Before submitting, make sure you've checked the following:
Target branch: Please verify that the pull request targets the dev branch.
Description: Provide a concise description of the changes made in this pull request.
Changelog: Ensure a changelog entry following the format of Keep a Changelog is added at the bottom of the PR description.
Documentation: Have you updated relevant documentation Open WebUI Docs, or other documentation sources?
Dependencies: Are there any new dependencies? Have you updated the dependency versions in the documentation?
Testing: Have you written and run sufficient tests for validating the changes?
Code review: Have you performed a self-review of your code, addressing any coding standard issues and ensuring adherence to the project's coding standards?
Label: To cleary categorize this pull request, assign a relevant label to the pull request title, using one of the following:
BREAKING CHANGE: Significant changes that may affect compatibility
build: Changes that affect the build system or external dependencies
ci: Changes to our continuous integration processes or workflows
chore: Refactor, cleanup, or other non-functional code changes
docs: Documentation update or addition
feat: Introduces a new feature or enhancement to the codebase
fix: Bug fix or error correction
i18n: Internationalization or localization changes
perf: Performance improvement
refactor: Code restructuring for better maintainability, readability, or scalability
style: Changes that do not affect the meaning of the code (white-space, formatting, missing semi-colons, etc.)
test: Adding missing tests or correcting existing tests
WIP: Work in progress, a temporary label for incomplete or ongoing work
Adds support for SSO logins with Google, Microsoft, or an OIDC provider.
Env vars:
ENABLE_OAUTH_SIGNUP - allow accounts to be created when logging in with oauth
OAUTH_MERGE_ACCOUNTS_BY_EMAIL - allow logging in to the account keyed by the email address present in the id token. This is less secure because handling the provided email address requires a lot of care that I have not put in.
OAUTH_PROVIDER_NAME - Name of the provider to show on the UI, defaults to SSO
Set redirect URI to <backend>/oauth/oidc/callback
As email addresses are not generally trusted - authentication is matched against the sub field of the ID token unless OAUTH_MERGE_ACCOUNTS_BY_EMAIL is enabled.
Added
OIDC support - Admins can now configure login via Google, Microsoft, or a custom OIDC provider.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/open-webui/open-webui/pull/2574
**Author:** [@cheahjs](https://github.com/cheahjs)
**Created:** 5/26/2024
**Status:** ✅ Merged
**Merged:** 6/25/2024
**Merged by:** [@tjbck](https://github.com/tjbck)
**Base:** `dev` ← **Head:** `feat/oauth`
---
### 📝 Commits (10+)
- [`a842d8d`](https://github.com/open-webui/open-webui/commit/a842d8d62beaa9aedb6608ea36631b06cb9f7d03) deps: add authlib
- [`0210a10`](https://github.com/open-webui/open-webui/commit/0210a105bfb4527f31e2bf1fb5086b0341ffe156) feat: experimental SSO support for Google, Microsoft, and OIDC
- [`b3557d0`](https://github.com/open-webui/open-webui/commit/b3557d05b177833d62a4db02f680396cfe3ad2e1) fix: bad authlib version
- [`7385016`](https://github.com/open-webui/open-webui/commit/7385016e364fdf796c7ef5871c1a47c097a46857) fix: only get user by emails without oauth sub
- [`776bb28`](https://github.com/open-webui/open-webui/commit/776bb2892c169d6c96d19750f0f61b7f77f3f170) fix: bad user get
- [`4a4e323`](https://github.com/open-webui/open-webui/commit/4a4e323a44b29f84a43abcfa32c8935fa58d91b5) refac: rename OPENID -> OAUTH
- [`06dbf59`](https://github.com/open-webui/open-webui/commit/06dbf5974253c90a6dd7c33cb069b2245637a16f) feat: make oauth config persist into config.json
- [`985fdca`](https://github.com/open-webui/open-webui/commit/985fdca585a6c2538cc8c1fe7097ce7406c063ec) refac: move things around, uplift oauth endpoints
