siyuan-note/siyuan · error

OIDC claim rule values cannot be empty

Error message

OIDC claim rule values cannot be empty

What it means

Tenth check in ValidateOIDCConfiguration (kernel/model/oidc.go:547): a claim rule's Values slice contains an empty string. Each value is a literal to match against the claim, so blanks are rejected — they would otherwise match nothing meaningful.

Source

Thrown at kernel/model/oidc.go:547

		}
	}
	if config.Provider != conf.OIDCProviderCustom && config.Provider != conf.OIDCProviderGoogle &&
		config.Provider != conf.OIDCProviderMicrosoft && config.Provider != conf.OIDCProviderGitHub {
		return errors.New("Unsupported OIDC provider")
	}
	if !config.AllowAll && len(config.ClaimRules) == 0 {
		return errors.New("OIDC login requires at least one claim rule when Allow all users is disabled")
	}
	for _, rule := range config.ClaimRules {
		if rule == nil || rule.Claim == "" || len(rule.Values) == 0 {
			return errors.New("OIDC claim rules must include a claim and at least one value")
		}
		if rule.Operator != conf.OIDCClaimOperatorEquals && rule.Operator != conf.OIDCClaimOperatorContains {
			return errors.New("Unsupported OIDC claim rule operator")
		}
		for _, value := range rule.Values {
			if value == "" {
				return errors.New("OIDC claim rule values cannot be empty")
			}
		}
	}
	return nil
}

func ValidateOIDCMobileConfiguration(config *conf.OIDC) error {
	if err := ValidateOIDCConfiguration(config); err != nil {
		return err
	}
	if config.Provider == conf.OIDCProviderGoogle {
		return errors.New("Google does not support the fixed SiYuan mobile OIDC callback URI")
	}
	return nil
}

func ValidateOIDCProviderConfiguration(ctx context.Context, config *conf.OIDC) error {
	if err := ValidateOIDCConfiguration(config); err != nil {

View on GitHub (pinned to 251596fc0d)

Solutions

1. Remove empty entries from each rule's Values list before saving.
2. Sanitize comma-separated input (split, trim, drop empties) on the client.
3. Re-run ValidateOIDCConfiguration to confirm.

Example fix

// before
rule.Values = []string{"admins", ""}
// after — filter empties at the boundary
rule.Values = nonEmpty([]string{"admins", ""}) // -> ["admins"]

cleaned := r.Values[:0]
for _, v := range r.Values {
    if v = strings.TrimSpace(v); v != "" {
        cleaned = append(cleaned, v)
    }
}
r.Values = cleaned
if len(r.Values) == 0 {
    return errors.New("claim rule has no values")
}

func noEmptyValues(r *conf.OIDCClaimRule) bool {
    for _, v := range r.Values {
        if strings.TrimSpace(v) == "" {
            return false
        }
    }
    return true
}

When it happens

Trigger: Adding a claim rule with a value row left blank in the UI, or a JSON rule like {Claim:'groups', Values:['admins','']}.

Common situations: Frontend allows trailing empty tag inputs; copy-pasting comma-separated values where a stray comma produced an empty element.

Related errors

• OIDC claim rules must include a claim and at least one value
• Unsupported OIDC claim rule operator
• Activation code cannot be empty
• invalid notebook ID
• OIDC login is not enabled

AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12). Data as JSON: /api/errors/b3bf622a9f0a57d7. Report an issue: GitHub.