usememos/memos · error

type must be OAUTH2

Error message

type must be OAUTH2

What it means

Thrown when an identity-provider deployment file declares a type other than OAUTH2. The deployment-config path only supports OAuth2 identity providers; the storepb.IdentityProvider proto has other type values (TYPE_UNSPECIFIED, LDAP in some forks) but the file loader rejects anything except "OAUTH2" so unsupported providers cannot be silently dropped. Startup of configuration loading fails with this error.

Source

Thrown at store/deployment_config.go:169

			return errors.Errorf("failed to decode protobuf JSON: unknown field %q", matches[1])
		}
		return errors.New("failed to decode protobuf JSON; verify field names, value types, and JSON syntax")
	}
	return nil
}

func validateDeploymentIdentityProvider(provider *storepb.IdentityProvider) error {
	if provider.Id != 0 {
		return errors.New("id must be omitted")
	}
	if !base.UIDMatcher.MatchString(provider.Uid) {
		return errors.New("uid is invalid")
	}
	if strings.TrimSpace(provider.Name) == "" {
		return errors.New("name is required")
	}
	if provider.Type != storepb.IdentityProvider_OAUTH2 {
		return errors.New("type must be OAUTH2")
	}
	if provider.IdentifierFilter != "" {
		if _, err := regexp.Compile(provider.IdentifierFilter); err != nil {
			return errors.Wrap(err, "identifierFilter must be a valid regular expression")
		}
	}
	config := provider.Config.GetOauth2Config()
	if config == nil {
		return errors.New("config.oauth2Config is required")
	}
	required := []struct {
		name  string
		value string
	}{
		{name: "clientId", value: config.ClientId},
		{name: "clientSecret", value: config.ClientSecret},
		{name: "authUrl", value: config.AuthUrl},
		{name: "tokenUrl", value: config.TokenUrl},

View on GitHub (pinned to 14d757ce1f)

Solutions

1. Set "type": "OAUTH2" explicitly in the memos-idp-*.json file.
2. For non-OAuth2 providers, create them at runtime through the admin UI / IdentityProviderService API instead of deployment files.

Example fix

// before
{ "uid": "github", "name": "GitHub", "config": { "oauth2Config": { ... } } }

// after
{ "uid": "github", "name": "GitHub", "type": "OAUTH2", "config": { "oauth2Config": { ... } } }

if provider.Type != storepb.IdentityProvider_OAUTH2 {
    return errors.New("deployment IdP files only support type OAUTH2")
}

func isSupportedIdpType(t storepb.IdentityProvider_Type) bool {
    return t == storepb.IdentityProvider_OAUTH2
}

When it happens

Trigger: A memos-idp-*.json with "type": "TYPE_UNSPECIFIED", a missing "type" key (defaults to 0 = unspecified), or an LDAP-style provider definition.

Common situations: Omitting the type field assuming it is inferred from the config shape; copying a provider definition from older docs or another Memos fork that supported LDAP; protojson enum written with the wrong value name.

Related errors

• uid is invalid
• name is required
• config.oauth2Config is required
• config.oauth2Config.scopes is required
• config.oauth2Config.fieldMapping.identifier is required

AI-assisted analysis of usememos/memos@14d757ce1f (2026-08-15). Data as JSON: /api/errors/7896b79531934067. Report an issue: GitHub.