I have searched the existing issues and discussions.
Problem Description
Group management varies between OAuth, LDAP, and trusted header authentication methods leading to lack of features depending on which auth model the deployment is using.
Desired Solution you'd like
Create a single util class that will create a standard approach for group management during log in attempts
Create a generic set of config values for use in the new group util:
ENABLE_GROUP_MANAGEMENT
If false then group management is not performed
ENABLE_GROUP_CREATION
If false then unrecognized groups will not be created.
BLOCKED_GROUPS
A list of groups that will not be sync'ed with the application
Continue support for the following config values until they are deprecated
ENABLE_OAUTH_GROUP_MANAGEMENT
ENABLE_OAUTH_GROUP_CREATION
OAUTH_BLOCKED_GROUPS
ENABLE_LDAP_GROUP_MANAGEMENT
ENABLE_LDAP_GROUP_CREATION
Alternatives Considered
No response
Additional Context
No response
Originally created by @cmbaatz on GitHub (Oct 2, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/18015
### Check Existing Issues
- [x] I have searched the existing issues and discussions.
### Problem Description
Group management varies between OAuth, LDAP, and trusted header authentication methods leading to lack of features depending on which auth model the deployment is using.
### Desired Solution you'd like
1. Create a single util class that will create a standard approach for group management during log in attempts
2. Create a generic set of config values for use in the new group util:
1. ENABLE_GROUP_MANAGEMENT
If false then group management is not performed
2. ENABLE_GROUP_CREATION
If false then unrecognized groups will not be created.
3. BLOCKED_GROUPS
A list of groups that will not be sync'ed with the application
3. Continue support for the following config values until they are deprecated
1. ENABLE_OAUTH_GROUP_MANAGEMENT
2. ENABLE_OAUTH_GROUP_CREATION
3. OAUTH_BLOCKED_GROUPS
4. ENABLE_LDAP_GROUP_MANAGEMENT
5. ENABLE_LDAP_GROUP_CREATION
### Alternatives Considered
_No response_
### Additional Context
_No response_
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @cmbaatz on GitHub (Oct 2, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/18015
Check Existing Issues
Problem Description
Group management varies between OAuth, LDAP, and trusted header authentication methods leading to lack of features depending on which auth model the deployment is using.
Desired Solution you'd like
If false then group management is not performed
If false then unrecognized groups will not be created.
A list of groups that will not be sync'ed with the application
Alternatives Considered
No response
Additional Context
No response