Tencent/WeKnora · error

OIDC login is disabled

Error message

OIDC login is disabled

What it means

Raised in getOIDCConfig when s.config is nil or OIDC auth is not configured/enabled — an OIDC login (authorization URL generation or LoginWithOIDC) was attempted while OIDC login is disabled for the deployment. Feature-flag guard; callers surface 400/403.

Source

Thrown at internal/application/service/user.go:1462

func validateOIDCEndpoints(cfg *config.OIDCAuthConfig) error {
	if err := validateOIDCEndpoint("authorization", cfg.AuthorizationEndpoint, true); err != nil {
		return err
	}
	if err := validateOIDCEndpoint("token", cfg.TokenEndpoint, true); err != nil {
		return err
	}
	if err := validateOIDCEndpoint("userinfo", cfg.UserInfoEndpoint, false); err != nil {
		return err
	}
	if err := validateOIDCEndpoint("jwks", cfg.JwksURI, false); err != nil {
		return err
	}
	return nil
}

func (s *userService) getOIDCConfig(ctx context.Context) (*config.OIDCAuthConfig, error) {
	if s.config == nil || s.config.OIDCAuth == nil || !s.config.OIDCAuth.Enable {
		return nil, errors.New("OIDC login is disabled")
	}
	cfg := *s.config.OIDCAuth
	if cfg.UserInfoMapping == nil {
		cfg.UserInfoMapping = &config.OIDCUserInfoMapping{Username: "name", Email: "email"}
	}
	if err := s.populateOIDCEndpoints(ctx, &cfg); err != nil {
		return nil, err
	}
	return &cfg, nil
}

func oidcNeedsDiscovery(cfg *config.OIDCAuthConfig) bool {
	return strings.TrimSpace(cfg.AuthorizationEndpoint) == "" ||
		strings.TrimSpace(cfg.TokenEndpoint) == "" ||
		strings.TrimSpace(cfg.JwksURI) == "" ||
		strings.TrimSpace(cfg.IssuerURL) == ""
}

View on GitHub (pinned to 988cbb0330)

Solutions

1. Enable and configure OIDC in the deployment config before using OIDC login
2. Fall back to password login for this deployment

When it happens

Trigger: Thrown at internal/application/service/user.go:1462 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/1209162da1ca5e42. Report an issue: GitHub.