siyuan-note/siyuan · warning

OIDC configuration changed during login

Error message

OIDC configuration changed during login

What it means

At claim time the transaction's ConfigVersion no longer matches the live config version. claimOIDCTransaction deletes the transaction and aborts because claims and token exchange must run against a single consistent OIDC configuration.

Source

Thrown at kernel/model/oidc.go:750

	return nil
}

func claimOIDCTransaction(ctx context.Context, state, binding string,
	allowDesktopWithoutBinding bool) (*oidcTransaction, bool, error) {
	if state == "" {
		return nil, false, errors.New("OIDC state is missing")
	}
	oidcTransactions.Lock()
	cleanupOIDCTransactionsLocked()
	transaction := oidcTransactions.byState[state]
	if transaction == nil {
		oidcTransactions.Unlock()
		return nil, false, errors.New("OIDC login transaction was not found or has expired")
	}
	if transaction.ConfigVersion != oidcConfigurationVersion(Conf.GetOIDC()) {
		deleteOIDCTransactionLocked(state)
		oidcTransactions.Unlock()
		return nil, false, errors.New("OIDC configuration changed during login")
	}
	if !(allowDesktopWithoutBinding && (transaction.Flow == oidcFlowDesktop || transaction.Flow == oidcFlowValidate)) &&
		(binding == "" || binding != transaction.Binding) {
		oidcTransactions.Unlock()
		return nil, false, errors.New("OIDC login binding does not match")
	}
	if !transaction.Claimed {
		transaction.Claimed = true
		copy := *transaction
		oidcTransactions.Unlock()
		return &copy, false, nil
	}
	done := transaction.Done
	oidcTransactions.Unlock()

	select {
	case <-ctx.Done():
		return nil, false, fmt.Errorf("wait for OIDC login transaction failed: %w", ctx.Err())

View on GitHub (pinned to 251596fc0d)

Solutions

1. Restart the login flow so it binds to the current config version.
2. Stop editing OIDC settings during active logins.
3. Schedule config changes in a maintenance window.

// Config changed mid-login: restart the flow rather than retrying the stale state.
if err != nil && strings.Contains(err.Error(), "configuration changed during login") {
    restartOIDCFlow(c)
}

When it happens

Trigger: Admin saved OIDC settings between a user's /api/system/oidc/start and the IdP callback; config rewritten by automation during a login.

Common situations: Operator iterating on OIDC config while users are logging in; scripted config churn racing with real users.

Related errors

• OIDC configuration changed during provider discovery
• OIDC configuration changed during validation
• A public HTTPS OIDC redirect URL is required for remote acce
• OIDC redirect URL must end with /api/system/oidc/callback
• Public OIDC redirect URL must use HTTPS

AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12). Data as JSON: /api/errors/0dd859671bb627b8. Report an issue: GitHub.