siyuan-note/siyuan · error

GitHub OAuth client secret is required

Error message

GitHub OAuth client secret is required

What it means

Third check in ValidateOIDCConfiguration (kernel/model/oidc.go:519): provider is GitHub and ClientSecret is empty. GitHub OAuth (used as an OIDC stand-in here) mandates a server-side client secret, unlike PKCE-only flows; an empty secret is rejected before issuer validation.

Source

Thrown at kernel/model/oidc.go:519

	if !cancelOIDCValidation(input.PollToken, workspaceSession.OIDCBinding) {
		ret.Code = -1
		ret.Msg = oidcLanguage(369, "Invalid OIDC configuration")
	}
}

func validateOIDCConfiguration() error {
	return ValidateOIDCConfiguration(Conf.GetOIDC())
}

func ValidateOIDCConfiguration(config *conf.OIDC) error {
	if config == nil || !config.Enabled {
		return errors.New("OIDC login is not enabled")
	}
	if config.ClientID == "" {
		return errors.New("OIDC client ID is required")
	}
	if config.Provider == conf.OIDCProviderGitHub && config.ClientSecret == "" {
		return errors.New("GitHub OAuth client secret is required")
	}
	if (config.Provider == conf.OIDCProviderCustom || config.Provider == conf.OIDCProviderMicrosoft) && config.IssuerURL == "" {
		return errors.New("OIDC issuer URL is required")
	}
	if (config.Provider == conf.OIDCProviderCustom || config.Provider == conf.OIDCProviderMicrosoft) && config.IssuerURL != "" {
		issuer, err := url.Parse(config.IssuerURL)
		if err != nil || issuer.Host == "" || issuer.User != nil || issuer.RawQuery != "" || issuer.Fragment != "" ||
			(issuer.Scheme != "https" && !util.IsLocalHostname(issuer.Hostname())) {
			return errors.New("OIDC issuer URL must use HTTPS unless it is a loopback address")
		}
	}
	if config.Provider != conf.OIDCProviderCustom && config.Provider != conf.OIDCProviderGoogle &&
		config.Provider != conf.OIDCProviderMicrosoft && config.Provider != conf.OIDCProviderGitHub {
		return errors.New("Unsupported OIDC provider")
	}
	if !config.AllowAll && len(config.ClaimRules) == 0 {
		return errors.New("OIDC login requires at least one claim rule when Allow all users is disabled")
	}

View on GitHub (pinned to 251596fc0d)

Solutions

1. Open the GitHub OAuth App settings, generate/copy the Client Secret, and save it into the OIDC config alongside the Client ID.
2. Use a fresh secret if the old one may have leaked — GitHub secrets are not retrievable, only regeneratable.
3. Re-validate with ValidateOIDCProviderConfiguration after saving.

Example fix

// before
cfg := &conf.OIDC{Enabled: true, Provider: conf.OIDCProviderGitHub, ClientID: "iv1.x"}
// after
cfg := &conf.OIDC{Enabled: true, Provider: conf.OIDCProviderGitHub,
    ClientID: "iv1.x", ClientSecret: os.Getenv("GITHUB_OAUTH_SECRET")}

if cfg.Provider == conf.OIDCProviderGitHub && cfg.ClientSecret == "" {
    return errors.New("GitHub OAuth secret required")
}
return ValidateOIDCConfiguration(cfg)

func githubSecretSet(c *conf.OIDC) bool {
    return c.Provider != conf.OIDCProviderGitHub || c.ClientSecret != ""
}

When it happens

Trigger: Choosing the GitHub provider and saving without pasting the GitHub OAuth App's Client Secret, or losing the secret during a config migration.

Common situations: Admin pasted only the Client ID from the GitHub OAuth App settings; CI deployed a config template that omits the secret.

Related errors

• GitHub OAuth client secret is required
• OIDC login is not enabled
• OIDC client ID is required
• OIDC issuer URL is required
• Unsupported OIDC provider

AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12). Data as JSON: /api/errors/2efac30966d581d1. Report an issue: GitHub.