[GH-ISSUE #7215] SSO (oauth2proxy) only a single user can sign in #14661

New Issue

GiteaMirror · 2026-04-19T20:58:21-05:00

GiteaMirror commented

2026-04-19 20:58:21 -05:00

Originally created by @simonfrey on GitHub (Nov 22, 2024).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/7215

Bug Report

Installation Method

docker-compose.yml with oauth2proxy

services:
  openwebui:
    image: ghcr.io/open-webui/open-webui:v0.4.2
    volumes:
      - ./owebvolume:/app/backend/data
    environment:
      - 'HOST=0.0.0.0'
      - 'WEBUI_URL=https://chat.XXX.de'
      - 'ENABLE_OLLAMA_API=False'
      - 'OPENAI_API_KEY=sk-proj-XXX'
      - 'OPENAI_API_BASE_URL=http://llm-proxy-api:8080/llm/v1'
      - 'ENABLE_COMMUNITY_SHARING=False'
      - 'ENABLE_SIGNUP=True'
      - 'DEFAULT_USER_ROLE=user'
      - 'ENABLE_OAUTH_SIGNUP=True'
      - 'WEBUI_AUTH_TRUSTED_NAME_HEADER=X-Forwarded-Email'
      - 'WEBUI_AUTH_TRUSTED_EMAIL_HEADER=X-Forwarded-Email'
    restart: unless-stopped
  oauth2proxy:
    image: quay.io/oauth2-proxy/oauth2-proxy:v7.6.0
    environment:
      OAUTH2_PROXY_HTTP_ADDRESS: 0.0.0.0:4180
      OAUTH2_PROXY_UPSTREAMS: http://openwebui:8080/
      OAUTH2_PROXY_PROVIDER: google
      OAUTH2_PROXY_CLIENT_ID: "XXX.apps.googleusercontent.com"
      OAUTH2_PROXY_CLIENT_SECRET: "GOCSPX-YYY"
      OAUTH2_PROXY_EMAIL_DOMAINS: "XXX.de"
      OAUTH2_PROXY_COOKIE_SECRET: "XXX="
      OAUTH2_PROXY_COOKIE_SECURE: "false"
      OAUTH2_PROXY_REDIRECT_URL: "https://chat.XXX.de/oauth2/callback"
      OAUTH2_PROXY_GCP_HEALTHCHECKS: "true"
      OAUTH2_PROXY_SKIP_AUTH_ROUTES: "GET=^/opensearch.xml"
    restart: unless-stopped
    entrypoint: "/bin/oauth2-proxy --custom-templates-dir=/oauth2proxy_template"
    volumes:
      - ./oauth2proxy_template:/oauth2proxy_template
    ports:
      - 4180:4180/tcp

Environment

Open WebUI Version: v0.4.2
Operating System: Ubuntu Linux
Browser (if applicable): Firefox

Confirmation:

I have read and followed all the instructions provided in the README.md.
I am on the latest version of both Open WebUI and Ollama.
I have included the browser console logs.
I have included the Docker container logs.
I have provided the exact steps to reproduce the bug in the "Steps to Reproduce" section below.

Expected Behavior:

Every user can sign in. First one becomes admin, all other ones become users (directly activated)

Actual Behavior:

Only first user can log in. Everyone else becomes the following error:

You do not have permission to access this resource. Please contact your administrator for assistance.

Description

Bug Summary:

I want to sign in

Reproduction Details

Steps to Reproduce:

Have two different users sign in. First one becomes admin, second one can't log in at all.

Logs and Screenshots

Browser Console Logs:

Screenshots/Screen Recordings (if applicable):

Originally created by @simonfrey on GitHub (Nov 22, 2024). Original GitHub issue: https://github.com/open-webui/open-webui/issues/7215 # Bug Report ## Installation Method docker-compose.yml with oauth2proxy ```yml services: openwebui: image: ghcr.io/open-webui/open-webui:v0.4.2 volumes: - ./owebvolume:/app/backend/data environment: - 'HOST=0.0.0.0' - 'WEBUI_URL=https://chat.XXX.de' - 'ENABLE_OLLAMA_API=False' - 'OPENAI_API_KEY=sk-proj-XXX' - 'OPENAI_API_BASE_URL=http://llm-proxy-api:8080/llm/v1' - 'ENABLE_COMMUNITY_SHARING=False' - 'ENABLE_SIGNUP=True' - 'DEFAULT_USER_ROLE=user' - 'ENABLE_OAUTH_SIGNUP=True' - 'WEBUI_AUTH_TRUSTED_NAME_HEADER=X-Forwarded-Email' - 'WEBUI_AUTH_TRUSTED_EMAIL_HEADER=X-Forwarded-Email' restart: unless-stopped oauth2proxy: image: quay.io/oauth2-proxy/oauth2-proxy:v7.6.0 environment: OAUTH2_PROXY_HTTP_ADDRESS: 0.0.0.0:4180 OAUTH2_PROXY_UPSTREAMS: http://openwebui:8080/ OAUTH2_PROXY_PROVIDER: google OAUTH2_PROXY_CLIENT_ID: "XXX.apps.googleusercontent.com" OAUTH2_PROXY_CLIENT_SECRET: "GOCSPX-YYY" OAUTH2_PROXY_EMAIL_DOMAINS: "XXX.de" OAUTH2_PROXY_COOKIE_SECRET: "XXX=" OAUTH2_PROXY_COOKIE_SECURE: "false" OAUTH2_PROXY_REDIRECT_URL: "https://chat.XXX.de/oauth2/callback" OAUTH2_PROXY_GCP_HEALTHCHECKS: "true" OAUTH2_PROXY_SKIP_AUTH_ROUTES: "GET=^/opensearch.xml" restart: unless-stopped entrypoint: "/bin/oauth2-proxy --custom-templates-dir=/oauth2proxy_template" volumes: - ./oauth2proxy_template:/oauth2proxy_template ports: - 4180:4180/tcp ``` ## Environment - **Open WebUI Version:** v0.4.2 - **Operating System:** Ubuntu Linux - **Browser (if applicable):** Firefox **Confirmation:** - [x] I have read and followed all the instructions provided in the README.md. - [x] I am on the latest version of both Open WebUI and Ollama. - [x] I have included the browser console logs. - [x] I have included the Docker container logs. - [x] I have provided the exact steps to reproduce the bug in the "Steps to Reproduce" section below. ## Expected Behavior: Every user can sign in. First one becomes admin, all other ones become users (directly activated) ## Actual Behavior: Only first user can log in. Everyone else becomes the following error: ``` You do not have permission to access this resource. Please contact your administrator for assistance. ``` ## Description **Bug Summary:** I want to sign in ## Reproduction Details **Steps to Reproduce:** Have two different users sign in. First one becomes admin, second one can't log in at all. ## Logs and Screenshots **Browser Console Logs:** ![Screenshot_select-area_20241122112804](https://github.com/user-attachments/assets/0c449164-2297-44e1-aa77-6d7ffa7199bd) **Screenshots/Screen Recordings (if applicable):** ![Screenshot_select-area_20241122112853](https://github.com/user-attachments/assets/062c6ff1-cd3e-4f16-be65-9cdf38837540)

GiteaMirror closed this issue

2026-04-19 20:58:21 -05:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#14661