github-starred/open-webui
2
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-11-09 10:50:35 -06:00
Code Issues 2.4k Packages Projects Releases 129 Wiki Activity

[GH-ISSUE #16221] issue: Open WebUI: OIDC Token Exchange with Authentik Returns 405 Method Not Allowed #33357

New Issue
Closed
opened 2026-04-25 07:15:23 -05:00 by GiteaMirror · 10 comments
GiteaMirror commented 2026-04-25 07:15:23 -05:00
Owner
Copy Link
Copy Source

Originally created by @icvdok on GitHub (Aug 2, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/16221

Check Existing Issues

  • I have searched the existing issues and discussions.
  • I am using the latest version of Open WebUI.

Installation Method

Docker

Open WebUI Version

v0.6.18 (latest)

Ollama Version (if applicable)

ollama version is 0.10.1

Operating System

Windows 10

Browser (if applicable)

MS Edge - Firefox

Confirmation

  • I have read and followed all instructions in README.md.
  • I am using the latest version of both Open WebUI and Ollama.
  • I have included the browser console logs.
  • I have included the Docker container logs.
  • I have provided every relevant configuration, setting, and environment variable used in my setup.
  • I have clearly listed every relevant configuration, custom setting, environment variable, and command-line option that influences my setup (such as Docker Compose overrides, .env values, browser settings, authentication configurations, etc).
  • I have documented step-by-step reproduction instructions that are precise, sequential, and leave nothing to interpretation. My steps:
  • Start with the initial platform/version/OS and dependencies used,
  • Specify exact install/launch/configure commands,
  • List URLs visited, user input (incl. example values/emails/passwords if needed),
  • Describe all options and toggles enabled or changed,
  • Include any files or environmental changes,
  • Identify the expected and actual result at each stage,
  • Ensure any reasonably skilled user can follow and hit the same issue.

Expected Behavior

Working OAUTH Integration, successful login Authentik users with OpenWebui

Actual Behavior

The auth process fail returning:{"detail":"The email or password provided is incorrect. Please check for typos and try logging in again."}.

Steps to Reproduce

  1. The user clicks the login button "Continue to authentik" and is successfully redirected to the Authentik authentication page.
  2. The user authenticates successfully and is redirected back to Open WebUI with a valid authorization code.
  3. Open WebUI's backend then attempts to perform a POST request to Authentik's token_endpoint.
  4. This POST request fails, and the Authentik server returns a 405 Method Not Allowed HTTP response.
  5. Open WebUI's logs show an OAuth callback error: Expecting value: line 1 column 1 (char 0) warning, as the client fails to parse the unexpected 405 response as a JSON token.
  6. The user is presented with a generic, incorrect error message in the UI: {"detail":"The email or password provided is incorrect. Please check for typos and try logging in again."}.

Logs & Screenshots

From WebUI Docker:
2025-08-02 06:36:49.176 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 178.197.222.115:0 - "GET /api/config HTTP/1.1" 200 - {}
2025-08-02 06:36:49.287 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 178.197.222.115:0 - "GET /manifest.json HTTP/1.1" 200 - {}
2025-08-02 06:37:11.039 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 178.197.222.115:0 - "GET /oauth/oidc/login HTTP/1.1" 302 - {}
2025-08-02 06:37:13.149 | INFO | httpx._client:_send_single_request:1740 - HTTP Request: POST https://auth.mydomain.com/application/o/token/ "HTTP/1.1 405 Method Not Allowed" - {}
2025-08-02 06:37:13.150 | WARNING | open_webui.utils.oauth:handle_callback:352 - OAuth callback error: Expecting value: line 1 column 1 (char 0) - {}
2025-08-02 06:37:13.151 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 178.197.222.115:0 - "GET /oauth/oidc/callback?code=ead2b9e4883447099ff6ccd049fa2645&state=FI3NGKcSc9FRcsla162MB0Jir3DTmq HTTP/1.1" 400 - {}

Additional Information

environment: # https://docs.openwebui.com/getting-started/env-configuration#default_models

