GiteaMirror commented

Owner

Originally created by @cyronis on GitHub (Feb 9, 2026).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/21280

Check Existing Issues

I have searched for any existing and/or related issues.
I have searched for any existing and/or related discussions.
I have also searched in the CLOSED issues AND CLOSED discussions and found no related items (your issue might already be addressed on the development branch!).
I am using the latest version of Open WebUI.

Installation Method

Git Clone

Open WebUI Version

0.7.2

Ollama Version (if applicable)

No response

Operating System

Ubuntu 22.04

Browser (if applicable)

No response

Confirmation

I have read and followed all instructions in README.md.
I am using the latest version of both Open WebUI and Ollama.
I have included the browser console logs.
I have included the Docker container logs.
I have provided every relevant configuration, setting, and environment variable used in my setup.
I have clearly listed every relevant configuration, custom setting, environment variable, and command-line option that influences my setup (such as Docker Compose overrides, .env values, browser settings, authentication configurations, etc).
I have documented step-by-step reproduction instructions that are precise, sequential, and leave nothing to interpretation. My steps:
Start with the initial platform/version/OS and dependencies used,
Specify exact install/launch/configure commands,
List URLs visited, user input (incl. example values/emails/passwords if needed),
Describe all options and toggles enabled or changed,
Include any files or environmental changes,
Identify the expected and actual result at each stage,
Ensure any reasonably skilled user can follow and hit the same issue.

Expected Behavior

When creating or updating a user via the SCIM 2.0 API, the externalId provided in the request payload should be persisted in the database. Subsequent GET requests to the user endpoint should return the stored externalId. This is critical for Identity Provider (IdP) synchronization (e.g., Microsoft Entra ID / Azure AD), which relies on this field to map external directory objects to internal users.

Actual Behavior

The externalId is ignored by the backend. Even if a valid string is sent in a POST or PATCH request, the API response returns "externalId": null. The user is created or updated successfully, but the link to the external identity is lost, causing "Provision on Demand" or synchronization cycles in IdPs to fail or report inconsistencies.

Steps to Reproduce

Using a tool like Bruno or curl, send a POST request to /api/v1/scim/v2/Users with the following payload:

JSON
{
"schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
"externalId": "my-unique-external-id",
"userName": "test.user@example.com",
"displayName": "Test User",
"name": { "givenName": "Test", "familyName": "User" },
"emails": [{ "value": "test.user@example.com", "primary": true }],
"active": true
}
Observe the HTTP 201 Created response.

Check the returned JSON: externalId is null instead of "my-unique-external-id".

Logs & Screenshots
Analysis of the source code (scim.py):
The issue is caused by a missing mapping in the SCIM router. While the Pydantic models (like SCIMUserCreateRequest) correctly include the externalId field, the actual database insertion logic does not:

Python

Current implementation in scim.py

new_user = Users.insert_new_user(
id=user_id,
name=name,
email=email,
profile_image_url=profile_image,
role="user" if user_data.active else "pending",
db=db,
# externalId is missing and therefore never saved to the DB
)
Additional Information
I am testing this using Microsoft Entra ID (Azure AD) Provisioning on Demand. The IdP expects the returned resource to reflect the externalId it just sent. Because OpenWebUI returns null, the synchronization state becomes unreliable.

Logs & Screenshots

N/A - Verified via API response and source code analysis

MICROSOFT_CLIENT_ID =
MICROSOFT_CLIENT_SECRET =
MICROSOFT_CLIENT_TENANT_ID =
MICROSOFT_REDIRECT_URI =
OPENID_PROVIDER_URL = https://login.microsoftonline.com/****/v2.0/.well-known/openid-configuration
OAUTH_SCOPE = openid email profile User.Read GroupMember.Read.All
OAUTH_EMAIL_CLAIM = email
ENABLE_OAUTH_ROLE_MANAGEMENT = true
OAUTH_ROLES_CLAIM = roles
ENABLE_OAUTH_GROUP_MANAGEMENT = true
ENABLE_OAUTH_GROUP_CREATION = true
OAUTH_GROUPS_CLAIM = groups
SCIM_ENABLED = TRUE
SCIM_TOKEN =

