[GH-ISSUE #23668] Bug: admin-configured scopes overridden by discovered scopes_supported in static-credential OAuth flow #20040

New Issue

GiteaMirror · 2026-04-20T02:37:21-05:00

GiteaMirror commented

2026-04-20 02:37:21 -05:00

Originally created by @dhruvalgupta2003 on GitHub (Apr 13, 2026).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/23668

Summary

In get_oauth_client_info_with_static_credentials, the scope value is unconditionally set from the authorization server's scopes_supported metadata when available. This silently overrides any custom scope string the admin supplied when registering the tool server.

For setups that rely on scope bundling (e.g. registering multiple MCP servers backed by the same Entra AD app, so one consent grants access to all of them — Calendar + Mail + User in a typical M365 deployment), this override means the authorization request ends up with only the generic discovered scopes (e.g. openid profile offline_access) and omits the custom resource scopes. Users get prompted for consent multiple times, or the resulting access token is missing the required audiences.

Location

backend/open_webui/utils/oauth.py around lines 478–481:

scope = None
if oauth_server_metadata and oauth_server_metadata.scopes_supported:
    scope = ' '.join(oauth_server_metadata.scopes_supported)

Impact

Breaks the "one consent, N MCP servers" pattern for M365 / Entra ID integrations.
Silently drops admin-chosen scopes with no warning.

Suggested fix

Prefer the admin-provided scope if one was supplied; fall back to discovered scopes_supported only when no explicit scope exists. Log when metadata-discovered scopes are being used so the behaviour is visible.

Originally created by @dhruvalgupta2003 on GitHub (Apr 13, 2026). Original GitHub issue: https://github.com/open-webui/open-webui/issues/23668 ### Summary In `get_oauth_client_info_with_static_credentials`, the scope value is unconditionally set from the authorization server's `scopes_supported` metadata when available. This silently overrides any custom scope string the admin supplied when registering the tool server. For setups that rely on **scope bundling** (e.g. registering multiple MCP servers backed by the same Entra AD app, so one consent grants access to all of them — Calendar + Mail + User in a typical M365 deployment), this override means the authorization request ends up with only the generic discovered scopes (e.g. `openid profile offline_access`) and omits the custom resource scopes. Users get prompted for consent multiple times, or the resulting access token is missing the required audiences. ### Location `backend/open_webui/utils/oauth.py` around lines 478–481: ```python scope = None if oauth_server_metadata and oauth_server_metadata.scopes_supported: scope = ' '.join(oauth_server_metadata.scopes_supported) ``` ### Impact - Breaks the "one consent, N MCP servers" pattern for M365 / Entra ID integrations. - Silently drops admin-chosen scopes with no warning. ### Suggested fix Prefer the admin-provided scope if one was supplied; fall back to discovered `scopes_supported` only when no explicit scope exists. Log when metadata-discovered scopes are being used so the behaviour is visible.

GiteaMirror closed this issue

2026-04-20 02:37:22 -05:00

GiteaMirror commented

2026-04-20 02:37:23 -05:00

@tjbck commented on GitHub (Apr 17, 2026):

Likely addressed with 349ea4ea9e.

Dynamic Oauth2.1 should be used in general.

@tjbck commented on GitHub (Apr 17, 2026): Likely addressed with 349ea4ea9e577f2cbfb4917ef5f52e5ac53c5b70. Dynamic Oauth2.1 should be used in general.

GiteaMirror referenced this issue

2026-04-20 05:56:19 -05:00

[PR #20040] [CLOSED] fix: add duplicate check to batch file processing #25440

GiteaMirror referenced this issue

2026-04-25 13:23:51 -05:00

[PR #20040] [CLOSED] fix: add duplicate check to batch file processing #41070

GiteaMirror referenced this issue

2026-04-30 00:26:02 -05:00

[PR #20040] [CLOSED] fix: add duplicate check to batch file processing #48488

GiteaMirror referenced this issue

2026-05-06 09:46:13 -05:00

[PR #20040] [CLOSED] fix: add duplicate check to batch file processing #64296