netbirdio/netbird · error

unsupported identity provider type

Error message

unsupported identity provider type

What it means

Sentinel error types.ErrIdentityProviderTypeUnsupported (management/server/types/identity_provider.go:12), returned by IdentityProvider.Validate when Type.IsValid() is false. The valid set is fixed in code: oidc, zitadel, entra, google, okta, pocketid, microsoft, authentik, keycloak, adfs. Anything else, including legacy or misspelled values, is rejected.

Source

Thrown at management/server/types/identity_provider.go:12

package types

import (
	"errors"
	"net/url"
)

// Identity provider validation errors
var (
	ErrIdentityProviderNameRequired      = errors.New("identity provider name is required")
	ErrIdentityProviderTypeRequired      = errors.New("identity provider type is required")
	ErrIdentityProviderTypeUnsupported   = errors.New("unsupported identity provider type")
	ErrIdentityProviderIssuerRequired    = errors.New("identity provider issuer is required")
	ErrIdentityProviderIssuerInvalid     = errors.New("identity provider issuer must be a valid URL")
	ErrIdentityProviderIssuerUnreachable = errors.New("identity provider issuer is unreachable")
	ErrIdentityProviderIssuerMismatch    = errors.New("identity provider issuer does not match the issuer returned by the provider")
	ErrIdentityProviderClientIDRequired  = errors.New("identity provider client ID is required")
)

// IdentityProviderType is the type of identity provider
type IdentityProviderType string

const (
	// IdentityProviderTypeOIDC is a generic OIDC identity provider
	IdentityProviderTypeOIDC IdentityProviderType = "oidc"
	// IdentityProviderTypeZitadel is the Zitadel identity provider
	IdentityProviderTypeZitadel IdentityProviderType = "zitadel"
	// IdentityProviderTypeEntra is the Microsoft Entra (Azure AD) identity provider
	IdentityProviderTypeEntra IdentityProviderType = "entra"
	// IdentityProviderTypeGoogle is the Google identity provider

View on GitHub (pinned to 93e97f4bf1)

Solutions

1. Use an exact supported constant, most commonly types.IdentityProviderTypeOIDC ("oidc") for generic OIDC providers
2. If you expect a newer type (e.g. entra), upgrade the management service to a version that lists it in IsValid()

Example fix

// before
idp.Type = "azure"

// after
idp.Type = types.IdentityProviderTypeEntra // "entra"

func isSupportedIdPType(t string) bool {
    switch types.IdentityProviderType(t) {
    case types.IdentityProviderTypeOIDC, types.IdentityProviderTypeZitadel,
        types.IdentityProviderTypeEntra, types.IdentityProviderTypeGoogle,
        types.IdentityProviderTypeOkta, types.IdentityProviderTypePocketID,
        types.IdentityProviderTypeMicrosoft, types.IdentityProviderTypeAuthentik,
        types.IdentityProviderTypeKeycloak, types.IdentityProviderTypeADFS:
        return true
    }
    return false
}

if err := idp.Validate(); err != nil {
    if errors.Is(err, types.ErrIdentityProviderTypeUnsupported) {
        // map to the closest supported type (e.g. "azure"->entra) or fail with guidance
    }
    return err
}

When it happens

Trigger: Saving an IdP config whose type is not in the switch in IdentityProviderType.IsValid, e.g. "azure", "oauth2", "OIDC" (capitalized), or a type added in a newer management version than the one you run.

Common situations: Upgrading or downgrading management versions where the supported type list changed; using generic "oidc-like" names instead of exact constants; automation written against different NetBird distributions.

Related errors

• identity provider name is required
• identity provider type is required
• identity provider issuer is required
• identity provider issuer must be a valid URL
• identity provider issuer does not match the issuer returned

AI-assisted analysis of netbirdio/netbird@93e97f4bf1 (2026-08-16). Data as JSON: /api/errors/4fd0fd61202b654a. Report an issue: GitHub.