rancher/rancher · error

finding oauth token for provider %s: %w

Error message

finding oauth token for provider %s: %w

What it means

Thrown by getClientCredentialsToken when reading the provider's cached client-credentials token secret via TokenMgr.GetSecret(name, name, nil) fails with an error other than NotFound. This is an infrastructure error talking to the Kubernetes API (or the secret store), not an auth failure - NotFound is handled by design, everything else surfaces here.

Source

Thrown at pkg/auth/providers/keycloakoidc/keycloak_provider.go:255

	if !reflect.DeepEqual(oauthToken, reusedToken) {
		if err := k.UpdateToken(reusedToken, token.GetUserID()); err != nil {
			logrus.Errorf("updating cached oauth token for user %s: %s", token.GetUserID(), err)
		}
	}

	return reusedToken, nil
}

func (k *keyCloakOIDCProvider) getClientCredentialsToken(ctx context.Context, provider *gooidc.Provider, config *apiv3.OIDCConfig) (*oauth2.Token, error) {
	var oauthToken *oauth2.Token
	secretExists := true
	storedOauthToken, err := k.TokenMgr.GetSecret(k.GetName(), k.GetName(), nil)
	if err != nil {
		if apierrors.IsNotFound(err) {
			secretExists = false
		} else {
			return nil, fmt.Errorf("finding oauth token for provider %s: %w", k.GetName(), err)
		}
	}
	if storedOauthToken != "" {
		if err := json.Unmarshal([]byte(storedOauthToken), &oauthToken); err != nil {
			return nil, fmt.Errorf("unmarshalling cached oauth token for provider %s: %w", k.GetName(), err)
		}
	}
	oauthConfig := oidc.ConfigToOauthConfig(provider.Endpoint(), config)
	clientConf := clientcredentials.Config{
		ClientID:     oauthConfig.ClientID,
		ClientSecret: oauthConfig.ClientSecret,
		TokenURL:     provider.Endpoint().TokenURL,
		AuthStyle:    oauth2.AuthStyleInParams,
		Scopes:       oauthConfig.Scopes,
	}
	if oauthToken != nil && (!oauthToken.Valid() || oauthToken.AccessToken == "") {
		logrus.Debugf("[keycloak oidc] RefreshAndUpdateToken: attempting to refresh access token from client credentials")
		tok, err := clientConf.Token(ctx)

View on GitHub (pinned to 932558d4e6)

Solutions

1. Check Kubernetes API server health and events for the management cluster at the time of the error
2. Verify the service account running the auth provider can get secrets in the namespace where token secrets live
3. Retry the operation - transient API errors resolve; if persistent, inspect the wrapped error for authorization (403) messages

if err != nil && strings.Contains(err.Error(), "finding oauth token for provider") {
    // infra error against the k8s API, not auth: safe to retry
    return retryWithBackoff(op)
}

When it happens

Trigger: The secret GET for the provider-named secret returns a 500/timeout, RBAC denies the service account reading secrets in the namespace, or the API server is temporarily unreachable while the Keycloak client-credentials flow initializes.

Common situations: Management cluster API server briefly unavailable; RBAC role bindings for the Rancher service account on secrets changed; etcd/secret-store latency causing request failures.

Related errors

• getting access token for user: %w
• error creating secret %s: %w
• error getting secret for %s : %w
• error updating secret %s: %w
• error creating secret %s %w

AI-assisted analysis of rancher/rancher@932558d4e6 (2026-08-16). Data as JSON: /api/errors/f85d932d2fef50ef. Report an issue: GitHub.