Expand description
The one response shape for “the node could not do its job because the
identity/authorization provider it depends on failed” — discovery, JWKS,
introspection, token endpoint, CAS /serviceValidate, an LDAP bind
transport error, a Keycloak/Casdoor callout.
Such a failure is not an authentication or authorization decision, so
it must not look like one: a 502 with {"error": "provider_error"} and
no WWW-Authenticate challenge, exiting through the node’s error port.
Before this helper each plugin mirrored its own denied shape (401 unauthorized + challenge, or 403 access_denied), which made an IdP
outage indistinguishable from a rejected credential — to API clients and,
for the interactive plugins, to browser users who saw “unauthorized”
instead of a login redirect.
Functions§
- provider_
error - Prepares the provider-failure response on
ctxand wraps it in theErrthe graph engine routes through the node’serrorport.