Browser (if applicable): Chrome Version 130.0.6723.58 (Official Build) (arm64)
Confirmation:
I have read and followed all the instructions provided in the README.md.
I am on the latest version of both Open WebUI and Ollama.
I have included the browser console logs.
I have included the Docker container logs.
I have provided the exact steps to reproduce the bug in the "Steps to Reproduce" section below.
Expected Behavior:
Should be logged into Open WebUI
Actual Behavior:
Getting the error message:
Your provider has not provided a trusted header. Please contact your administrator for assistance.
Description
Bug Summary:
Trying to run oauth2-proxy as reverse proxy in front of Open Web UI, following instructions -> https://docs.openwebui.com/tutorials/features/sso/#oauth2-proxy
Unfortunately, Open WebUI doesn't see the the e-mail that is being set in the header. I've seen others have got this working, so not sure what I've misconfigured.
Reproduction Details
Steps to Reproduce:
Run the docker-compose provided and go to http://localhost:8082
Originally created by @derek-assurity on GitHub (Oct 22, 2024).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/6321
# Bug Report
## Installation Method
Running using docker compose
`docker-compose.yml`
``` docker
# OAuth2 test
services:
oauth2-proxy:
image: quay.io/oauth2-proxy/oauth2-proxy
ports:
- 8082:4180
volumes:
- ./config:/config
entrypoint: ["/bin/oauth2-proxy", "--config", "/config/oauth2-proxy.cfg"]
open-webui:
image:
ghcr.io/open-webui/open-webui:0.3.30
environment:
ENABLE_LOGIN_FORM: 'false'
OAUTH_MERGE_ACCOUNTS_BY_EMAIL: 'true'
DEFAULT_USER_ROLE: 'user'
WEBUI_AUTH_TRUSTED_EMAIL_HEADER: 'X-Auth-Request-Email'
ENABLE_COMMUNITY_SHARING: 'false'
ENABLE_MESSAGE_RATING: 'false'
PORT: 8084
ENABLE_OAUTH_SIGNUP: 'true'
WEBUI_AUTH: 'false'
```
The config for OAuth2 is:
``` toml
auth_logging = true
auth_logging_format = "{{.Client}} - {{.Username}} [{{.Timestamp}}] [{{.Status}}] {{.Message}}"
client_id = "<REDACTED>.apps.googleusercontent.com"
client_secret = "<REDACTED>"
cookie_secret = "<REDACTED>"
cookie_secure = false
custom_templates_dir = "/config/web/"
email_domains = [
"*"
]
http_address = "0.0.0.0:4180"
oidc_issuer_url = "https://oauth2.googleapis.com"
pass_access_token = true
pass_basic_auth = true
pass_user_headers = true
profile_url = "https://www.googleapis.com/oauth2/v1/userinfo"
provider = "google"
proxy_websockets = true
redirect_url = "http://localhost:8082/oauth2/callback"
request_logging = true
request_logging_format = "{{.Client}} - {{.Username}} [{{.Timestamp}}] {{.Host}} {{.RequestMethod}} {{.Upstream}} {{.RequestURI}} {{.Protocol}} {{.UserAgent}} {{.StatusCode}} {{.ResponseSize}} {{.RequestDuration}}"
scope = "openid email profile"
set_authorization_header = true
set_xauthrequest = true
skip_jwt_bearer_tokens = true
upstreams = [
"http://open-webui:8084"
]
```
## Environment
- **Open WebUI Version:** v0.3.30
- **Ollama (if applicable):** N/A
- **Operating System:** macOS Sequoia 15.0.1
- **Browser (if applicable):** Chrome Version 130.0.6723.58 (Official Build) (arm64)
**Confirmation:**
- [X] I have read and followed all the instructions provided in the README.md.
- [X] I am on the latest version of both Open WebUI and Ollama.
- [X] I have included the browser console logs.
- [X] I have included the Docker container logs.
- [X] I have provided the exact steps to reproduce the bug in the "Steps to Reproduce" section below.
## Expected Behavior:
Should be logged into Open WebUI
## Actual Behavior:
Getting the error message:
```
Your provider has not provided a trusted header. Please contact your administrator for assistance.
```
## Description
**Bug Summary:**
Trying to run `oauth2-proxy` as reverse proxy in front of Open Web UI, following instructions -> https://docs.openwebui.com/tutorials/features/sso/#oauth2-proxy
Unfortunately, Open WebUI doesn't see the the e-mail that is being set in the header. I've seen others have got this working, so not sure what I've misconfigured.
## Reproduction Details
**Steps to Reproduce:**
Run the `docker-compose` provided and go to `http://localhost:8082`
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @derek-assurity on GitHub (Oct 22, 2024).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/6321
Bug Report
Installation Method
Running using docker compose
docker-compose.ymlThe config for OAuth2 is:
Environment
Open WebUI Version: v0.3.30
Ollama (if applicable): N/A
Operating System: macOS Sequoia 15.0.1
Browser (if applicable): Chrome Version 130.0.6723.58 (Official Build) (arm64)
Confirmation:
Expected Behavior:
Should be logged into Open WebUI
Actual Behavior:
Getting the error message:
Description
Bug Summary:
Trying to run
oauth2-proxyas reverse proxy in front of Open Web UI, following instructions -> https://docs.openwebui.com/tutorials/features/sso/#oauth2-proxyUnfortunately, Open WebUI doesn't see the the e-mail that is being set in the header. I've seen others have got this working, so not sure what I've misconfigured.
Reproduction Details
Steps to Reproduce:
Run the
docker-composeprovided and go tohttp://localhost:8082