github-starred/open-webui
2
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-11-14 05:02:01 -06:00
Code Issues 2.4k Packages Projects Releases 129 Wiki Activity

issue: Authentication issue with openwebui and Keycloak #5575

New Issue
Open
opened 2025-11-11 16:24:57 -06:00 by GiteaMirror · 13 comments
GiteaMirror commented 2025-11-11 16:24:57 -06:00
Owner
Copy Link
Copy Source

Originally created by @infra823 on GitHub (Jun 17, 2025).

Originally assigned to: @jackthgu on GitHub.

Check Existing Issues

  • I have searched the existing issues and discussions.
  • I am using the latest version of Open WebUI.

Installation Method

Docker

Open WebUI Version

0.6.13

Ollama Version (if applicable)

0.9.0

Operating System

Ubuntu 22.04

Browser (if applicable)

No response

Confirmation

  • I have read and followed all instructions in README.md.
  • I am using the latest version of both Open WebUI and Ollama.
  • I have included the browser console logs.
  • I have included the Docker container logs.
  • I have provided every relevant configuration, setting, and environment variable used in my setup.
  • I have clearly listed every relevant configuration, custom setting, environment variable, and command-line option that influences my setup (such as Docker Compose overrides, .env values, browser settings, authentication configurations, etc).
  • I have documented step-by-step reproduction instructions that are precise, sequential, and leave nothing to interpretation. My steps:
  • Start with the initial platform/version/OS and dependencies used,
  • Specify exact install/launch/configure commands,
  • List URLs visited, user input (incl. example values/emails/passwords if needed),
  • Describe all options and toggles enabled or changed,
  • Include any files or environmental changes,
  • Identify the expected and actual result at each stage,
  • Ensure any reasonably skilled user can follow and hit the same issue.

Expected Behavior

  • When connecting with Keycloak Oauth provider, users and admins are properly recognized in Open-webui

Actual Behavior

  • Login works for all users, but admins are not recognized

Steps to Reproduce

  1. Install Keycloak from the image quay.io/keycloak/keycloak:26.2.5
  2. Create a client for open-webui in keycloak
  3. Create a regular user account in Keycloak
  4. Create a user account in Keycloak with the admin scope
  5. Install Open-webui from the 0.6.13 image "main-cuda" with only keycloak as auth provider (see below env configuration)
  6. Access Open-webui website and select the Keycloak auth provider
  7. Try to log into Open-webui with keycloak as a user -> works OK
  8. Try to log into Open-webui with keycloak as an admin -> auth works but user is not admin

Logs & Screenshots

# openwebui container env excerpt
      GLOBAL_LOG_LEVEL: INFO
      OPENWEBUI_SKIP_USER_APPROUVAL: true
      OPENWEBUI_DEFAULT_USER_STATE: "active"
      OPENWEBUI_ALLOW_NEW_USERS: true
      BYPASS_MODEL_ACCESS_CONTROL: True
      WEBUI_URL: https://internal/
      PORT: 3000
      ENABLE_OAUTH_SIGNUP: true
      ENABLE_SIGNUP: false
      ENABLE_LOGIN_FORM: false
      ENABLE_OAUTH_GROUP_MANAGEMENT: true
      ENABLE_OAUTH_ROLE_MANAGEMENT: true
      ENABLE_PERSISTENT_CONFIG: false
      OAUTH_MERGE_ACCOUNTS_BY_EMAIL: true
      OAUTH_CLIENT_ID: ***
      OAUTH_CLIENT_SECRET: ****
      OPENID_PROVIDER_URL: https://internal/keycloak/realms/internal/.well-known/openid-configuration
      OAUTH_PROVIDER_NAME: openwebui
      OPENID_REDIRECT_URI: https://internal/oauth/oidc/callback
      OAUTH_SCOPES: openid email profile
      OAUTH_ALLOWED_ROLES: user,admin
      OAUTH_ADMIN_ROLES: admin
      OAUTH_ROLES_CLAIM: realm_access.roles
      DEFAULT_USER_ROLE: user
      CORS_ALLOW_ORIGIN: null

