OIDC App Sync-in

[Stephan-P]

Sync-in keeps throwing up OIDC configuration errors, indicating that the first interaction with VoidAuth is not going as expected.

{
  "statusCode": 400,
  "message": "OIDC provider configuration error"
}

Could there be a mismatch/miscommunication between VoidAuth and Sync-in'?
https://sync-in.com/docs/setup-guide/authentication/oidc

[Stephan-P]

Further details from the Sync-in logs:

sync-in  | [2026-07-07 08:09:28] ERROR (126): [AuthProviderOIDC] [initializeOIDCClient] OIDC client initialization failed: OperationProcessingError: only HTTP and HTTPS requests are allowed | req-dz
sync-in  | [2026-07-07 08:09:28] WARN (126): [HTTP] GET /api/auth/oidc/login (HTTPS/1.1 400) 88.159.160.217 (64 bytes in 4ms) Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 | req-dz
sync-in  |     err: {
sync-in  |       "type": "HttpException",
sync-in  |       "message": "OIDC provider configuration error",
sync-in  |       "stack":
sync-in  |           HttpException: OIDC provider configuration error
sync-in  |               at AuthProviderOIDC.mapOIDCInitializationError (/app/server/authentication/providers/oidc/auth-provider-oidc.service.js:235:28)
sync-in  |               at AuthProviderOIDC.initializeOIDCClient (/app/server/authentication/providers/oidc/auth-provider-oidc.service.js:219:24)
sync-in  |               at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
sync-in  |               at async AuthProviderOIDC.getConfig (/app/server/authentication/providers/oidc/auth-provider-oidc.service.js:59:27)
sync-in  |               at async AuthProviderOIDC.getAuthorizationUrl (/app/server/authentication/providers/oidc/auth-provider-oidc.service.js:65:24)
sync-in  |               at async AuthOIDCController.oidcLogin (/app/server/authentication/providers/oidc/auth-oidc.controller.js:34:21)
sync-in  |       "response": "OIDC provider configuration error",
sync-in  |       "status": 400,
sync-in  |       "name": "HttpException"
sync-in  |     }

What does all this mean?

[notquitenothing]

Based on that error message maybe a malformed issuer URL or redirect URL? The issuer URL should be copied from VoidAuth (OIDC Apps -> OIDC Information Dropdown -> OIDC Issuer Endpoint). For your issuer URL it looks like it should just be something like https://syncin.example.com/api/auth/oidc/callback , it looks like it should take the form of https://{your-sync-in-domain}/api/auth/oidc/callback but I am not sure

[Stephan-P]

Okay, I had the Issuer URL wrong. I didn't realise I had to follow VodAuth's lead in this.
Indeed the redirect URL (defined by Sync-in) is https://sync-in.my-domain.tld/api/auth/oidc/callback, which I made sure is properly entered in the VoidAuth OIDC App config.

Still, things don't go well with the following error message:

  "statusCode": 400,
  "message": "OIDC authentication failed"
}

And the Sync-in docker log (for which I will have to create new Client-ID and Client-Secret):

sync-in  | [2026-07-08 20:42:35] ERROR (101): [AuthProviderOIDC] [handleCallback] OIDC callback error: HttpException: No email address found in the OIDC profile | req-1b
sync-in  | [2026-07-08 20:42:35] WARN (101): [HTTP] GET /api/auth/oidc/callback?code=tMvIwLVYLPZg0ChQdUB26NXBkCmBHYcwL6uicxb-O8n&state=nzgI74mbv-Cuwc3qvhTef0XA0Jz_4wyvU1AD3jGZnCE&iss=https%3A%2F%2Flogin.my-domain.tld%2Foidc (HTTPS/1.1 400) 88.159.160.217 (57 bytes in 64ms) Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36 | req-1b
sync-in  |     err: {
sync-in  |       "type": "HttpException",
sync-in  |       "message": "OIDC authentication failed",
sync-in  |       "stack":
sync-in  |           HttpException: OIDC authentication failed
sync-in  |               at AuthProviderOIDC.handleCallback (/app/server/authentication/providers/oidc/auth-provider-oidc.service.js:152:23)
sync-in  |               at process.processTicksAndRejections (node:internal/process/task_queues:104:5)
sync-in  |               at async AuthOIDCController.oidcCallback (/app/server/authentication/providers/oidc/auth-oidc.controller.js:39:22)
sync-in  |       "response": "OIDC authentication failed",
sync-in  |       "status": 400,
sync-in  |       "name": "HttpException"
sync-in  |     }

What's this first line about "No email address found" about?

[notquitenothing]

It looks like Sync-In requires OIDC profiles to have an email address (even if you do not have the requireVerifiedEmail security option enabled). You can see their code here where the email is required and throws this error otherwise. Indeed it seems like Sync-In users are required to have an email address.

[Stephan-P]

Ooh, you've been checking Sync-in's code (!)
I've also asked Johan@synv-in what is going on here.

I know and understand that Sync-in uses username and/or email address to link the oidc user to its own known users (and even create new accounts as necessary), But this error is playing up right after the user has clicked the button "log in using OIDC" well before a username or its email address is made known by VoidAuth.

I've got two users specified in VoidAuth, where the admin account does not have an e-mail address and therefore is not email verified. Could this play a role here as well?
(It's because of the unique email addresses that I have not been able to fill this field for the admin account. Though, I could add me an email alias... I will do that to try and see.)

[Stephan-P]

The incorrect issuer URL was the problem.

After that was fixed I was being blocked by Sync-in, because I was already logged into VoidAuth with the admin account that 1. wasn't email verified because it didn't have an e-mail and 2.: not a known account with Sync-in.
After I deliberately logged out of VoidAuth, I did receive the login page and after I had logged on there as the other known user I got in Sync-in alright.

Such a pleasant discovery during a sleepless midnight hour. I'm going to sleep again now and I'll create a new oidc app entry with new service ID and service secret tomorrow ;-)