OpenID Connect sign-in failed

Logged when a single sign-on with an oidc provider fails before the management policy runs, or when sign-out cannot get the provider's sign-out URL. The stage field is start, callback, or logout. At callback, common causes are an expired or missing login state cookie, a callback that belongs to another browser, a failed code exchange, and an ID token with a wrong issuer, audience, nonce, signature, or lifetime. The user sees an error on the Radiator UI login page.

Check the error and the provider field. Verify that client_id, client_secret, and redirect_url match the application registered at the identity provider, and that the clocks of Radiator and the provider are synchronized. A missing login state means the sign-in took more than 10 minutes or the browser blocked the cookie.