I have searched for all existing open AND closed issues and discussions for similar requests. I have found none that is comparable to my request.
Verify Feature Scope
I have read through and understood the scope definition for feature requests in the Issues section. I believe my feature request meets the definition and belongs in the Issues section instead of the Discussions.
Problem Description
My OIDC provider returns claims for "affiliation" as a semicolon separated list, ex "Faculty@ucsc.edu;Employee@ucsc.edu;Member@ucsc.edu". However, OWUI treats this as a single monolithic group name.
Desired Solution you'd like
I propose that we detect semicolons and interpret the result as a list of group names. I have implemented this in my local copy of OWUI with the following code:
Screenshot shows before and after of the proposed change
For the CILogon authentication system that supports thousands of universities worldwide, semicolons are the conventional separator for group membership associated with the affiliation claim. See "affiliation" on cilogon.org/oidc
Originally created by @ianmichaelterry on GitHub (Nov 6, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/18979
### Check Existing Issues
- [x] I have searched for all existing **open AND closed** issues and discussions for similar requests. I have found none that is comparable to my request.
### Verify Feature Scope
- [x] I have read through and understood the scope definition for feature requests in the Issues section. I believe my feature request meets the definition and belongs in the Issues section instead of the Discussions.
### Problem Description
My OIDC provider returns claims for "affiliation" as a semicolon separated list, ex "Faculty@ucsc.edu;Employee@ucsc.edu;Member@ucsc.edu". However, OWUI treats this as a single monolithic group name.
### Desired Solution you'd like
I propose that we detect semicolons and interpret the result as a list of group names. I have implemented this in my local copy of OWUI with the following code:
```python
if ";" in claim_data:
user_oauth_groups = claim_data.split(";")
else:
user_oauth_groups = [claim_data]
```
This code goes in the `update_user_groups` function in `oauth.py`, approximate line number 920.
ex.
```python
if isinstance(claim_data, list):
user_oauth_groups = claim_data
elif isinstance(claim_data, str):
if ";" in claim_data:
user_oauth_groups = claim_data.split(";")
else:
user_oauth_groups = [claim_data]
else:
user_oauth_groups = []
```
### Alternatives Considered
_No response_
### Additional Context
Screenshot shows before and after of the proposed change
<img width="971" height="187" alt="Image" src="https://github.com/user-attachments/assets/02694490-27df-44d9-ab46-ae8464a542ae" />
For the CILogon authentication system that supports thousands of universities worldwide, semicolons are the conventional separator for group membership associated with the affiliation claim. See "affiliation" on [cilogon.org/oidc](https://cilogon.org/oidc)
I want to endorse this change because it will have a big impact on my ability to spread OWUI-based BayLeaf to many other universities around the world.
<!-- gh-comment-id:3499269973 -->
@rndmcnlly commented on GitHub (Nov 6, 2025):
I want to endorse this change because it will have a big impact on my ability to spread OWUI-based [BayLeaf](https://bayleaf.chat/about) to many other universities around the world.
<!-- gh-comment-id:3499270736 -->
@Classic298 commented on GitHub (Nov 6, 2025):
should be addressed by this env var which was introduced today - please confirm.
https://docs.openwebui.com/getting-started/env-configuration#oauth_roles_separator
Wait, please reopen, OAUTH_ROLES_SEPARATOR is not a solution here because we need a separator for groups rather than roles.
That said, OAUTH_GROUPS_SEPARATOR would be a nice name for a configurable version of what we've hard-coded as ; in the solution above.
<!-- gh-comment-id:3499347698 -->
@rndmcnlly commented on GitHub (Nov 6, 2025):
Wait, please reopen, `OAUTH_ROLES_SEPARATOR` is not a solution here because we need a separator for **groups** rather than **roles**.
That said, `OAUTH_GROUPS_SEPARATOR` would be a nice name for a configurable version of what we've hard-coded as `;` in the solution above.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @ianmichaelterry on GitHub (Nov 6, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/18979
Check Existing Issues
Verify Feature Scope
Problem Description
My OIDC provider returns claims for "affiliation" as a semicolon separated list, ex "Faculty@ucsc.edu;Employee@ucsc.edu;Member@ucsc.edu". However, OWUI treats this as a single monolithic group name.
Desired Solution you'd like
I propose that we detect semicolons and interpret the result as a list of group names. I have implemented this in my local copy of OWUI with the following code:
This code goes in the
update_user_groupsfunction inoauth.py, approximate line number 920.ex.
Alternatives Considered
No response
Additional Context
Screenshot shows before and after of the proposed change
For the CILogon authentication system that supports thousands of universities worldwide, semicolons are the conventional separator for group membership associated with the affiliation claim. See "affiliation" on cilogon.org/oidc
@rndmcnlly commented on GitHub (Nov 6, 2025):
I want to endorse this change because it will have a big impact on my ability to spread OWUI-based BayLeaf to many other universities around the world.
@Classic298 commented on GitHub (Nov 6, 2025):
should be addressed by this env var which was introduced today - please confirm.
https://docs.openwebui.com/getting-started/env-configuration#oauth_roles_separator
@rndmcnlly commented on GitHub (Nov 6, 2025):
Wait, please reopen,
OAUTH_ROLES_SEPARATORis not a solution here because we need a separator for groups rather than roles.That said,
OAUTH_GROUPS_SEPARATORwould be a nice name for a configurable version of what we've hard-coded as;in the solution above.@Classic298 commented on GitHub (Nov 6, 2025):
Pr welcome, sorry for the misunderstanding
@rndmcnlly commented on GitHub (Nov 6, 2025):
No problem, here's the PR: https://github.com/open-webui/open-webui/pull/18983
@Classic298 commented on GitHub (Nov 6, 2025):
@rndmcnlly please reopen with correct CLA