we-promise/sure · warning

[OmniAuth] Skipping OIDC provider '#{name}' - missing requir

Error message

[OmniAuth] Skipping OIDC provider '#{name}' - missing required configuration

What it means

Startup warning from config/initializers/omniauth.rb (line 44): for a provider configured with strategy openid_connect, Oidc::ProviderOptionsBuilder.call(cfg) returned an empty/nil options hash — required OIDC configuration (discovery/issuer, client_id, client_secret, etc.) is missing from the providers config. The provider is then skipped (next), so it does not appear in OmniAuth, auth.oidc_enabled is NOT set true, and no SSO button is rendered for it. Other providers in the list still load.

Source

Thrown at config/initializers/omniauth.rb:44

  Rack::Response.new([ "302 Moved" ], 302, "Location" => "/auth/failure?message=#{message}&strategy=#{strategy&.name}").finish
end

Rails.application.config.middleware.use OmniAuth::Builder do
  # Load providers from either YAML or DB via ProviderLoader
  providers = ProviderLoader.load_providers

  providers.each do |raw_cfg|
    cfg = raw_cfg.deep_symbolize_keys
    strategy = cfg[:strategy].to_s
    name = (cfg[:name] || cfg[:id]).to_s

    case strategy
    when "openid_connect"
      oidc_options = Oidc::ProviderOptionsBuilder.call(cfg)

      unless oidc_options.present?
        Rails.logger.warn("[OmniAuth] Skipping OIDC provider '#{name}' - missing required configuration")
        next
      end

      provider :openid_connect, oidc_options

      Rails.configuration.x.auth.oidc_enabled = true
      Rails.configuration.x.auth.sso_providers << cfg.merge(name: name, issuer: oidc_options[:issuer])

    when "google_oauth2"
      client_id = cfg[:client_id].presence || ENV["GOOGLE_OAUTH_CLIENT_ID"].presence
      client_secret = cfg[:client_secret].presence || ENV["GOOGLE_OAUTH_CLIENT_SECRET"].presence

      # Test environment fallback
      if Rails.env.test?
        client_id ||= "test_client_id"
        client_secret ||= "test_client_secret"
      end

View on GitHub (pinned to e69894adb9)

Solutions

1. Compare the skipped provider's config against the OIDC provider template/docs and fill the required keys (issuer/discovery, client_id, client_secret) or their ENV equivalents.
2. Check the boot log for the exact provider name in the warning — only that one is skipped; fix and reboot to register it.
3. After fixing, verify auth.oidc_enabled became true and the provider shows in sso_providers (login page).
4. If the provider was meant to be disabled, remove its stanza entirely so the warning noise goes away.

Example fix

// before
# providers.yml entry missing secret -> '[OmniAuth] Skipping OIDC provider acme...'
- id: acme
  strategy: openid_connect
  issuer: https://sso.acme.test

// after
- id: acme
  strategy: openid_connect
  issuer: https://sso.acme.test
  client_id: <%= ENV['ACME_CLIENT_ID'] %>
  client_secret: <%= ENV['ACME_CLIENT_SECRET'] %>

cfg = provider_config.deep_symbolize_keys
required = %i[issuer client_id client_secret]
missing = required.reject { |k| cfg[k].present? || ENV[k.to_s.upcase].present? }
Rails.logger.warn("#{cfg[:id]}: missing #{missing.join(', ')}") if missing.any?

oidc_options = Oidc::ProviderOptionsBuilder.call(cfg)
oidc_options.present? # falsy means the provider will be skipped

When it happens

Trigger: Declaring an openid_connect provider in the providers config (providers.yml or equivalent loaded via ProviderLoader) whose entry lacks required keys — e.g. missing client_id/secret with no ENV fallback, missing issuer or discovery URL — so the options builder yields nothing at boot.

Common situations: Self-hosted admins enabling SSO with a partially filled provider stanza; renaming config keys (client-id vs client_id) so the builder reads nils; forgetting to set the OIDC client secret env var referenced by the config.

Related errors

• [OmniAuth] Skipping SAML provider '#{name}' - missing IdP co
• No SSO providers enabled; check auth.yml / ENV configuration
• [SSL] WARNING: SSL verification is DISABLED
• Auth config not loaded: #{e.class} - #{e.message}
• {result.error}

AI-assisted analysis of we-promise/sure@e69894adb9 (2026-08-21). Data as JSON: /api/errors/fd8209056ff479ce. Report an issue: GitHub.