theonedev/onedev · error · ExplicitException

Client secret needs to be specified to generate refresh toke

Error message

Client secret needs to be specified to generate refresh token

What it means

Office365Connector's refresh-token callback next validates the clientSecret input. The Microsoft OAuth authorization-code flow requires the app's client secret credential, so a null value raises an ExplicitException.

Source

Thrown at server-plugin/server-plugin-mail-office365/src/main/java/io/onedev/server/plugin/mail/office365/Office365Connector.java:168

	public void setTimeout(int timeout) {
		this.timeout = timeout;
	}

	private static String getTokenEndpoint(String tenantId) {
		return String.format("https://login.microsoftonline.com/%s/oauth2/v2.0/token", tenantId);
	}

	@SuppressWarnings("unused")
	private static RefreshToken.Callback getRefreshTokenCallback() {
		String tenantId = (String) EditContext.get().getInputValue("tenantId");
		if (tenantId == null)
			throw new ExplicitException("Directory (tenant) ID needs to be specified to generate refresh token");
		String clientId = (String) EditContext.get().getInputValue("clientId");
		if (clientId == null)
			throw new ExplicitException("Application (client) ID needs to be specified to generate refresh token");
		String clientSecret = (String) EditContext.get().getInputValue("clientSecret");
		if (clientSecret == null)
			throw new ExplicitException("Client secret needs to be specified to generate refresh token");

		String userPrincipalName = (String) EditContext.get().getInputValue("userPrincipalName");
		if (userPrincipalName == null)
			throw new ExplicitException("User principal name needs to be specified to generate refresh token");

		Collection<String> scopes = Lists.newArrayList(
				"https://outlook.office.com/SMTP.Send",
				"https://outlook.office.com/IMAP.AccessAsUser.All",
				"offline_access");

		String authorizeEndpoint = String.format(
				"https://login.microsoftonline.com/%s/oauth2/v2.0/authorize", tenantId);
		String tokenEndpoint = getTokenEndpoint(tenantId);

		return new RefreshToken.Callback() {

			@Override
			public String getAuthorizeEndpoint() {

View on GitHub (pinned to d44925c47c)

Solutions

Create a new client secret in Azure Portal (App registration -> Certificates & secrets) and paste it into the form.
Check the existing secret's expiry and regenerate if expired.
Complete all connector fields before clicking generate refresh token.

Example fix

// before
clientSecret = null;
// after
clientSecret = "abc123~xxxxxxxxxxxxxxxxxxxxx";

Defensive patterns

Strategy: validation

Validate before calling

if (!clientSecret || clientSecret.trim() === "") throw new Error("Fill Client secret before generating refresh token");

Try / catch

try {
    generateRefreshToken();
} catch (ExplicitException e) {
    alert("Complete the connector form first: " + e.getMessage());
}

Prevention

Create a client secret under Certificates & secrets in Azure before configuring.
Track secret expiry and rotate before it lapses.
Fill all app credential fields before clicking generate.

When it happens

Trigger: Generating a refresh token with tenantId and clientId filled but the 'Client secret' input empty in the Office365 connector form.

Common situations: Azure app has no client secret created under 'Certificates & secrets'; secret expired and was cleared; user thinks only public-client flow (no secret) is used.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/97fac30f53482f68. Report an issue: GitHub.