Originally created by @icvdok on GitHub (Aug 2, 2025). Original GitHub issue: https://github.com/open-webui/open-webui/issues/16221 ### Check Existing Issues - [x] I have searched the existing issues and discussions. - [x] I am using the latest version of Open WebUI. ### Installation Method Docker ### Open WebUI Version v0.6.18 (latest) ### Ollama Version (if applicable) ollama version is 0.10.1 ### Operating System Windows 10 ### Browser (if applicable) MS Edge - Firefox ### Confirmation - [x] I have read and followed all instructions in `README.md`. - [x] I am using the latest version of **both** Open WebUI and Ollama. - [x] I have included the browser console logs. - [x] I have included the Docker container logs. - [x] I have **provided every relevant configuration, setting, and environment variable used in my setup.** - [x] I have clearly **listed every relevant configuration, custom setting, environment variable, and command-line option that influences my setup** (such as Docker Compose overrides, .env values, browser settings, authentication configurations, etc). - [x] I have documented **step-by-step reproduction instructions that are precise, sequential, and leave nothing to interpretation**. My steps: - Start with the initial platform/version/OS and dependencies used, - Specify exact install/launch/configure commands, - List URLs visited, user input (incl. example values/emails/passwords if needed), - Describe all options and toggles enabled or changed, - Include any files or environmental changes, - Identify the expected and actual result at each stage, - Ensure any reasonably skilled user can follow and hit the same issue. ### Expected Behavior Working OAUTH Integration, successful login Authentik users with OpenWebui ### Actual Behavior The auth process fail returning:{"detail":"The email or password provided is incorrect. Please check for typos and try logging in again."}. ### Steps to Reproduce 1. The user clicks the login button "Continue to authentik" and is successfully redirected to the Authentik authentication page. 2. The user authenticates successfully and is redirected back to Open WebUI with a valid authorization code. 3. Open WebUI's backend then attempts to perform a POST request to Authentik's token_endpoint. 4. This POST request fails, and the Authentik server returns a 405 Method Not Allowed HTTP response. 5. Open WebUI's logs show an OAuth callback error: Expecting value: line 1 column 1 (char 0) warning, as the client fails to parse the unexpected 405 response as a JSON token. 6. The user is presented with a generic, incorrect error message in the UI: {"detail":"The email or password provided is incorrect. Please check for typos and try logging in again."}. ### Logs & Screenshots From WebUI Docker: 2025-08-02 06:36:49.176 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 178.197.222.115:0 - "GET /api/config HTTP/1.1" 200 - {} 2025-08-02 06:36:49.287 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 178.197.222.115:0 - "GET /manifest.json HTTP/1.1" 200 - {} 2025-08-02 06:37:11.039 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 178.197.222.115:0 - "GET /oauth/oidc/login HTTP/1.1" 302 - {} 2025-08-02 06:37:13.149 | INFO | httpx._client:_send_single_request:1740 - HTTP Request: POST [https://auth.mydomain.com/application/o/token/](https://www.google.com/search?q=https://auth.mydomain.com/application/o/token/) "HTTP/1.1 405 Method Not Allowed" - {} 2025-08-02 06:37:13.150 | WARNING | open_webui.utils.oauth:handle_callback:352 - OAuth callback error: Expecting value: line 1 column 1 (char 0) - {} 2025-08-02 06:37:13.151 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 178.197.222.115:0 - "GET /oauth/oidc/callback?code=ead2b9e4883447099ff6ccd049fa2645&state=FI3NGKcSc9FRcsla162MB0Jir3DTmq HTTP/1.1" 400 - {} ### Additional Information environment: # https://docs.openwebui.com/getting-started/env-configuration#default_models - OLLAMA_BASE_URLS=http://host.docker.internal:11434 #comma separated ollama hosts - ENV=prod - WEBUI_AUTH=True - WEBUI_NAME=My AI App - WEBUI_URL=https://aibot.mydomain.com - WEBUI_SECRET_KEY=my-secret-key - ENABLE_OAUTH_SIGNUP=true - ENABLE_LOGIN_FORM=true - OAUTH_CLIENT_ID=my-oauth-client-id - OAUTH_CLIENT_SECRET=my-oauth-client-secret - OAUTH_PROVIDER_NAME=Authentik - OPENID_PROVIDER_URL=https://auth.mydomain.com/application/o/prd_webui/.well-known/openid-configuration - OAUTH_MERGE_ACCOUNTS_BY_EMAIL=true - OPENID_REDIRECT_URI=https://aibot.mydomain.com/oauth/oidc/callback
GiteaMirror added the bug label 2026-04-25 07:15:23 -05:00
GiteaMirror commented 2026-04-25 07:15:24 -05:00
Author
Owner
Copy Link
Copy Source

