siyuan-note/siyuan · error

OIDC redirect URL is required

Error message

OIDC redirect URL is required

What it means

Thrown by oidc_provider.New() when the redirectURL argument is an empty string. The redirect URL is the endpoint the provider sends the authorization code back to after user consent; without it the OAuth2 dance cannot complete. This is the third validation guard in the constructor.

Source

Thrown at kernel/model/oidc_provider/provider.go:43

const (
	googleIssuer = "https://accounts.google.com"
)

type Provider struct {
	kind         string
	oauth2Config *oauth2.Config
	verifier     *oidc.IDTokenVerifier
}

func New(ctx context.Context, config *conf.OIDC, redirectURL string) (*Provider, error) {
	if config == nil {
		return nil, errors.New("OIDC configuration is missing")
	}
	if config.ClientID == "" {
		return nil, errors.New("OIDC client ID is required")
	}
	if redirectURL == "" {
		return nil, errors.New("OIDC redirect URL is required")
	}
	if config.Provider == conf.OIDCProviderGitHub && config.ClientSecret == "" {
		return nil, errors.New("GitHub OAuth client secret is required")
	}
	issuerURL := strings.TrimSpace(config.IssuerURL)
	switch config.Provider {
	case conf.OIDCProviderGoogle:
		issuerURL = googleIssuer
	case conf.OIDCProviderMicrosoft:
		// Microsoft 多租户端点的 issuer 会随租户变化，必须使用租户专属 issuer。
	case conf.OIDCProviderCustom:
	case conf.OIDCProviderGitHub:
		return newGitHub(config, redirectURL), nil
	default:
		return nil, fmt.Errorf("unsupported OIDC provider [%s]", config.Provider)
	}
	if issuerURL == "" {
		return nil, errors.New("OIDC issuer URL is required")

View on GitHub (pinned to 251596fc0d)

Solutions

1. Ensure the server base URL / access address is configured so the OIDC callback URL can be derived.
2. In the calling code, construct and validate redirectURL = baseUrl + "/api/oidc/callback" before invoking New().
3. If behind a reverse proxy, set the correct X-Forwarded-* headers or explicit base URL so the redirect is not empty.

Example fix

// before
provider, err := oidc_provider.New(ctx, config, "")

// after
redirectURL := strings.TrimRight(conf.ServerURL, "/") + "/api/oidc/callback"
if redirectURL == "/api/oidc/callback" {
    return nil, errors.New("server base URL is not configured")
}
provider, err := oidc_provider.New(ctx, config, redirectURL)

if redirectURL == "" {
    return nil, errors.New("redirect URL could not be derived; configure the server base address")
}
provider, err := oidc_provider.New(ctx, config, redirectURL)

func hasRedirectURL(url string) bool {
    return strings.TrimSpace(url) != ""
}

When it happens

Trigger: Calling New() with an empty redirectURL string. This typically means the caller failed to construct the callback URL from the server's base address, or the server base URL is unset/empty in configuration.

Common situations: The SiYuan instance is behind a reverse proxy and the externally-visible base URL was not configured, so the caller computed an empty redirect. The kernel is running in an environment where util.ServerURL or equivalent returns empty. The developer passed a literal empty string during testing.

Related errors

• GitHub OAuth client secret is required
• OIDC configuration is missing
• OIDC client ID is required
• unsupported OIDC provider [%s]
• OIDC issuer URL is required

AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12). Data as JSON: /api/errors/e7c7a25fea3290c6. Report an issue: GitHub.