github-starred/open-webui
2
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-07-16 06:03:26 -05:00
Code Issues 2.4k Packages Projects Releases 129 Wiki Activity

[GH-ISSUE #20808] issue: mcp oauth 2.1 callback always ends in 401 not authenticated #122604

New Issue
Closed
opened 2026-05-21 01:30:04 -05:00 by GiteaMirror · 4 comments
GiteaMirror commented 2026-05-21 01:30:04 -05:00
Owner
Copy Link

Originally created by @bk-lg on GitHub (Jan 20, 2026).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/20808

Check Existing Issues

  • I have searched for any existing and/or related issues.
  • I have searched for any existing and/or related discussions.
  • I have also searched in the CLOSED issues AND CLOSED discussions and found no related items (your issue might already be addressed on the development branch!).
  • I am using the latest version of Open WebUI.

Installation Method

Docker

Open WebUI Version

0.7.2

Ollama Version (if applicable)

Operating System

Ubuntu 24.04

Browser (if applicable)

Microsoft Edge 44.0.3719.82

Confirmation

  • I have read and followed all instructions in README.md.
  • I am using the latest version of both Open WebUI and Ollama.
  • I have included the browser console logs.
  • I have included the Docker container logs.
  • I have provided every relevant configuration, setting, and environment variable used in my setup.
  • I have clearly listed every relevant configuration, custom setting, environment variable, and command-line option that influences my setup (such as Docker Compose overrides, .env values, browser settings, authentication configurations, etc).
  • I have documented step-by-step reproduction instructions that are precise, sequential, and leave nothing to interpretation. My steps:
  • Start with the initial platform/version/OS and dependencies used,
  • Specify exact install/launch/configure commands,
  • List URLs visited, user input (incl. example values/emails/passwords if needed),
  • Describe all options and toggles enabled or changed,
  • Include any files or environmental changes,
  • Identify the expected and actual result at each stage,
  • Ensure any reasonably skilled user can follow and hit the same issue.

Expected Behavior

When I configure an MCP Server as Admin with Oauth 2.1 the user can enable the Tool, Login and get's returned to the application without errors and can start to use the mcp component.

Actual Behavior

Tested with:

  • Miro MCP
  • Atlassian MCP

When I enable the tool I get redirected to the corresponding Service(Miro, Atlassian) and authorize the access. Then I get a typical callback and openwebui displays in the Browser the json formatted message detail: "Not authenticated".

The callback urls looks like this: https://llm.example.com/oauth/clients/mcp:miro/callback?code=SomeRedactedCode&state=SomeRedactedState

The return code from the request is 401.
The docker logs schows only the info message with the request and the return code.
After some time the second log message that no oauth session was found gets logged.

Steps to Reproduce

  1. Use Ubuntu 24.04
  2. Use Docker from official Docker APT repository(Docker version 28.3.3, build 980b856)
  3. Start Openwebui with Docker and Network Mode Host listining on 127.0.0.1
  4. User Basic Nginx as reverse proxy with tls termination in the host
  5. Use OpenWeb UI in 0.7.2(I allready had this behaviour with older versions too)
  6. Go To Admin Panel
  7. Open Settings -> External Tools
  8. Add Connection
  9. Select MCP Streamable HTTP
  10. add https://mcp.miro.com as Base URL
  11. Choose OAuth 2.1 for Authentication
  12. Register Client
  13. Verify Connection(Works in OpenWebUI < 0.7.2. Throws in current version 400 Bad Request. But didn't change the behaviour I observed)
  14. Set ID to miro
  15. Set Name to Miro
  16. Save Connection
  17. Open new Chat(I used gpt-5.1 with azure openai services)
  18. Click Integrations -> Tools -> Miro
  19. Login with Miro via M365 Social Login
  20. Select your team
  21. Click Add
  22. Click Continue and get redirected to your Open Web UI Instance
  23. See the error page from the Screenshot with the not authenticated message

Logs & Screenshots

Image 
Jan 20 10:00:39 web01 docker-openwebui[3663256]: 2026-01-20 09:00:39.008 | WARNING  | open_webui.utils.oauth:get_oauth_token:680 - No OAuth session found for user 0f5a8fb5-e949-4ff9-8c66-3fa2e9ee3ce1, client_id mcp:miro

Additional Information

We use OIDC based logins with role management via microsoft entra id for our users.
The behaviour is the same for normal users and admins.