@dw-matt commented on GitHub (Aug 4, 2025):

Try adding
OAUTH_TOKEN_ENDPOINT_AUTH_METHOD=client_secret_post

It looks like the authentication library in Open WebUI uses "client_secret_basic" by default. This environment variable is not listed in the documentation but exists in the source code and tells the library to put the client secret in the post body instead of the request headers. All of the Authentik OAuth 2.0 examples use POST, so hopefully this helps.

<!-- gh-comment-id:3152024169 --> @dw-matt commented on GitHub (Aug 4, 2025): Try adding OAUTH_TOKEN_ENDPOINT_AUTH_METHOD=client_secret_post It looks like the authentication library in Open WebUI uses "client_secret_basic" by default. This environment variable is not listed in the documentation but exists in the source code and tells the library to put the client secret in the post body instead of the request headers. All of the Authentik OAuth 2.0 examples use POST, so hopefully this helps.
GiteaMirror commented 2026-04-25 07:15:24 -05:00
Author
Owner
Copy Link
Copy Source

@icvdok commented on GitHub (Aug 5, 2025):

Hello , thanks for the reply, unfortunately it return the same error:
{"detail":"The email or password provided is incorrect. Please check for typos and try logging in again."}
Here the log:
2025-08-05 04:27:49.852 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 178.197.202.121:0 - "GET /manifest.json HTTP/1.1" 200 - {} 2025-08-05 04:27:50.044 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 178.197.202.121:0 - "GET /api/config HTTP/1.1" 200 - {} 2025-08-05 04:27:52.233 | INFO | httpx._client:_send_single_request:1740 - HTTP Request: GET https://auth.mydomain.com.ch/application/o/prd_webui/.well-known/openid-configuration "HTTP/1.1 200 OK" - {} 2025-08-05 04:27:52.264 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 178.197.202.121:0 - "GET /oauth/oidc/login HTTP/1.1" 302 - {} 2025-08-05 04:27:54.244 | INFO | httpx._client:_send_single_request:1740 - HTTP Request: POST https://auth.mydomain.com/application/o/token/ "HTTP/1.1 405 Method Not Allowed" - {} 2025-08-05 04:27:54.245 | WARNING | open_webui.utils.oauth:handle_callback:352 - OAuth callback error: Expecting value: line 1 column 1 (char 0) - {} 2025-08-05 04:27:54.246 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 178.197.202.121:0 - "GET /oauth/oidc/callback?code=1cab95f304744ac984cbee77643b70c3&state=uoPWxX15lgn8r0CIKsJxYRkxOauOqk HTTP/1.1" 400 - {}

