rancher/rancher · error

Invalid provider configuration

Error message

Invalid provider configuration

What it means

The OIDC redirect handler reads the genericoidc config's `enabled` field from the unstructured map and asserts it to bool. If the field exists but is a different JSON type (string "true", number 1, null handled separately), the assertion fails and returns 500 "Invalid provider configuration" — the operator's log names the provider and the offending Go type.

Source

Thrown at pkg/auth/handler/handler.go:107

		http.Error(w, "Failed to get provider configuration", http.StatusBadRequest)
		return
	}

	authConfigData, ok := authConfig.(runtime.Unstructured)
	if !ok {
		logrus.Errorf("[oidc] Invalid auth config format for provider %s: expected runtime.Unstructured", provider)
		http.Error(w, "Invalid auth config format", http.StatusInternalServerError)
		return
	}
	data := authConfigData.UnstructuredContent()
	logrus.Debugf("[oidc] Retrieved auth config for provider: %s", provider)

	// Validate that the provider is enabled
	if enabledRaw := data[client.GenericOIDCConfigFieldEnabled]; enabledRaw != nil {
		enabled, ok := enabledRaw.(bool)
		if !ok {
			logrus.Errorf("[oidc] Invalid enabled field type for provider %s: expected bool, got %T", provider, enabledRaw)
			http.Error(w, "Invalid provider configuration", http.StatusInternalServerError)
			return
		}
		if !enabled {
			logrus.Debugf("[oidc] Provider %s is disabled", provider)
			http.Error(w, "Provider is disabled", http.StatusNotFound)
			return
		}
	}

	// Validate PKCE method if configured
	var pkceVerifier string
	if pkceMethodRaw := data[client.GenericOIDCConfigFieldPKCEMethod]; pkceMethodRaw != nil {
		pkceMethod, ok := pkceMethodRaw.(string)
		if !ok {
			logrus.Errorf("[oidc] Invalid PKCE method type for provider %s: expected string, got %T", provider, pkceMethodRaw)
			http.Error(w, "Invalid PKCE method type", http.StatusInternalServerError)
			return
		}

View on GitHub (pinned to 932558d4e6)

Solutions

1. Check the log "[oidc] Invalid enabled field type ... got %T" to see the actual type stored
2. Fix the field to a real boolean: kubectl patch authconfig <provider> --type merge -p '{"genericOIDCConfig":{"enabled":true}}' (unquoted)
3. Validate the AuthConfig against the rancher CRD schema (kubectl apply --dry-run=server) before applying
4. Audit whatever automation produced the value and stop it coercing booleans to strings/numbers

Example fix

# before
genericOIDCConfig:
  enabled: "true"
# after
genericOIDCConfig:
  enabled: true

// Before enabling a generic OIDC provider, verify scalar types on the config map:
func validateOIDCEnabled(m map[string]any) error {
    v, ok := m["enabled"]
    if !ok || v == nil {
        return nil // absent is fine
    }
    if _, ok := v.(bool); !ok {
        return fmt.Errorf("enabled must be bool, got %T", v)
    }
    return nil
}

func boolField(m map[string]any, key string) (bool, bool) {
    b, ok := m[key].(bool)
    return b, ok
}

When reading the unstructured config yourself, always two-value assert per field and emit a precise error instead of relying on the handler's 500.

When it happens

Trigger: An AuthConfig of type genericOIDCProvider whose genericoidcConfig.enabled is present but not a boolean — e.g. applied via kubectl as enabled: "true" (quoted) or enabled: 1, or written by automation that stringifies values. Every login redirect for that provider 500s.

Common situations: Hand-edited AuthConfig YAML quoting the bool; Helm/GitOps templating rendering booleans as strings; CRD schema drift that stopped enforcing boolean type; external tools writing config maps of values into the object.

Related errors

• Invalid PKCE method type
• Unsupported PKCE method. Supported methods: S256
• failed to transform auth config: %w
• Failed to get provider configuration
• Provider is disabled

AI-assisted analysis of rancher/rancher@932558d4e6 (2026-08-16). Data as JSON: /api/errors/b5219aaa37f40dd9. Report an issue: GitHub.