If you need additional information for specific configuration settings of our installation, feel free to reach out.
I attached a redacted version of our env settings for the docker container.

openwebui_env.txt

Originally created by @bk-lg on GitHub (Jan 20, 2026). Original GitHub issue: https://github.com/open-webui/open-webui/issues/20808 ### Check Existing Issues - [x] I have searched for any existing and/or related issues. - [x] I have searched for any existing and/or related discussions. - [x] I have also searched in the CLOSED issues AND CLOSED discussions and found no related items (your issue might already be addressed on the development branch!). - [x] I am using the latest version of Open WebUI. ### Installation Method Docker ### Open WebUI Version 0.7.2 ### Ollama Version (if applicable) - ### Operating System Ubuntu 24.04 ### Browser (if applicable) Microsoft Edge 44.0.3719.82 ### Confirmation - [x] I have read and followed all instructions in `README.md`. - [x] I am using the latest version of **both** Open WebUI and Ollama. - [x] I have included the browser console logs. - [x] I have included the Docker container logs. - [x] I have **provided every relevant configuration, setting, and environment variable used in my setup.** - [x] I have clearly **listed every relevant configuration, custom setting, environment variable, and command-line option that influences my setup** (such as Docker Compose overrides, .env values, browser settings, authentication configurations, etc). - [x] I have documented **step-by-step reproduction instructions that are precise, sequential, and leave nothing to interpretation**. My steps: - Start with the initial platform/version/OS and dependencies used, - Specify exact install/launch/configure commands, - List URLs visited, user input (incl. example values/emails/passwords if needed), - Describe all options and toggles enabled or changed, - Include any files or environmental changes, - Identify the expected and actual result at each stage, - Ensure any reasonably skilled user can follow and hit the same issue. ### Expected Behavior When I configure an MCP Server as Admin with Oauth 2.1 the user can enable the Tool, Login and get's returned to the application without errors and can start to use the mcp component. ### Actual Behavior Tested with: - Miro MCP - Atlassian MCP When I enable the tool I get redirected to the corresponding Service(Miro, Atlassian) and authorize the access. Then I get a typical callback and openwebui displays in the Browser the json formatted message detail: "Not authenticated". The callback urls looks like this: https://llm.example.com/oauth/clients/mcp:miro/callback?code=SomeRedactedCode&state=SomeRedactedState The return code from the request is 401. The docker logs schows only the info message with the request and the return code. After some time the second log message that no oauth session was found gets logged. ### Steps to Reproduce 1. Use Ubuntu 24.04 2. Use Docker from official Docker APT repository(Docker version 28.3.3, build 980b856) 3. Start Openwebui with Docker and Network Mode Host listining on 127.0.0.1 4. User Basic Nginx as reverse proxy with tls termination in the host 5. Use OpenWeb UI in 0.7.2(I allready had this behaviour with older versions too) 6. Go To Admin Panel 7. Open Settings -> External Tools 8. Add Connection 9. Select MCP Streamable HTTP 10. add https://mcp.miro.com as Base URL 11. Choose OAuth 2.1 for Authentication 12. Register Client 13. Verify Connection(Works in OpenWebUI < 0.7.2. Throws in current version 400 Bad Request. But didn't change the behaviour I observed) 14. Set ID to miro 15. Set Name to Miro 16. Save Connection 17. Open new Chat(I used gpt-5.1 with azure openai services) 18. Click Integrations -> Tools -> Miro 19. Login with Miro via M365 Social Login 20. Select your team 21. Click Add 22. Click Continue and get redirected to your Open Web UI Instance 23. See the error page from the Screenshot with the not authenticated message ### Logs & Screenshots <img width="238" height="76" alt="Image" src="https://github.com/user-attachments/assets/e7fd736e-a2b2-4c0b-b1c2-7d9cba5e44eb" /> ``` Jan 20 10:00:39 web01 docker-openwebui[3663256]: 2026-01-20 09:00:39.008 | WARNING | open_webui.utils.oauth:get_oauth_token:680 - No OAuth session found for user 0f5a8fb5-e949-4ff9-8c66-3fa2e9ee3ce1, client_id mcp:miro ``` ### Additional Information We use OIDC based logins with role management via microsoft entra id for our users. The behaviour is the same for normal users and admins. If you need additional information for specific configuration settings of our installation, feel free to reach out. I attached a redacted version of our env settings for the docker container. [openwebui_env.txt](https://github.com/user-attachments/files/24733658/openwebui_env.txt)
GiteaMirror added the bug label 2026-05-21 01:30:04 -05:00
GiteaMirror commented 2026-05-21 01:30:07 -05:00
Author
Owner
Copy Link

@owui-terminator[bot] commented on GitHub (Jan 20, 2026):

🔍 Similar Issues Found

I found some existing issues that might be related to this one. Please check if any of these are duplicates or contain helpful solutions:

  1. #19823 Issue: MCP with OAuth 2.1 Authorization/Token retrival is broken in v0.6.41
    by mllab-nl • Dec 08, 2025 • bug

  2. #19116 issue: MCP OAuth 2.1 client registration fails when policy_uri, client_uri, logo_uri or tos_uri are not set
    by xqqp • Nov 11, 2025 • bug

  3. #19148 issue: Verify OAuth mcp server sends incorrect authorization header
    by Oleg52 • Nov 12, 2025 • bug

  4. #18010 issue: MCP OAuth 2.1 flow doesn't match standard (missing code_challenge and resource_url)
    by hsuyuming • Oct 02, 2025 • bug

