siyuan-note/siyuan · error

OIDC client ID is required

Error message

OIDC client ID is required

What it means

Second check in ValidateOIDCConfiguration (kernel/model/oidc.go:516): OIDC is enabled but ClientID is empty. Every OIDC provider requires a client identifier registered at the IdP, so an empty ClientID is rejected before provider-specific checks run.

Source

Thrown at kernel/model/oidc.go:516

		return
	}
	workspaceSession := util.GetWorkspaceSession(util.GetSession(c))
	if !cancelOIDCValidation(input.PollToken, workspaceSession.OIDCBinding) {
		ret.Code = -1
		ret.Msg = oidcLanguage(369, "Invalid OIDC configuration")
	}
}

func validateOIDCConfiguration() error {
	return ValidateOIDCConfiguration(Conf.GetOIDC())
}

func ValidateOIDCConfiguration(config *conf.OIDC) error {
	if config == nil || !config.Enabled {
		return errors.New("OIDC login is not enabled")
	}
	if config.ClientID == "" {
		return errors.New("OIDC client ID is required")
	}
	if config.Provider == conf.OIDCProviderGitHub && config.ClientSecret == "" {
		return errors.New("GitHub OAuth client secret is required")
	}
	if (config.Provider == conf.OIDCProviderCustom || config.Provider == conf.OIDCProviderMicrosoft) && config.IssuerURL == "" {
		return errors.New("OIDC issuer URL is required")
	}
	if (config.Provider == conf.OIDCProviderCustom || config.Provider == conf.OIDCProviderMicrosoft) && config.IssuerURL != "" {
		issuer, err := url.Parse(config.IssuerURL)
		if err != nil || issuer.Host == "" || issuer.User != nil || issuer.RawQuery != "" || issuer.Fragment != "" ||
			(issuer.Scheme != "https" && !util.IsLocalHostname(issuer.Hostname())) {
			return errors.New("OIDC issuer URL must use HTTPS unless it is a loopback address")
		}
	}
	if config.Provider != conf.OIDCProviderCustom && config.Provider != conf.OIDCProviderGoogle &&
		config.Provider != conf.OIDCProviderMicrosoft && config.Provider != conf.OIDCProviderGitHub {
		return errors.New("Unsupported OIDC provider")
	}

View on GitHub (pinned to 251596fc0d)

Solutions

1. Obtain the Client ID from the OIDC provider's app registration console and paste it into settings.
2. Re-save the full OIDC config (ClientID + ClientSecret + Provider + IssuerURL) together.
3. If migrating configs, verify the JSON carried ClientID across versions.

Example fix

// before
cfg := &conf.OIDC{Enabled: true, Provider: conf.OIDCProviderGitHub, ClientSecret: "x"}
// after
cfg := &conf.OIDC{Enabled: true, Provider: conf.OIDCProviderGitHub,
    ClientID: os.Getenv("SIYUAN_OIDC_CLIENT_ID"),
    ClientSecret: os.Getenv("SIYUAN_OIDC_CLIENT_SECRET")}

if cfg.Enabled && cfg.ClientID == "" {
    return errors.New("OIDC ClientID missing")
}
return ValidateOIDCConfiguration(cfg)

func hasClientID(c *conf.OIDC) bool { return c != nil && c.ClientID != "" }

When it happens

Trigger: Saving OIDC config with Enabled=true but leaving the Client ID field blank, or a config migration that dropped the ClientID value.

Common situations: Admin enabled OIDC to test and forgot to paste the IdP-issued client ID; frontend form submitted before the field was filled.

Related errors

• OIDC login is not enabled
• Unsupported OIDC provider
• OIDC claim rules must include a claim and at least one value
• OIDC client ID is required
• unsupported OIDC provider [%s]

AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12). Data as JSON: /api/errors/c3678203d7009b7e. Report an issue: GitHub.