[GH-ISSUE #18924] feat: Allow authorization code flow with SSO logins #34247

New Issue

GiteaMirror · 2026-04-25T08:09:44-05:00

GiteaMirror commented

2026-04-25 08:09:44 -05:00

Originally created by @pllopis on GitHub (Nov 4, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/18924

Check Existing Issues

I have searched all existing open AND closed issues and discussions for similar requests. I have found none that is comparable to my request.

Problem Description

When reviewing the open-webui options and documentation, it seems that client_id and client_secret are required for oauth/oidc to work. This entails a client_credentials flow, but in some environments using the auth code flow is preferred, particularly where a user is involved and it's not machine-to-machine communication.

Desired Solution you'd like

It would be good to have open-webui support the authorization code flow so that it's the user logging in, given that's what the auth flow is meant for originally.

Alternatives Considered

No response

Additional Context

First of all, is my assumption correct that based on the docs and current state only client credentials flow works, or has anyone been able to make an authorization code flow work with open-webui?

Second, if the answer is that it's not currently supported, any feedback on why not? Is it just a matter of someone putting the effort into adding support, or are there other technical reasons that make this contribution non-obvious?
Thanks!

Originally created by @pllopis on GitHub (Nov 4, 2025). Original GitHub issue: https://github.com/open-webui/open-webui/issues/18924 ### Check Existing Issues - [x] I have searched all existing open AND closed issues and discussions for similar requests. I have found none that is comparable to my request. ### Problem Description When reviewing the open-webui options and [documentation](https://docs.openwebui.com/features/auth/sso/#oidc), it seems that client_id and client_secret are required for oauth/oidc to work. This entails a **client_credentials** flow, but in some environments using the **auth code flow** is preferred, particularly where a user is involved and it's not machine-to-machine communication. ### Desired Solution you'd like It would be good to have open-webui support the authorization code flow so that it's the user logging in, given that's what the auth flow is meant for originally. ### Alternatives Considered _No response_ ### Additional Context First of all, is my assumption correct that based on the docs and current state only client credentials flow works, or has anyone been able to make an authorization code flow work with open-webui? Second, if the answer is that it's not currently supported, any feedback on why not? Is it just a matter of someone putting the effort into adding support, or are there other technical reasons that make this contribution non-obvious? Thanks!

GiteaMirror closed this issue

2026-04-25 08:09:45 -05:00

GiteaMirror commented

2026-04-25 08:09:47 -05:00

@tjbck commented on GitHub (Nov 4, 2025):

We'd be happy to review PRs!

@tjbck commented on GitHub (Nov 4, 2025): We'd be happy to review PRs!

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#34247