mirror of
https://github.com/open-webui/open-webui.git
synced 2026-05-06 19:08:59 -05:00
[GH-ISSUE #12325] issue: Microsoft SSO Profile Pictures Causing Severe Performance Degradation in Admin Panels #16556
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/open-webui#16556
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @MushroomLamp-COB on GitHub (Apr 2, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/12325
Check Existing Issues
Installation Method
Git Clone
Open WebUI Version
v0.6.0
Ollama Version (if applicable)
NA
Operating System
Amazon Linux (EC2, Docker container)
Browser (if applicable)
NA
Confirmation
README.md.Expected Behavior
Microsoft SSO authentication should work efficiently without causing significant performance degradation.
There should be an option to use default profile images instead of loading images from the OAuth provider.
When setting a non-existent claim in OAUTH_PICTURE_CLAIM, it should fall back to the default user image rather than the provider's picture URL
Actual Behavior
Microsoft SSO authentication works, but it causes extreme performance issues when loading user data.
The Knowledgebase section and Users section in the admin panel for us took approximately 30 seconds to load just 5 users, pulling large base64 strings. (there are some large images in our tenancy)
Setting OAUTH_PICTURE_CLAIM to a non-existent claim (e.g., "no-claim") doesn't work as expected because the code falls back to the provider's picture URL rather than using the default image.
The application retrieves full-size profile pictures (1-10MB) rather than thumbnails, causing significant load times.
Steps to Reproduce
Logs & Screenshots
NA
Additional Information
Root Cause:
The issue is in backend/open_webui/utils/oauth.py at line 330, where the code is designed to fall back to the OAuth provider's picture URL rather than an empty string when the specified claim doesn't exist:
picture_url = user_data.get( picture_claim, OAUTH_PROVIDERS[provider].get("picture_url", "")This means that when OAUTH_PICTURE_CLAIM is set to a non-existent claim, instead of using an empty string (which would trigger the default user image), it falls back to whatever is defined in
OAUTH_PROVIDERS[provider].get("picture_url", "").Solution:
Change line 330 in backend/open_webui/utils/oauth.py from:
picture_url = user_data.get( picture_claim, OAUTH_PROVIDERS[provider].get("picture_url", "")To:
picture_url = user_data.get(picture_claim, "")This change ensures that when a claim doesn't exist, it falls back to an empty string, which causes the application to use the default user image (user.png) instead of attempting to load the images from Microsoft Entra.
I think that a better solution would be to create an environment variable for OAUTH_USE_PICTURE_CLAIM (bool) to toggle between using the picture claim, or the user.png
@tjbck commented on GitHub (Apr 2, 2025):
PR Welcome.
@MushroomLamp-COB commented on GitHub (Apr 3, 2025):
Thanks, PR raised
#12376
This is my first PR, hopefully all is ok!
@tjbck commented on GitHub (Apr 3, 2025):
7a1e10f3a7Removed
OAUTH_USE_PICTURE_CLAIMin favour of settingOAUTH_PICTURE_CLAIMto empty string. Thanks!@MushroomLamp-COB commented on GitHub (Apr 3, 2025):
Thanks @tjbck
Does this mean we will set OAUTH_PICTURE_CLAIM rather than use a OAUTH_USE_PICTURE_CLAIM env going forward?
@tjbck commented on GitHub (Apr 3, 2025):
Yep! (e.g.
OAUTH_PICTURE_CLAIM="")