OIDC login requires at least one claim rule when Allow all u

Error message

OIDC login requires at least one claim rule when Allow all users is disabled

What it means

Seventh check in ValidateOIDCConfiguration (kernel/model/oidc.go:536): AllowAll is false and ClaimRules is empty. SiYuan refuses to enable OIDC without an authorization policy — either allow everyone (AllowAll=true) or restrict via at least one claim rule (e.g. group == 'siyuan-users').

Source

Thrown at kernel/model/oidc.go:536

	if config.Provider == conf.OIDCProviderGitHub && config.ClientSecret == "" {
		return errors.New("GitHub OAuth client secret is required")
	}
	if (config.Provider == conf.OIDCProviderCustom || config.Provider == conf.OIDCProviderMicrosoft) && config.IssuerURL == "" {
		return errors.New("OIDC issuer URL is required")
	}
	if (config.Provider == conf.OIDCProviderCustom || config.Provider == conf.OIDCProviderMicrosoft) && config.IssuerURL != "" {
		issuer, err := url.Parse(config.IssuerURL)
		if err != nil || issuer.Host == "" || issuer.User != nil || issuer.RawQuery != "" || issuer.Fragment != "" ||
			(issuer.Scheme != "https" && !util.IsLocalHostname(issuer.Hostname())) {
			return errors.New("OIDC issuer URL must use HTTPS unless it is a loopback address")
		}
	}
	if config.Provider != conf.OIDCProviderCustom && config.Provider != conf.OIDCProviderGoogle &&
		config.Provider != conf.OIDCProviderMicrosoft && config.Provider != conf.OIDCProviderGitHub {
		return errors.New("Unsupported OIDC provider")
	}
	if !config.AllowAll && len(config.ClaimRules) == 0 {
		return errors.New("OIDC login requires at least one claim rule when Allow all users is disabled")
	}
	for _, rule := range config.ClaimRules {
		if rule == nil || rule.Claim == "" || len(rule.Values) == 0 {
			return errors.New("OIDC claim rules must include a claim and at least one value")
		}
		if rule.Operator != conf.OIDCClaimOperatorEquals && rule.Operator != conf.OIDCClaimOperatorContains {
			return errors.New("Unsupported OIDC claim rule operator")
		}
		for _, value := range rule.Values {
			if value == "" {
				return errors.New("OIDC claim rule values cannot be empty")
			}
		}
	}
	return nil
}

func ValidateOIDCMobileConfiguration(config *conf.OIDC) error {

View on GitHub (pinned to 251596fc0d)

Solutions

Add at least one claim rule (e.g. claim='groups', operator='equals', values=['admins']) before saving.
Or set AllowAll=true if every IdP user should be admitted (not recommended for public IdPs).
Use the OIDC test/login flow in settings to confirm a real user matches the rule.

Example fix

// before
cfg := &conf.OIDC{Enabled: true, AllowAll: false, ClaimRules: nil}
// after — restrict by group claim
cfg.ClaimRules = []*conf.OIDCClaimRule{{
    Claim: "groups", Operator: conf.OIDCClaimOperatorEquals, Values: []string{"siyuan-users"},
}}

Defensive patterns

Strategy: validation

Validate before calling

if !cfg.AllowAll && len(cfg.ClaimRules) == 0 {
    return errors.New("add a claim rule or set AllowAll=true")
}
return ValidateOIDCConfiguration(cfg)

Type guard

func authzPolicyPresent(c *conf.OIDC) bool {
    return c.AllowAll || len(c.ClaimRules) > 0
}

Prevention

Always pair 'restrict access' with at least one concrete claim rule.
Prefer claim-rule scoping over AllowAll for any non-trivial IdP.

When it happens

Trigger: Saving an enabled OIDC config with Allow all users off but no claim rules configured, which would otherwise let any valid IdP account into the workspace.

Common situations: Admin enables OIDC, restricts access, but forgets to add a claim rule; or a default config template ships with AllowAll=false and an empty rules slice.

Related errors

AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12). Data as JSON: /api/errors/6677f3f66bec3f17. Report an issue: GitHub.