siyuan-note/siyuan · error

OIDC configuration is missing

Error message

OIDC configuration is missing

What it means

Thrown by oidc_provider.New() when the config argument is nil. This is the first guard in the OIDC provider constructor, firing before any field validation. The OIDC subsystem requires a populated *conf.OIDC to build an OAuth2 config and verifier; a nil pointer means the caller never initialized or loaded the OIDC settings from the SiYuan configuration.

Source

Thrown at kernel/model/oidc_provider/provider.go:37

	"github.com/coreos/go-oidc/v3/oidc"
	"github.com/siyuan-note/siyuan/kernel/conf"
	"golang.org/x/oauth2"
)

const (
	googleIssuer = "https://accounts.google.com"
)

type Provider struct {
	kind         string
	oauth2Config *oauth2.Config
	verifier     *oidc.IDTokenVerifier
}

func New(ctx context.Context, config *conf.OIDC, redirectURL string) (*Provider, error) {
	if config == nil {
		return nil, errors.New("OIDC configuration is missing")
	}
	if config.ClientID == "" {
		return nil, errors.New("OIDC client ID is required")
	}
	if redirectURL == "" {
		return nil, errors.New("OIDC redirect URL is required")
	}
	if config.Provider == conf.OIDCProviderGitHub && config.ClientSecret == "" {
		return nil, errors.New("GitHub OAuth client secret is required")
	}
	issuerURL := strings.TrimSpace(config.IssuerURL)
	switch config.Provider {
	case conf.OIDCProviderGoogle:
		issuerURL = googleIssuer
	case conf.OIDCProviderMicrosoft:
		// Microsoft 多租户端点的 issuer 会随租户变化，必须使用租户专属 issuer。
	case conf.OIDCProviderCustom:
	case conf.OIDCProviderGitHub:

View on GitHub (pinned to 251596fc0d)

Solutions

1. Ensure conf.OIDC is populated in the SiYuan settings before any OIDC login flow is reachable.
2. In the calling code, add a nil-check on Conf.OIDC before invoking New() and return a user-friendly 'OIDC not configured' HTTP error.
3. If OIDC is optional, gate the endpoint registration on Conf.OIDC != nil at server startup so the route is never exposed.

Example fix

// before
provider, err := oidc_provider.New(ctx, Conf.OIDC, redirectURL)

// after
if Conf.OIDC == nil {
    http.Error(w, "OIDC not configured", http.StatusServiceUnavailable)
    return
}
provider, err := oidc_provider.New(ctx, Conf.OIDC, redirectURL)

if config == nil {
    return nil, errors.New("OIDC is not configured; set up an OIDC provider in Settings first")
}
provider, err := oidc_provider.New(ctx, config, redirectURL)

func isOIDCConfigured(c *conf.OIDC) bool {
    return c != nil
}

When it happens

Trigger: Calling oidc_provider.New(ctx, nil, redirectURL) — the entire config struct is nil. This happens when the API layer reads conf.OIDC and it was never set, or when a code path forwards the pointer without checking intermediate nil fields (e.g., Conf.OIDC itself is nil).

Common situations: The administrator has not configured any OIDC provider in settings but the feature was triggered anyway (e.g., a user navigates to the SSO login endpoint). A migration or config reset left the OIDC section empty. The API handler dereferences Conf.OIDC without a nil-check before calling New().

Related errors

• OIDC client ID is required
• OIDC redirect URL is required
• GitHub OAuth client secret is required
• unsupported OIDC provider [%s]
• OIDC issuer URL is required

AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12). Data as JSON: /api/errors/6ddb45d103b427f9. Report an issue: GitHub.