What causes "sync response is not available" in netbirdio/netbird?

Identify the failing scheme from the log line's 'scheme' field, then check that scheme's specific backend connectivity.

sync response is not available

Error message

sync response is not available

What it means

Inside authenticateWithSchemes (middleware.go:535): the middleware iterates config.Schemes and calls scheme.Authenticate(r); a returned error means the scheme could not even attempt authentication (infrastructure failure), so it logs 'authentication infrastructure error', marks OriginAuth, and short-circuits with 502. Credential failures are handled inside the schemes (empty token), not here.

Source

Thrown at client/internal/connect.go:531

	e = c.engine
	c.engineMutex.Unlock()
	return e
}

// GetLatestSyncResponse returns the latest sync response from the engine.
func (c *ConnectClient) GetLatestSyncResponse() (*mgmProto.SyncResponse, error) {
	engine := c.Engine()
	if engine == nil {
		return nil, errors.New("engine is not initialized")
	}

	syncResponse, err := engine.GetLatestSyncResponse()
	if err != nil {
		return nil, fmt.Errorf("get latest sync response: %w", err)
	}

	if syncResponse == nil {
		return nil, errors.New("sync response is not available")
	}

	return syncResponse, nil
}

// SetLogLevel sets the log level for the firewall manager if the engine is running.
func (c *ConnectClient) SetLogLevel(level log.Level) {
	engine := c.Engine()
	if engine == nil {
		return
	}

	fwManager := engine.GetFirewallManager()
	if fwManager != nil {
		fwManager.SetLogLevel(level)
	}
}

View on GitHub (pinned to 93e97f4bf1)

Solutions

Identify the failing scheme from the log line's 'scheme' field, then check that scheme's specific backend connectivity.
Verify the IdP issuer/management endpoint is reachable from the proxy process (not just from the operator's machine).
If a scheme's backend is permanently gone, remove the scheme from the domain registration so it stops poisoning the loop.
Restart the proxy after restoring backends to clear any cached broken provider state.

Defensive patterns

Strategy: retry

Validate before calling

// Pre-flight the scheme backends the domain relies on (IdP issuer reachable).
client := &http.Client{Timeout: 3 * time.Second}
resp, err := client.Get(strings.TrimSuffix(issuer, "/") + "/.well-known/openid-configuration")
if err != nil || resp.StatusCode != 200 {
    return errors.New("IdP discovery unreachable; login will 502")
}

Try / catch

resp, err := client.Get(loginURL)
if err == nil && resp.StatusCode == http.StatusBadGateway {
    // Auth infrastructure down: check the failing scheme in proxy logs,
    // restore its backend, then retry the login. Backoff between attempts.
}

Prevention

Probe IdP discovery and management endpoints from the proxy's network path, not your workstation.
Only register schemes whose backends are deployed and reachable.
Alert on 502s at the login step separately from per-user failures.
Restart the proxy after backend recovery to clear cached provider state.

When it happens

Trigger: Any scheme's Authenticate erroring while probing the request: an OIDC scheme failing to build its authorize redirect (IdP discovery cached badly), a basic-auth scheme unable to reach its validator, or a tunnel/peer scheme whose validation backing service is down — triggered by simply requesting the domain's login path.

Common situations: IdP unreachable from the proxy pod; management gRPC down so dependent schemes cannot initialize; partial network partition between proxy and identity backends; a scheme added to a domain whose backing service was never deployed.

Related errors

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/3ba8d1d8dbcf7011. Report an issue: GitHub.