What causes "unsupported OIDC provider [%s]" in siyuan-note/siyuan?

unsupported OIDC provider [%s]

Error message

unsupported OIDC provider [%s]

What it means

Thrown by oidc_provider.New() when config.Provider does not match any of the known constants: OIDCProviderGoogle, OIDCProviderMicrosoft, OIDCProviderCustom, or OIDCProviderGitHub. The switch's default case formats the unrecognized value into the error so the developer can see what was passed.

Source

Thrown at kernel/model/oidc_provider/provider.go:58

		return nil, errors.New("OIDC client ID is required")
	}
	if redirectURL == "" {
		return nil, errors.New("OIDC redirect URL is required")
	}
	if config.Provider == conf.OIDCProviderGitHub && config.ClientSecret == "" {
		return nil, errors.New("GitHub OAuth client secret is required")
	}
	issuerURL := strings.TrimSpace(config.IssuerURL)
	switch config.Provider {
	case conf.OIDCProviderGoogle:
		issuerURL = googleIssuer
	case conf.OIDCProviderMicrosoft:
		// Microsoft 多租户端点的 issuer 会随租户变化，必须使用租户专属 issuer。
	case conf.OIDCProviderCustom:
	case conf.OIDCProviderGitHub:
		return newGitHub(config, redirectURL), nil
	default:
		return nil, fmt.Errorf("unsupported OIDC provider [%s]", config.Provider)
	}
	if issuerURL == "" {
		return nil, errors.New("OIDC issuer URL is required")
	}
	discovered, err := oidc.NewProvider(ctx, issuerURL)
	if err != nil {
		return nil, fmt.Errorf("discover OIDC provider failed: %w", err)
	}
	scopes := append([]string{}, config.Scopes...)
	if !contains(scopes, oidc.ScopeOpenID) {
		scopes = append([]string{oidc.ScopeOpenID}, scopes...)
	}
	return &Provider{
		kind: conf.OIDCProviderCustom,
		oauth2Config: &oauth2.Config{
			ClientID:     config.ClientID,
			ClientSecret: config.ClientSecret,
			Endpoint:     discovered.Endpoint(),

View on GitHub (pinned to 251596fc0d)

Solutions

Set config.Provider to one of: OIDCProviderGoogle, OIDCProviderMicrosoft, OIDCProviderCustom, or OIDCProviderGitHub.
Check the raw config value for typos or case sensitivity issues.
If you added a new provider constant, add a case branch in the switch statement of New().

Example fix

// before
config.Provider = "git_hub" // typo

// after
config.Provider = conf.OIDCProviderGitHub

Defensive patterns

Strategy: validation

Validate before calling

validProviders := []string{conf.OIDCProviderGoogle, conf.OIDCProviderMicrosoft, conf.OIDCProviderCustom, conf.OIDCProviderGitHub}
valid := false
for _, p := range validProviders {
    if config.Provider == p {
        valid = true
        break
    }
}
if !valid {
    return nil, fmt.Errorf("unsupported OIDC provider [%s]; use google, microsoft, custom, or github", config.Provider)
}

Type guard

func isValidOIDCProvider(p string) bool {
    switch p {
    case conf.OIDCProviderGoogle, conf.OIDCProviderMicrosoft, conf.OIDCProviderCustom, conf.OIDCProviderGitHub:
        return true
    }
    return false
}

Prevention

Use the defined constants (conf.OIDCProvider*) rather than raw strings.
Validate provider against the known set in the API handler before calling New().
When adding a new provider, add both the constant and the switch case simultaneously.

When it happens

Trigger: Calling New() with config.Provider set to a value outside the four supported enum constants. This can happen if the conf.OIDCProvider type is a raw string/int and the admin or a config migration wrote an arbitrary value, or a new provider constant was added to conf but not yet handled in this switch.

Common situations: A typo in the configuration file (e.g., 'gitHub' instead of the expected constant value). A future version added a new provider constant but the switch in provider.go was not updated. The config was hand-edited to an invalid provider string.

Related errors

AI-assisted analysis of siyuan-note/siyuan@251596fc0d (2026-08-12). Data as JSON: /api/errors/689f078518e37518. Report an issue: GitHub.