- [`6a36039`](https://github.com/open-webui/open-webui/commit/6a36039a59efd8cbcf2909dab880a4b6daf8ba0d) Merge remote-tracking branch 'upstream/dev' into feat/oauth
- [`a1f4706`](https://github.com/open-webui/open-webui/commit/a1f4706aa17957e9eba8694ec3a44e9f68eec43f) fix: OAUTH_MERGE_ACCOUNTS_BY_EMAIL not being correctly read
### 📊 Changes
**52 files changed** (+633 additions, -13 deletions)
<details>
<summary>View changed files</summary>
➕ `backend/apps/webui/internal/migrations/017_add_user_oauth_sub.py` (+49 -0)
📝 `backend/apps/webui/main.py` (+2 -0)
📝 `backend/apps/webui/models/auths.py` (+4 -1)
📝 `backend/apps/webui/models/users.py` (+25 -0)
📝 `backend/apps/webui/routers/auths.py` (+0 -1)
📝 `backend/config.py` (+139 -0)
📝 `backend/main.py` (+174 -2)
📝 `backend/requirements.txt` (+1 -0)
📝 `pyproject.toml` (+1 -0)
📝 `requirements-dev.lock` (+9 -3)
📝 `requirements.lock` (+9 -3)
📝 `src/lib/i18n/locales/ar-BH/translation.json` (+2 -0)
📝 `src/lib/i18n/locales/bg-BG/translation.json` (+2 -0)
📝 `src/lib/i18n/locales/bn-BD/translation.json` (+2 -0)
📝 `src/lib/i18n/locales/ca-ES/translation.json` (+2 -0)
📝 `src/lib/i18n/locales/ceb-PH/translation.json` (+2 -0)
📝 `src/lib/i18n/locales/de-DE/translation.json` (+2 -0)
📝 `src/lib/i18n/locales/dg-DG/translation.json` (+2 -0)
📝 `src/lib/i18n/locales/en-GB/translation.json` (+2 -0)
📝 `src/lib/i18n/locales/en-US/translation.json` (+2 -0)
_...and 32 more files_
</details>
### 📄 Description
# Pull Request Checklist
**Before submitting, make sure you've checked the following:**
- [x] **Target branch:** Please verify that the pull request targets the `dev` branch.
- [ ] **Description:** Provide a concise description of the changes made in this pull request.
- [ ] **Changelog:** Ensure a changelog entry following the format of [Keep a Changelog](https://keepachangelog.com/) is added at the bottom of the PR description.
- [ ] **Documentation:** Have you updated relevant documentation [Open WebUI Docs](https://github.com/open-webui/docs), or other documentation sources?
- [ ] **Dependencies:** Are there any new dependencies? Have you updated the dependency versions in the documentation?
- [x] **Testing:** Have you written and run sufficient tests for validating the changes?
- [ ] **Code review:** Have you performed a self-review of your code, addressing any coding standard issues and ensuring adherence to the project's coding standards?
- [x] **Label:** To cleary categorize this pull request, assign a relevant label to the pull request title, using one of the following:
- **BREAKING CHANGE**: Significant changes that may affect compatibility
- **build**: Changes that affect the build system or external dependencies
- **ci**: Changes to our continuous integration processes or workflows
- **chore**: Refactor, cleanup, or other non-functional code changes
- **docs**: Documentation update or addition
- **feat**: Introduces a new feature or enhancement to the codebase
- **fix**: Bug fix or error correction
- **i18n**: Internationalization or localization changes
- **perf**: Performance improvement
- **refactor**: Code restructuring for better maintainability, readability, or scalability
- **style**: Changes that do not affect the meaning of the code (white-space, formatting, missing semi-colons, etc.)
- **test**: Adding missing tests or correcting existing tests
- **WIP**: Work in progress, a temporary label for incomplete or ongoing work
# Changelog Entry
### Description
Addresses #483
Adds support for SSO logins with Google, Microsoft, or an OIDC provider.
Env vars:
* `ENABLE_OAUTH_SIGNUP` - allow accounts to be created when logging in with oauth
* `OAUTH_MERGE_ACCOUNTS_BY_EMAIL` - allow logging in to the account keyed by the email address present in the id token. This is less secure because handling the provided email address requires a lot of care that I have not put in.