  5. #20629 issue: MCP server response fails
    by thrasher • Jan 12, 2026 • bug

Show 3 more related issues

  1. #20291 issue: MCP Atlassian OAuth token refresh fails with "Constructor parameter should be str" in v0.6.43
    by rolandscho • Dec 31, 2025 • bug

  2. #19792 issue: OAuth Login redirects to https://openwebui.domain.org/oauth/oidc/openwebui.domain.org after succesful login
    by StNiosem • Dec 06, 2025 • bug

  3. #19813 issue: Failed to connect to MCP server, while the connection test works fine
    by spi-dlp • Dec 08, 2025 • bug

💡 Tips:

  • If this is a duplicate, please consider closing this issue and adding any additional details to the existing one
  • If you found a solution in any of these issues, please share it here to help others

This comment was generated automatically by a bot. Please react with a 👍 if this comment was helpful, or a 👎 if it was not.

<!-- gh-comment-id:3771836227 --> @owui-terminator[bot] commented on GitHub (Jan 20, 2026): 🔍 **Similar Issues Found** I found some existing issues that might be related to this one. Please check if any of these are duplicates or contain helpful solutions: 1. [#19823](https://github.com/open-webui/open-webui/issues/19823) **Issue: MCP with OAuth 2.1 Authorization/Token retrival is broken in v0.6.41** *by mllab-nl • Dec 08, 2025 • `bug`* 2. [#19116](https://github.com/open-webui/open-webui/issues/19116) **issue: MCP OAuth 2.1 client registration fails when policy_uri, client_uri, logo_uri or tos_uri are not set** *by xqqp • Nov 11, 2025 • `bug`* 3. [#19148](https://github.com/open-webui/open-webui/issues/19148) **issue: Verify OAuth mcp server sends incorrect authorization header** *by Oleg52 • Nov 12, 2025 • `bug`* 4. [#18010](https://github.com/open-webui/open-webui/issues/18010) **issue: MCP OAuth 2.1 flow doesn't match standard (missing code_challenge and resource_url)** *by hsuyuming • Oct 02, 2025 • `bug`* 5. [#20629](https://github.com/open-webui/open-webui/issues/20629) **issue: MCP server response fails** *by thrasher • Jan 12, 2026 • `bug`* <details> <summary>Show 3 more related issues</summary> 6. [#20291](https://github.com/open-webui/open-webui/issues/20291) **issue: MCP Atlassian OAuth token refresh fails with "Constructor parameter should be str" in v0.6.43** *by rolandscho • Dec 31, 2025 • `bug`* 7. [#19792](https://github.com/open-webui/open-webui/issues/19792) **issue: OAuth Login redirects to https://openwebui.domain.org/oauth/oidc/openwebui.domain.org after succesful login** *by StNiosem • Dec 06, 2025 • `bug`* 8. [#19813](https://github.com/open-webui/open-webui/issues/19813) **issue: Failed to connect to MCP server, while the connection test works fine** *by spi-dlp • Dec 08, 2025 • `bug`* </details> --- 💡 **Tips:** - If this is a duplicate, please consider closing this issue and adding any additional details to the existing one - If you found a solution in any of these issues, please share it here to help others *This comment was generated automatically by a bot.* Please react with a 👍 if this comment was helpful, or a 👎 if it was not.
GiteaMirror commented 2026-05-21 01:30:07 -05:00
Author
Owner
Copy Link

@bk-lg commented on GitHub (Jan 20, 2026):

For context: I rechecked all the linked issues the bot posted and as far as I can understand with my system engineers view none of these describes my observed behaviour.

<!-- gh-comment-id:3771869517 --> @bk-lg commented on GitHub (Jan 20, 2026): For context: I rechecked all the linked issues the bot posted and as far as I can understand with my system engineers view none of these describes my observed behaviour.
GiteaMirror commented 2026-05-21 01:30:08 -05:00
Author
Owner
Copy Link

@Lemmons commented on GitHub (Jan 21, 2026):

FYI - I filed a bug report for the Verify Connection issue yesterday

<!-- gh-comment-id:3780497600 --> @Lemmons commented on GitHub (Jan 21, 2026): FYI - I filed a [bug report for the Verify Connection issue](https://github.com/open-webui/open-webui/issues/20828) yesterday
GiteaMirror commented 2026-05-21 01:30:09 -05:00
Author
Owner
Copy Link

@tjbck commented on GitHub (Jan 21, 2026):

@Lemmons should be addressed in dev, testing wanted here!

<!-- gh-comment-id:3781558098 --> @tjbck commented on GitHub (Jan 21, 2026): @Lemmons should be addressed in dev, testing wanted here!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
confirmed
confirmed issue
core
documentation
enhancement
good first issue
help wanted
non-core
pull-request
Mirrored from GitHub Pull Request
 python
question
testing wanted
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/open-webui#122604
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?