enh: OIDC/OAuth2 flow logs #1843

New Issue

GiteaMirror · 2025-11-11T14:54:40-06:00

GiteaMirror commented

2025-11-11 14:54:40 -06:00

Originally created by @senpro-ingwersenk on GitHub (Aug 22, 2024).

Bug Report

There are issues here and there with the OIDC/OAuth implementation that you can find reports on in numerous tickets. The biggest issue is, that the logs give you no feedback on what is wrong exactly and just continues on with weird messages in the frontend - like mismatching email/password, when the request is the result of an OIDC flow. It makes no sense...

So, I would like to ask for more and better debugging so we can get rid of that bug! :)

/cc @brtptrs

Installation Method

I used Docker Compose - but Keycloak lives in a k3s cluster - in fact, in a separate network.

Environment

Open WebUI Version: ghcr.io/open-webui/open-webui:main
Ollama (if applicable): n/a
Operating System: Linux, arm64, Debian 12
Browser (if applicable): Not applicable

Confirmation:

I have read and followed all the instructions provided in the README.md.
I am on the latest version of both Open WebUI and Ollama.
I have included the browser console logs.
I have included the Docker container logs.
I have provided the exact steps to reproduce the bug in the "Steps to Reproduce" section below.

Expected Behavior:

Right now, we only get messages like this:

WARNI [main] OAuth callback error: Expecting value: line 1 column 1 (char 0)

No URL, no parameters, no response body. I even set LOG_LEVEL: trace.

The expected behaviour is to receive more context to reproduce or at least investigate bette rinto where the problem comes from.

Actual Behavior:

Short logs with little information

Description

Bug Summary:
OpenWebUI does not provide further information even under trace logging, making the actual debugging quite difficult.

Reproduction Details

Steps to Reproduce:
There's a couple. In my case, just a basic Keycloak realm ("master") with a provider configured for client/secret, with everything else left on default.

Logs and Screenshots

Browser Console Logs:
n/a

Docker Container Logs:
See above

Screenshots/Screen Recordings (if applicable):
n/a

Additional Information

In my case, Keycloak lives in a separate segment of the main network and there is a chance that it is running into our firewall and I have no real way of finding that out because the firewall my boss chose to use is ... uh ... well, to put it nicely, it is not nice. ;) It has a WAF but it is hard to look into it's logs.

Note

If the bug report is incomplete or does not follow the provided instructions, it may not be addressed. Please ensure that you have followed the steps outlined in the README.md and troubleshooting.md documents, and provide all necessary information for us to reproduce and address the issue. Thank you!

Thank you too!

Originally created by @senpro-ingwersenk on GitHub (Aug 22, 2024). # Bug Report There are issues here and there with the OIDC/OAuth implementation that you can find reports on in numerous tickets. The biggest issue is, that the logs give you no feedback on what is wrong exactly and just continues on with weird messages in the frontend - like mismatching email/password, when the request is the result of an OIDC flow. It makes no sense... So, I would like to ask for more and better debugging so we can get rid of that bug! :) /cc @brtptrs ## Installation Method I used Docker Compose - but Keycloak lives in a k3s cluster - in fact, in a separate network. ## Environment - **Open WebUI Version:** `ghcr.io/open-webui/open-webui:main` - **Ollama (if applicable):** n/a - **Operating System:** Linux, arm64, Debian 12 - **Browser (if applicable):** Not applicable **Confirmation:** - [X] I have read and followed all the instructions provided in the README.md. - [X] I am on the latest version of both Open WebUI and Ollama. - [ ] I have included the browser console logs. - [ ] I have included the Docker container logs. - [ ] I have provided the exact steps to reproduce the bug in the "Steps to Reproduce" section below. ## Expected Behavior: Right now, we only get messages like this: ``` WARNI [main] OAuth callback error: Expecting value: line 1 column 1 (char 0) ``` No URL, no parameters, no response body. I even set `LOG_LEVEL: trace`. The expected behaviour is to receive more context to reproduce or at least investigate bette rinto where the problem comes from. ## Actual Behavior: Short logs with little information ## Description **Bug Summary:** OpenWebUI does not provide further information even under trace logging, making the actual debugging quite difficult. ## Reproduction Details **Steps to Reproduce:** There's a couple. In my case, just a basic Keycloak realm ("master") with a provider configured for client/secret, with everything else left on default. ## Logs and Screenshots **Browser Console Logs:** n/a **Docker Container Logs:** See above **Screenshots/Screen Recordings (if applicable):** n/a ## Additional Information In my case, Keycloak lives in a separate segment of the main network and there is a chance that it is running into our firewall and I have no real way of finding that out because the firewall my boss chose to use is ... uh ... well, to put it nicely, it is not nice. ;) It has a WAF but it is hard to look into it's logs. ## Note > If the bug report is incomplete or does not follow the provided instructions, it may not be addressed. Please ensure that you have followed the steps outlined in the README.md and troubleshooting.md documents, and provide all necessary information for us to reproduce and address the issue. Thank you! Thank you too!

GiteaMirror commented

2025-11-11 14:54:42 -06:00

@tjbck commented on GitHub (Aug 22, 2024):

PR welcome!

@tjbck commented on GitHub (Aug 22, 2024): PR welcome!

GiteaMirror referenced this issue

2025-11-11 17:31:25 -06:00

[PR #1843] [CLOSED] Increase-Context-Length #7608

Sign in to join this conversation.