github-starred/open-webui
2
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-07-11 10:34:13 -05:00
Code Issues 2.4k Packages Projects Releases 129 Wiki Activity

[PR #17619] [CLOSED] Feat: Add separate Client ID for Personal OneDrive to fix authentication #24493

New Issue
Closed
opened 2026-04-20 05:25:47 -05:00 by GiteaMirror · 0 comments
GiteaMirror commented 2026-04-20 05:25:47 -05:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/open-webui/open-webui/pull/17619
Author: @Classic298
Created: 9/20/2025
Status: ❌ Closed

Base: dev ← Head: onedrive-business-personal

📝 Commits (3)

📊 Changes

3 files changed (+45 additions, -28 deletions)

View changed files

📝 backend/open_webui/config.py (+6 -0)
📝 backend/open_webui/main.py (+2 -0)
📝 src/lib/utils/onedrive-file-picker.ts (+37 -28)

📄 Description

PR Title: Feat: Add separate Client ID for Personal OneDrive to fix authentication

PR Description:

This pull request resolves a long-standing architectural flaw in the Microsoft OneDrive integration, as detailed in issue #550.

The Problem

The original implementation used a single environment variable, ONEDRIVE_CLIENT_ID, for both "Work/School" and "Personal" OneDrive authentication flows. This is fundamentally incompatible with Microsoft's identity platform, where business and consumer applications must be registered separately.

This led to a critical bug: if an administrator configured ONEDRIVE_CLIENT_ID for a business tenant (the primary use case), the "Personal OneDrive" feature would inevitably fail with an unauthorized_client error because the business-only Client ID was being presented to the consumer login service (login.live.com).

The Solution

This PR introduces a complete technical fix by separating the configurations for the two account types:

  1. Backend Changes (config.py, main.py):

    • A new environment variable, ONEDRIVE_PERSONAL_CLIENT_ID, has been introduced to hold the Client ID for a separate, consumer-facing Azure App Registration.
    • The /api/config endpoint has been updated to expose this new personal_client_id to the frontend, ensuring the client-side has all necessary credentials.

  2. Frontend Changes (onedrive-file-picker.ts):

    • The core MSAL logic has been refactored. The getMsalInstance function now dynamically selects the correct Client ID based on the authorityType (personal or organizations).
    • If a user selects "Personal OneDrive," the new personalClientId is used.
    • If a user selects "Work/School OneDrive," the original clientId is used.

Impact

  • Fixes Issue (Docs) 550: This change directly resolves the core complaint from the issue, making the personal OneDrive integration functional without breaking the business/SharePoint integration.
  • Enables Full Functionality: Administrators can now configure both personal and business OneDrive integrations, and they will work independently and correctly as the UI implies.
  • Improves User Experience: This eliminates a frustrating and confusing dead-end for users and administrators who were previously unable to use the personal OneDrive feature.

Documentation

To support this change and address all other points from Docs issue 550, the documentation has been comprehensively updated in a parallel effort:

  1. A new tutorial, "Configuring OneDrive & SharePoint Integration," has been created to provide a full, step-by-step guide for setting up both business and personal integrations.
  2. The Environment Variables reference page has been updated to include the new ONEDRIVE_PERSONAL_CLIENT_ID variable and clarify the specific roles of each configuration setting.

This PR, combined with the updated documentation, provides a complete and robust solution for the OneDrive integration.

Updated env var config (dev) based on THIS PR's CHANGES: https://github.com/open-webui/docs/blob/main/docs/getting-started/env-configuration.md#OneDrive

NEW OneDrive setup guide (dev) based on THIS PR's CHANGES: https://github.com/open-webui/docs/blob/dev/docs/tutorials/integrations/onedrive-sharepoint.mdx

