I have searched all existing open AND closed issues and discussions for similar requests. I have found none that is comparable to my request.
Problem Description
I am in the unfortunate position that my Identity Provider sets groups in the token using an LDAP-like syntax, so instead of something like mygroup, I get values like cn=mygroup,ou=myunit,o=myorg.
Switching the separator to something else like a semicolon would work as a quick fix, but would be a breaking change, even worse, it would cause the same issue for the other unfortunate people who might have semicolons in the role names.
A simple thing that comes to mind would be to escape the comma with backslashes, but then you'd need to split them with a lookbehind, maybe with a regex.
Maybe a nicer approach would be to try to parse the env var as JSON, and only if that fails, treat it as a comma-separated list?
I'm happy to send a PR if you can advise what kind of solution would you be willing to accept.
Alternatives Considered
We have a workaround for now, which is to use another claim for the roles, but that is less than ideal.
Additional Context
No response
Originally created by @attilaolah on GitHub (Oct 23, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/18542
### Check Existing Issues
- [x] I have searched all existing open AND closed issues and discussions for similar requests. I have found none that is comparable to my request.
### Problem Description
I am in the unfortunate position that my Identity Provider sets groups in the token using an LDAP-like syntax, so instead of something like `mygroup`, I get values like `cn=mygroup,ou=myunit,o=myorg`.
These cannot be used with `OAUTH_ALLOWED_ROLES` or `OAUTH_ADMIN_ROLES` because the commas are used as a separator, so the value is treated as if I specified the parts as individual roles, see here: https://github.com/open-webui/open-webui/blob/7a83e7dfa367d19f762ec17cac5e4a94ea2bd97d/backend/open_webui/config.py#L579-L592
### Desired Solution you'd like
Switching the separator to something else like a semicolon would work as a quick fix, but would be a breaking change, even worse, it would cause the same issue for the other unfortunate people who might have semicolons in the role names.
A simple thing that comes to mind would be to escape the comma with backslashes, but then you'd need to split them with a lookbehind, maybe with a regex.
Maybe a nicer approach would be to try to parse the env var as JSON, and only if that fails, treat it as a comma-separated list?
I'm happy to send a PR if you can advise what kind of solution would you be willing to accept.
### Alternatives Considered
We have a workaround for now, which is to use another claim for the roles, but that is less than ideal.
### Additional Context
_No response_
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @attilaolah on GitHub (Oct 23, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/18542
Check Existing Issues
Problem Description
I am in the unfortunate position that my Identity Provider sets groups in the token using an LDAP-like syntax, so instead of something like
mygroup, I get values likecn=mygroup,ou=myunit,o=myorg.These cannot be used with
OAUTH_ALLOWED_ROLESorOAUTH_ADMIN_ROLESbecause the commas are used as a separator, so the value is treated as if I specified the parts as individual roles, see here: https://github.com/open-webui/open-webui/blob/7a83e7dfa367d19f762ec17cac5e4a94ea2bd97d/backend/open_webui/config.py#L579-L592Desired Solution you'd like
Switching the separator to something else like a semicolon would work as a quick fix, but would be a breaking change, even worse, it would cause the same issue for the other unfortunate people who might have semicolons in the role names.
A simple thing that comes to mind would be to escape the comma with backslashes, but then you'd need to split them with a lookbehind, maybe with a regex.
Maybe a nicer approach would be to try to parse the env var as JSON, and only if that fails, treat it as a comma-separated list?
I'm happy to send a PR if you can advise what kind of solution would you be willing to accept.
Alternatives Considered
We have a workaround for now, which is to use another claim for the roles, but that is less than ideal.
Additional Context
No response