rancher/rancher · error

failed to fetch discovery document: %s

Error message

failed to fetch discovery document: %s

What it means

The HTTP request to the discovery endpoint completed, but the response status was not 200. The error includes the HTTP status (e.g. '404 Not Found'), indicating the server answered but the discovery document was not served at the requested URL.

Source

Thrown at pkg/auth/providers/oidc/oidc_client.go:90

		return "", fmt.Errorf("both authEndpoint and issuerURL are missing in the authConfig")
	}

	discoveryURL, err := url.JoinPath(issuerURL, "/.well-known/openid-configuration")
	if err != nil {
		return "", fmt.Errorf("could not form discovery URL: %w", err)
	}

	client := &http.Client{
		Timeout: 10 * time.Second,
	}
	discoveryResponse, err := client.Get(discoveryURL)
	if err != nil {
		return "", fmt.Errorf("unable to fetch discovery information for OIDC provider: %w", err)
	}
	defer discoveryResponse.Body.Close()

	if discoveryResponse.StatusCode != http.StatusOK {
		return "", fmt.Errorf("failed to fetch discovery document: %s", discoveryResponse.Status)
	}

	var discoveryInfo struct {
		AuthorizationEndpoint string `json:"authorization_endpoint"`
	}

	if err := json.NewDecoder(discoveryResponse.Body).Decode(&discoveryInfo); err != nil {
		return "", fmt.Errorf("unable to decode the OIDC discovery response %w", err)
	}
	if discoveryInfo.AuthorizationEndpoint == "" {
		return "", fmt.Errorf("no authorization endpoint found in discovery response with status %s", discoveryResponse.Status)
	}

	return discoveryInfo.AuthorizationEndpoint, nil
}

View on GitHub (pinned to 932558d4e6)

Solutions

1. Open <issuer>/.well-known/openid-configuration in a browser or curl and verify it returns the JSON document; adjust the issuer (especially realm/tenant path) until it does
2. Match the issuer exactly to the 'issuer' field inside the provider's own discovery document
3. If a proxy/gateway fronts the IdP, whitelist the well-known path and disable auth challenges on it

Example fix

# before
issuer: https://sso.example.com          # 404: realm path missing

# after
issuer: https://sso.example.com/realms/main   # curl -s https://sso.example.com/realms/main/.well-known/openid-configuration returns JSON

authURL, err := FetchAuthURL(config)
if err != nil {
    if strings.Contains(err.Error(), "failed to fetch discovery document") {
        // non-200 from IdP: surface the embedded status (e.g. 404 => wrong issuer path)
        return fmt.Errorf("check issuer path, discovery endpoint returned: %w", err)
    }
    return err
}

When it happens

Trigger: Issuer path is wrong so /.well-known/openid-configuration lands on a 404 (common with Keycloak realm paths like /realms/<wrong-realm>); the endpoint sits behind an authenticating reverse proxy returning 401/403; the IdP returns 5xx under load or misconfiguration.

Common situations: Keycloak issuer missing or mistyping the realm name; Azure AD/Okta issuer copied from the wrong panel; an internal gateway that returns 403 for unknown hosts; a CDN/WAF intercepting the path.

Related errors

• creating OIDC provider: %w
• both authEndpoint and issuerURL are missing in the authConfi
• no authorization endpoint found in discovery response with s
• joining issuer path: %w
• failed to transform auth config: %w

AI-assisted analysis of rancher/rancher@932558d4e6 (2026-08-16). Data as JSON: /api/errors/b4531e9c16650630. Report an issue: GitHub.