[PR #17196] [CLOSED] feat: Add OAUTH_PRESERVE_LOCAL_GROUPS option to protect local groups during OAuth sync #39986

New Issue

GiteaMirror · 2026-04-25T12:23:49-05:00

GiteaMirror commented

2026-04-25 12:23:49 -05:00

📋 Pull Request Information

Original PR: https://github.com/open-webui/open-webui/pull/17196
Author: @wggcch
Created: 9/4/2025
Status: ❌ Closed

Base: main ← Head: feat/oauth-group-sync-preserve-local-groups

📝 Commits (1)

d7975f2 feat:

📊 Changes

3 files changed (+91 additions, -8 deletions)

View changed files

📝 backend/open_webui/config.py (+6 -0)
📝 backend/open_webui/models/groups.py (+29 -1)
📝 backend/open_webui/utils/oauth.py (+56 -7)

📄 Description

🎯 Problem

Currently, OAuth group synchronization overwrites all local groups, removing users from locally managed groups when they login via OAuth. This creates management conflicts between OAuth-managed and locally-managed groups.

🚀 Solution

This PR introduces a new optional configuration OAUTH_PRESERVE_LOCAL_GROUPS that allows administrators to preserve locally created groups while still enabling OAuth group synchronization.

📋 Changes

New Configuration Option

OAUTH_PRESERVE_LOCAL_GROUPS (default: false) - Enables protection of local groups during OAuth sync

Core Functionality

OAuth Metadata Tracking: Groups now track their origin (oauth_source in metadata)
Smart Group Management: Distinguishes between local and OAuth-managed groups
Name Conflict Resolution: Local groups take priority over OAuth groups with same names
Backward Compatibility: Default behavior unchanged (fully backward compatible)

Modified Files

backend/open_webui/config.py: Added new configuration option
backend/open_webui/models/groups.py: Extended group creation with OAuth tracking
backend/open_webui/utils/oauth.py: Enhanced group sync logic for local group preservation

🔧 Usage

# Enable local group preservation
OAUTH_PRESERVE_LOCAL_GROUPS=true

🧪 Scenarios Covered

Preserved Local Groups: Users stay in local "poweruser" group + get OAuth groups
Department Changes: Users removed from old OAuth departments but keep local groups
Name Conflicts: Local "admin" group preserved, OAuth "admin" group skipped
Legacy Mode: Works exactly as before when disabled (default)

🔄 Backward Compatibility

✅ Default behavior unchanged (OAUTH_PRESERVE_LOCAL_GROUPS=false)
✅ No database migrations required
✅ Existing APIs unchanged
✅ Zero breaking changes

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/open-webui/pull/17196 **Author:** [@wggcch](https://github.com/wggcch) **Created:** 9/4/2025 **Status:** ❌ Closed **Base:** `main` ← **Head:** `feat/oauth-group-sync-preserve-local-groups` --- ### 📝 Commits (1) - [`d7975f2`](https://github.com/open-webui/open-webui/commit/d7975f2a28ad993aba2852567e62d76dd997cdf4) feat: ### 📊 Changes **3 files changed** (+91 additions, -8 deletions) <details> <summary>View changed files</summary> 📝 `backend/open_webui/config.py` (+6 -0) 📝 `backend/open_webui/models/groups.py` (+29 -1) 📝 `backend/open_webui/utils/oauth.py` (+56 -7) </details> ### 📄 Description ## 🎯 **Problem** Currently, OAuth group synchronization overwrites all local groups, removing users from locally managed groups when they login via OAuth. This creates management conflicts between OAuth-managed and locally-managed groups. ## 🚀 **Solution** This PR introduces a new optional configuration `OAUTH_PRESERVE_LOCAL_GROUPS` that allows administrators to preserve locally created groups while still enabling OAuth group synchronization. ## 📋 **Changes** ### New Configuration Option - **`OAUTH_PRESERVE_LOCAL_GROUPS`** (default: `false`) - Enables protection of local groups during OAuth sync ### Core Functionality - **OAuth Metadata Tracking**: Groups now track their origin (`oauth_source` in metadata) - **Smart Group Management**: Distinguishes between local and OAuth-managed groups - **Name Conflict Resolution**: Local groups take priority over OAuth groups with same names - **Backward Compatibility**: Default behavior unchanged (fully backward compatible) ### Modified Files - **`backend/open_webui/config.py`**: Added new configuration option - **`backend/open_webui/models/groups.py`**: Extended group creation with OAuth tracking - **`backend/open_webui/utils/oauth.py`**: Enhanced group sync logic for local group preservation ## 🔧 **Usage** ```bash # Enable local group preservation OAUTH_PRESERVE_LOCAL_GROUPS=true ``` ## 🧪 **Scenarios Covered** 1. **Preserved Local Groups**: Users stay in local "poweruser" group + get OAuth groups 2. **Department Changes**: Users removed from old OAuth departments but keep local groups 3. **Name Conflicts**: Local "admin" group preserved, OAuth "admin" group skipped 4. **Legacy Mode**: Works exactly as before when disabled (default) ## 🔄 **Backward Compatibility** - ✅ **Default behavior unchanged** (OAUTH_PRESERVE_LOCAL_GROUPS=false) - ✅ **No database migrations required** - ✅ **Existing APIs unchanged** - ✅ **Zero breaking changes** --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

GiteaMirror added the pull-request label 2026-04-25 12:23:49 -05:00

GiteaMirror closed this issue

2026-04-25 12:23:51 -05:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#39986