siyuan-note/siyuan · error

remote access requires at least one authentication method

Error message

remote access requires at least one authentication method

What it means

Returned by ValidateOIDCConfigurationChange (kernel/model/oidc.go:585) when OIDC is being disabled (or is already nil/not enabled) while the workspace is exposed for remote access (requireRemoteRedirect=true), there is no alternative authentication enabled (hasAlternativeAuthentication=false), and the change is not privileged (bypassAuthentication=false). Removing OIDC in that state would leave remote access with no auth, so the change is refused.

Source

Thrown at kernel/model/oidc.go:585

	}
	redirectURL := "http://127.0.0.1:6806/api/system/oidc/callback"
	if config.RedirectURL != "" {
		var err error
		if redirectURL, err = validatePublicOIDCRedirectURL(config.RedirectURL); err != nil {
			return err
		}
	}
	validationContext, cancel := context.WithTimeout(ctx, oidcProviderTimeout)
	defer cancel()
	_, err := oidc_provider.New(validationContext, config, redirectURL)
	return err
}

func ValidateOIDCConfigurationChange(ctx context.Context, config *conf.OIDC, requireRemoteRedirect,
	hasAlternativeAuthentication, bypassAuthentication bool) error {
	if config == nil || !config.Enabled {
		if requireRemoteRedirect && !hasAlternativeAuthentication && !bypassAuthentication {
			return errors.New("remote access requires at least one authentication method")
		}
		return nil
	}
	if requireRemoteRedirect {
		if _, err := validatePublicOIDCRedirectURL(config.RedirectURL); err != nil {
			return err
		}
	}
	return ValidateOIDCProviderConfiguration(ctx, config)
}

func effectiveOIDCRedirectURL(c *gin.Context, flow string) (string, error) {
	if flow == oidcFlowMobile {
		return oidcMobileRedirectURL, nil
	}
	if flow == oidcFlowWeb && !IsLocalRequest(c) {
		return validatePublicOIDCRedirectURL(Conf.GetOIDC().RedirectURL)
	}

View on GitHub (pinned to 251596fc0d)

Solutions

1. Enable an alternative authentication method (application token or user accounts) before disabling OIDC.
2. Or restrict the kernel back to loopback-only access before disabling OIDC.
3. Or call the config endpoint from a local/privileged context that sets bypassAuthentication=true.

Example fix

// before — disabling OIDC on a remote-exposed workspace
setOIDC(enabled=false) // -> error
// after — enable app token first, then disable OIDC
enableAppAccessToken()
setOIDC(enabled=false)

if !oidcWillBeEnabled && requireRemoteRedirect && !hasOtherAuth && !bypass {
    return errors.New("enable an alternative auth before disabling OIDC")
}

func safeToDisableOIDC(remote, altAuth, bypass bool) bool {
    return !remote || altAuth || bypass
}

When it happens

Trigger: Turning OIDC off via /api/system/setOIDC when the kernel listens on a non-loopback address and no other auth (app access token, account system) is active.

Common situations: Admin disables OIDC on a publicly exposed SiYuan instance without first enabling an alternative; API call from a remote host during config edit.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• A public HTTPS OIDC redirect URL is required for remote acce
• OIDC login is not enabled
• OIDC client ID is required
• OIDC issuer URL must use HTTPS unless it is a loopback addre
• OIDC login requires at least one claim rule when Allow all u

AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12). Data as JSON: /api/errors/9148b9d7c6c5b7fc. Report an issue: GitHub.