Kong OIDC Auth Returns Invalid Issuer

You encounter a kong configuration issue that prevents your workflow from completing. This guide walks through the fix step by step.

Wrong ❌

curl -X POST http://localhost:8001/routes/my-route/plugins --data "name=oidc" --data "config.client_id=my-client" --data "config.client_secret=my-secret" --data "config.discovery=https://auth.example.com/.well-known/openid-configuration"

Wrong Output

OIDC auth returns infinite redirect loop or "invalid issuer" error. Token validation fails.

Right ✅

curl -X POST http://localhost:8001/routes/my-route/plugins --data "name=oidc" --data "config.client_id=my-client" --data "config.client_secret=my-secret" --data "config.discovery=https://auth.example.com/.well-known/openid-configuration" --data "config.ssl_verify=false" --data "config.redirect_uri=https://kong.example.com/oidc/callback" --data "config.scope=openid,profile,email" --data "config.session_secret=$(openssl rand -hex 32)" --data "config.auth_methods=bearer"

Right Output

OIDC auth working. Users redirected to login, authenticated, then routes accessible.

Prevention

• Verify the discovery URL returns valid OIDC metadata.
• Set the correct redirect_uri matching Kong's exposed URL.
• Generate a strong session_secret for session encryption.
• Use bearer auth method for APIs, authorization_code for browser flows.
• Set ssl_verify=false only in dev - always use HTTPS in prod.

DodaTech applies similar defensive patterns across Doda Browser, DodaZIP, and Durga Antivirus Pro infrastructure for production reliability.

Common Mistakes with oidc auth

1. Forgetting that lazy evaluation defers computation until the value is forced, causing space leaks with unevaluated thunks
2. Using return to exit a function early instead of wrapping a pure value in the monad
3. Mixing let bindings with <- bindings in do notation, producing type errors

These mistakes appear frequently in real-world KONG code. DodaTech's contributors have identified these patterns through analysis of open-source projects and production systems.

Practice Exercise

Write a pure function that safely divides two integers using Maybe, then test it with edge cases like division by zero and negative numbers.

This exercise reinforces the concepts covered in this guide. Try implementing it before checking online solutions.

FAQ

This quick fix is part of the DodaTech infrastructure engineering series. Learn more at DodaTech tutorials.