siyuan-note/siyuan · error

Google does not support the fixed SiYuan mobile OIDC callbac

Error message

Google does not support the fixed SiYuan mobile OIDC callback URI

What it means

Returned by ValidateOIDCMobileConfiguration (kernel/model/oidc.go:559) when the provider is Google. The SiYuan mobile app uses a fixed callback URI that Google's OAuth consent screen rejects (Google requires a verifiable https redirect, not a custom scheme/loopback), so Google is explicitly disallowed for the mobile flow.

Source

Thrown at kernel/model/oidc.go:559

		}
		if rule.Operator != conf.OIDCClaimOperatorEquals && rule.Operator != conf.OIDCClaimOperatorContains {
			return errors.New("Unsupported OIDC claim rule operator")
		}
		for _, value := range rule.Values {
			if value == "" {
				return errors.New("OIDC claim rule values cannot be empty")
			}
		}
	}
	return nil
}

func ValidateOIDCMobileConfiguration(config *conf.OIDC) error {
	if err := ValidateOIDCConfiguration(config); err != nil {
		return err
	}
	if config.Provider == conf.OIDCProviderGoogle {
		return errors.New("Google does not support the fixed SiYuan mobile OIDC callback URI")
	}
	return nil
}

func ValidateOIDCProviderConfiguration(ctx context.Context, config *conf.OIDC) error {
	if err := ValidateOIDCConfiguration(config); err != nil {
		return err
	}
	redirectURL := "http://127.0.0.1:6806/api/system/oidc/callback"
	if config.RedirectURL != "" {
		var err error
		if redirectURL, err = validatePublicOIDCRedirectURL(config.RedirectURL); err != nil {
			return err
		}
	}
	validationContext, cancel := context.WithTimeout(ctx, oidcProviderTimeout)
	defer cancel()
	_, err := oidc_provider.New(validationContext, config, redirectURL)

View on GitHub (pinned to 251596fc0d)

Solutions

1. For mobile login, choose a provider that accepts SiYuan's fixed mobile callback (Microsoft, Custom with a compatible IdP), or use GitHub.
2. Keep Google only for the desktop/web flow where a normal HTTPS redirect URL is configured.
3. If Google is mandatory, run a Custom provider pointing at an intermediate IdP that proxies to Google with a valid redirect.

Example fix

// before — mobile flow + Google
model.ValidateOIDCMobileConfiguration(cfgWithGoogle) // -> error
// after — switch the mobile flow to a compatible provider
cfg.Provider = conf.OIDCProviderMicrosoft
model.ValidateOIDCMobileConfiguration(cfg)

if mobile && cfg.Provider == conf.OIDCProviderGoogle {
    return errors.New("pick a non-Google provider for mobile OIDC")
}

func mobileCompatible(c *conf.OIDC) bool {
    return c.Provider != conf.OIDCProviderGoogle
}

When it happens

Trigger: Selecting the mobile OIDC login flow with Provider set to Google; or calling ValidateOIDCMobileConfiguration from the mobile settings screen with a Google-backed config.

Common situations: Org uses Google Workspace for SSO and tries to wire it into the SiYuan mobile app, hitting Google's redirect-URI restrictions.

Related errors

• Unsupported OIDC provider
• unzip [%s] failed: %s
• no AI provider configured
• generate image failed: %w
• unsupported multimodal provider protocol: %s

AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12). Data as JSON: /api/errors/c8c296664dadecb8. Report an issue: GitHub.