Contributor License Agreement

By submitting this pull request, I confirm that I have read and fully agree to the Contributor License Agreement (CLA), and I am providing my contributions under its terms.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/open-webui/pull/17619 **Author:** [@Classic298](https://github.com/Classic298) **Created:** 9/20/2025 **Status:** ❌ Closed **Base:** `dev` ← **Head:** `onedrive-business-personal` --- ### 📝 Commits (3) - [`20de67c`](https://github.com/open-webui/open-webui/commit/20de67cd16339f19e6c8717b6b003c9f0022052a) Update config.py - [`297a041`](https://github.com/open-webui/open-webui/commit/297a041aa262c4ed15f79df51815c867d98dc2c9) Update main.py - [`ff5c2d4`](https://github.com/open-webui/open-webui/commit/ff5c2d4ea9e2f402dd91a1df8a7e321399346b1f) Update onedrive-file-picker.ts ### 📊 Changes **3 files changed** (+45 additions, -28 deletions) <details> <summary>View changed files</summary> 📝 `backend/open_webui/config.py` (+6 -0) 📝 `backend/open_webui/main.py` (+2 -0) 📝 `src/lib/utils/onedrive-file-picker.ts` (+37 -28) </details> ### 📄 Description **PR Title:** Feat: Add separate Client ID for Personal OneDrive to fix authentication **PR Description:** This pull request resolves a long-standing architectural flaw in the Microsoft OneDrive integration, as detailed in issue [#550](https://github.com/open-webui/docs/issues/550). #### **The Problem** The original implementation used a single environment variable, `ONEDRIVE_CLIENT_ID`, for both "Work/School" and "Personal" OneDrive authentication flows. This is fundamentally incompatible with Microsoft's identity platform, where business and consumer applications must be registered separately. This led to a critical bug: if an administrator configured `ONEDRIVE_CLIENT_ID` for a business tenant (the primary use case), the "Personal OneDrive" feature would inevitably fail with an `unauthorized_client` error because the business-only Client ID was being presented to the consumer login service (`login.live.com`). #### **The Solution** This PR introduces a complete technical fix by separating the configurations for the two account types: 1. **Backend Changes (`config.py`, `main.py`):** * A new environment variable, `ONEDRIVE_PERSONAL_CLIENT_ID`, has been introduced to hold the Client ID for a separate, consumer-facing Azure App Registration. * The `/api/config` endpoint has been updated to expose this new `personal_client_id` to the frontend, ensuring the client-side has all necessary credentials. 2. **Frontend Changes (`onedrive-file-picker.ts`):** * The core MSAL logic has been refactored. The `getMsalInstance` function now dynamically selects the correct Client ID based on the `authorityType` (`personal` or `organizations`). * If a user selects "Personal OneDrive," the new `personalClientId` is used. * If a user selects "Work/School OneDrive," the original `clientId` is used. #### **Impact** * **Fixes Issue (Docs) 550:** This change directly resolves the core complaint from the issue, making the personal OneDrive integration functional without breaking the business/SharePoint integration. * **Enables Full Functionality:** Administrators can now configure **both** personal and business OneDrive integrations, and they will work independently and correctly as the UI implies. * **Improves User Experience:** This eliminates a frustrating and confusing dead-end for users and administrators who were previously unable to use the personal OneDrive feature. #### **Documentation** To support this change and address all other points from Docs issue 550, the documentation has been comprehensively updated in a parallel effort: 1. A new tutorial, **"Configuring OneDrive & SharePoint Integration,"** has been created to provide a full, step-by-step guide for setting up both business and personal integrations. 2. The **Environment Variables** reference page has been updated to include the new `ONEDRIVE_PERSONAL_CLIENT_ID` variable and clarify the specific roles of each configuration setting. This PR, combined with the updated documentation, provides a complete and robust solution for the OneDrive integration. Updated env var config (dev) based on THIS PR's CHANGES: https://github.com/open-webui/docs/blob/main/docs/getting-started/env-configuration.md#OneDrive NEW OneDrive setup guide (dev) based on THIS PR's CHANGES: https://github.com/open-webui/docs/blob/dev/docs/tutorials/integrations/onedrive-sharepoint.mdx ### Contributor License Agreement By submitting this pull request, I confirm that I have read and fully agree to the [Contributor License Agreement (CLA)](https://github.com/open-webui/open-webui/blob/main/CONTRIBUTOR_LICENSE_AGREEMENT), and I am providing my contributions under its terms. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
GiteaMirror added the pull-request label 2026-04-20 05:25:48 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
confirmed
confirmed issue
core
documentation
enhancement
good first issue
help wanted
non-core
pull-request
Mirrored from GitHub Pull Request
 python
question
testing wanted
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/open-webui#24493
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?