[GH-ISSUE #17113] feat: Adjust OAUTH_BLOCKED_GROUPS to allow regex patterns #18170

New Issue

GiteaMirror · 2026-04-20T00:23:20-05:00

GiteaMirror commented

2026-04-20 00:23:20 -05:00

Originally created by @wggcch on GitHub (Sep 1, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/17113

Check Existing Issues

I have searched the existing issues and discussions.

Problem Description

Current Bahavior:

When I use an oauth provider for Login and Group management, I can also set a List of local Groups, that will not be updated by oauth with the ENV: OAUTH_BLOCKED_GROUPS
This can be a List of Names like ['my-group', 'another-group'] and so on.

But what if I have already created multiple groups in OpenWebui and do not want to exclude every single group?

Desired Solution you'd like

Support Regex Matching to partly allow more or even all groups to be blocked from OAuth overwriting

within oauth.py

import re
# ...existing code...

def is_blocked_group(group_name, blocked_groups):
    for blocked in blocked_groups:
        try:
            # try to interprete regex
            if re.fullmatch(blocked, group_name):
                return True
        except re.error:
            if blocked == group_name:
                return True
    return False

That than would allow us to use the ENV like this:

OAUTH_BLOCKED_GROUPS = ['local-.*'] -> block all groups to be overwritten from oauth provider starting with `local-'

Alternatives Considered

No response

Additional Context

We are currently using keycloak as our oauth provider and we have had some Groups managed within Openwebui. We wanted to sync our keycloak Groups into open webui but than we saw, that this would overwrite our open webui managed Groups.

For every open webui managed group we now need to

add it to the OAUTH_BLOCKED_GROUPS List
restart the open webui docker container so that the env is updated

Originally created by @wggcch on GitHub (Sep 1, 2025). Original GitHub issue: https://github.com/open-webui/open-webui/issues/17113 ### Check Existing Issues - [x] I have searched the existing issues and discussions. ### Problem Description Current Bahavior: When I use an oauth provider for Login and Group management, I can also set a List of local Groups, that will not be updated by oauth with the ENV: OAUTH_BLOCKED_GROUPS This can be a List of Names like ['my-group', 'another-group'] and so on. But what if I have already created multiple groups in OpenWebui and do not want to exclude every single group? ### Desired Solution you'd like Support Regex Matching to partly allow more or even all groups to be blocked from OAuth overwriting within oauth.py ```python import re # ...existing code... def is_blocked_group(group_name, blocked_groups): for blocked in blocked_groups: try: # try to interprete regex if re.fullmatch(blocked, group_name): return True except re.error: if blocked == group_name: return True return False ``` That than would allow us to use the ENV like this: OAUTH_BLOCKED_GROUPS = ['local-.*'] -> block all groups to be overwritten from oauth provider starting with `local-' ### Alternatives Considered _No response_ ### Additional Context We are currently using keycloak as our oauth provider and we have had some Groups managed within Openwebui. We wanted to sync our keycloak Groups into open webui but than we saw, that this would overwrite our open webui managed Groups. For every open webui managed group we now need to - add it to the OAUTH_BLOCKED_GROUPS List - restart the open webui docker container so that the env is updated

GiteaMirror closed this issue

2026-04-20 00:23:21 -05:00

GiteaMirror commented

2026-04-20 00:23:22 -05:00

@tjbck commented on GitHub (Sep 1, 2025):

PR welcome!

@tjbck commented on GitHub (Sep 1, 2025): PR welcome!

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#18170