{"record":{"id":"c8c296664dadecb8","repo":"siyuan-note/siyuan","slug":"google-does-not-support-the-fixed-siyuan-mobile-oi","errorCode":null,"errorMessage":"Google does not support the fixed SiYuan mobile OIDC callback URI","messagePattern":"Google does not support the fixed SiYuan mobile OIDC callback URI","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"kernel/model/oidc.go","lineNumber":559,"sourceCode":"\t\t}\n\t\tif rule.Operator != conf.OIDCClaimOperatorEquals && rule.Operator != conf.OIDCClaimOperatorContains {\n\t\t\treturn errors.New(\"Unsupported OIDC claim rule operator\")\n\t\t}\n\t\tfor _, value := range rule.Values {\n\t\t\tif value == \"\" {\n\t\t\t\treturn errors.New(\"OIDC claim rule values cannot be empty\")\n\t\t\t}\n\t\t}\n\t}\n\treturn nil\n}\n\nfunc ValidateOIDCMobileConfiguration(config *conf.OIDC) error {\n\tif err := ValidateOIDCConfiguration(config); err != nil {\n\t\treturn err\n\t}\n\tif config.Provider == conf.OIDCProviderGoogle {\n\t\treturn errors.New(\"Google does not support the fixed SiYuan mobile OIDC callback URI\")\n\t}\n\treturn nil\n}\n\nfunc ValidateOIDCProviderConfiguration(ctx context.Context, config *conf.OIDC) error {\n\tif err := ValidateOIDCConfiguration(config); err != nil {\n\t\treturn err\n\t}\n\tredirectURL := \"http://127.0.0.1:6806/api/system/oidc/callback\"\n\tif config.RedirectURL != \"\" {\n\t\tvar err error\n\t\tif redirectURL, err = validatePublicOIDCRedirectURL(config.RedirectURL); err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\tvalidationContext, cancel := context.WithTimeout(ctx, oidcProviderTimeout)\n\tdefer cancel()\n\t_, err := oidc_provider.New(validationContext, config, redirectURL)","sourceCodeStart":541,"sourceCodeEnd":577,"githubUrl":"https://github.com/siyuan-note/siyuan/blob/251596fc0de2f9528c00c224252fd073a99973f4/kernel/model/oidc.go#L541-L577","documentation":"Returned by ValidateOIDCMobileConfiguration (kernel/model/oidc.go:559) when the provider is Google. The SiYuan mobile app uses a fixed callback URI that Google's OAuth consent screen rejects (Google requires a verifiable https redirect, not a custom scheme/loopback), so Google is explicitly disallowed for the mobile flow.","triggerScenarios":"Selecting the mobile OIDC login flow with Provider set to Google; or calling ValidateOIDCMobileConfiguration from the mobile settings screen with a Google-backed config.","commonSituations":"Org uses Google Workspace for SSO and tries to wire it into the SiYuan mobile app, hitting Google's redirect-URI restrictions.","solutions":["For mobile login, choose a provider that accepts SiYuan's fixed mobile callback (Microsoft, Custom with a compatible IdP), or use GitHub.","Keep Google only for the desktop/web flow where a normal HTTPS redirect URL is configured.","If Google is mandatory, run a Custom provider pointing at an intermediate IdP that proxies to Google with a valid redirect."],"exampleFix":"// before — mobile flow + Google\nmodel.ValidateOIDCMobileConfiguration(cfgWithGoogle) // -> error\n// after — switch the mobile flow to a compatible provider\ncfg.Provider = conf.OIDCProviderMicrosoft\nmodel.ValidateOIDCMobileConfiguration(cfg)","handlingStrategy":"validation","validationCode":"if mobile && cfg.Provider == conf.OIDCProviderGoogle {\n    return errors.New(\"pick a non-Google provider for mobile OIDC\")\n}","typeGuard":"func mobileCompatible(c *conf.OIDC) bool {\n    return c.Provider != conf.OIDCProviderGoogle\n}","tryCatchPattern":null,"preventionTips":["Hide Google as a provider option in the mobile OIDC setup UI.","Document the fixed-callback constraint for users coming from Google Workspace."],"tags":["oidc","mobile","google","provider"],"backgroundTag":null,"analyzedSha":"251596fc0de2f9528c00c224252fd073a99973f4","analyzedAt":"2026-08-12T21:18:37.123Z","schemaVersion":2},"datasetVersion":"2026-08-12T23:17:12.415Z"}