github-starred/open-webui
2
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-03-10 07:43:10 -05:00
Code Issues 308 Packages Projects Releases 100 Wiki Activity

OIDC Login Role Management Configuration Issue: Roles Not Correctly Recognized from Lark #4307

New Issue
Closed
opened 2025-11-11 15:51:13 -06:00 by GiteaMirror · 0 comments
GiteaMirror commented 2025-11-11 15:51:13 -06:00
Owner
Copy Link

Originally created by @hongspell on GitHub (Mar 7, 2025).

Issue Content:

### Description
We have configured Open WebUI to use Lark's OIDC for authentication, but we are still receiving the following error when trying to log in:

{"detail":"You do not have permission to access this resource. Please contact your administrator for assistance."}


### Environment Variables Configured:
```bash
OAUTH_CLIENT_ID=xxx
OAUTH_CLIENT_SECRET=xxx
OPENID_PROVIDER_URL=https://anycross.larksuite.com/sso/xxx/.well-known/openid-configuration
OAUTH_PROVIDER_NAME=Lark
OAUTH_SCOPES=openid email profile
OAUTH_AUTO_SIGNUP=true
OAUTH_EMAIL_VERIFIED=true
ENABLE_OAUTH_ROLE_MANAGEMENT=true
OAUTH_ROLES_CLAIM=user.roles  # The role claim returned by Lark
OAUTH_ALLOWED_ROLES=member,user
OAUTH_ADMIN_ROLES=admin

Explanation

  1. Role Field Configuration: We have configured OAUTH_ROLES_CLAIM=user.roles, but still cannot log in, receiving the "permission denied" message.
  2. Role Return: We need to confirm whether Lark's OIDC is returning the correct role field (user.roles) and whether these roles match the configurations in OAUTH_ALLOWED_ROLES and OAUTH_ADMIN_ROLES.

Possible Issue:

  • Does Lark return the correct role information?
  • Do we need to adjust the OAUTH_ROLES_CLAIM configuration to match the role field returned by Lark?

Request for Help:

Has anyone encountered a similar configuration issue or have any suggestions on how to correct the role field mapping or Open WebUI configuration?

Originally created by @hongspell on GitHub (Mar 7, 2025). ### Issue Content: ```markdown ### Description We have configured Open WebUI to use Lark's OIDC for authentication, but we are still receiving the following error when trying to log in: ``` `{"detail":"You do not have permission to access this resource. Please contact your administrator for assistance."}` ```markdown ### Environment Variables Configured: ```bash OAUTH_CLIENT_ID=xxx OAUTH_CLIENT_SECRET=xxx OPENID_PROVIDER_URL=https://anycross.larksuite.com/sso/xxx/.well-known/openid-configuration OAUTH_PROVIDER_NAME=Lark OAUTH_SCOPES=openid email profile OAUTH_AUTO_SIGNUP=true OAUTH_EMAIL_VERIFIED=true ENABLE_OAUTH_ROLE_MANAGEMENT=true OAUTH_ROLES_CLAIM=user.roles # The role claim returned by Lark OAUTH_ALLOWED_ROLES=member,user OAUTH_ADMIN_ROLES=admin ``` ### Explanation 1. **Role Field Configuration**: We have configured `OAUTH_ROLES_CLAIM=user.roles`, but still cannot log in, receiving the "permission denied" message. 2. **Role Return**: We need to confirm whether Lark's OIDC is returning the correct role field (`user.roles`) and whether these roles match the configurations in `OAUTH_ALLOWED_ROLES` and `OAUTH_ADMIN_ROLES`. ### Possible Issue: - Does Lark return the correct role information? - Do we need to adjust the `OAUTH_ROLES_CLAIM` configuration to match the role field returned by Lark? ### Request for Help: Has anyone encountered a similar configuration issue or have any suggestions on how to correct the role field mapping or Open WebUI configuration?
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
core
documentation
enhancement
good first issue
help wanted
non-core
pull-request
Mirrored from GitHub Pull Request
 python
question
testing wanted
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/open-webui#4307
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?