redis/node-redis · error · Error

Invalid authority configuration

Error message

Invalid authority configuration

What it means

Thrown by EntraIdCredentialsProviderFactory.getAuthority() in its default branch (entra-id-credentials-provider-factory.ts:257). AuthorityConfig is a TypeScript discriminated union of {type:'multi-tenant'}, {type:'custom'}, {type:'default'}; the default branch only fires when config.type is none of those. Under strict TypeScript this is prevented at compile time, so at runtime it implies the value bypassed the type system (any, JS caller, malformed config).

Source

Thrown at packages/entraid/lib/entra-id-credentials-provider-factory.ts:258

        return new EntraidCredentialsProvider(tm, idp, {
          onReAuthenticationError: params.onReAuthenticationError,
          credentialsMapper: params.credentialsMapper ?? DEFAULT_CREDENTIALS_MAPPER,
          onRetryableError: params.onRetryableError
        });
      }
    };
  }

  static getAuthority(config: AuthorityConfig): string {
    switch (config.type) {
      case 'multi-tenant':
        return `https://login.microsoftonline.com/${config.tenantId}`;
      case 'custom':
        return config.authorityUrl;
      case 'default':
        return 'https://login.microsoftonline.com/common';
      default:
        throw new Error('Invalid authority configuration');
    }
  }

}

export const REDIS_SCOPE_DEFAULT = 'https://redis.azure.com/.default';
export const REDIS_SCOPE = 'https://redis.azure.com'

export type AuthorityConfig =
  | { type: 'multi-tenant'; tenantId: string }
  | { type: 'custom'; authorityUrl: string }
  | { type: 'default' };

export type PKCEParams = {
  code: string;
  verifier: string;
  clientInfo?: string;
}

View on GitHub (pinned to bb5beb5657)

Solutions

1. Use one of the supported types: 'default', { type:'multi-tenant', tenantId }, or { type:'custom', authorityUrl }.
2. If you have a tenant id, prefer { type:'multi-tenant', tenantId } which builds https://login.microsoftonline.com/<tenantId>.
3. Validate the type field at the config-loading boundary before passing it in.
4. If calling from JS, add a runtime check matching the union.

Example fix

// before
authorityConfig: { type: 'organizations' }
// after
authorityConfig: { type: 'multi-tenant', tenantId: process.env.MSAL_TENANT_ID }

function buildAuthorityConfig(raw) {
  if (raw === undefined) return { type: 'default' };
  if (raw.type === 'default') return { type: 'default' };
  if (raw.type === 'multi-tenant' && raw.tenantId) return { type: 'multi-tenant', tenantId: raw.tenantId };
  if (raw.type === 'custom' && raw.authorityUrl) return { type: 'custom', authorityUrl: raw.authorityUrl };
  throw new Error('Unsupported authority config: ' + JSON.stringify(raw));
}

function isAuthorityConfig(c: unknown): c is
  | { type: 'default' }
  | { type: 'multi-tenant'; tenantId: string }
  | { type: 'custom'; authorityUrl: string } {
  if (typeof c !== 'object' || c === null) return false;
  const t = (c as any).type;
  if (t === 'default') return true;
  if (t === 'multi-tenant') return typeof (c as any).tenantId === 'string';
  if (t === 'custom') return typeof (c as any).authorityUrl === 'string';
  return false;
}

try {
  const provider = EntraIdCredentialsProviderFactory.createForClientCredentials({ ...params, authorityConfig });
} catch (e) {
  if (e instanceof Error && /Invalid authority configuration/.test(e.message)) {
    // authorityConfig.type is wrong; fall back to { type: 'default' }
  }
  throw e;
}

When it happens

Trigger: Passing authorityConfig = { type: 'organizations' } or any unrecognized type literal; calling getAuthority from JavaScript without types; loading authority config from a JSON/env source that produced a different type string.

Common situations: Hard-coding an authority type copied from MSAL/Azure docs (e.g. 'organizations', 'single-tenant') that is not part of this library's AuthorityConfig union; env-driven config that defaults to an undefined type.

Related errors

• Reconnect strategy should return `false | Error | number`, g
• invalid sentinelClientOptions for Sentinel
• Invalid token response
• SESSION_SECRET environment variable must be set
• MSAL_CLIENT_ID and MSAL_TENANT_ID environment variables must

AI-assisted analysis of redis/node-redis@bb5beb5657 (2026-08-03). Data as JSON: /data/errors/9283ac9ba7b763da.json. Report an issue: GitHub.