{"record":{"id":"9148b9d7c6c5b7fc","repo":"siyuan-note/siyuan","slug":"remote-access-requires-at-least-one-authentication","errorCode":null,"errorMessage":"remote access requires at least one authentication method","messagePattern":"remote access requires at least one authentication method","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"kernel/model/oidc.go","lineNumber":585,"sourceCode":"\t}\n\tredirectURL := \"http://127.0.0.1:6806/api/system/oidc/callback\"\n\tif config.RedirectURL != \"\" {\n\t\tvar err error\n\t\tif redirectURL, err = validatePublicOIDCRedirectURL(config.RedirectURL); err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\tvalidationContext, cancel := context.WithTimeout(ctx, oidcProviderTimeout)\n\tdefer cancel()\n\t_, err := oidc_provider.New(validationContext, config, redirectURL)\n\treturn err\n}\n\nfunc ValidateOIDCConfigurationChange(ctx context.Context, config *conf.OIDC, requireRemoteRedirect,\n\thasAlternativeAuthentication, bypassAuthentication bool) error {\n\tif config == nil || !config.Enabled {\n\t\tif requireRemoteRedirect && !hasAlternativeAuthentication && !bypassAuthentication {\n\t\t\treturn errors.New(\"remote access requires at least one authentication method\")\n\t\t}\n\t\treturn nil\n\t}\n\tif requireRemoteRedirect {\n\t\tif _, err := validatePublicOIDCRedirectURL(config.RedirectURL); err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\treturn ValidateOIDCProviderConfiguration(ctx, config)\n}\n\nfunc effectiveOIDCRedirectURL(c *gin.Context, flow string) (string, error) {\n\tif flow == oidcFlowMobile {\n\t\treturn oidcMobileRedirectURL, nil\n\t}\n\tif flow == oidcFlowWeb && !IsLocalRequest(c) {\n\t\treturn validatePublicOIDCRedirectURL(Conf.GetOIDC().RedirectURL)\n\t}","sourceCodeStart":567,"sourceCodeEnd":603,"githubUrl":"https://github.com/siyuan-note/siyuan/blob/251596fc0de2f9528c00c224252fd073a99973f4/kernel/model/oidc.go#L567-L603","documentation":"Returned by ValidateOIDCConfigurationChange (kernel/model/oidc.go:585) when OIDC is being disabled (or is already nil/not enabled) while the workspace is exposed for remote access (requireRemoteRedirect=true), there is no alternative authentication enabled (hasAlternativeAuthentication=false), and the change is not privileged (bypassAuthentication=false). Removing OIDC in that state would leave remote access with no auth, so the change is refused.","triggerScenarios":"Turning OIDC off via /api/system/setOIDC when the kernel listens on a non-loopback address and no other auth (app access token, account system) is active.","commonSituations":"Admin disables OIDC on a publicly exposed SiYuan instance without first enabling an alternative; API call from a remote host during config edit.","solutions":["Enable an alternative authentication method (application token or user accounts) before disabling OIDC.","Or restrict the kernel back to loopback-only access before disabling OIDC.","Or call the config endpoint from a local/privileged context that sets bypassAuthentication=true."],"exampleFix":"// before — disabling OIDC on a remote-exposed workspace\nsetOIDC(enabled=false) // -> error\n// after — enable app token first, then disable OIDC\nenableAppAccessToken()\nsetOIDC(enabled=false)","handlingStrategy":"validation","validationCode":"if !oidcWillBeEnabled && requireRemoteRedirect && !hasOtherAuth && !bypass {\n    return errors.New(\"enable an alternative auth before disabling OIDC\")\n}","typeGuard":"func safeToDisableOIDC(remote, altAuth, bypass bool) bool {\n    return !remote || altAuth || bypass\n}","tryCatchPattern":null,"preventionTips":["Always stage an alternative auth method before flipping OIDC off on remote-exposed kernels.","Treat remote-access config changes as privileged — perform them locally."],"tags":["oidc","auth","remote-access","security","config-change"],"backgroundTag":null,"analyzedSha":"251596fc0de2f9528c00c224252fd073a99973f4","analyzedAt":"2026-08-12T21:18:37.123Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}