siyuan-note/siyuan · error
OIDC issuer URL is required
Error message
OIDC issuer URL is required
What it means
Fourth check in ValidateOIDCConfiguration (kernel/model/oidc.go:522): provider is Custom or Microsoft but IssuerURL is empty. These providers need a discovery endpoint URL (the issuer), so an empty URL is rejected before the URL is parsed and scheme-checked.
Source
Thrown at kernel/model/oidc.go:522
}
}
func validateOIDCConfiguration() error {
return ValidateOIDCConfiguration(Conf.GetOIDC())
}
func ValidateOIDCConfiguration(config *conf.OIDC) error {
if config == nil || !config.Enabled {
return errors.New("OIDC login is not enabled")
}
if config.ClientID == "" {
return errors.New("OIDC client ID is required")
}
if config.Provider == conf.OIDCProviderGitHub && config.ClientSecret == "" {
return errors.New("GitHub OAuth client secret is required")
}
if (config.Provider == conf.OIDCProviderCustom || config.Provider == conf.OIDCProviderMicrosoft) && config.IssuerURL == "" {
return errors.New("OIDC issuer URL is required")
}
if (config.Provider == conf.OIDCProviderCustom || config.Provider == conf.OIDCProviderMicrosoft) && config.IssuerURL != "" {
issuer, err := url.Parse(config.IssuerURL)
if err != nil || issuer.Host == "" || issuer.User != nil || issuer.RawQuery != "" || issuer.Fragment != "" ||
(issuer.Scheme != "https" && !util.IsLocalHostname(issuer.Hostname())) {
return errors.New("OIDC issuer URL must use HTTPS unless it is a loopback address")
}
}
if config.Provider != conf.OIDCProviderCustom && config.Provider != conf.OIDCProviderGoogle &&
config.Provider != conf.OIDCProviderMicrosoft && config.Provider != conf.OIDCProviderGitHub {
return errors.New("Unsupported OIDC provider")
}
if !config.AllowAll && len(config.ClaimRules) == 0 {
return errors.New("OIDC login requires at least one claim rule when Allow all users is disabled")
}
for _, rule := range config.ClaimRules {
if rule == nil || rule.Claim == "" || len(rule.Values) == 0 {
return errors.New("OIDC claim rules must include a claim and at least one value")View on GitHub (pinned to 251596fc0d)
Solutions
- Find the issuer URL from the provider's OpenID Connect discovery metadata (Azure: endpoint tab; Keycloak: realm settings -> OpenID Endpoint Configuration).
- Paste the full HTTPS URL ending at the issuer root (not the .well-known path).
- Re-save and re-run ValidateOIDCProviderConfiguration to confirm discovery succeeds.
Example fix
// before
cfg := &conf.OIDC{Enabled: true, Provider: conf.OIDCProviderMicrosoft, ClientID: "abc"}
// after
cfg := &conf.OIDC{Enabled: true, Provider: conf.OIDCProviderMicrosoft, ClientID: "abc",
IssuerURL: "https://login.microsoftonline.com/" + tenantID + "/v2.0"} Defensive patterns
Strategy: validation
Validate before calling
needsIssuer := cfg.Provider == conf.OIDCProviderCustom || cfg.Provider == conf.OIDCProviderMicrosoft
if needsIssuer && cfg.IssuerURL == "" {
return errors.New("issuer URL required for this provider")
}
return ValidateOIDCConfiguration(cfg) Type guard
func issuerSatisfied(c *conf.OIDC) bool {
if c.Provider != conf.OIDCProviderCustom && c.Provider != conf.OIDCProviderMicrosoft {
return true
}
return c.IssuerURL != ""
} Prevention
- Keep the issuer URL alongside the client ID in your secrets store.
- For Azure AD, include the tenant ID in the URL; 'common' works for multi-tenant.
When it happens
Trigger: Selecting Custom or Microsoft in OIDC settings and saving without entering the issuer URL (e.g. https://login.microsoftonline.com/<tenant>/v2.0).
Common situations: Admin copied only the application (client) ID from Azure AD or a Keycloak admin panel and forgot the issuer/.well-known URL.
Related errors
- OIDC issuer URL is required
- OIDC login is not enabled
- OIDC client ID is required
- GitHub OAuth client secret is required
- OIDC issuer URL must use HTTPS unless it is a loopback addre
AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12).
Data as JSON: /api/errors/10d06a96ca18f3c8.
Report an issue: GitHub.