<!-- gh-comment-id:3153255924 --> @icvdok commented on GitHub (Aug 5, 2025): Hello , thanks for the reply, unfortunately it return the same error: {"detail":"The email or password provided is incorrect. Please check for typos and try logging in again."} Here the log: `2025-08-05 04:27:49.852 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 178.197.202.121:0 - "GET /manifest.json HTTP/1.1" 200 - {} 2025-08-05 04:27:50.044 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 178.197.202.121:0 - "GET /api/config HTTP/1.1" 200 - {} 2025-08-05 04:27:52.233 | INFO | httpx._client:_send_single_request:1740 - HTTP Request: GET https://auth.mydomain.com.ch/application/o/prd_webui/.well-known/openid-configuration "HTTP/1.1 200 OK" - {} 2025-08-05 04:27:52.264 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 178.197.202.121:0 - "GET /oauth/oidc/login HTTP/1.1" 302 - {} 2025-08-05 04:27:54.244 | INFO | httpx._client:_send_single_request:1740 - HTTP Request: POST https://auth.mydomain.com/application/o/token/ "HTTP/1.1 405 Method Not Allowed" - {} 2025-08-05 04:27:54.245 | WARNING | open_webui.utils.oauth:handle_callback:352 - OAuth callback error: Expecting value: line 1 column 1 (char 0) - {} 2025-08-05 04:27:54.246 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 178.197.202.121:0 - "GET /oauth/oidc/callback?code=1cab95f304744ac984cbee77643b70c3&state=uoPWxX15lgn8r0CIKsJxYRkxOauOqk HTTP/1.1" 400 - {}`
GiteaMirror commented 2026-04-25 07:15:25 -05:00
Author
Owner
Copy Link
Copy Source

@lwsrbrts commented on GitHub (Aug 6, 2025):

I'm using Authentik with my OWUI and it works as expected for me. The only difference I'm seeing is the lack of an environment variable for scopes. Mine is:

OAUTH_SCOPES: openid email profile

Otherwise, the rest of my config looks like this, with some obvious stuff redacted.

    environment:
      OLLAMA_BASE_URL: http://192.168.1.185:11434
      WEBUI_SECRET_KEY: [redacted]
      CORS_ALLOW_ORIGIN: https://[redacted]
      OAUTH_CLIENT_ID: [redacted]
      OAUTH_CLIENT_SECRET: [redacted]
      OAUTH_PROVIDER_NAME: authentik
      OPENID_PROVIDER_URL: https://[redacted]/application/o/open-webui/.well-known/openid-configuration
      ENABLE_OAUTH_SIGNUP: true
      OAUTH_MERGE_ACCOUNTS_BY_EMAIL: true
      OAUTH_SCOPES: openid email profile
      OPENID_REDIRECT_URI: https://[redacted]/oauth/oidc/callback
<!-- gh-comment-id:3161153137 --> @lwsrbrts commented on GitHub (Aug 6, 2025): I'm using Authentik with my OWUI and it works as expected for me. The only difference I'm seeing is the lack of an environment variable for scopes. Mine is: `OAUTH_SCOPES: openid email profile` Otherwise, the rest of my config looks like this, with some obvious stuff redacted. ```yaml environment: OLLAMA_BASE_URL: http://192.168.1.185:11434 WEBUI_SECRET_KEY: [redacted] CORS_ALLOW_ORIGIN: https://[redacted] OAUTH_CLIENT_ID: [redacted] OAUTH_CLIENT_SECRET: [redacted] OAUTH_PROVIDER_NAME: authentik OPENID_PROVIDER_URL: https://[redacted]/application/o/open-webui/.well-known/openid-configuration ENABLE_OAUTH_SIGNUP: true OAUTH_MERGE_ACCOUNTS_BY_EMAIL: true OAUTH_SCOPES: openid email profile OPENID_REDIRECT_URI: https://[redacted]/oauth/oidc/callback ```
GiteaMirror commented 2026-04-25 07:15:25 -05:00
Author
Owner
Copy Link
Copy Source

@icvdok commented on GitHub (Aug 7, 2025):

Thanks, i'll try to add it.

