What causes "getting config for OIDC Logout: %w" in rancher/rancher?

Inspect the stored object: kubectl get authconfig cognito -o yaml (or the management cluster equivalent) and verify it is intact

rancher/rancher · error

getting config for OIDC Logout: %w

Error message

getting config for OIDC Logout: %w

What it means

Raised by CognitoProvider.Logout when GetConfig fails. GetConfig resolves to OpenIDCProvider.GetOIDCConfig, which reads the cognito OIDCConfig authConfig object from the Kubernetes API, decodes its unstructured content, and reads referenced secrets (e.g. the private key). Failure means the stored provider configuration could not be fetched or interpreted — the logout request never reaches Cognito.

Source

Thrown at pkg/auth/providers/cognito/cognito.go:68

// GetName returns the name of this provider.
func (p *CognitoProvider) GetName() string {
	return Name
}

func (p *CognitoProvider) RefetchGroupPrincipals(principalID string, secret string) ([]v3.Principal, error) {
	return p.OpenIDCProvider.RefetchGroupPrincipals(principalID, secret)
}

func (p *CognitoProvider) UsesUserSecrets() bool      { return true }
func (p *CognitoProvider) CanRefreshPrincipals() bool { return true }

func (p *CognitoProvider) Logout(w http.ResponseWriter, r *http.Request, token accessor.TokenAccessor) error {
	providerName := token.GetAuthProvider()
	logrus.Debugf("CognitoProvider [logout]: triggered by provider %s", providerName)
	oidcConfig, err := p.GetConfig()
	if err != nil {
		return fmt.Errorf("getting config for OIDC Logout: %w", err)
	}
	if oidcConfig.LogoutAllForced {
		return fmt.Errorf("CognitoProvider [logout]: Rancher provider resource `%v` configured for forced SLO, rejecting regular logout", providerName)
	}

	return nil
}

func (p *CognitoProvider) LogoutAll(w http.ResponseWriter, r *http.Request, token accessor.TokenAccessor) error {
	logrus.Debugf("CognitoProvider [logout-all]: triggered by provider %s", token.GetAuthProvider())
	oidcConfig, err := p.GetConfig()
	if err != nil {
		return err
	}

	providerName := token.GetAuthProvider()
	if !oidcConfig.LogoutAllEnabled {
		return fmt.Errorf("CognitoProvider [logout-all]: Rancher provider resource `%v` not configured for SLO", providerName)

View on GitHub (pinned to 932558d4e6)

Solutions

Inspect the stored object: kubectl get authconfig cognito -o yaml (or the management cluster equivalent) and verify it is intact
Re-save the Cognito configuration through the Rancher UI/auth API to regenerate a well-formed object and secret
Verify any referenced secrets still exist and contain the expected keys
Check the wrapped inner error — it distinguishes fetch failure, decode failure, and secret-read failure

Defensive patterns

Strategy: try-catch

Try / catch

oidcConfig, err := p.GetConfig()
if err != nil {
    // config-store problem, not a Cognito problem: distinguish fetch vs decode vs secret-read in the inner error
    return fmt.Errorf("logout unavailable: Cognito authConfig unreadable: %w", err)
}

Prevention

Manage the Cognito authConfig and its secrets only through the Rancher API/UI so they stay well-formed
Include the authConfig object in backup/restore procedures and verify after upgrades
Alert on missing authConfig CRs so drift is caught before users log out

When it happens

Trigger: The cognito authConfig CR is deleted or the API read fails; stored fields are corrupted so Decode fails; a referenced Kubernetes secret (private key and similar) is missing or unreadable; RBAC denies the read.

Common situations: Provider config partially deleted or hand-edited; secret removed during credential rotation; upgrade migrations leaving the authConfig in a shape the decoder rejects; API server connectivity issues at logout time.

Related errors

AI-assisted analysis of rancher/rancher@932558d4e6 (2026-08-16). Data as JSON: /api/errors/8069091f16c00fe2. Report an issue: GitHub.