prestodb/presto · error · RuntimeException

Invalid response from OpenID Metadata endpoint:

Error message

Invalid response from OpenID Metadata endpoint: 

What it means

OidcDiscovery.parseConfigurationResponse could not parse the OpenID Provider Metadata document (JSON parse failure or missing/invalid required fields); the parse error details are appended. Discovery via the issuer's well-known endpoint did not yield a usable configuration.

Source

Thrown at presto-main/src/main/java/com/facebook/presto/server/security/oauth2/OidcDiscovery.java:100

    public OAuth2ServerConfig get()
    {
        return Failsafe.with(new RetryPolicy<>()
                        .withMaxAttempts(-1)
                        .withMaxDuration(discoveryTimeout)
                        .withDelay(Duration.ofSeconds(1))
                        .abortOn(IllegalStateException.class)
                        .onFailedAttempt(attempt -> LOG.debug("OpenID Connect Metadata read failed: %s", attempt.getLastFailure())))
                .get(() -> httpClient.execute(new OIDCProviderConfigurationRequest(issuer), this::parseConfigurationResponse));
    }

    private OAuth2ServerConfig parseConfigurationResponse(HTTPResponse response)
            throws ParseException
    {
        int statusCode = response.getStatusCode();
        if (statusCode != OK.code()) {
            // stop on any client errors other than REQUEST_TIMEOUT and TOO_MANY_REQUESTS
            if (statusCode < 400 || statusCode >= 500 || statusCode == REQUEST_TIMEOUT.code() || statusCode == TOO_MANY_REQUESTS.code()) {
                throw new RuntimeException("Invalid response from OpenID Metadata endpoint: " + statusCode);
            }
            else {
                throw new IllegalStateException(format("Invalid response from OpenID Metadata endpoint. Expected response code to be %s, but was %s", OK.code(), statusCode));
            }
        }
        return readConfiguration(response.getContent());
    }

    private OAuth2ServerConfig readConfiguration(String body)
            throws ParseException
    {
        OIDCProviderMetadata metadata = OIDCProviderMetadata.parse(body);
        checkMetadataState(issuer.equals(metadata.getIssuer()), "The value of the \"issuer\" claim in Metadata document different than the Issuer URL used for the Configuration Request.");
        try {
            JsonNode metadataJson = OBJECT_MAPPER.readTree(body);
            Optional<String> userinfoEndpoint;
            if (userinfoEndpointEnabled) {
                userinfoEndpoint = getOptionalField("userinfo_endpoint", Optional.ofNullable(metadata.getUserInfoEndpointURI()).map(URI::toString), USERINFO_URL, userinfoUrl);

View on GitHub (pinned to 55bb57d202)

Solutions

1. Verify the oauth issuer URL points at a compliant OIDC provider
2. Fetch the .well-known/openid-configuration URL manually and validate the JSON

When it happens

Trigger: Thrown at presto-main/src/main/java/com/facebook/presto/server/security/oauth2/OidcDiscovery.java:100 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of prestodb/presto@55bb57d202 (2026-09-04). Data as JSON: /api/errors/778c0bd9d10016c7. Report an issue: GitHub.