From b1582b3391a5845358c0a95d4c7d20a867d66f8f Mon Sep 17 00:00:00 2001
From: GatewayJ <835269233@qq.com>
Date: Fri, 3 Jul 2026 14:15:58 +0800
Subject: [PATCH] fix(iam): improve OIDC token exchange diagnostics (#4232)

---
 crates/iam/src/oidc.rs | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/crates/iam/src/oidc.rs b/crates/iam/src/oidc.rs
index be9e99ef8..08fe0183a 100644
--- a/crates/iam/src/oidc.rs
+++ b/crates/iam/src/oidc.rs
@@ -22,7 +22,8 @@ use crate::oidc_state::{OidcAuthSession, OidcLogoutSession, OidcStateStore};
 use openidconnect::core::{CoreAuthenticationFlow, CoreClient, CoreIdToken};
 use openidconnect::{
     AsyncHttpClient, Audience, AuthType, AuthorizationCode, ClientId, ClientSecret, CsrfToken, IssuerUrl, LogoutRequest, Nonce,
-    PkceCodeChallenge, PkceCodeVerifier, PostLogoutRedirectUrl, ProviderMetadataWithLogout, RedirectUrl, Scope,
+    PkceCodeChallenge, PkceCodeVerifier, PostLogoutRedirectUrl, ProviderMetadataWithLogout, RedirectUrl, RequestTokenError,
+    Scope,
 };
 use reqwest::Client;
 use rustfs_config::oidc::*;
@@ -569,7 +570,14 @@ impl OidcSys {
             .set_redirect_uri(Cow::Owned(redirect))
             .request_async(&self.http_client)
             .await
-            .map_err(|e| format!("token exchange failed: {e}"))?;
+            .map_err(|e| match &e {
+                RequestTokenError::Parse(parse_err, body) => format!(
+                    "token exchange failed: {e}: parse_error_path={}, response_body_len={}",
+                    parse_err.path(),
+                    body.len()
+                ),
+                _ => format!("token exchange failed: {e}"),
+            })?;
 
         // Verify the ID token (signature, issuer, audience, expiry, nonce)
         let id_token = token_response