Additional Information

No response

Originally created by @cyronis on GitHub (Feb 9, 2026). Original GitHub issue: https://github.com/open-webui/open-webui/issues/21280 ### Check Existing Issues - [x] I have searched for any existing and/or related issues. - [x] I have searched for any existing and/or related discussions. - [x] I have also searched in the CLOSED issues AND CLOSED discussions and found no related items (your issue might already be addressed on the development branch!). - [x] I am using the latest version of Open WebUI. ### Installation Method Git Clone ### Open WebUI Version 0.7.2 ### Ollama Version (if applicable) _No response_ ### Operating System Ubuntu 22.04 ### Browser (if applicable) _No response_ ### Confirmation - [x] I have read and followed all instructions in `README.md`. - [x] I am using the latest version of **both** Open WebUI and Ollama. - [x] I have included the browser console logs. - [x] I have included the Docker container logs. - [x] I have **provided every relevant configuration, setting, and environment variable used in my setup.** - [x] I have clearly **listed every relevant configuration, custom setting, environment variable, and command-line option that influences my setup** (such as Docker Compose overrides, .env values, browser settings, authentication configurations, etc). - [x] I have documented **step-by-step reproduction instructions that are precise, sequential, and leave nothing to interpretation**. My steps: - Start with the initial platform/version/OS and dependencies used, - Specify exact install/launch/configure commands, - List URLs visited, user input (incl. example values/emails/passwords if needed), - Describe all options and toggles enabled or changed, - Include any files or environmental changes, - Identify the expected and actual result at each stage, - Ensure any reasonably skilled user can follow and hit the same issue. ### Expected Behavior When creating or updating a user via the SCIM 2.0 API, the externalId provided in the request payload should be persisted in the database. Subsequent GET requests to the user endpoint should return the stored externalId. This is critical for Identity Provider (IdP) synchronization (e.g., Microsoft Entra ID / Azure AD), which relies on this field to map external directory objects to internal users. ### Actual Behavior The externalId is ignored by the backend. Even if a valid string is sent in a POST or PATCH request, the API response returns "externalId": null. The user is created or updated successfully, but the link to the external identity is lost, causing "Provision on Demand" or synchronization cycles in IdPs to fail or report inconsistencies. ### Steps to Reproduce Using a tool like Bruno or curl, send a POST request to /api/v1/scim/v2/Users with the following payload: JSON { "schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"], "externalId": "my-unique-external-id", "userName": "test.user@example.com", "displayName": "Test User", "name": { "givenName": "Test", "familyName": "User" }, "emails": [{ "value": "test.user@example.com", "primary": true }], "active": true } Observe the HTTP 201 Created response. Check the returned JSON: externalId is null instead of "my-unique-external-id". Logs & Screenshots Analysis of the source code (scim.py): The issue is caused by a missing mapping in the SCIM router. While the Pydantic models (like SCIMUserCreateRequest) correctly include the externalId field, the actual database insertion logic does not: Python # Current implementation in scim.py new_user = Users.insert_new_user( id=user_id, name=name, email=email, profile_image_url=profile_image, role="user" if user_data.active else "pending", db=db, # externalId is missing and therefore never saved to the DB ) Additional Information I am testing this using Microsoft Entra ID (Azure AD) Provisioning on Demand. The IdP expects the returned resource to reflect the externalId it just sent. Because OpenWebUI returns null, the synchronization state becomes unreliable. ### Logs & Screenshots N/A - Verified via API response and source code analysis MICROSOFT_CLIENT_ID = MICROSOFT_CLIENT_SECRET = MICROSOFT_CLIENT_TENANT_ID = MICROSOFT_REDIRECT_URI = OPENID_PROVIDER_URL = https://login.microsoftonline.com/****/v2.0/.well-known/openid-configuration OAUTH_SCOPE = openid email profile User.Read GroupMember.Read.All OAUTH_EMAIL_CLAIM = email ENABLE_OAUTH_ROLE_MANAGEMENT = true OAUTH_ROLES_CLAIM = roles ENABLE_OAUTH_GROUP_MANAGEMENT = true ENABLE_OAUTH_GROUP_CREATION = true OAUTH_GROUPS_CLAIM = groups SCIM_ENABLED = TRUE SCIM_TOKEN = ### Additional Information _No response_

GiteaMirror added the bug label 2026-04-25 09:08:04 -05:00

GiteaMirror closed this issue

2026-04-25 09:08:06 -05:00

GiteaMirror commented

2026-04-25 09:08:07 -05:00

Author

Owner

@guenhter commented on GitHub (Feb 10, 2026):

Will hopefully be fixed by https://github.com/open-webui/open-webui/pull/21099

@guenhter commented on GitHub (Feb 10, 2026): Will hopefully be fixed by https://github.com/open-webui/open-webui/pull/21099

GiteaMirror commented

2026-04-25 09:08:08 -05:00

Author

Owner

@tjbck commented on GitHub (Feb 13, 2026):

Should be addressed in dev, let us know if the issue persists!

@tjbck commented on GitHub (Feb 13, 2026): Should be addressed in dev, let us know if the issue persists!

[GH-ISSUE #21280] issue: SCIM externalId is ignored during User Creation and Updates #34958

Check Existing Issues

Installation Method

Open WebUI Version

Ollama Version (if applicable)

Operating System

Browser (if applicable)

Confirmation

Expected Behavior

Actual Behavior

Steps to Reproduce

Current implementation in scim.py

Logs & Screenshots

Additional Information