[SearchPrincipals] no authProvider specified in token

Error message

[SearchPrincipals] no authProvider specified in token

What it means

SearchPrincipals dispatches the search to the auth provider recorded on the caller's token (myToken.GetAuthProvider()). If that field is empty the function cannot decide which backend to search and returns this error immediately. Tokens that carry no authProvider include API bearer tokens and other tokens minted outside a provider login flow.

Source

Thrown at pkg/auth/providers/providers.go:189

	principal, err := p.GetPrincipal(principalID, myToken)
	if err != nil && myToken.GetAuthProvider() != local.Name {
		p2, e2 := lp.GetPrincipal(principalID, myToken)
		if e2 == nil {
			return p2, nil
		}
	}

	return principal, err
}

// SearchPrincipals searches for principals by name using the token's auth
// provider, appending the local results so that users who can log in locally
// remain findable under any provider.
func SearchPrincipals(name, principalType string, myToken accessor.TokenAccessor) ([]apiv3.Principal, error) {
	ap := myToken.GetAuthProvider()
	if ap == "" {
		return []apiv3.Principal{}, fmt.Errorf("[SearchPrincipals] no authProvider specified in token")
	}

	mu.RLock()
	p := providers[ap]
	lp := providers[local.Name]
	mu.RUnlock()

	if p == nil {
		return []apiv3.Principal{}, fmt.Errorf("[SearchPrincipals] authProvider %v not initialized", ap)
	}
	principals, err := p.SearchPrincipals(name, principalType, myToken)
	if err != nil {
		return principals, err
	}
	if ap != local.Name && lp != nil {
		localPrincipals, err := lp.SearchPrincipals(name, principalType, myToken)
		if err != nil {
			return principals, err

View on GitHub (pinned to 932558d4e6)

Solutions

Authenticate with a token produced by an actual provider login (including local login, which sets authProvider="local") instead of an API bearer token.
Inspect the token (kubectl get secret -n cattle-system or the tokens management resource) and confirm its authProvider field is populated.
If you own the caller, short-circuit: when myToken.GetAuthProvider() is empty, search only the local provider instead of erroring.

Example fix

// before
principals, err := providers.SearchPrincipals(name, userType, myToken)

// after
if ap := myToken.GetAuthProvider(); ap == "" {
    local, err := providers.GetProvider(local.Name)
    if err != nil {
        return nil, err
    }
    return local.SearchPrincipals(name, userType, myToken)
}
principals, err := providers.SearchPrincipals(name, userType, myToken)

Defensive patterns

Strategy: validation

Validate before calling

if myToken.GetAuthProvider() == "" {
    // token has no provider context (API key, system token)
    lp, err := providers.GetProvider(local.Name)
    if err != nil {
        return nil, err
    }
    return lp.SearchPrincipals(name, principalType, myToken)
}
return providers.SearchPrincipals(name, principalType, myToken)

Try / catch

principals, err := providers.SearchPrincipals(name, principalType, myToken)
if err != nil && strings.Contains(err.Error(), "no authProvider specified in token") {
    // caller context lacks a provider: retry scoped to local
    lp, lerr := providers.GetProvider(local.Name)
    if lerr != nil {
        return nil, err
    }
    return lp.SearchPrincipals(name, principalType, myToken)
}

Prevention

Drive principal-search APIs with tokens obtained through a provider login (including local), not API bearer keys.
When minting custom tokens, always populate the authProvider attribute.
Wrap search endpoints with a pre-check on GetAuthProvider() and a documented fallback policy.

When it happens

Trigger: Calling the principal-search path (e.g. GET /v3/principals?action=search with a search term) while authenticating with a Rancher API key/bearer token whose authProvider attribute is empty, or any token created programmatically (kubectl-style kubeconfig token, system token) that never went through an auth provider login.

Common situations: Scripts or CI using personal API keys to drive user/group search; tooling that authenticates with a service token; a login flow that failed to stamp authProvider on the minted token.

Related errors

AI-assisted analysis of rancher/rancher@932558d4e6 (2026-08-16). Data as JSON: /api/errors/f9ac66392960b77b. Report an issue: GitHub.