Skip to content

Identity Provider Unavailable

URI: https://docs.ankatech.co/errors/idp-unavailable
HTTP Status: 503 Service Unavailable

When you see this

A live connectivity probe to an external identity provider failed during a self-test. This is a transient connectivity condition about a provider that is configured, which is what separates it from idp-not-bound — that one means the provider is not activated at all.

Common Causes

  • The OIDC discovery document is unreachable, times out, or is not parseable.
  • The discovery document's issuer does not match the configured issuer.
  • The discovery document is incomplete — one of the endpoints the login path needs is missing.
  • SAML metadata is unreachable or unparseable, carries no X.509 certificate, or its signing certificate is not currently valid.
  • The LDAP bind or search against the configured directory failed.
  • A probe step returned an empty body.
  • The provider's stored secret could not be opened from custody.

Response Example

{
  "type": "https://docs.ankatech.co/errors/idp-unavailable",
  "title": "Identity Provider Unavailable",
  "status": 503,
  "detail": "The identity provider could not be reached during the self-test. Verify connectivity and retry.",
  "instance": "/api/v3/admin/platform/idp/3f2504e0-4f89-11d3-9a0c-0305e82c3301/test",
  "timestamp": 1730000000,
  "extensions": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

Content-Type: application/problem+json — the response follows RFC 9457 Problem Details.

The detail is a fixed sentence and is the same for every cause above. The specific cause — the target host, the timeout, the TLS error, the missing endpoint — is written to the server log only, so the response cannot be used to enumerate internal hosts.

How to Resolve

  1. Read the server log for this correlation id: it names the actual probe step and cause, which the response body deliberately does not.
  2. Verify network reachability from the platform to the provider's discovery, metadata or LDAP endpoint.
  3. For OIDC, confirm the discovery document's issuer matches the value configured here and that it publishes every endpoint the login path needs.
  4. For SAML, confirm the metadata is reachable and its signing certificate is currently valid.
  5. Re-run the self-test.

For full schema definitions, examples, and interactive testing, see the Developer Hub Reference.