{"record":{"id":"6677f3f66bec3f17","repo":"siyuan-note/siyuan","slug":"oidc-login-requires-at-least-one-claim-rule-when-a","errorCode":null,"errorMessage":"OIDC login requires at least one claim rule when Allow all users is disabled","messagePattern":"OIDC login requires at least one claim rule when Allow all users is disabled","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"kernel/model/oidc.go","lineNumber":536,"sourceCode":"\tif config.Provider == conf.OIDCProviderGitHub && config.ClientSecret == \"\" {\n\t\treturn errors.New(\"GitHub OAuth client secret is required\")\n\t}\n\tif (config.Provider == conf.OIDCProviderCustom || config.Provider == conf.OIDCProviderMicrosoft) && config.IssuerURL == \"\" {\n\t\treturn errors.New(\"OIDC issuer URL is required\")\n\t}\n\tif (config.Provider == conf.OIDCProviderCustom || config.Provider == conf.OIDCProviderMicrosoft) && config.IssuerURL != \"\" {\n\t\tissuer, err := url.Parse(config.IssuerURL)\n\t\tif err != nil || issuer.Host == \"\" || issuer.User != nil || issuer.RawQuery != \"\" || issuer.Fragment != \"\" ||\n\t\t\t(issuer.Scheme != \"https\" && !util.IsLocalHostname(issuer.Hostname())) {\n\t\t\treturn errors.New(\"OIDC issuer URL must use HTTPS unless it is a loopback address\")\n\t\t}\n\t}\n\tif config.Provider != conf.OIDCProviderCustom && config.Provider != conf.OIDCProviderGoogle &&\n\t\tconfig.Provider != conf.OIDCProviderMicrosoft && config.Provider != conf.OIDCProviderGitHub {\n\t\treturn errors.New(\"Unsupported OIDC provider\")\n\t}\n\tif !config.AllowAll && len(config.ClaimRules) == 0 {\n\t\treturn errors.New(\"OIDC login requires at least one claim rule when Allow all users is disabled\")\n\t}\n\tfor _, rule := range config.ClaimRules {\n\t\tif rule == nil || rule.Claim == \"\" || len(rule.Values) == 0 {\n\t\t\treturn errors.New(\"OIDC claim rules must include a claim and at least one value\")\n\t\t}\n\t\tif rule.Operator != conf.OIDCClaimOperatorEquals && rule.Operator != conf.OIDCClaimOperatorContains {\n\t\t\treturn errors.New(\"Unsupported OIDC claim rule operator\")\n\t\t}\n\t\tfor _, value := range rule.Values {\n\t\t\tif value == \"\" {\n\t\t\t\treturn errors.New(\"OIDC claim rule values cannot be empty\")\n\t\t\t}\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc ValidateOIDCMobileConfiguration(config *conf.OIDC) error {","sourceCodeStart":518,"sourceCodeEnd":554,"githubUrl":"https://github.com/siyuan-note/siyuan/blob/251596fc0de2f9528c00c224252fd073a99973f4/kernel/model/oidc.go#L518-L554","documentation":"Seventh check in ValidateOIDCConfiguration (kernel/model/oidc.go:536): AllowAll is false and ClaimRules is empty. SiYuan refuses to enable OIDC without an authorization policy — either allow everyone (AllowAll=true) or restrict via at least one claim rule (e.g. group == 'siyuan-users').","triggerScenarios":"Saving an enabled OIDC config with Allow all users off but no claim rules configured, which would otherwise let any valid IdP account into the workspace.","commonSituations":"Admin enables OIDC, restricts access, but forgets to add a claim rule; or a default config template ships with AllowAll=false and an empty rules slice.","solutions":["Add at least one claim rule (e.g. claim='groups', operator='equals', values=['admins']) before saving.","Or set AllowAll=true if every IdP user should be admitted (not recommended for public IdPs).","Use the OIDC test/login flow in settings to confirm a real user matches the rule."],"exampleFix":"// before\ncfg := &conf.OIDC{Enabled: true, AllowAll: false, ClaimRules: nil}\n// after — restrict by group claim\ncfg.ClaimRules = []*conf.OIDCClaimRule{{\n    Claim: \"groups\", Operator: conf.OIDCClaimOperatorEquals, Values: []string{\"siyuan-users\"},\n}}","handlingStrategy":"validation","validationCode":"if !cfg.AllowAll && len(cfg.ClaimRules) == 0 {\n    return errors.New(\"add a claim rule or set AllowAll=true\")\n}\nreturn ValidateOIDCConfiguration(cfg)","typeGuard":"func authzPolicyPresent(c *conf.OIDC) bool {\n    return c.AllowAll || len(c.ClaimRules) > 0\n}","tryCatchPattern":null,"preventionTips":["Always pair 'restrict access' with at least one concrete claim rule.","Prefer claim-rule scoping over AllowAll for any non-trivial IdP."],"tags":["oidc","authorization","claim-rules","config","security"],"backgroundTag":null,"analyzedSha":"251596fc0de2f9528c00c224252fd073a99973f4","analyzedAt":"2026-08-12T21:18:37.123Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}