siyuan-note/siyuan · error

OIDC claim rules must include a claim and at least one value

Error message

OIDC claim rules must include a claim and at least one value

What it means

Eighth check in ValidateOIDCConfiguration (kernel/model/oidc.go:540): iterating ClaimRules, a rule is nil, its Claim field is empty, or its Values slice is empty. Each rule must name a claim (e.g. 'email', 'groups') and provide at least one value to match.

Source

Thrown at kernel/model/oidc.go:540

		return errors.New("OIDC issuer URL is required")
	}
	if (config.Provider == conf.OIDCProviderCustom || config.Provider == conf.OIDCProviderMicrosoft) && config.IssuerURL != "" {
		issuer, err := url.Parse(config.IssuerURL)
		if err != nil || issuer.Host == "" || issuer.User != nil || issuer.RawQuery != "" || issuer.Fragment != "" ||
			(issuer.Scheme != "https" && !util.IsLocalHostname(issuer.Hostname())) {
			return errors.New("OIDC issuer URL must use HTTPS unless it is a loopback address")
		}
	}
	if config.Provider != conf.OIDCProviderCustom && config.Provider != conf.OIDCProviderGoogle &&
		config.Provider != conf.OIDCProviderMicrosoft && config.Provider != conf.OIDCProviderGitHub {
		return errors.New("Unsupported OIDC provider")
	}
	if !config.AllowAll && len(config.ClaimRules) == 0 {
		return errors.New("OIDC login requires at least one claim rule when Allow all users is disabled")
	}
	for _, rule := range config.ClaimRules {
		if rule == nil || rule.Claim == "" || len(rule.Values) == 0 {
			return errors.New("OIDC claim rules must include a claim and at least one value")
		}
		if rule.Operator != conf.OIDCClaimOperatorEquals && rule.Operator != conf.OIDCClaimOperatorContains {
			return errors.New("Unsupported OIDC claim rule operator")
		}
		for _, value := range rule.Values {
			if value == "" {
				return errors.New("OIDC claim rule values cannot be empty")
			}
		}
	}
	return nil
}

func ValidateOIDCMobileConfiguration(config *conf.OIDC) error {
	if err := ValidateOIDCConfiguration(config); err != nil {
		return err
	}
	if config.Provider == conf.OIDCProviderGoogle {

View on GitHub (pinned to 251596fc0d)

Solutions

1. Open the OIDC claim rules editor and ensure each row has a non-empty claim name and at least one value.
2. Remove placeholder/empty rows before saving.
3. If editing JSON, ensure every element of ClaimRules is a complete object {Claim, Operator, Values}.

Example fix

// before
cfg.ClaimRules = []*conf.OIDCClaimRule{{Claim: "", Values: nil}}
// after
cfg.ClaimRules = []*conf.OIDCClaimRule{{Claim: "email", Operator: conf.OIDCClaimOperatorEquals, Values: []string{"@corp.com"}}}

for _, r := range cfg.ClaimRules {
    if r == nil || r.Claim == "" || len(r.Values) == 0 {
        return fmt.Errorf("incomplete claim rule: %%+v", r)
    }
}

func ruleComplete(r *conf.OIDCClaimRule) bool {
    return r != nil && r.Claim != "" && len(r.Values) > 0
}

When it happens

Trigger: Adding a claim rule via JSON/UI with a blank claim name, or with no values filled in; a rule object that deserialized to nil.

Common situations: Frontend bug that submits a rule row with the claim dropdown empty; hand-edited conf.json with a malformed rule entry.

Related errors

• OIDC login is not enabled
• OIDC client ID is required
• Unsupported OIDC provider
• OIDC login requires at least one claim rule when Allow all u
• Unsupported OIDC claim rule operator

AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12). Data as JSON: /api/errors/91c98f78e142bfbe. Report an issue: GitHub.