The alternatives are the current way, i.e. Trusted Headers
Additional context
Add any other context or screenshots about the feature request here.
Originally created by @nickytonline on GitHub (Jan 15, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/8592
# Feature Request
Request to add support for [Pomerium JWT validation](https://www.pomerium.com/docs/capabilities/getting-users-identity#jwt-validation) in OpenWebUI, complementing the existing trusted headers authentication method.
## Important Notes
### Overview
Request to add support for [Pomerium JWT validation](https://www.pomerium.com/docs/capabilities/getting-users-identity#jwt-validation) in OpenWebUI, complementing the existing trusted headers authentication method.
### Background
OpenWebUI already supports Pomerium integration via trusted headers (as shown in [Pomerium's official integration guide for OpenWebUI](https://www.pomerium.com/docs/guides/secure-llm-webui)). Adding JWT validation support would:
* Provide a more secure authentication option for environments requiring it
* Allow for offline validation of user claims
* Reduce reliance on header trust in certain deployments
### Implementation Requirements
1. JWT Validation Support
* Validate Pomerium-issued JWTs
* Extract user claims (email, groups, etc.) from validated tokens
* Configure via environment variables
* Fall back to existing trusted headers method if JWT validation is not enabled
2. Documentation Needs
* Add JWT validation section to existing Pomerium integration docs
* Include configuration examples for:
* Environment variables for JWT setup
* Docker Compose configuration
* JWT public key or JWKS configuration
* Document security considerations vs. trusted headers approach
Happy to provide pull requests for this and the documentation. 😎
---
**Is your feature request related to a problem? Please describe.**
N/A
**Describe the solution you'd like**
The solution would be similar to https://github.com/argoproj/argo-cd/pull/20928
**Describe alternatives you've considered**
The alternatives are the current way, i.e. Trusted Headers
**Additional context**
Add any other context or screenshots about the feature request here.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Originally created by @nickytonline on GitHub (Jan 15, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/8592
Feature Request
Request to add support for Pomerium JWT validation in OpenWebUI, complementing the existing trusted headers authentication method.
Important Notes
Overview
Request to add support for Pomerium JWT validation in OpenWebUI, complementing the existing trusted headers authentication method.
Background
OpenWebUI already supports Pomerium integration via trusted headers (as shown in Pomerium's official integration guide for OpenWebUI). Adding JWT validation support would:
Implementation Requirements
JWT Validation Support
Documentation Needs
Happy to provide pull requests for this and the documentation. 😎
Is your feature request related to a problem? Please describe.
N/A
Describe the solution you'd like
The solution would be similar to https://github.com/argoproj/argo-cd/pull/20928
Describe alternatives you've considered
The alternatives are the current way, i.e. Trusted Headers
Additional context
Add any other context or screenshots about the feature request here.