What causes "Failed to parse SSO provider response" in pentaho/pentaho-kettle?

Log/print the raw response body to see what the server actually returned

pentaho/pentaho-kettle · error · IOException

Failed to parse SSO provider response

Error message

Failed to parse SSO provider response

What it means

fetchProviders parses the HTTP response body as JSON (JSONArray of SSO provider entries); any exception during reading or extracting the expected fields (clientName, authorizationUri, registrationId) is wrapped in this IOException. It means the response was received but was not valid JSON or had an unexpected structure.

Solutions

Log/print the raw response body to see what the server actually returned
Confirm the server's login plugin version matches the expected oauth-providers response schema
Check that authentication/session cookies are valid — a login page often comes back as 200 HTML
Handle unexpected shapes defensively: check instanceof JSONArray before casting
Verify no proxy/intermediary is rewriting the response

Example fix

// before
Object parsed = new JSONParser().parse( reader );
// after
Object parsed = new JSONParser().parse( reader );
if ( !( parsed instanceof JSONArray ) ) {
  throw new IOException( "Unexpected SSO provider response (not a JSON array): " + parsed );
}

Defensive patterns

Strategy: fallback

Validate before calling

// verify the endpoint speaks JSON before parsing
connection.setRequestProperty( "Accept", "application/json" );
String contentType = connection.getContentType();
if ( contentType == null || !contentType.contains( "json" ) ) {
  throw new IOException( "Expected JSON response, got: " + contentType );
}

Try / catch

try {
  providers = ssoProviderService.fetchProviders( serverUrl );
} catch ( IOException e ) {
  if ( e.getCause() instanceof ParseException ) {
    log.warn( "SSO response not parseable — server may not support SSO" );
  }
  providers = Collections.emptyList();
}

Prevention

Send Accept: application/json and validate the response content type before parsing
Confirm server plugin version matches the expected response schema
Log the raw body on parse failure for diagnosis
Don't assume 2xx means valid JSON — proxies can return HTML with 200

When it happens

Trigger: Endpoint returns 2xx but body is not valid JSON, is not a JSON array, or array elements lack/mis-type the expected fields (clientName, authorizationUri, registrationId).

Common situations: Server returns an HTML error/login page with 200 status; a proxy injects content; server plugin version changed the response schema; truncated or empty body.

Understand the failure class

Background: JSON parse error: "Unexpected token" / "not valid JSON" / "failed to parse" — what JSON parsers are really complaining about — this error's family across 45 libraries.

Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

AI-assisted analysis of pentaho/pentaho-kettle@f3058517a1 (2026-09-13). Data as JSON: /api/errors/9b359190d96bd682. Report an issue: GitHub.

Appendix: source

Thrown at plugins/repositories/core/src/main/java/org/pentaho/di/ui/repo/util/SsoProviderService.java:75

        if ( !( parsed instanceof JSONArray providersArray ) ) {
          return Collections.emptyList();
        }

        List<SsoProvider> providers = new ArrayList<>();
        for ( Object item : providersArray ) {
          if ( item instanceof JSONObject providerObject ) {
            boolean enabled = getBoolean( providerObject.get( "enabled" ) );
            String clientName = stringValue( providerObject.get( "clientName" ) );
            String authorizationUri = stringValue( providerObject.get( "authorizationUri" ) );
            String registrationId = stringValue( providerObject.get( "registrationId" ) );
            if ( enabled && !isBlank( clientName ) && !isBlank( authorizationUri ) ) {
              providers.add( new SsoProvider( clientName, authorizationUri, registrationId ) );
            }
          }
        }
        return providers;
      } catch ( Exception e ) {
        throw new IOException( "Failed to parse SSO provider response", e );
      }
    } finally {
      if ( connection != null ) {
        connection.disconnect();
      }
    }
  }

  public boolean isOAuthEnabled( String serverUrl ) throws IOException {
    String settingsUrl = normalizeBaseUrl( serverUrl ) + "/plugin/login/api/v0/system-settings";
    HttpURLConnection connection = null;

    try {
      connection = (HttpURLConnection) new URL( settingsUrl ).openConnection();
      connection.setInstanceFollowRedirects( false );
      connection.setRequestMethod( "GET" );
      connection.setConnectTimeout( CONNECT_TIMEOUT_MS );
      connection.setReadTimeout( READ_TIMEOUT_MS );

View on GitHub (pinned to f3058517a1)