siyuan-note/siyuan · error

OIDC validation configuration is missing

Error message

OIDC validation configuration is missing

What it means

The validate-flow transaction reached activation but transaction.Config is nil. The config snapshot is captured at validation start and is only cleared on a successful activation (set to nil) or on a failed completion - so nil here means the transaction is in an unexpected state, typically a double-activation attempt.

Source

Thrown at kernel/model/oidc.go:836

	copy := *transaction
	return &copy, true
}

func activateOIDCValidation(pollToken, binding string) (activated bool, err error) {
	oidcTransactions.Lock()
	defer oidcTransactions.Unlock()
	cleanupOIDCTransactionsLocked()
	state := oidcTransactions.byPoll[pollToken]
	transaction := oidcTransactions.byState[state]
	if transaction == nil || transaction.Flow != oidcFlowValidate || transaction.Binding == "" ||
		binding == "" || transaction.Binding != binding || !transaction.Completed || !transaction.Success {
		return false, errors.New("OIDC validation transaction was not found or has expired")
	}
	if transaction.Activated {
		return false, nil
	}
	if transaction.Config == nil {
		return false, errors.New("OIDC validation configuration is missing")
	}
	configurationChanged, swapped := Conf.CompareAndSetOIDC(transaction.ConfigVersion, transaction.Config)
	if !swapped {
		deleteOIDCTransactionLocked(state)
		return false, errors.New("OIDC configuration changed during validation")
	}
	transaction.Config = nil
	transaction.Activated = true
	return configurationChanged, nil
}

func cancelOIDCValidation(pollToken, binding string) bool {
	oidcTransactions.Lock()
	defer oidcTransactions.Unlock()
	cleanupOIDCTransactionsLocked()
	state := oidcTransactions.byPoll[pollToken]
	transaction := oidcTransactions.byState[state]
	if transaction == nil || transaction.Flow != oidcFlowValidate || transaction.Activated || transaction.Binding == "" ||

View on GitHub (pinned to 251596fc0d)

Solutions

1. Do not re-activate - inspect the result of the first activation call.
2. If the first activation errored, re-run validation from the start.
3. Treat an already-activated transaction as success: activateOIDCValidation returns (false, nil) when Activated is already true.

// Distinguish 'already activated' (ok) from a real state error.
activated, err := activateOIDCValidation(pollToken, binding)
if err != nil && strings.Contains(err.Error(), "configuration is missing") {
    // most likely already activated; re-poll to confirm current state
    if tx, ok := pollOIDCTransaction(pollToken, binding); ok && tx.Activated {
        return nil // already activated, nothing to do
    }
}

When it happens

Trigger: Activating a transaction whose Config was already nilled by a prior activation that did not flip Activated, or whose completion failed and cleared Config.

Common situations: Client retries activation after an earlier call already consumed the config; activation racing the completion cleanup path.

Related errors

• OIDC login is not enabled
• OIDC client ID is required
• Unsupported OIDC provider
• OIDC claim rules must include a claim and at least one value
• Unsupported OIDC claim rule operator

AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12). Data as JSON: /api/errors/56b7ce9c911ef6b7. Report an issue: GitHub.