[OmniAuth] Skipping OIDC provider '#

Error message

[OmniAuth] Skipping OIDC provider '#{name}' - missing required configuration

What it means

Startup warning from config/initializers/omniauth.rb (line 44): for a provider configured with strategy openid_connect, Oidc::ProviderOptionsBuilder.call(cfg) returned an empty/nil options hash — required OIDC configuration (discovery/issuer, client_id, client_secret, etc.) is missing from the providers config. The provider is then skipped (next), so it does not appear in OmniAuth, auth.oidc_enabled is NOT set true, and no SSO button is rendered for it. Other providers in the list still load.

Solutions

Compare the skipped provider's config against the OIDC provider template/docs and fill the required keys (issuer/discovery, client_id, client_secret) or their ENV equivalents.
Check the boot log for the exact provider name in the warning — only that one is skipped; fix and reboot to register it.
After fixing, verify auth.oidc_enabled became true and the provider shows in sso_providers (login page).
If the provider was meant to be disabled, remove its stanza entirely so the warning noise goes away.

Example fix

// before
# providers.yml entry missing secret -> '[OmniAuth] Skipping OIDC provider acme...'
- id: acme
  strategy: openid_connect
  issuer: https://sso.acme.test

// after
- id: acme
  strategy: openid_connect
  issuer: https://sso.acme.test
  client_id: <%= ENV['ACME_CLIENT_ID'] %>
  client_secret: <%= ENV['ACME_CLIENT_SECRET'] %>

Defensive patterns

Strategy: validation

Validate before calling

cfg = provider_config.deep_symbolize_keys
required = %i[issuer client_id client_secret]
missing = required.reject { |k| cfg[k].present? || ENV[k.to_s.upcase].present? }
Rails.logger.warn("#{cfg[:id]}: missing #{missing.join(', ')}") if missing.any?

Type guard

oidc_options = Oidc::ProviderOptionsBuilder.call(cfg)
oidc_options.present? # falsy means the provider will be skipped

Prevention

Validate provider stanzas with a boot check or spec asserting Oidc::ProviderOptionsBuilder.call(cfg).present? for each openid_connect entry.
Mirror required keys in an example config and in deployment docs for self-hosters.
After config changes, confirm the login page shows every intended SSO button; a missing one usually means this warning fired at boot.

When it happens

Trigger: Declaring an openid_connect provider in the providers config (providers.yml or equivalent loaded via ProviderLoader) whose entry lacks required keys — e.g. missing client_id/secret with no ENV fallback, missing issuer or discovery URL — so the options builder yields nothing at boot.

Common situations: Self-hosted admins enabling SSO with a partially filled provider stanza; renaming config keys (client-id vs client_id) so the builder reads nils; forgetting to set the OIDC client secret env var referenced by the config.

Related errors

AI-assisted analysis of we-promise/sure@e69894adb9 (2026-08-21). Data as JSON: /api/errors/fd8209056ff479ce. Report an issue: GitHub.

Appendix: source

Thrown at config/initializers/omniauth.rb:44

  Rack::Response.new([ "302 Moved" ], 302, "Location" => "/auth/failure?message=#{message}&strategy=#{strategy&.name}").finish
end

Rails.application.config.middleware.use OmniAuth::Builder do
  # Load providers from either YAML or DB via ProviderLoader
  providers = ProviderLoader.load_providers

  providers.each do |raw_cfg|
    cfg = raw_cfg.deep_symbolize_keys
    strategy = cfg[:strategy].to_s
    name = (cfg[:name] || cfg[:id]).to_s

    case strategy
    when "openid_connect"
      oidc_options = Oidc::ProviderOptionsBuilder.call(cfg)

      unless oidc_options.present?
        Rails.logger.warn("[OmniAuth] Skipping OIDC provider '#{name}' - missing required configuration")
        next
      end

      provider :openid_connect, oidc_options

      Rails.configuration.x.auth.oidc_enabled = true
      Rails.configuration.x.auth.sso_providers << cfg.merge(name: name, issuer: oidc_options[:issuer])

    when "google_oauth2"
      client_id = cfg[:client_id].presence || ENV["GOOGLE_OAUTH_CLIENT_ID"].presence
      client_secret = cfg[:client_secret].presence || ENV["GOOGLE_OAUTH_CLIENT_SECRET"].presence

      # Test environment fallback
      if Rails.env.test?
        client_id ||= "test_client_id"
        client_secret ||= "test_client_secret"
      end

View on GitHub (pinned to e69894adb9)