siyuan-note/siyuan · error

OIDC client ID is required

Error message

OIDC client ID is required

What it means

Thrown by oidc_provider.New() when config.ClientID is an empty string. The OAuth2 flow requires a client ID registered with the identity provider; without it, the authorization URL and token exchange are meaningless. This is the second validation guard after the nil-config check.

Source

Thrown at kernel/model/oidc_provider/provider.go:40

	"golang.org/x/oauth2"
)

const (
	googleIssuer = "https://accounts.google.com"
)

type Provider struct {
	kind         string
	oauth2Config *oauth2.Config
	verifier     *oidc.IDTokenVerifier
}

func New(ctx context.Context, config *conf.OIDC, redirectURL string) (*Provider, error) {
	if config == nil {
		return nil, errors.New("OIDC configuration is missing")
	}
	if config.ClientID == "" {
		return nil, errors.New("OIDC client ID is required")
	}
	if redirectURL == "" {
		return nil, errors.New("OIDC redirect URL is required")
	}
	if config.Provider == conf.OIDCProviderGitHub && config.ClientSecret == "" {
		return nil, errors.New("GitHub OAuth client secret is required")
	}
	issuerURL := strings.TrimSpace(config.IssuerURL)
	switch config.Provider {
	case conf.OIDCProviderGoogle:
		issuerURL = googleIssuer
	case conf.OIDCProviderMicrosoft:
		// Microsoft 多租户端点的 issuer 会随租户变化，必须使用租户专属 issuer。
	case conf.OIDCProviderCustom:
	case conf.OIDCProviderGitHub:
		return newGitHub(config, redirectURL), nil
	default:
		return nil, fmt.Errorf("unsupported OIDC provider [%s]", config.Provider)

View on GitHub (pinned to 251596fc0d)

Solutions

1. Register an OAuth application with the chosen provider and copy the Client ID into SiYuan's OIDC settings.
2. Validate the ClientID field in the API handler before calling New() and return a 400 with a clear message.
3. Check the frontend form for required-field enforcement on the client ID input.

Example fix

// before
provider, err := oidc_provider.New(ctx, config, redirectURL)

// after
if config.ClientID == "" {
    return nil, fmt.Errorf("OIDC client ID must be set in settings")
}
provider, err := oidc_provider.New(ctx, config, redirectURL)

if config.ClientID == "" {
    return nil, errors.New("OIDC client ID is required; register an OAuth app with the provider")
}
provider, err := oidc_provider.New(ctx, config, redirectURL)

func hasOIDCClientID(c *conf.OIDC) bool {
    return c != nil && c.ClientID != ""
}

When it happens

Trigger: Calling New() with a *conf.OIDC whose ClientID field is empty. The config struct exists but the admin never entered the client ID obtained from Google/Microsoft/GitHub/Custom provider registration.

Common situations: The admin configured the issuer URL and provider type but forgot to paste the client ID from the provider's developer console. A config import or sync brought over a partial OIDC config. The frontend form submitted without the client ID field but the backend did not reject it.

Related errors

• unsupported OIDC provider [%s]
• OIDC issuer URL is required
• OIDC login is not enabled
• OIDC client ID is required
• Unsupported OIDC provider

AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12). Data as JSON: /api/errors/d2d0f29b94909fa4. Report an issue: GitHub.