
func validatePKCEConfig(config *PKCEAuthProviderConfig) error {
	errorMsgFormat := "invalid provider configuration received from management: %s value is empty. Contact your NetBird administrator"

	if config.ClientID == "" {
		return fmt.Errorf(errorMsgFormat, "Client ID")
	}
	if config.TokenEndpoint == "" {
		return fmt.Errorf(errorMsgFormat, "Token Endpoint")
	}
	if config.AuthorizationEndpoint == "" {
		return fmt.Errorf(errorMsgFormat, "Authorization Auth Endpoint")
	}
	if config.Scope == "" {
		return fmt.Errorf(errorMsgFormat, "PKCE Auth Scopes")
	}
	if config.RedirectURLs == nil {
		return fmt.Errorf(errorMsgFormat, "PKCE Redirect URLs")
	}
	return nil
}

// PKCEAuthorizationFlow implements the OAuthFlow interface for
// the Authorization Code Flow with PKCE.

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. Have the NetBird administrator complete the IdP configuration on management: set the IdP application Client ID
2. Re-fetch provider config on the management side (OIDC discovery) and save the integration again
3. End user: retry netbird up after the admin fixes the config; no local change helps

// For administrators: assert the provider config is complete before publishing it
func providerConfigComplete(c *auth.PKCEAuthProviderConfig) error {
	missing := []string{}
	if c.ClientID == "" {
		missing = append(missing, "ClientID")
	}
	if c.TokenEndpoint == "" {
		missing = append(missing, "TokenEndpoint")
	}
	if c.AuthorizationEndpoint == "" {
		missing = append(missing, "AuthorizationEndpoint")
	}
	if c.Scope == "" {
		missing = append(missing, "Scope")
	}
	if c.RedirectURLs == nil {
		missing = append(missing, "RedirectURLs")
	}
	if len(missing) > 0 {
		return fmt.Errorf("incomplete IdP config, missing: %s", strings.Join(missing, ", "))
	}
	return nil
}

if err != nil && strings.Contains(err.Error(), "invalid provider configuration received from management") {
	// administrator-side gap: report which field the message names and stop - no local workaround
}

When it happens

Trigger: authenticateWithPKCEFlow builds the flow from management's login response and validatePKCEConfig rejects it because ClientID == ''. Happens when the IdP integration on management was saved without the application (client) ID, or a management version/API path returns a provider object with unset fields.

Common situations: Admin partially configured an IdP connector (filled domain/issuer but not the app ID); IdP config migration lost the client ID field; test/dev management instances with stubbed provider settings.

Related errors

• validate access token failed with error: %v
• getting pkce authorization flow info failed with error: %v
• no SSO provider returned from management. Please proceed wit
• failed to parse redirect URL: %v
• PKCE authorization flow failed: %v

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/8dca7c76f5444246. Report an issue: GitHub.