Is your feature request related to a problem? Please describe.
I'm currently using Microsoft Entra ID as my OAuth provider but Entra does not reliably return user emails in the email claim of the OAuth ID token. Some users in my environment do not have the email field set but instead have the email returned in the preferred_username or username claims.
As a result, when a user who does not have the email claim tries to login, the logs show OAuth callback failed, email is missing and the user is redirected to an API page listing The email or password provided is incorrect. Please check for typos and try logging in again.
Describe the solution you'd like
To more widely support different OAuth configurations, environment variables should be added similar to OAUTH_USERNAME_CLAIM allowing users to specify an alternative email claim, such as OAUTH_EMAIL_CLAIM and/or MICROSOFT_EMAIL_CLAIM.
This should be pretty straightforward, only need to define the variable(s) in backend/config.py and change line 2161 of main.py to something like this:
Alternatively, for the Microsoft auth provider, it could check for the preferred_username claim and fall back to that value if the email claim doesn't exist.
Originally created by @cdgco on GitHub (Aug 7, 2024).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/4435
**Is your feature request related to a problem? Please describe.**
I'm currently using Microsoft Entra ID as my OAuth provider but Entra does not reliably return user emails in the `email` claim of the OAuth ID token. Some users in my environment do not have the email field set but instead have the email returned in the `preferred_username` or `username` claims.
As a result, when a user who does not have the email claim tries to login, the logs show `OAuth callback failed, email is missing` and the user is redirected to an API page listing `The email or password provided is incorrect. Please check for typos and try logging in again.`
**Describe the solution you'd like**
To more widely support different OAuth configurations, environment variables should be added similar to `OAUTH_USERNAME_CLAIM` allowing users to specify an alternative email claim, such as `OAUTH_EMAIL_CLAIM` and/or `MICROSOFT_EMAIL_CLAIM`.
This should be pretty straightforward, only need to define the variable(s) in [backend/config.py](https://github.com/open-webui/open-webui/tree/99d10d1189452ad49fcace219e9c90ae65906cd1/backend/config.py) and change [line 2161 of main.py](https://github.com/open-webui/open-webui/blob/99d10d1189452ad49fcace219e9c90ae65906cd1/backend/main.py#L2161) to something like this:
```
email_claim = webui_app.state.config.OAUTH_EMAIL_CLAIM
email = user_data.get(email_claim, "")
```
I'm happy to open a PR as well.
**Describe alternatives you've considered**
Alternatively, for the Microsoft auth provider, it could check for the `preferred_username` claim and fall back to that value if the `email` claim doesn't exist.
That would be a valuable PR, I think the approach you outline should work. If this primarily only affects microsoft, perhaps the variable should be named accordingly, otherwise this may make things difficult if you use both Google and Microsoft (as I do). FWIW, it seems all my users return a valid email claim 😅
<!-- gh-comment-id:2274149615 -->
@justinh-rahb commented on GitHub (Aug 7, 2024):
That would be a valuable PR, I think the approach you outline should work. If this primarily only affects microsoft, perhaps the variable should be named accordingly, otherwise this may make things difficult if you use both Google and Microsoft (as I do). FWIW, it seems all my users return a valid `email` claim 😅
I ended following the same implementation as the picture claim that seems to be provider agnostic and I think it would be good to have this support OIDC as well, so using just the OAUTH_EMAIL_CLAIM should cover all the bases.
I think the missing claim is something to do with aliases in Azure but not totally sure. My primary account has an email but my org has some permissions only / alias accounts that don't seem to have emails assigned.
<!-- gh-comment-id:2274164855 -->
@cdgco commented on GitHub (Aug 7, 2024):
I ended following the same implementation as the picture claim that seems to be provider agnostic and I think it would be good to have this support OIDC as well, so using just the `OAUTH_EMAIL_CLAIM` should cover all the bases.
I think the missing claim is something to do with aliases in Azure but not totally sure. My primary account has an email but my org has some permissions only / alias accounts that don't seem to have emails assigned.
@someonewating commented on GitHub (May 24, 2025):
I believe the root cause is indeed Microsoft Entra ID.
Not sure why @justinh-rahb 's Entra ID is able to return email claim. In my tenant, the account does not have email claim unless it is configured.
After adding the email address to the 'Contact Information'. The error is resolved.
<!-- gh-comment-id:2906650257 -->
@someonewating commented on GitHub (May 24, 2025):
I believe the root cause is indeed Microsoft Entra ID.
Not sure why @justinh-rahb 's Entra ID is able to return `email` claim. In my tenant, the account does not have `email` claim unless it is configured.
After adding the email address to the 'Contact Information'. The error is resolved.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @cdgco on GitHub (Aug 7, 2024).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/4435
Is your feature request related to a problem? Please describe.
I'm currently using Microsoft Entra ID as my OAuth provider but Entra does not reliably return user emails in the
emailclaim of the OAuth ID token. Some users in my environment do not have the email field set but instead have the email returned in thepreferred_usernameorusernameclaims.As a result, when a user who does not have the email claim tries to login, the logs show
OAuth callback failed, email is missingand the user is redirected to an API page listingThe email or password provided is incorrect. Please check for typos and try logging in again.Describe the solution you'd like
To more widely support different OAuth configurations, environment variables should be added similar to
OAUTH_USERNAME_CLAIMallowing users to specify an alternative email claim, such asOAUTH_EMAIL_CLAIMand/orMICROSOFT_EMAIL_CLAIM.This should be pretty straightforward, only need to define the variable(s) in backend/config.py and change line 2161 of main.py to something like this:
I'm happy to open a PR as well.
Describe alternatives you've considered
Alternatively, for the Microsoft auth provider, it could check for the
preferred_usernameclaim and fall back to that value if theemailclaim doesn't exist.@justinh-rahb commented on GitHub (Aug 7, 2024):
That would be a valuable PR, I think the approach you outline should work. If this primarily only affects microsoft, perhaps the variable should be named accordingly, otherwise this may make things difficult if you use both Google and Microsoft (as I do). FWIW, it seems all my users return a valid
emailclaim 😅@cdgco commented on GitHub (Aug 7, 2024):
I ended following the same implementation as the picture claim that seems to be provider agnostic and I think it would be good to have this support OIDC as well, so using just the
OAUTH_EMAIL_CLAIMshould cover all the bases.I think the missing claim is something to do with aliases in Azure but not totally sure. My primary account has an email but my org has some permissions only / alias accounts that don't seem to have emails assigned.
@someonewating commented on GitHub (May 24, 2025):
I believe the root cause is indeed Microsoft Entra ID.
Not sure why @justinh-rahb 's Entra ID is able to return
emailclaim. In my tenant, the account does not haveemailclaim unless it is configured.After adding the email address to the 'Contact Information'. The error is resolved.