prestodb/presto · error · IllegalStateException

Invalid response from OpenID Metadata endpoint. Expected res

Error message

Invalid response from OpenID Metadata endpoint. Expected response code to be %s, but was %s

What it means

The OpenID metadata endpoint returned a status other than the expected success code; the expected and actual codes are included. Discovery runs under a Failsafe retry policy, so this error is retried until the discovery timeout elapses.

Source

Thrown at presto-main/src/main/java/com/facebook/presto/server/security/oauth2/OidcDiscovery.java:103

                        .withMaxAttempts(-1)
                        .withMaxDuration(discoveryTimeout)
                        .withDelay(Duration.ofSeconds(1))
                        .abortOn(IllegalStateException.class)
                        .onFailedAttempt(attempt -> LOG.debug("OpenID Connect Metadata read failed: %s", attempt.getLastFailure())))
                .get(() -> httpClient.execute(new OIDCProviderConfigurationRequest(issuer), this::parseConfigurationResponse));
    }

    private OAuth2ServerConfig parseConfigurationResponse(HTTPResponse response)
            throws ParseException
    {
        int statusCode = response.getStatusCode();
        if (statusCode != OK.code()) {
            // stop on any client errors other than REQUEST_TIMEOUT and TOO_MANY_REQUESTS
            if (statusCode < 400 || statusCode >= 500 || statusCode == REQUEST_TIMEOUT.code() || statusCode == TOO_MANY_REQUESTS.code()) {
                throw new RuntimeException("Invalid response from OpenID Metadata endpoint: " + statusCode);
            }
            else {
                throw new IllegalStateException(format("Invalid response from OpenID Metadata endpoint. Expected response code to be %s, but was %s", OK.code(), statusCode));
            }
        }
        return readConfiguration(response.getContent());
    }

    private OAuth2ServerConfig readConfiguration(String body)
            throws ParseException
    {
        OIDCProviderMetadata metadata = OIDCProviderMetadata.parse(body);
        checkMetadataState(issuer.equals(metadata.getIssuer()), "The value of the \"issuer\" claim in Metadata document different than the Issuer URL used for the Configuration Request.");
        try {
            JsonNode metadataJson = OBJECT_MAPPER.readTree(body);
            Optional<String> userinfoEndpoint;
            if (userinfoEndpointEnabled) {
                userinfoEndpoint = getOptionalField("userinfo_endpoint", Optional.ofNullable(metadata.getUserInfoEndpointURI()).map(URI::toString), USERINFO_URL, userinfoUrl);
            }
            else {
                userinfoEndpoint = Optional.empty();

View on GitHub (pinned to 55bb57d202)

Solutions

1. Check that the issuer URL is reachable and the OIDC discovery endpoint responds successfully
2. Wait for transient provider outages to clear; discovery retries for the configured timeout

When it happens

Trigger: Thrown at presto-main/src/main/java/com/facebook/presto/server/security/oauth2/OidcDiscovery.java:103 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/6f5250ab4864e521. Report an issue: GitHub.