401 UNAUTHORIZED: Failed to Load Server Config due to Expired Refresh JWT Token

Problem

The error "Failed to load server config: Unexpected error" is occurring, and the logs indicate the following message:

Authentication provider returned 401 UNAUTHORIZED: {"type":"about:blank","title":"Unauthorized","status":401,"detail":"Refresh token is expired","instance":"/api/auth/internal/token","buildNumber":"2025.6.4.6733"}

Cause

The issue originates from an expired refresh JWT token issued by the internal authorization server: "Refresh token is expired","instance":"/api/auth/internal/token". As per the configuration, the refresh token has a lifetime of 30 days. After this period, a re-authentication through the SAML provider is mandatory.

 internal-tokens:
      token-life: 30m
      refresh-token-life: 30d
      private-key: |
        <private_key_pkcs8.pem>
      public-key: |
        <public_key.pem>

Resolution

To resolve this issue, follow these steps:

1. Re-login through the SAML provider to generate a new session and refresh token.
2. Optionally, clear the existing IDE Services session/auth data.

If possible, consider extending the refresh-token-life setting to reduce the frequency of re-authentication, depending on your organization's security compliance (e.g., refresh-token-life: 90d).

If the issue persists after performing the steps above and a fresh login, please provide the server logs during the issue reproduction to help further troubleshooting.

For additional references:

• SAML Configuration Guide
• Log Collection