<!-- gh-comment-id:3164525093 --> @icvdok commented on GitHub (Aug 7, 2025): Thanks, i'll try to add it.
GiteaMirror commented 2026-04-25 07:15:26 -05:00
Author
Owner
Copy Link
Copy Source

@icvdok commented on GitHub (Aug 7, 2025):

No way, I've try almost everything. This is the last compose according to your feedbacks.

  ollama-webui:
     container_name: prd_ollama-webui
     image: ghcr.io/open-webui/open-webui:${WEBUI_DOCKER_TAG-main}
     volumes:
       - ollama-webui:/app/backend/data
     depends_on:
       - ollama
     ports:
       - 8081:8080
     environment:
       OLLAMA_BASE_URLS: http://ss02.lan:11434
       WEBUI_SECRET_KEY: [redacted]
       OAUTH_CLIENT_ID: [redacted]
       OAUTH_CLIENT_SECRET: [redacted]
       OAUTH_PROVIDER_NAME: authentik
       OPENID_PROVIDER_URL: https://[redacted]/application/o/prd_webui/.well-known/openid-configuration
       ENABLE_OAUTH_SIGNUP: true
       OAUTH_MERGE_ACCOUNTS_BY_EMAIL: true
       OAUTH_SCOPES: openid email profile
       OPENID_REDIRECT_URI: https://[redacted]/oauth/oidc/callback
     extra_hosts:
       - host.docker.internal:host-gateway
     restart: unless-stopped
     networks:
       - default

I'm quiet sure that the authentik process works but there is something in the webui that reject the token. Do you create the users in the webui with the same mail before login with the authentik users?

<!-- gh-comment-id:3164820436 --> @icvdok commented on GitHub (Aug 7, 2025): No way, I've try almost everything. This is the last compose according to your feedbacks. ``` ollama-webui: container_name: prd_ollama-webui image: ghcr.io/open-webui/open-webui:${WEBUI_DOCKER_TAG-main} volumes: - ollama-webui:/app/backend/data depends_on: - ollama ports: - 8081:8080 environment: OLLAMA_BASE_URLS: http://ss02.lan:11434 WEBUI_SECRET_KEY: [redacted] OAUTH_CLIENT_ID: [redacted] OAUTH_CLIENT_SECRET: [redacted] OAUTH_PROVIDER_NAME: authentik OPENID_PROVIDER_URL: https://[redacted]/application/o/prd_webui/.well-known/openid-configuration ENABLE_OAUTH_SIGNUP: true OAUTH_MERGE_ACCOUNTS_BY_EMAIL: true OAUTH_SCOPES: openid email profile OPENID_REDIRECT_URI: https://[redacted]/oauth/oidc/callback extra_hosts: - host.docker.internal:host-gateway restart: unless-stopped networks: - default ``` I'm quiet sure that the authentik process works but there is something in the webui that reject the token. Do you create the users in the webui with the same mail before login with the authentik users?
GiteaMirror commented 2026-04-25 07:15:27 -05:00
Author
Owner
Copy Link
Copy Source

@lwsrbrts commented on GitHub (Aug 7, 2025):

I originally used OWUI with the built-in authentication and had created my account with my email address, which is the same email as I use for the Authentik system as well.

These two settings should mean that isn't necessary though:

       ENABLE_OAUTH_SIGNUP: true
       OAUTH_MERGE_ACCOUNTS_BY_EMAIL: true

I do however actually log on with my authentik username (not the email address), so when prompted at authentik's logon page, I just log on with username.

This is my entire docker compose for OWUI.

volumes:
  owui-data:

networks:
  owui:

services:
  webui:
    container_name: open-webui
    image: ghcr.io/open-webui/open-webui:latest
    volumes:
      - owui-data:/app/backend/data:rw
    environment:
      OLLAMA_BASE_URL: http://192.168.1.185:11434
      WEBUI_SECRET_KEY: [redacted]
      CORS_ALLOW_ORIGIN: https://[redacted]
      OAUTH_CLIENT_ID: [redacted]
      OAUTH_CLIENT_SECRET: [redacted]
      OAUTH_PROVIDER_NAME: authentik
      OPENID_PROVIDER_URL: https://[redacted]/application/o/open-webui/.well-known/openid-configuration
      ENABLE_OAUTH_SIGNUP: true
      OAUTH_MERGE_ACCOUNTS_BY_EMAIL: true
      OAUTH_SCOPES: openid email profile
      OPENID_REDIRECT_URI: https://[redacted]/oauth/oidc/callback
    labels:
      - com.centurylinklabs.watchtower.enable=true # Enable watchtower container auto update
    healthcheck:
      test: timeout 10s bash -c ':> /dev/tcp/127.0.0.1/8080' || exit 1
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 90s
    ports:
      - 8271:8080
    restart: unless-stopped
    networks:
      owui:

I'm sure you've seen this but authentik also document how to integrate OWUI with authentik here: https://integrations.goauthentik.io/miscellaneous/open-webui/

<!-- gh-comment-id:3165213485 --> @lwsrbrts commented on GitHub (Aug 7, 2025): I originally used OWUI with the built-in authentication and had created my account with my email address, which is the same email as I use for the Authentik system as well. These two settings _should_ mean that isn't necessary though: ``` ENABLE_OAUTH_SIGNUP: true OAUTH_MERGE_ACCOUNTS_BY_EMAIL: true ``` I do however actually log on with my authentik username (not the email address), so when prompted at authentik's logon page, I just log on with `username`. This is my entire docker compose for OWUI. ```dockerfile volumes: owui-data: networks: owui: services: webui: container_name: open-webui image: ghcr.io/open-webui/open-webui:latest volumes: - owui-data:/app/backend/data:rw environment: OLLAMA_BASE_URL: http://192.168.1.185:11434 WEBUI_SECRET_KEY: [redacted] CORS_ALLOW_ORIGIN: https://[redacted] OAUTH_CLIENT_ID: [redacted] OAUTH_CLIENT_SECRET: [redacted] OAUTH_PROVIDER_NAME: authentik OPENID_PROVIDER_URL: https://[redacted]/application/o/open-webui/.well-known/openid-configuration ENABLE_OAUTH_SIGNUP: true OAUTH_MERGE_ACCOUNTS_BY_EMAIL: true OAUTH_SCOPES: openid email profile OPENID_REDIRECT_URI: https://[redacted]/oauth/oidc/callback labels: - com.centurylinklabs.watchtower.enable=true # Enable watchtower container auto update healthcheck: test: timeout 10s bash -c ':> /dev/tcp/127.0.0.1/8080' || exit 1 interval: 10s timeout: 5s retries: 3 start_period: 90s ports: - 8271:8080 restart: unless-stopped networks: owui: ``` I'm sure you've seen this but authentik also document how to integrate OWUI with authentik here: https://integrations.goauthentik.io/miscellaneous/open-webui/
GiteaMirror commented 2026-04-25 07:15:27 -05:00
Author
Owner
Copy Link
Copy Source

@kmamtora commented on GitHub (Aug 7, 2025):

I am getting Internal Server Error

<!-- gh-comment-id:3165689271 --> @kmamtora commented on GitHub (Aug 7, 2025): I am getting Internal Server Error
GiteaMirror commented 2026-04-25 07:15:28 -05:00
Author
Owner
Copy Link
Copy Source

@icvdok commented on GitHub (Aug 8, 2025):

Thanks @lwsrbrts , very helpful, I've try almost everything, any compose combinations and authentik options without success. Recreate the provider ,the application, recreate the dockers stack. I'try also to create an identical webui local usersame as the authentik user before swith to oauth, nothing. I've discovered that my self signed certificate was expired on authentik, created a new one but nothing change. Try to remove any cache in the frontend proxy, nothing. I'm stuck here now:

2025-08-08 07:04:17.076 | WARNING | open_webui.utils.oauth:handle_callback:352 - OAuth callback error: unsupported_algorithm: - {} 2025-08-08 07:04:17.077 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 178.197.210.130:0 - "GET /oauth/oidc/callback?code=a45ccfec78b94f05ae35da0d668a7d6a&state=ko0YvwVUjFokhhJcEYZhYpT3mHNvDl HTTP/1.1" 400 - {}

Any change return always this error, the Authentik log is clean and confirm the authentication no errors are logged here. It's something on the webui server that create this issue (quiet common reading other posts) and there is no clear and documented solution as far as I know. I'll continue the investigation but this try and error approach is a very time consuming.

