rancher/rancher · error

Failed to get provider configuration

Error message

Failed to get provider configuration

What it means

The OIDC login redirect handler fetches the provider's AuthConfig (management.cattle.io/v3) via p.authConfigs.Get(provider) using the {provider} path value. Any error other than NotFound — apiserver unavailable, RBAC denial, cache/informer failure, timeout — is masked to the client as 400 "Failed to get provider configuration"; the real cause only appears in the log line "[oidc] Failed to get provider configuration for <provider>: <err>". Note the 400 status is misleading: the failure is server-side.

Source

Thrown at pkg/auth/handler/handler.go:89

// Security considerations:
//   - The redirect URL is constructed from trusted authConfig data stored in the cluster
//   - User-provided state and scope are passed as query parameters but do not control the redirect destination
//   - PKCE is used when configured to prevent authorization code interception attacks
//   - The PKCE verifier is stored in a secure cookie when PKCE is enabled
func (p *AuthProviderServer) redirectToIdP(w http.ResponseWriter, req *http.Request) {
	provider := req.PathValue("provider")

	logrus.Debugf("[oidc] Redirecting to IdP for provider: %s", provider)

	authConfig, err := p.authConfigs.Get(provider, metav1.GetOptions{})
	if err != nil {
		if apierrors.IsNotFound(err) {
			logrus.Debugf("[oidc] Provider not found: %s", provider)
			http.NotFound(w, req)
			return
		}
		logrus.Errorf("[oidc] Failed to get provider configuration for %s: %v", provider, err)
		http.Error(w, "Failed to get provider configuration", http.StatusBadRequest)
		return
	}

	authConfigData, ok := authConfig.(runtime.Unstructured)
	if !ok {
		logrus.Errorf("[oidc] Invalid auth config format for provider %s: expected runtime.Unstructured", provider)
		http.Error(w, "Invalid auth config format", http.StatusInternalServerError)
		return
	}
	data := authConfigData.UnstructuredContent()
	logrus.Debugf("[oidc] Retrieved auth config for provider: %s", provider)

	// Validate that the provider is enabled
	if enabledRaw := data[client.GenericOIDCConfigFieldEnabled]; enabledRaw != nil {
		enabled, ok := enabledRaw.(bool)
		if !ok {
			logrus.Errorf("[oidc] Invalid enabled field type for provider %s: expected bool, got %T", provider, enabledRaw)
			http.Error(w, "Invalid provider configuration", http.StatusInternalServerError)

View on GitHub (pinned to 932558d4e6)

Solutions

1. Check rancher logs for "[oidc] Failed to get provider configuration for <provider>" — the underlying error is only logged there
2. Verify the AuthConfig exists and the provider path segment matches: kubectl get authconfig <provider>
3. If the underlying error is apiserver/RBAC related, fix apiserver health or the handler client's permissions on authconfigs, then retry the redirect
4. If it was transient (apiserver restart), simply retry after the control plane recovers

// Before directing users at the login URL, confirm the provider exists:
// kubectl get authconfig <provider>  (exit 0 = exists; NotFound gives 404, not this error)
if !authConfigExists(provider) {
    return fmt.Errorf("provider %s not configured", provider)
}

resp, err := client.Get(redirectURL)
// ...
if resp.StatusCode == http.StatusBadRequest {
    body, _ := io.ReadAll(resp.Body)
    if strings.Contains(string(body), "Failed to get provider configuration") {
        // server-side read failure masked as 400: check rancher logs; retry after apiserver recovery
        time.Sleep(backoff())
        return retry() // safe: state was not mutated
    }
}

When it happens

Trigger: GET on the oidc redirect route (handler reading req.PathValue("provider")) while the authconfig read fails for a non-NotFound reason: apiserver/etcd disruption, RBAC blocking the handler's client on authconfigs, or an unsynced informer cache.

Common situations: During apiserver or etcd instability or recovery-from-backup; after CRD/authconfig schema breakage from a partial upgrade; custom deployments where the handler's backing client lacks read permissions. A typo'd provider name usually yields 404 (NotFound) instead — hitting this 400 means the config read itself failed.

Related errors

• Provider is disabled
• invalid data for auth store update
• error creating secret %s: %w
• Invalid provider configuration
• Invalid PKCE method type

AI-assisted analysis of rancher/rancher@932558d4e6 (2026-08-16). Data as JSON: /api/errors/e7e58e0d16bdfb4e. Report an issue: GitHub.