Additional Information

No response

Originally created by @infra823 on GitHub (Jun 17, 2025). Originally assigned to: @jackthgu on GitHub. ### Check Existing Issues - [x] I have searched the existing issues and discussions. - [x] I am using the latest version of Open WebUI. ### Installation Method Docker ### Open WebUI Version 0.6.13 ### Ollama Version (if applicable) 0.9.0 ### Operating System Ubuntu 22.04 ### Browser (if applicable) _No response_ ### Confirmation - [x] I have read and followed all instructions in `README.md`. - [x] I am using the latest version of **both** Open WebUI and Ollama. - [x] I have included the browser console logs. - [x] I have included the Docker container logs. - [x] I have **provided every relevant configuration, setting, and environment variable used in my setup.** - [x] I have clearly **listed every relevant configuration, custom setting, environment variable, and command-line option that influences my setup** (such as Docker Compose overrides, .env values, browser settings, authentication configurations, etc). - [x] I have documented **step-by-step reproduction instructions that are precise, sequential, and leave nothing to interpretation**. My steps: - Start with the initial platform/version/OS and dependencies used, - Specify exact install/launch/configure commands, - List URLs visited, user input (incl. example values/emails/passwords if needed), - Describe all options and toggles enabled or changed, - Include any files or environmental changes, - Identify the expected and actual result at each stage, - Ensure any reasonably skilled user can follow and hit the same issue. ### Expected Behavior - When connecting with Keycloak Oauth provider, users and admins are properly recognized in Open-webui ### Actual Behavior - Login works for all users, but admins are not recognized ### Steps to Reproduce 1. Install Keycloak from the image quay.io/keycloak/keycloak:26.2.5 2. Create a client for open-webui in keycloak 3. Create a regular user account in Keycloak 4. Create a user account in Keycloak with the admin scope 5. Install Open-webui from the 0.6.13 image "main-cuda" with only keycloak as auth provider (see below env configuration) 6. Access Open-webui website and select the Keycloak auth provider 7. Try to log into Open-webui with keycloak as a user -> works OK 8. Try to log into Open-webui with keycloak as an admin -> auth works but user is not admin ### Logs & Screenshots ```yaml # openwebui container env excerpt GLOBAL_LOG_LEVEL: INFO OPENWEBUI_SKIP_USER_APPROUVAL: true OPENWEBUI_DEFAULT_USER_STATE: "active" OPENWEBUI_ALLOW_NEW_USERS: true BYPASS_MODEL_ACCESS_CONTROL: True WEBUI_URL: https://internal/ PORT: 3000 ENABLE_OAUTH_SIGNUP: true ENABLE_SIGNUP: false ENABLE_LOGIN_FORM: false ENABLE_OAUTH_GROUP_MANAGEMENT: true ENABLE_OAUTH_ROLE_MANAGEMENT: true ENABLE_PERSISTENT_CONFIG: false OAUTH_MERGE_ACCOUNTS_BY_EMAIL: true OAUTH_CLIENT_ID: *** OAUTH_CLIENT_SECRET: **** OPENID_PROVIDER_URL: https://internal/keycloak/realms/internal/.well-known/openid-configuration OAUTH_PROVIDER_NAME: openwebui OPENID_REDIRECT_URI: https://internal/oauth/oidc/callback OAUTH_SCOPES: openid email profile OAUTH_ALLOWED_ROLES: user,admin OAUTH_ADMIN_ROLES: admin OAUTH_ROLES_CLAIM: realm_access.roles DEFAULT_USER_ROLE: user CORS_ALLOW_ORIGIN: null ``` ### Additional Information _No response_
GiteaMirror added the bug label 2025-11-11 16:24:58 -06:00
GiteaMirror commented 2025-11-11 16:24:58 -06:00
Author
Owner
Copy Link
Copy Source

@tjbck commented on GitHub (Jun 18, 2025):

Could you share your backend logs with GLOBAL_LOG_LEVEL set to DEBUG?

Related: https://github.com/open-webui/open-webui/blob/b5f4c85bb196c16a775802907aedd87366f58b0f/backend/open_webui/utils/oauth.py#L110

@tjbck commented on GitHub (Jun 18, 2025): Could you share your backend logs with `GLOBAL_LOG_LEVEL` set to `DEBUG`? Related: https://github.com/open-webui/open-webui/blob/b5f4c85bb196c16a775802907aedd87366f58b0f/backend/open_webui/utils/oauth.py#L110
GiteaMirror commented 2025-11-11 16:24:58 -06:00
Author
Owner
Copy Link
Copy Source

@simcop2387 commented on GitHub (Jun 18, 2025):

Is it possible that the realm_access.roles isn't being looked at as a path inside the token? Try setting up a mapper for the client in keycloak that puts it into a top level "roles" key for that client.

Client -> "openwebui-client" -> Client Scopes -> "openwebui-client-dedicated" -> "Add Mapper, by configuration" -> "User Realm Role" -> Give it a token claim name like "user_roles", then configure OAUTH_ROLES_CLAIM for openwebui to point at "user_roles" instead?

You should be able to see the new claim in the token by evaluating the user in the Client Scope tab in keycloak to see that things are showing up the way you expect.

@simcop2387 commented on GitHub (Jun 18, 2025): Is it possible that the `realm_access.roles` isn't being looked at as a path inside the token? Try setting up a mapper for the client in keycloak that puts it into a top level "roles" key for that client. Client -> "openwebui-client" -> Client Scopes -> "openwebui-client-dedicated" -> "Add Mapper, by configuration" -> "User Realm Role" -> Give it a token claim name like "user_roles", then configure `OAUTH_ROLES_CLAIM` for openwebui to point at "user_roles" instead? You should be able to see the new claim in the token by evaluating the user in the Client Scope tab in keycloak to see that things are showing up the way you expect.
GiteaMirror commented 2025-11-11 16:24:59 -06:00
Author
Owner
Copy Link
Copy Source

@infra823 commented on GitHub (Jun 18, 2025):