<!-- gh-comment-id:3166823938 --> @icvdok commented on GitHub (Aug 8, 2025): Thanks @lwsrbrts , very helpful, I've try almost everything, any compose combinations and authentik options without success. Recreate the provider ,the application, recreate the dockers stack. I'try also to create an identical webui local usersame as the authentik user before swith to oauth, nothing. I've discovered that my self signed certificate was expired on authentik, created a new one but nothing change. Try to remove any cache in the frontend proxy, nothing. I'm stuck here now: `2025-08-08 07:04:17.076 | WARNING | open_webui.utils.oauth:handle_callback:352 - OAuth callback error: unsupported_algorithm: - {} 2025-08-08 07:04:17.077 | INFO | uvicorn.protocols.http.httptools_impl:send:476 - 178.197.210.130:0 - "GET /oauth/oidc/callback?code=a45ccfec78b94f05ae35da0d668a7d6a&state=ko0YvwVUjFokhhJcEYZhYpT3mHNvDl HTTP/1.1" 400 - {}` Any change return always this error, the Authentik log is clean and confirm the authentication no errors are logged here. It's something on the webui server that create this issue (quiet common reading other posts) and there is no clear and documented solution as far as I know. I'll continue the investigation but this try and error approach is a very time consuming.
GiteaMirror commented 2026-04-25 07:15:28 -05:00
Author
Owner
Copy Link
Copy Source

@icvdok commented on GitHub (Aug 8, 2025):

Finally I've get this things working. In case someone is interested, I had two main issues, CSRF state mismatch and an unsupported_algorithm error. In addition to the obvious checks like urls, client id, secrets matching on both side, here some other check that solve my situation.

1. mismatching_state: CSRF Warning!

This issue was caused by caching on my Nginx Proxy Manager (NPM) instance, which was interfering with the state parameter of the OAuth flow.

The Solution:

I disabled "Cache Assets" in the NPM Proxy Host settings for the Open WebUI domain.

I added a custom location for the /oauth/ path with explicit caching directives to ensure no caching occurs. The NPM "Advanced" tab for this location was set to:

proxy_no_cache 1;
proxy_cache_bypass 1;

This resolved the mismatching_state error in the logs.

2. unsupported_algorithm

This error occurred after the successful token exchange and was the result of a misconfiguration in Authentik's provider settings. Specifically, a signing key was being used for token encryption, which Open WebUI does not support.

The Solution:

I generated a new key pair in Authentik, ensuring the Private key Algorithm was set to RSA.

In the Authentik provider settings for Open WebUI, I set the new key for the Signing Key field.

Crucially, ensure the "Encryption Key" field is blank. Removing the key from this field prevented Authentik from encrypting the ID token, allowing Open WebUI to successfully validate the signature.

Minimal Working Docker Compose Configuration
Here is the minimal and working environment configuration for the Open WebUI Docker container:

YAML

environment:
  OLLAMA_BASE_URLS: http://ss02.lan:11434
  WEBUI_AUTH: True
  WEBUI_NAME: AI
  WEBUI_URL: https://<your-openwebui-domain.com>
  WEBUI_SECRET_KEY: <your-secret-key>
  OAUTH_CLIENT_ID: <your-client-id>
  OAUTH_CLIENT_SECRET: <your-client-secret>
  OAUTH_PROVIDER_NAME: authentik
  OPENID_PROVIDER_URL: https://<your-authentik-domain.com>/application/o/webui/.well-known/openid-configuration
  ENABLE_OAUTH_SIGNUP: true
  OAUTH_SCOPES: openid email profile

General Notes and Observations

  • All tests were performed in a private browser session to eliminate caching and cookie-related issues.
  • Open WebUI requires a connection to the Authentik instance to fetch the JWKS. You can test this from inside the Open WebUI container with curl https://<your-authentik-domain.com>/application/o/webui/jwks/.
  • After the initial successful login via Authentik, Open WebUI creates a local user account with a validate status.
  • To enable the user to log in again, an existing Open WebUI admin must log in and change the new user's status to user or admin.

I'll continue to optimize the setup in the next future.

