chore(oidc error): expose actual error information #2172

kyle · 2026-08-23T19:41:59Z

kyle commented

2026-08-23 19:41:59 +00:00

This pull request exposes the actual error information behind the current generic OIDC "failed to parse" message:

 ERROR conduwuit_service::oidc: Failed to exchange OIDC authorization code: \n
-Failed to parse server response
+Failed to parse server response (Parse(Error { path: Path { segments: [] }, original: Error("Invalid JSON web token: found 5 parts (expected 3)", line: 1, column: 6188) }, [123, 34, ..., 34, 125]))
     at src/service/oidc/mod.rs:283 on conduwuit:worker ThreadId(7)
     in tower_sessions::service::call

This issue was created by my provider configuration, but made impossible to debug by swallowing error information even at TRACE log level.

Pull request checklist:

This pull request targets the main branch, and the branch is named something other than
main.
I have written an appropriate pull request title and my description is clear.
I understand I am responsible for the contents of this pull request.
I have followed the contributing guidelines:
- My contribution follows the code style, if applicable.
- I ran pre-commit checks before opening/drafting this pull request.
- I have tested my contribution (or proof-read it for documentation-only changes)
  myself, if applicable. This includes ensuring code compiles.
- My commit messages follow the commit message format and are descriptive.

This pull request exposes the actual error information behind the current generic OIDC "failed to parse" message: > ```diff > ERROR conduwuit_service::oidc: Failed to exchange OIDC authorization code: \n > -Failed to parse server response > +Failed to parse server response (Parse(Error { path: Path { segments: [] }, original: Error("Invalid JSON web token: found 5 parts (expected 3)", line: 1, column: 6188) }, [123, 34, ..., 34, 125])) > at src/service/oidc/mod.rs:283 on conduwuit:worker ThreadId(7) > in tower_sessions::service::call > ``` This issue was created by my provider configuration, but made impossible to debug by swallowing error information even at TRACE log level. **Pull request checklist:**  - [x] This pull request targets the `main` branch, and the branch is named something other than `main`. - [x] I have written an appropriate pull request title and my description is clear. - [x] I understand I am responsible for the contents of this pull request. - I have followed the [contributing guidelines][c1]: - [x] My contribution follows the [code style][c2], if applicable. - [x] I ran [pre-commit checks][c1pc] before opening/drafting this pull request. - [x] I have [tested my contribution][c1t] (or proof-read it for documentation-only changes) myself, if applicable. This includes ensuring code compiles. - [x] My commit messages follow the [commit message format][c1cm] and are descriptive. [c1]: https://forgejo.ellis.link/continuwuation/continuwuity/src/branch/main/CONTRIBUTING.md [c2]: https://forgejo.ellis.link/continuwuation/continuwuity/src/branch/main/docs/development/code_style.mdx [c1pc]: https://forgejo.ellis.link/continuwuation/continuwuity/src/branch/main/CONTRIBUTING.md#pre-commit-checks [c1t]: https://forgejo.ellis.link/continuwuation/continuwuity/src/branch/main/CONTRIBUTING.md#running-tests-locally [c1cm]: https://forgejo.ellis.link/continuwuation/continuwuity/src/branch/main/CONTRIBUTING.md#commit-messages

forgejo-actions added the

Changelog

Missing

label

2026-08-23 19:42:05 +00:00

kyle commented

2026-08-23 19:43:59 +00:00

For future readers (perhaps including myself):

Failed to exchange OIDC authorization code: Failed to parse server response

The cause of this error, in my case, was configuring a Authentik provider with both signing† and encryption‡.

Un-configuring the encryption key‡ (setting it to "-----") resolved this issue.

† OpenID provider > Signing Key
‡ OpenID provider > Advanced Protocol Settings > Encryption Key

_For future readers (perhaps including myself):_ > Failed to exchange OIDC authorization code: Failed to parse server response The cause of this error, in my case, was configuring a Authentik provider with **both** signing† and encryption‡. Un-configuring the encryption key‡ (setting it to "-----") resolved this issue. --- † OpenID provider > Signing Key ‡ OpenID provider > Advanced Protocol Settings > Encryption Key

Jade added

and removed

labels

2026-08-23 19:47:02 +00:00

nex reviewed

2026-08-23 20:38:18 +00:00

src/service/oidc/mod.rs Outdated

					
				@ -281,3 +281,3 @@

							.await

							.map_err(|err| {

								error!("Failed to exchange OIDC authorization code: {err}");

								error!("Failed to exchange OIDC authorization code: {err} ({:?})", err);

It might be cleaner to just

error!(error=?err, "Failed to exchange OIDC authorization code")

It might be cleaner to just ```rs error!(error=?err, "Failed to exchange OIDC authorization code") ```

👀 1

Yes it is, and still shows the error info

ERROR conduwuit_service::oidc: Failed to exchange OIDC authorization code, error: Parse(Error { path: Path { segments: [] }, original: Error("Invalid JSON web token: found 5 parts (expected 3)", line: 1, column: 6188) }, [123, 34, ..., 34, 125])
    at src/service/oidc/mod.rs:283 on conduwuit:worker ThreadId(3)
    in tower_sessions::service::call

Changing to this

Yes it is, and still shows the error info > ``` > ERROR conduwuit_service::oidc: Failed to exchange OIDC authorization code, error: Parse(Error { path: Path { segments: [] }, original: Error("Invalid JSON web token: found 5 parts (expected 3)", line: 1, column: 6188) }, [123, 34, ..., 34, 125]) > at src/service/oidc/mod.rs:283 on conduwuit:worker ThreadId(3) > in tower_sessions::service::call > ``` Changing to this

kyle marked this conversation as resolved