* Google
* see: https://support.google.com/cloud/answer/6158849?hl=en
* GOOGLE_CLIENT_ID - Google OAuth client ID
* GOOGLE_CLIENT_SECRET - Google OAuth client secret
* Set redirect URI to `<backend>/oauth/google/callback`
* Microsoft
* see: https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app
* Only supports either Entra or personal apps, but not combined apps
* MICROSOFT_CLIENT_ID - Microsoft OAuth client ID
* MICROSOFT_CLIENT_SECRET - Microsoft OAuth client secret
* MICROSOFT_CLIENT_TENANT_ID - Microsoft tenant ID, use `9188040d-6c67-4c5b-b112-36a304b66dad` for personal accounts
* * Set redirect URI to `<backend>/oauth/microsoft/callback`
* OIDC
* OAUTH_CLIENT_ID - OIDC client ID
* OAUTH_CLIENT_SECRET - OIDC client secret
* OPENID_PROVIDER_URL - OIDC well known URL, eg https://accounts.google.com/.well-known/openid-configuration
* OAUTH_PROVIDER_NAME - Name of the provider to show on the UI, defaults to SSO
* * Set redirect URI to `<backend>/oauth/oidc/callback`
As email addresses are not generally trusted - authentication is matched against the `sub` field of the ID token unless `OAUTH_MERGE_ACCOUNTS_BY_EMAIL` is enabled.
### Added
- OIDC support - Admins can now configure login via Google, Microsoft, or a custom OIDC provider.
### Screenshots or Videos
<img width="865" alt="image" src="https://github.com/open-webui/open-webui/assets/818368/361c2cdb-9c64-4454-bad2-164b2fcc0f8a">
<img width="864" alt="image" src="https://github.com/open-webui/open-webui/assets/818368/055117d6-25ec-4b71-b7da-0e4391c6faab">
Example deployment: https://jscheah-open-webui.hf.space/
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/open-webui/open-webui/pull/2574
Author: @cheahjs
Created: 5/26/2024
Status: ✅ Merged
Merged: 6/25/2024
Merged by: @tjbck
Base:
dev← Head:feat/oauth📝 Commits (10+)
a842d8ddeps: add authlib0210a10feat: experimental SSO support for Google, Microsoft, and OIDCb3557d0fix: bad authlib version7385016fix: only get user by emails without oauth sub776bb28fix: bad user get4a4e323refac: rename OPENID -> OAUTH06dbf59feat: make oauth config persist into config.json985fdcarefac: move things around, uplift oauth endpoints6a36039Merge remote-tracking branch 'upstream/dev' into feat/oautha1f4706fix: OAUTH_MERGE_ACCOUNTS_BY_EMAIL not being correctly read📊 Changes
52 files changed (+633 additions, -13 deletions)
View changed files
➕
backend/apps/webui/internal/migrations/017_add_user_oauth_sub.py(+49 -0)📝
backend/apps/webui/main.py(+2 -0)📝
backend/apps/webui/models/auths.py(+4 -1)📝
backend/apps/webui/models/users.py(+25 -0)📝
backend/apps/webui/routers/auths.py(+0 -1)📝
backend/config.py(+139 -0)📝
backend/main.py(+174 -2)📝
backend/requirements.txt(+1 -0)📝
pyproject.toml(+1 -0)📝
requirements-dev.lock(+9 -3)📝
requirements.lock(+9 -3)📝
src/lib/i18n/locales/ar-BH/translation.json(+2 -0)📝
src/lib/i18n/locales/bg-BG/translation.json(+2 -0)📝
src/lib/i18n/locales/bn-BD/translation.json(+2 -0)📝
src/lib/i18n/locales/ca-ES/translation.json(+2 -0)📝
src/lib/i18n/locales/ceb-PH/translation.json(+2 -0)📝
src/lib/i18n/locales/de-DE/translation.json(+2 -0)📝
src/lib/i18n/locales/dg-DG/translation.json(+2 -0)📝
src/lib/i18n/locales/en-GB/translation.json(+2 -0)📝
src/lib/i18n/locales/en-US/translation.json(+2 -0)...and 32 more files
📄 Description
Pull Request Checklist
Before submitting, make sure you've checked the following:
devbranch.Changelog Entry
Description
Addresses #483
Adds support for SSO logins with Google, Microsoft, or an OIDC provider.
Env vars:
ENABLE_OAUTH_SIGNUP- allow accounts to be created when logging in with oauthOAUTH_MERGE_ACCOUNTS_BY_EMAIL- allow logging in to the account keyed by the email address present in the id token. This is less secure because handling the provided email address requires a lot of care that I have not put in.<backend>/oauth/google/callback9188040d-6c67-4c5b-b112-36a304b66dadfor personal accounts<backend>/oauth/microsoft/callback<backend>/oauth/oidc/callbackAs email addresses are not generally trusted - authentication is matched against the
subfield of the ID token unlessOAUTH_MERGE_ACCOUNTS_BY_EMAILis enabled.Added
Screenshots or Videos
Example deployment: https://jscheah-open-webui.hf.space/
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.