OIDC Login Role Management Configuration Issue: Roles Not Correctly Recognized from Lark #4307

New Issue

2025-11-11T15:51:13-06:00

GiteaMirror commented

2025-11-11 15:51:13 -06:00

Originally created by @hongspell on GitHub (Mar 7, 2025).

Issue Content:

### Description
We have configured Open WebUI to use Lark's OIDC for authentication, but we are still receiving the following error when trying to log in:

{"detail":"You do not have permission to access this resource. Please contact your administrator for assistance."}


### Environment Variables Configured:
```bash
OAUTH_CLIENT_ID=xxx
OAUTH_CLIENT_SECRET=xxx
OPENID_PROVIDER_URL=https://anycross.larksuite.com/sso/xxx/.well-known/openid-configuration
OAUTH_PROVIDER_NAME=Lark
OAUTH_SCOPES=openid email profile
OAUTH_AUTO_SIGNUP=true
OAUTH_EMAIL_VERIFIED=true
ENABLE_OAUTH_ROLE_MANAGEMENT=true
OAUTH_ROLES_CLAIM=user.roles  # The role claim returned by Lark
OAUTH_ALLOWED_ROLES=member,user
OAUTH_ADMIN_ROLES=admin

Explanation

Role Field Configuration: We have configured OAUTH_ROLES_CLAIM=user.roles, but still cannot log in, receiving the "permission denied" message.
Role Return: We need to confirm whether Lark's OIDC is returning the correct role field (user.roles) and whether these roles match the configurations in OAUTH_ALLOWED_ROLES and OAUTH_ADMIN_ROLES.

Possible Issue:

Does Lark return the correct role information?
Do we need to adjust the OAUTH_ROLES_CLAIM configuration to match the role field returned by Lark?

Request for Help:

Has anyone encountered a similar configuration issue or have any suggestions on how to correct the role field mapping or Open WebUI configuration?

Originally created by @hongspell on GitHub (Mar 7, 2025). ### Issue Content: ```markdown ### Description We have configured Open WebUI to use Lark's OIDC for authentication, but we are still receiving the following error when trying to log in: ``` `{"detail":"You do not have permission to access this resource. Please contact your administrator for assistance."}` ```markdown ### Environment Variables Configured: ```bash OAUTH_CLIENT_ID=xxx OAUTH_CLIENT_SECRET=xxx OPENID_PROVIDER_URL=https://anycross.larksuite.com/sso/xxx/.well-known/openid-configuration OAUTH_PROVIDER_NAME=Lark OAUTH_SCOPES=openid email profile OAUTH_AUTO_SIGNUP=true OAUTH_EMAIL_VERIFIED=true ENABLE_OAUTH_ROLE_MANAGEMENT=true OAUTH_ROLES_CLAIM=user.roles # The role claim returned by Lark OAUTH_ALLOWED_ROLES=member,user OAUTH_ADMIN_ROLES=admin ``` ### Explanation 1. **Role Field Configuration**: We have configured `OAUTH_ROLES_CLAIM=user.roles`, but still cannot log in, receiving the "permission denied" message. 2. **Role Return**: We need to confirm whether Lark's OIDC is returning the correct role field (`user.roles`) and whether these roles match the configurations in `OAUTH_ALLOWED_ROLES` and `OAUTH_ADMIN_ROLES`. ### Possible Issue: - Does Lark return the correct role information? - Do we need to adjust the `OAUTH_ROLES_CLAIM` configuration to match the role field returned by Lark? ### Request for Help: Has anyone encountered a similar configuration issue or have any suggestions on how to correct the role field mapping or Open WebUI configuration?

GiteaMirror closed this issue

2025-11-11 15:51:13 -06:00

GiteaMirror referenced this issue

2025-11-11 17:48:45 -06:00

[PR #4307] [MERGED] 💄 Support @Model display model pictures #8245

GiteaMirror referenced this issue

2026-04-20 03:31:06 -05:00

[PR #4307] [MERGED] 💄 Support @Model display model pictures #21449

GiteaMirror referenced this issue

2026-04-25 10:43:04 -05:00

[PR #4307] [MERGED] 💄 Support @Model display model pictures #37079

GiteaMirror referenced this issue