Feature: Add Pomerium JWT Validation Support to OpenWebUI #3290

New Issue

GiteaMirror · 2025-11-11T15:28:09-06:00

GiteaMirror commented

2025-11-11 15:28:09 -06:00

Originally created by @nickytonline on GitHub (Jan 15, 2025).

Feature Request

Request to add support for Pomerium JWT validation in OpenWebUI, complementing the existing trusted headers authentication method.

Important Notes

Overview

Request to add support for Pomerium JWT validation in OpenWebUI, complementing the existing trusted headers authentication method.

Background

OpenWebUI already supports Pomerium integration via trusted headers (as shown in Pomerium's official integration guide for OpenWebUI). Adding JWT validation support would:

Provide a more secure authentication option for environments requiring it
Allow for offline validation of user claims
Reduce reliance on header trust in certain deployments

Implementation Requirements

JWT Validation Support
- Validate Pomerium-issued JWTs
- Extract user claims (email, groups, etc.) from validated tokens
- Configure via environment variables
- Fall back to existing trusted headers method if JWT validation is not enabled
Documentation Needs
- Add JWT validation section to existing Pomerium integration docs
- Include configuration examples for:
  - Environment variables for JWT setup
  - Docker Compose configuration
  - JWT public key or JWKS configuration
- Document security considerations vs. trusted headers approach

Happy to provide pull requests for this and the documentation. 😎

Is your feature request related to a problem? Please describe.

N/A

Describe the solution you'd like

The solution would be similar to https://github.com/argoproj/argo-cd/pull/20928

Describe alternatives you've considered

The alternatives are the current way, i.e. Trusted Headers

Additional context

Add any other context or screenshots about the feature request here.

Originally created by @nickytonline on GitHub (Jan 15, 2025). # Feature Request Request to add support for [Pomerium JWT validation](https://www.pomerium.com/docs/capabilities/getting-users-identity#jwt-validation) in OpenWebUI, complementing the existing trusted headers authentication method. ## Important Notes ### Overview Request to add support for [Pomerium JWT validation](https://www.pomerium.com/docs/capabilities/getting-users-identity#jwt-validation) in OpenWebUI, complementing the existing trusted headers authentication method. ### Background OpenWebUI already supports Pomerium integration via trusted headers (as shown in [Pomerium's official integration guide for OpenWebUI](https://www.pomerium.com/docs/guides/secure-llm-webui)). Adding JWT validation support would: * Provide a more secure authentication option for environments requiring it * Allow for offline validation of user claims * Reduce reliance on header trust in certain deployments ### Implementation Requirements 1. JWT Validation Support * Validate Pomerium-issued JWTs * Extract user claims (email, groups, etc.) from validated tokens * Configure via environment variables * Fall back to existing trusted headers method if JWT validation is not enabled 2. Documentation Needs * Add JWT validation section to existing Pomerium integration docs * Include configuration examples for: * Environment variables for JWT setup * Docker Compose configuration * JWT public key or JWKS configuration * Document security considerations vs. trusted headers approach Happy to provide pull requests for this and the documentation. 😎 --- **Is your feature request related to a problem? Please describe.** N/A **Describe the solution you'd like** The solution would be similar to https://github.com/argoproj/argo-cd/pull/20928 **Describe alternatives you've considered** The alternatives are the current way, i.e. Trusted Headers **Additional context** Add any other context or screenshots about the feature request here.

GiteaMirror closed this issue

2025-11-11 15:28:10 -06:00

GiteaMirror referenced this issue

2026-04-19 20:01:04 -05:00

[GH-ISSUE #3290] feat: Allow admins to brand their site #13212

GiteaMirror referenced this issue

2026-04-25 03:19:21 -05:00

[GH-ISSUE #3290] feat: Allow admins to brand their site #28740

GiteaMirror referenced this issue

2026-05-05 13:06:40 -05:00

[GH-ISSUE #3290] feat: Allow admins to brand their site #51878

Sign in to join this conversation.