OIDC configuration changed during provider discovery

Error message

OIDC configuration changed during provider discovery

What it means

getOIDCProvider releases the lock to run OIDC discovery (a network call capped at oidcProviderTimeout = 10s). After re-acquiring the lock it checks that the cached config version still matches the live one; if an admin saved OIDC settings during discovery, the freshly-discovered provider is discarded to avoid serving a provider built from stale config.

Source

Thrown at kernel/model/oidc.go:665

	if oidcProviders.version != version {
		oidcProviders.version = version
		oidcProviders.items = map[string]*oidc_provider.Provider{}
	}
	if provider := oidcProviders.items[key]; provider != nil {
		oidcProviders.Unlock()
		return provider, nil
	}
	oidcProviders.Unlock()
	discoveryContext, cancel := context.WithTimeout(ctx, oidcProviderTimeout)
	defer cancel()
	provider, err := oidc_provider.New(discoveryContext, Conf.GetOIDC(), redirectURL)
	if err != nil {
		return nil, err
	}
	oidcProviders.Lock()
	defer oidcProviders.Unlock()
	if oidcProviders.version != version || oidcConfigurationVersion(Conf.GetOIDC()) != version {
		return nil, errors.New("OIDC configuration changed during provider discovery")
	}
	if existing := oidcProviders.items[key]; existing != nil {
		return existing, nil
	}
	if len(oidcProviders.items) >= oidcProviderCacheMax {
		oidcProviders.items = map[string]*oidc_provider.Provider{}
	}
	oidcProviders.items[key] = provider
	return provider, nil
}

func newOIDCTransaction(input *oidcStartInput, binding, clientIP, redirectURL string) (*oidcTransaction, error) {
	state, err := secureRandomToken(32)
	if err != nil {
		return nil, err
	}
	nonce, err := secureRandomToken(32)
	if err != nil {

View on GitHub (pinned to 251596fc0d)

Solutions

Retry /api/system/oidc/start - the new config will be discovered and cached.
Stop editing OIDC settings while logins are in flight.
If it persists, confirm only one admin/process is writing OIDC config.

Defensive patterns

Strategy: retry

Try / catch

// Retry start once; the new config version will be discovered and cached.
var provider *oidc_provider.Provider
for attempt := 0; attempt < 2; attempt++ {
    provider, err = getOIDCProvider(ctx, redirectURL)
    if err == nil {
        break
    }
    if !strings.Contains(err.Error(), "configuration changed during provider discovery") {
        break
    }
}

Prevention

Do not edit OIDC settings while users are logging in.
Serialize config writes - only one admin/process at a time.
Treat discovery as retryable; surface a friendly 'try again' to the user.

When it happens

Trigger: Admin saves OIDC settings while a login or validation flow is mid-discovery; rapid successive config edits racing with new logins.

Common situations: Operator iterates on OIDC config while users are actively logging in; load/CI tests that reconfigure OIDC concurrently with login traffic.

Related errors

AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12). Data as JSON: /api/errors/733da79eb595f0c7. Report an issue: GitHub.