Follow the evidence.

Protocol

OpenID Connect

Flow

Authorization code + PKCE

Symptom

Users sign in at the provider, return to /callback, and see a generic error. Began after moving the RP to a new tenant configuration.

Exact error

id_token validation failed: unexpected iss

Recent changes

Issuer URL configured manually in the RP during tenant migration.

# Authorization request (sanitized)
GET https://login.example.test/tenant-a/authorize
  ?response_type=code
  &client_id=rp-portal
  &redirect_uri=https://portal.example.test/callback
  &scope=openid%20profile%20email
  &state=st_3b81
  &nonce=n_9c2e
  &code_challenge_method=S256

# Discovery document (excerpt)
{ "issuer": "https://login.example.test/tenant-a",
  "jwks_uri": "https://login.example.test/tenant-a/keys" }

# Decoded ID token claims (signature removed)
{
  "iss": "https://login.example.test/tenant-a/",
  "aud": "rp-portal",
  "sub": "u_51f0",
  "iat": 1792418400,
  "exp": 1792422000,
  "email": "j.doe@example.test"
}

# RP log (sanitized)
ERROR oidc.callback id_token validation failed: unexpected iss