This investigation was challenging, and I hope this detailed report helps others who are facing similar struggles with Open WebUI and Authentik integration.

<!-- gh-comment-id:3167270851 --> @icvdok commented on GitHub (Aug 8, 2025): Finally I've get this things working. In case someone is interested, I had two main issues, CSRF state mismatch and an unsupported_algorithm error. In addition to the obvious checks like urls, client id, secrets matching on both side, here some other check that solve my situation. ### 1. mismatching_state: CSRF Warning! This issue was caused by caching on my Nginx Proxy Manager (NPM) instance, which was interfering with the state parameter of the OAuth flow. **The Solution:** I disabled "Cache Assets" in the NPM Proxy Host settings for the Open WebUI domain. I added a custom location for the /oauth/ path with explicit caching directives to ensure no caching occurs. The NPM "Advanced" tab for this location was set to: ``` proxy_no_cache 1; proxy_cache_bypass 1; ``` This resolved the mismatching_state error in the logs. ### 2. unsupported_algorithm This error occurred after the successful token exchange and was the result of a misconfiguration in Authentik's provider settings. Specifically, a signing key was being used for token encryption, which Open WebUI does not support. **The Solution:** I generated a new key pair in Authentik, ensuring the Private key Algorithm was set to RSA. In the Authentik provider settings for Open WebUI, I set the new key for the Signing Key field. **Crucially, ensure the "Encryption Key" field is blank.** Removing the key from this field prevented Authentik from encrypting the ID token, allowing Open WebUI to successfully validate the signature. Minimal Working Docker Compose Configuration Here is the minimal and working environment configuration for the Open WebUI Docker container: ``` YAML environment: OLLAMA_BASE_URLS: http://ss02.lan:11434 WEBUI_AUTH: True WEBUI_NAME: AI WEBUI_URL: https://<your-openwebui-domain.com> WEBUI_SECRET_KEY: <your-secret-key> OAUTH_CLIENT_ID: <your-client-id> OAUTH_CLIENT_SECRET: <your-client-secret> OAUTH_PROVIDER_NAME: authentik OPENID_PROVIDER_URL: https://<your-authentik-domain.com>/application/o/webui/.well-known/openid-configuration ENABLE_OAUTH_SIGNUP: true OAUTH_SCOPES: openid email profile ``` ### General Notes and Observations - All tests were performed in a private browser session to eliminate caching and cookie-related issues. - Open WebUI requires a connection to the Authentik instance to fetch the JWKS. You can test this from inside the Open WebUI container with curl https://<your-authentik-domain.com>/application/o/webui/jwks/. - After the initial successful login via Authentik, Open WebUI creates a local user account with a validate status. - To enable the user to log in again, an existing Open WebUI admin must log in and change the new user's status to user or admin. I'll continue to optimize the setup in the next future. This investigation was challenging, and I hope this detailed report helps others who are facing similar struggles with Open WebUI and Authentik integration.
GiteaMirror commented 2026-04-25 07:15:28 -05:00
Author
Owner
Copy Link
Copy Source

@Classic298 commented on GitHub (Aug 8, 2025):

Hey, it looks like your issues with caching and OAUTH provider config are covered in the official Open WebUI docs! Check out the 'Troubleshooting OAUTH / SSO Issues' section – especially points 3 and 4 about 'OAUTH Misconfiguration' and 'Server-Side Caching.' Hope it helps!

<!-- gh-comment-id:3167457985 --> @Classic298 commented on GitHub (Aug 8, 2025): Hey, it looks like your issues with caching and OAUTH provider config are covered in the official Open WebUI docs! Check out the '[Troubleshooting OAUTH / SSO Issues](https://docs.openwebui.com/troubleshooting/sso)' section – especially points 3 and 4 about 'OAUTH Misconfiguration' and 'Server-Side Caching.' Hope it helps!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
confirmed
confirmed issue
core
documentation
enhancement
good first issue
help wanted
non-core
pull-request
Mirrored from GitHub Pull Request
 python
question
testing wanted
No labels bug
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/open-webui#33357