siyuan-note/siyuan · error

OIDC login is not enabled

Error message

OIDC login is not enabled

What it means

First failure mode of ValidateOIDCConfiguration (kernel/model/oidc.go:513): the OIDC config block is nil or its Enabled field is false. Every OIDC login/validate flow starts here, so any OIDC API call against a disabled configuration fails immediately.

Source

Thrown at kernel/model/oidc.go:513

	if err := c.ShouldBindJSON(input); err != nil || input.PollToken == "" {
		ret.Code = -1
		ret.Msg = oidcLanguage(369, "Invalid OIDC configuration")
		return
	}
	workspaceSession := util.GetWorkspaceSession(util.GetSession(c))
	if !cancelOIDCValidation(input.PollToken, workspaceSession.OIDCBinding) {
		ret.Code = -1
		ret.Msg = oidcLanguage(369, "Invalid OIDC configuration")
	}
}

func validateOIDCConfiguration() error {
	return ValidateOIDCConfiguration(Conf.GetOIDC())
}

func ValidateOIDCConfiguration(config *conf.OIDC) error {
	if config == nil || !config.Enabled {
		return errors.New("OIDC login is not enabled")
	}
	if config.ClientID == "" {
		return errors.New("OIDC client ID is required")
	}
	if config.Provider == conf.OIDCProviderGitHub && config.ClientSecret == "" {
		return errors.New("GitHub OAuth client secret is required")
	}
	if (config.Provider == conf.OIDCProviderCustom || config.Provider == conf.OIDCProviderMicrosoft) && config.IssuerURL == "" {
		return errors.New("OIDC issuer URL is required")
	}
	if (config.Provider == conf.OIDCProviderCustom || config.Provider == conf.OIDCProviderMicrosoft) && config.IssuerURL != "" {
		issuer, err := url.Parse(config.IssuerURL)
		if err != nil || issuer.Host == "" || issuer.User != nil || issuer.RawQuery != "" || issuer.Fragment != "" ||
			(issuer.Scheme != "https" && !util.IsLocalHostname(issuer.Hostname())) {
			return errors.New("OIDC issuer URL must use HTTPS unless it is a loopback address")
		}
	}
	if config.Provider != conf.OIDCProviderCustom && config.Provider != conf.OIDCProviderGoogle &&

View on GitHub (pinned to 251596fc0d)

Solutions

1. Enable OIDC in settings (set system.conf OIDC.Enabled=true) and save before retrying.
2. If the call came from a client login flow, hide the OIDC button when the config says Enabled=false.
3. Confirm Conf.GetOIDC() is not returning nil due to a missing/migrated config block.

Example fix

// before
ValidateOIDCConfiguration(conf.GetOIDC()) // Enabled=false -> error
// after — gate the call on enabled state
cfg := conf.GetOIDC()
if cfg == nil || !cfg.Enabled {
    return nil // OIDC not in use; skip validation
}
return ValidateOIDCConfiguration(cfg)

cfg := conf.GetOIDC()
if cfg == nil || !cfg.Enabled {
    return nil // not an error in the calling context — OIDC is off
}
return ValidateOIDCConfiguration(cfg)

func oidcEnabled(c *conf.OIDC) bool { return c != nil && c.Enabled }

When it happens

Trigger: Hitting /api/system/oidc/* (login, validate, start) when settings -> about -> OIDC login is off, or calling ValidateOIDCConfiguration programmatically before the user has enabled OIDC.

Common situations: User toggled OIDC off but clients still call login; admin testing endpoints before flipping Enabled=true; mobile/desktop login buttons shown when OIDC is disabled.

Related errors

• OIDC client ID is required
• Unsupported OIDC provider
• OIDC claim rules must include a claim and at least one value
• OIDC client ID is required
• unsupported OIDC provider [%s]

AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12). Data as JSON: /api/errors/e411054d9b316980. Report an issue: GitHub.