siyuan-note/siyuan · warning

OIDC configuration changed during validation

Error message

OIDC configuration changed during validation

What it means

Conf.CompareAndSetOIDC(ConfigVersion, Config) returned swapped == false during activation: another OIDC config write landed between validation start and activation. The candidate config is discarded and the transaction is deleted as stale.

Source

Thrown at kernel/model/oidc.go:841

	oidcTransactions.Lock()
	defer oidcTransactions.Unlock()
	cleanupOIDCTransactionsLocked()
	state := oidcTransactions.byPoll[pollToken]
	transaction := oidcTransactions.byState[state]
	if transaction == nil || transaction.Flow != oidcFlowValidate || transaction.Binding == "" ||
		binding == "" || transaction.Binding != binding || !transaction.Completed || !transaction.Success {
		return false, errors.New("OIDC validation transaction was not found or has expired")
	}
	if transaction.Activated {
		return false, nil
	}
	if transaction.Config == nil {
		return false, errors.New("OIDC validation configuration is missing")
	}
	configurationChanged, swapped := Conf.CompareAndSetOIDC(transaction.ConfigVersion, transaction.Config)
	if !swapped {
		deleteOIDCTransactionLocked(state)
		return false, errors.New("OIDC configuration changed during validation")
	}
	transaction.Config = nil
	transaction.Activated = true
	return configurationChanged, nil
}

func cancelOIDCValidation(pollToken, binding string) bool {
	oidcTransactions.Lock()
	defer oidcTransactions.Unlock()
	cleanupOIDCTransactionsLocked()
	state := oidcTransactions.byPoll[pollToken]
	transaction := oidcTransactions.byState[state]
	if transaction == nil || transaction.Flow != oidcFlowValidate || transaction.Activated || transaction.Binding == "" ||
		binding == "" || transaction.Binding != binding {
		return false
	}
	deleteOIDCTransactionLocked(state)
	return true

View on GitHub (pinned to 251596fc0d)

Solutions

1. Re-run validation start with the latest intended config.
2. Ensure only one admin/process edits OIDC config at a time.
3. Treat the prior validation result as stale and discard it.

// CAS lost: re-run validation start with the latest config.
if _, err := activateOIDCValidation(pollToken, binding); err != nil && strings.Contains(err.Error(), "configuration changed during validation") {
    restartValidationFlow(c)
}

When it happens

Trigger: A second admin (or automation) saved OIDC settings while a validation activation is in flight; rapid config churn racing with activation.

Common situations: Two admins validating/editing OIDC at once; config pushed by tooling that races the manual validate flow.

Related errors

• OIDC configuration changed during provider discovery
• OIDC configuration changed during login
• A public HTTPS OIDC redirect URL is required for remote acce
• OIDC redirect URL must end with /api/system/oidc/callback
• Public OIDC redirect URL must use HTTPS

AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12). Data as JSON: /api/errors/28ec85e8deebdd9b. Report an issue: GitHub.