rancher/rancher · error

creating OIDC login URL: %w

Error message

creating OIDC login URL: %w

What it means

TransformToAuthProvider builds the provider descriptor shown to clients and computes the login redirect URL via getRedirectURL. Any failure there (in practice, url.JoinPath failing on a malformed rancherAPIHost value, since the no-API-host path ignores discovery errors) is wrapped as 'creating OIDC login URL'.

Source

Thrown at pkg/auth/providers/oidc/oidc_provider.go:342

		p = apiv3.Principal{
			ObjectMeta:    metav1.ObjectMeta{Name: principalType + "://" + externalID},
			DisplayName:   externalID,
			LoginName:     externalID,
			PrincipalType: UserType,
			Provider:      o.Name,
		}
	} else {
		p = o.groupToPrincipal(externalID)
	}
	p = o.toPrincipalFromToken(principalType, p, token)
	return p, nil
}

func (o *OpenIDCProvider) TransformToAuthProvider(authConfig map[string]any) (map[string]any, error) {
	p := common.TransformToAuthProvider(authConfig)
	redirectPath, err := o.getRedirectURL(authConfig)
	if err != nil {
		return nil, fmt.Errorf("creating OIDC login URL: %w", err)
	}

	p[publicclient.OIDCProviderFieldRedirectURL] = redirectPath

	return p, nil
}

type urlValues interface {
	Add(_, _ string)
	Encode() string
}

// GetOIDCRedirectionURL generates the URL to redirect to the provider.
//
// the Values can either be an `orderedValues` value or a url.Values.
func GetOIDCRedirectionURL(config map[string]any, pkceVerifier string, values urlValues) string {
	authURL, _ := FetchAuthURL(config)

View on GitHub (pinned to 932558d4e6)

Solutions

1. Set a valid absolute rancherAPIHost (scheme + host, e.g. https://rancher.example.com) and re-test
2. Verify the authconfig object still carries metadata.name
3. If rancherAPIHost is intentionally unset, remove the key entirely rather than leaving a malformed value

Example fix

# before
rancherAPIHost: "rancher.example.com"   # no scheme, JoinPath fails

# after
rancherAPIHost: "https://rancher.example.com"

func validateAuthProviderConfig(authConfig map[string]any) error {
    meta, ok := authConfig["metadata"].(map[string]any)
    if !ok || meta["name"] == nil {
        return errors.New("authConfig requires metadata.name (getRedirectURL asserts it)")
    }
    if host, ok := authConfig["rancherAPIHost"].(string); ok && host != "" {
        u, err := url.Parse(host)
        if err != nil || !u.IsAbs() || u.Host == "" {
            return fmt.Errorf("rancherAPIHost must be an absolute URL, got %q", host)
        }
    }
    return nil
}

providerConfig, err := provider.TransformToAuthProvider(authConfig)
if err != nil && strings.Contains(err.Error(), "creating OIDC login URL") {
    // inspect rancherAPIHost in authConfig; JoinPath rejected it
    return err
}

When it happens

Trigger: The authConfig contains a rancherAPIHost that is not a parseable URL base (bad scheme, control chars), so url.JoinPath(rancherAPIHost, "v1-oidc", name) errors. Additionally, getRedirectURL type-asserts authConfig["metadata"]["name"] without ok-checks, so a missing metadata.name panics nearby.

Common situations: Setting the server's API host/AppliedEndpointRef-driven field to a malformed value; proxies rewriting the API host; a hand-edited authconfig missing metadata.name.

Related errors

• joining issuer path: %w
• could not form discovery URL: %w
• building Azure AD logout endpoint: %w
• creating OIDC provider: %w
• failed to transform auth config: %w

AI-assisted analysis of rancher/rancher@932558d4e6 (2026-08-16). Data as JSON: /api/errors/286623c94e17b64d. Report an issue: GitHub.