From 509a6708f0bda52e5562b06c790dad19a76a4b7c Mon Sep 17 00:00:00 2001 From: Mathias Mikkel Neerup Date: Fri, 10 Jul 2026 09:24:15 +0200 Subject: [PATCH] fix: surface Entra ID token endpoint errors in fetchToken Previously a non-2xx response from the token endpoint was silently parsed into an empty token, producing a misleading 'token response did not contain an id_token' error. Return the status code and error body instead. Signed-off-by: Mathias Mikkel Neerup --- providers/ms_entra_id.go | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/providers/ms_entra_id.go b/providers/ms_entra_id.go index 304c5a3a..e66c7f30 100644 --- a/providers/ms_entra_id.go +++ b/providers/ms_entra_id.go @@ -348,6 +348,14 @@ func (p *MicrosoftEntraIDProvider) fetchToken(ctx context.Context, params url.Va SetHeader("Content-Type", "application/x-www-form-urlencoded"). Do() + if err := resp.Error(); err != nil { + return nil, fmt.Errorf("token request failed: %v", err) + } + + if resp.StatusCode() < 200 || resp.StatusCode() >= 300 { + return nil, fmt.Errorf("token request returned %d: %s", resp.StatusCode(), string(resp.Body())) + } + var token *oauth2.Token var rawResponse interface{}