siyuan-note/siyuan · error

discover OIDC provider failed: %w

Error message

discover OIDC provider failed: %w

What it means

Thrown when oidc.NewProvider(ctx, issuerURL) fails during OIDC discovery. The underlying go-oidc library fetches the provider's /.well-known/openid-configuration endpoint and parses it; any network, TLS, DNS, timeout, or malformed-response failure is wrapped with %w for the caller to inspect. This is a runtime/environment error, not a configuration validation error.

Source

Thrown at kernel/model/oidc_provider/provider.go:65

	}
	issuerURL := strings.TrimSpace(config.IssuerURL)
	switch config.Provider {
	case conf.OIDCProviderGoogle:
		issuerURL = googleIssuer
	case conf.OIDCProviderMicrosoft:
		// Microsoft 多租户端点的 issuer 会随租户变化，必须使用租户专属 issuer。
	case conf.OIDCProviderCustom:
	case conf.OIDCProviderGitHub:
		return newGitHub(config, redirectURL), nil
	default:
		return nil, fmt.Errorf("unsupported OIDC provider [%s]", config.Provider)
	}
	if issuerURL == "" {
		return nil, errors.New("OIDC issuer URL is required")
	}
	discovered, err := oidc.NewProvider(ctx, issuerURL)
	if err != nil {
		return nil, fmt.Errorf("discover OIDC provider failed: %w", err)
	}
	scopes := append([]string{}, config.Scopes...)
	if !contains(scopes, oidc.ScopeOpenID) {
		scopes = append([]string{oidc.ScopeOpenID}, scopes...)
	}
	return &Provider{
		kind: conf.OIDCProviderCustom,
		oauth2Config: &oauth2.Config{
			ClientID:     config.ClientID,
			ClientSecret: config.ClientSecret,
			Endpoint:     discovered.Endpoint(),
			RedirectURL:  redirectURL,
			Scopes:       scopes,
		},
		verifier: discovered.Verifier(&oidc.Config{ClientID: config.ClientID}),
	}, nil
}

View on GitHub (pinned to 251596fc0d)

Solutions

1. Verify the issuer URL is correct by curling it: curl -v <issuerURL>/.well-known/openid-configuration
2. Ensure the SiYuan host can reach the provider over HTTPS (check firewall, proxy, DNS).
3. If using a self-signed certificate, configure the appropriate CA trust on the host or set the system root CAs.
4. Inspect the wrapped error (err) for the underlying cause — it will contain the HTTP status or network error.
5. If behind a corporate proxy, ensure HTTP_PROXY/HTTPS_PROXY environment variables are set for the kernel process.

Example fix

// before
provider, err := oidc_provider.New(ctx, config, redirectURL)
if err != nil {
    log.Printf("OIDC init failed: %v", err)
}

// after
provider, err := oidc_provider.New(ctx, config, redirectURL)
if err != nil {
    var discoverErr *fmt.wrapError
    if strings.Contains(err.Error(), "discover OIDC provider") {
        log.Printf("OIDC discovery failed — check issuer URL [%s] and network connectivity: %v", config.IssuerURL, err)
    }
    return
}

// Pre-flight: verify issuer discovery endpoint is reachable
discoveryURL := strings.TrimRight(issuerURL, "/") + "/.well-known/openid-configuration"
resp, err := http.Head(discoveryURL)
if err != nil || resp.StatusCode != 200 {
    return nil, fmt.Errorf("OIDC discovery endpoint unreachable at %s", discoveryURL)
}

provider, err := oidc_provider.New(ctx, config, redirectURL)
if err != nil {
    if strings.Contains(err.Error(), "discover OIDC provider") {
        // Network or provider issue — safe to retry after a delay
        time.Sleep(2 * time.Second)
        provider, err = oidc_provider.New(ctx, config, redirectURL)
        if err != nil {
            log.Printf("OIDC discovery failed after retry: %v", err)
            return
        }
    }
}

When it happens

Trigger: The provider constructor calls oidc.NewProvider which performs an HTTP GET on the issuer's discovery endpoint. This fails when: the issuer URL is unreachable, the server returns a non-200 or invalid JSON, TLS certificate verification fails, DNS resolution fails, or the context deadline is exceeded.

Common situations: The SiYuan server has no internet access or is behind a firewall blocking outbound HTTPS to the provider. The issuer URL has a self-signed or expired TLS certificate. The issuer URL is mistyped (valid hostname but wrong path). The provider's discovery endpoint is temporarily down. DNS misconfiguration in the container/host.

Related errors

• exchange OIDC authorization code failed: %w
• verify OIDC ID token failed: %w
• discover OAuth authorization server: %w
• OAuth protected resource metadata not found
• send article to liandi failed [sc=%d]

AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12). Data as JSON: /api/errors/789ce9167be8e57a. Report an issue: GitHub.