xai-org/grok-build · error · OidcError

OidcError::NotConfigured

Error message

OidcError::NotConfigured

What it means

`run_login_flow` requires the GrokComConfig to carry an OIDC configuration block. This error is thrown when `config.oidc` is None — OIDC login was requested but never configured, so there is no issuer/client_id to drive discovery and the authorize URL.

Source

Thrown at crates/codegen/xai-grok-shell/src/auth/oidc/login.rs:356

            anyhow::Error::new(OidcError::CallbackChannelClosed)
        })?;

    let _ = shutdown_tx.send(());
    let _ = server.await;

    result.map_err(|e| anyhow::Error::new(OidcError::CallbackAuthFailed(e)))
}

/// Run the full OIDC login flow: discovery → PKCE → browser → callback → token exchange → persist.
pub async fn run_login_flow(
    config: &GrokComConfig,
    auth_manager: &Arc<AuthManager>,
    channels: Option<super::super::flow::AuthChannels>,
) -> anyhow::Result<(GrokAuth, bool)> {
    let oidc = config
        .oidc
        .as_ref()
        .ok_or_else(|| anyhow::Error::new(OidcError::NotConfigured))?;
    run_login_flow_with_config(oidc, auth_manager, channels).await
}

/// Run the OIDC login flow with an explicit [`OidcAuthConfig`].
///
/// Also used by the OAuth2 provider path via [`OAuth2ProviderConfig::as_oidc`].
///
/// The flow races two input paths:
///   - **Path A**: A loopback HTTP server on `127.0.0.1` that receives the IdP redirect.
///   - **Path B**: Stdin paste — the user manually pastes the callback URL or bare auth code.
///
/// Path B is essential for remote VMs where the browser runs on a different machine
/// and the `127.0.0.1` redirect cannot reach the CLI process.
/// * `channels` — `Some`: pushes the auth URL to the TUI and receives pasted codes.
///   `None`: prints to stderr / reads stdin (CLI mode).
pub async fn run_login_flow_with_config(
    oidc: &OidcAuthConfig,
    auth_manager: &Arc<AuthManager>,

View on GitHub (pinned to bc7f02eddd)

Solutions

  1. Add the `oidc` section (issuer, client_id, etc.) to your GrokComConfig / config file before logging in.
  2. Run the provider's setup/config command to generate the OIDC configuration.
  3. Check for config key typos or a wrong config file path being loaded (verify which file the tool actually reads).
  4. If you intend non-OIDC auth (API key), use the appropriate login/auth path instead of run_login_flow.

Example fix

// before: config without oidc
let cfg = GrokComConfig { oidc: None, .. };
// after
let cfg = GrokComConfig {
    oidc: Some(OidcAuthConfig {
        issuer: "https://idp.example.com".into(),
        client_id: "my-client".into(),
        ..Default::default()
    }),
    ..
};
Defensive patterns

Strategy: validation

Validate before calling

// run before calling run_login_flow
if config.oidc.is_none() {
    return Err(anyhow!(
        "OIDC is not configured: add the [oidc] section (issuer, client_id) to your config"
    ));
}

Type guard

fn is_not_configured(err: &anyhow::Error) -> bool {
    err.downcast_ref::<OidcError>()
        .map_or(false, |e| matches!(e, OidcError::NotConfigured))
}

Try / catch

match run_login_flow(config, auth_manager, channels).await {
    Err(e) if is_not_configured(&e) => {
        eprintln!("OIDC not configured. Run the setup command or add the oidc block to your config file.");
    }
    other => other?,
}

Prevention

When it happens

Trigger: Calling run_login_flow (or the CLI login command) with a GrokComConfig whose `oidc` field is None — `config.oidc.as_ref().ok_or_else(|| OidcError::NotConfigured)?` fires immediately, before any network activity.

Common situations: Fresh install without running OIDC setup; config file missing the [oidc] section; typo in config key so it fails to deserialize into `oidc`; environment where only API-key auth is configured; using the OAuth2 provider path without as_oidc mapping present.

Related errors

AI-assisted analysis of xai-org/grok-build@bc7f02eddd (2026-08-31). Data as JSON: /api/errors/43d0fb082ba6ae2c. Report an issue: GitHub.