rancher/rancher · error

invalid hostname provided

Error message

invalid hostname provided

What it means

Thrown during the testAndApply/login flow for Google OAuth when the authenticated user's hd (hosted domain) claim does not equal the hostname configured in the GoogleOauthConfig. It is the provider's guard ensuring only members of the configured Google Workspace domain can enable or log in via this provider. It only fires when testAndEnableAction is true (enabling the provider) or during login enforcement against config.Hostname.

Source

Thrown at pkg/auth/providers/googleoauth/goauth_helper.go:29

	apiv3 "github.com/rancher/rancher/pkg/apis/management.cattle.io/v3"
	"github.com/sirupsen/logrus"
	"golang.org/x/oauth2"
	"golang.org/x/oauth2/google"
	admin "google.golang.org/api/admin/directory/v1"
	"google.golang.org/api/googleapi"
)

func (g *googleOauthProvider) getUserInfoAndGroups(adminSvc *admin.Service, gOAuthToken *oauth2.Token, config *apiv3.GoogleOauthConfig, testAndEnableAction bool) (apiv3.Principal, []apiv3.Principal, error) {
	var userPrincipal apiv3.Principal
	var groupPrincipals []apiv3.Principal
	// use the access token to make requests, get user info
	user, err := g.goauthClient.getUser(gOAuthToken.AccessToken, config)
	if err != nil {
		return userPrincipal, groupPrincipals, err
	}
	if testAndEnableAction {
		if user.HostedDomain != config.Hostname {
			return userPrincipal, groupPrincipals, fmt.Errorf("invalid hostname provided")
		}
	}
	userPrincipal = g.toPrincipal(userType, *user, nil)
	userPrincipal.Me = true
	logrus.Debugf("[Google OAuth] loginuser: Obtained userinfo using oauth access token")

	groupPrincipals, err = g.getGroupsUserBelongsTo(adminSvc, user.SubjectUniqueID, user.HostedDomain, config)
	if err != nil {
		// The error for this group request could be 403, because svc acc was not provided, and we're relying on individual
		// users' creds to get groups
		if config.ServiceAccountCredential == "" {
			var gErr *googleapi.Error
			if !errors.As(err, &gErr) || gErr.Code != http.StatusForbidden {
				// if the error is not forbidden, return the error
				return userPrincipal, groupPrincipals, err
			}
			// if the error is forbidden, don't throw any error, just no group principals will be returned
		} else {

View on GitHub (pinned to 932558d4e6)

Solutions

1. Authenticate with a user account that belongs to the exact configured Workspace domain (user@example.com when Hostname=example.com)
2. Fix config.Hostname to be the bare domain only, lowercase, no scheme, no trailing slash
3. If multiple domains are legitimate, ensure the primary domain is configured and users log in with accounts from it

Example fix

# before (GoogleOauthConfig CR)
spec:
  hostname: https://mycompany.com/

# after
spec:
  hostname: mycompany.com

// normalizeHostname strips scheme/space and lowercases so the hd comparison matches.
func normalizeHostname(h string) string {
    h = strings.TrimSpace(strings.ToLower(h))
    h = strings.TrimPrefix(h, "https://")
    h = strings.TrimPrefix(h, "http://")
    return strings.Trim(h, "/")
}

if user.HostedDomain != normalizeHostname(config.Hostname) {
    return fmt.Errorf("user domain %q not in configured hostname %q", user.HostedDomain, config.Hostname)
}

When it happens

Trigger: Calling testAndApply while signed in with a @gmail.com personal account while config.Hostname is set to a Workspace domain; hostname configured with a scheme or typo such as 'https://example.com' or 'example.co'; a Workspace user whose hd claim is a secondary/alias domain differing from the configured hostname.

Common situations: Admin testing the provider with their personal Google account; trailing whitespace or uppercase in the hostname field; Google account is from a different Workspace domain than intended; copy-pasting the full origin instead of the bare domain.

Related errors

• [Google OAuth] testAndApply: server error while authenticati
• request failed, got status code: %d
• cannot get the google account due to invalid externalIDType
• failed to retrieve GoogleOAuthConfig, error: %v
• invalid Service Account Credentials provided

AI-assisted analysis of rancher/rancher@932558d4e6 (2026-08-16). Data as JSON: /api/errors/6df3588925131c30. Report an issue: GitHub.