rancher/rancher · error

invalid data for auth store update

Error message

invalid data for auth store update

What it means

Rancher wraps every authconfig schema store with a secrets store (pkg/auth/api/secrets). On Update it first reads the top-level 'type' key from the request data to look up TypeToFields/SubTypeToFields, which decide which credential fields must be stripped from the body and stored in Kubernetes Secrets. If 'type' is absent it rejects the request with this error before any field extraction happens.

Source

Thrown at pkg/auth/api/secrets/store.go:29

	wcorev1 "github.com/rancher/wrangler/v3/pkg/generated/controllers/core/v1"
)

func Wrap(store types.Store, secrets wcorev1.SecretController) types.Store {
	return &Store{
		Store:   store,
		Secrets: secrets,
	}
}

type Store struct {
	types.Store
	Secrets wcorev1.SecretController
}

func (s *Store) Update(apiContext *types.APIContext, schema *types.Schema, data map[string]interface{}, id string) (map[string]interface{}, error) {
	authType, found := values.GetValue(data, "type")
	if !found {
		return nil, fmt.Errorf("invalid data for auth store update")
	}

	kind := convert.ToString(authType)
	fields, ok := TypeToFields[kind]
	subFields, subOk := SubTypeToFields[kind]
	if !ok && !subOk {
		return s.Store.Update(apiContext, schema, data, id)
	}

	var err error
	for _, field := range fields {
		if val, ok := data[field]; ok {
			data[field], err = s.CreateOrUpdateSecrets(convert.ToString(val), field, kind)
			if err != nil {
				return nil, err
			}
		}
	}

View on GitHub (pinned to 932558d4e6)

Solutions

1. Add 'type' matching the provider (e.g. "type":"azuread") to the PUT body
2. GET the authconfig first, merge your changes into the returned document, and PUT the merged body
3. In client code, assert the payload contains 'type' before sending and cover it with a test

Example fix

// before
PUT /v3/authconfigs/azuread
{"applicationSecret":"new-secret"}
// after
PUT /v3/authconfigs/azuread
{"type":"azuread","applicationSecret":"new-secret"}

// Go client: verify the payload carries the discriminator before updating
if _, ok := data["type"]; !ok {
    return fmt.Errorf("payload missing required 'type' field for authconfig update")
}
_, err := apiClient.Update("authconfigs", id, data)

if err != nil {
    if strings.Contains(err.Error(), "invalid data for auth store update") {
        // re-fetch the resource, merge 'type' and other required fields, retry once
    }
}

When it happens

Trigger: PUT /v3/authconfigs/{azuread|openldap|okta|...} whose JSON body omits the 'type' key — typically a partial document containing only the changed fields, or a rebuilt body from a GET-modify-PUT pipeline that drops 'type'.

Common situations: Automation/curl/Terraform that PUTs a minimal payload; client code that constructs the body from scratch instead of merging with the current resource; UI extensions posting custom payloads.

Related errors

• error creating secret %s: %w
• failed to create secret password: %w
• InvalidType
• failed to compile regex '%s': %w
• failed to create filter: invalid filter action: '%s'

AI-assisted analysis of rancher/rancher@932558d4e6 (2026-08-16). Data as JSON: /api/errors/d5c03aa6efaf2537. Report an issue: GitHub.