pentaho/pentaho-kettle · error · IOException

Provider lookup failed with HTTP status

Error message

Provider lookup failed with HTTP status {status}

What it means

SsoProviderService.fetchProviders calls the server's SSO providers endpoint; any HTTP status outside 2xx (other than 404, which is treated as 'SSO not configured' and returns an empty list) is converted into this IOException. It means the server was reachable but rejected or failed the lookup request.

Solutions

1. Verify the server URL and network path; test the endpoint directly (curl <server>/plugin/login/api/v0/oauth-providers) to see the real status
2. If 401/403, supply valid authentication credentials for the repository server
3. Check the Pentaho server logs for a 500 on the login plugin and fix server-side configuration
4. If the server simply doesn't support SSO, treat a 404/empty result as expected (the code already does this for 404)
5. Retry later if the status is 5xx from a temporarily unhealthy server

Example fix

// before
throw new IOException( "Provider lookup failed with HTTP status " + responseCode );
// after
if ( responseCode == HttpURLConnection.HTTP_UNAUTHORIZED ) {
  throw new IOException( "SSO provider lookup unauthorized: check credentials for " + connection.getURL() );
}
throw new IOException( "Provider lookup failed with HTTP status " + responseCode );

HttpURLConnection c = (HttpURLConnection) new URL( buildProvidersUrl( serverUrl ) ).openConnection();
c.setRequestMethod( "HEAD" );
int code = c.getResponseCode();
if ( code != 404 && ( code < 200 || code >= 300 ) ) {
  throw new IllegalStateException( "SSO endpoint will fail, HTTP " + code );
}

try {
  List<SsoProvider> providers = ssoProviderService.fetchProviders( serverUrl );
} catch ( IOException e ) {
  log.warn( "SSO provider lookup failed: " + e.getMessage(), e );
  providers = Collections.emptyList(); // degrade to non-SSO login
}

When it happens

Trigger: Calling fetchProviders() against a Pentaho server whose /plugin/login/api/v0/oauth-providers endpoint returns a non-2xx, non-404 status (e.g. 401 unauthorized, 403 forbidden, 500 server error).

Common situations: Server requires authentication and none was supplied; a proxy or gateway returns 502/503; the server version exposes the endpoint but errors on it; wrong server URL pointing at a service that answers with an error status.

Understand the failure class

Background: "API error: {status}" and "HTTP 401/403/404/429/5xx" errors: non-2xx HTTP responses explained — this error's family across 27 libraries.

Related errors

• Carte.Error.NoServerFound
• Client error creating folder
• CmsTokenProvider: Keycloak token request failed — HTTP
• Failed to fetch driver metadata for
• Failed to fetch driver metadata for

AI-assisted analysis of pentaho/pentaho-kettle@f3058517a1 (2026-09-13). Data as JSON: /api/errors/195ea905ae31133a. Report an issue: GitHub.

Appendix: source

Thrown at plugins/repositories/core/src/main/java/org/pentaho/di/ui/repo/util/SsoProviderService.java:51

  public List<SsoProvider> fetchProviders( String serverUrl ) throws IOException {
    String providersUrl = buildProvidersUrl( serverUrl );
    HttpURLConnection connection = null;

    try {
      connection = (HttpURLConnection) new URL( providersUrl ).openConnection();
      connection.setRequestMethod( "GET" );
      connection.setConnectTimeout( CONNECT_TIMEOUT_MS );
      connection.setReadTimeout( READ_TIMEOUT_MS );
      connection.setRequestProperty( "Accept", "application/json" );

      int responseCode = connection.getResponseCode();
      if ( responseCode == HttpURLConnection.HTTP_NOT_FOUND ) {
        // The SSO providers endpoint does not exist on this server — SSO is not configured.
        return Collections.emptyList();
      }
      if ( responseCode < 200 || responseCode >= 300 ) {
        throw new IOException( "Provider lookup failed with HTTP status " + responseCode );
      }

      try ( InputStreamReader reader =
              new InputStreamReader( connection.getInputStream(), StandardCharsets.UTF_8 ) ) {
        Object parsed = new JSONParser().parse( reader );
        if ( !( parsed instanceof JSONArray providersArray ) ) {
          return Collections.emptyList();
        }

        List<SsoProvider> providers = new ArrayList<>();
        for ( Object item : providersArray ) {
          if ( item instanceof JSONObject providerObject ) {
            boolean enabled = getBoolean( providerObject.get( "enabled" ) );
            String clientName = stringValue( providerObject.get( "clientName" ) );
            String authorizationUri = stringValue( providerObject.get( "authorizationUri" ) );
            String registrationId = stringValue( providerObject.get( "registrationId" ) );
            if ( enabled && !isBlank( clientName ) && !isBlank( authorizationUri ) ) {
              providers.add( new SsoProvider( clientName, authorizationUri, registrationId ) );

View on GitHub (pinned to f3058517a1)