The authentication issue appears to comes from our configuration Keycloak setup. Here are the logs in case you notice anything strange. Thank you for your help.

openwebui  | 2025-06-18 13:43:01.240 | DEBUG    | httpcore._trace:atrace:87 - receive_response_body.started request=<Request [b'GET']> - {}
openwebui  | 2025-06-18 13:43:01.240 | DEBUG    | httpcore._trace:atrace:87 - receive_response_body.complete - {}
openwebui  | 2025-06-18 13:43:01.240 | DEBUG    | httpcore._trace:atrace:87 - response_closed.started - {}
openwebui  | 2025-06-18 13:43:01.240 | DEBUG    | httpcore._trace:atrace:87 - response_closed.complete - {}
openwebui  | 2025-06-18 13:43:01.240 | DEBUG    | httpcore._trace:atrace:87 - close.started - {}
openwebui  | 2025-06-18 13:43:01.240 | DEBUG    | httpcore._trace:atrace:87 - close.complete - {}
openwebui  | 2025-06-18 13:43:01.245 | DEBUG    | open_webui.utils.oauth:get_user_role:101 - Running OAUTH Role management - {}
openwebui  | 2025-06-18 13:43:01.246 | DEBUG    | open_webui.utils.oauth:get_user_role:117 - Oauth Roles claim: realm_access.roles - {}
openwebui  | 2025-06-18 13:43:01.246 | DEBUG    | open_webui.utils.oauth:get_user_role:118 - User roles from oauth: [] - {}
openwebui  | 2025-06-18 13:43:01.246 | DEBUG    | open_webui.utils.oauth:get_user_role:119 - Accepted user roles: ['user', 'admin'] - {}
openwebui  | 2025-06-18 13:43:01.246 | DEBUG    | open_webui.utils.oauth:get_user_role:120 - Accepted admin roles: ['admin'] - {}
openwebui  | 2025-06-18 13:43:01.246 | DEBUG    | open_webui.utils.oauth:update_user_groups:148 - Running OAUTH Group management - {}
openwebui  | 2025-06-18 13:43:01.248 | DEBUG    | open_webui.utils.oauth:update_user_groups:220 - Oauth Groups claim: groups - {}
openwebui  | 2025-06-18 13:43:01.248 | DEBUG    | open_webui.utils.oauth:update_user_groups:221 - User oauth groups: [] - {}
openwebui  | 2025-06-18 13:43:01.248 | DEBUG    | open_webui.utils.oauth:update_user_groups:222 - User's current groups: [] - {}
openwebui  | 2025-06-18 13:43:01.248 | DEBUG    | open_webui.utils.oauth:update_user_groups:223 - All groups available in OpenWebUI: [] - {}
@infra823 commented on GitHub (Jun 18, 2025): The authentication issue appears to comes from our configuration Keycloak setup. Here are the logs in case you notice anything strange. Thank you for your help. ``` openwebui | 2025-06-18 13:43:01.240 | DEBUG | httpcore._trace:atrace:87 - receive_response_body.started request=<Request [b'GET']> - {} openwebui | 2025-06-18 13:43:01.240 | DEBUG | httpcore._trace:atrace:87 - receive_response_body.complete - {} openwebui | 2025-06-18 13:43:01.240 | DEBUG | httpcore._trace:atrace:87 - response_closed.started - {} openwebui | 2025-06-18 13:43:01.240 | DEBUG | httpcore._trace:atrace:87 - response_closed.complete - {} openwebui | 2025-06-18 13:43:01.240 | DEBUG | httpcore._trace:atrace:87 - close.started - {} openwebui | 2025-06-18 13:43:01.240 | DEBUG | httpcore._trace:atrace:87 - close.complete - {} openwebui | 2025-06-18 13:43:01.245 | DEBUG | open_webui.utils.oauth:get_user_role:101 - Running OAUTH Role management - {} openwebui | 2025-06-18 13:43:01.246 | DEBUG | open_webui.utils.oauth:get_user_role:117 - Oauth Roles claim: realm_access.roles - {} openwebui | 2025-06-18 13:43:01.246 | DEBUG | open_webui.utils.oauth:get_user_role:118 - User roles from oauth: [] - {} openwebui | 2025-06-18 13:43:01.246 | DEBUG | open_webui.utils.oauth:get_user_role:119 - Accepted user roles: ['user', 'admin'] - {} openwebui | 2025-06-18 13:43:01.246 | DEBUG | open_webui.utils.oauth:get_user_role:120 - Accepted admin roles: ['admin'] - {} openwebui | 2025-06-18 13:43:01.246 | DEBUG | open_webui.utils.oauth:update_user_groups:148 - Running OAUTH Group management - {} openwebui | 2025-06-18 13:43:01.248 | DEBUG | open_webui.utils.oauth:update_user_groups:220 - Oauth Groups claim: groups - {} openwebui | 2025-06-18 13:43:01.248 | DEBUG | open_webui.utils.oauth:update_user_groups:221 - User oauth groups: [] - {} openwebui | 2025-06-18 13:43:01.248 | DEBUG | open_webui.utils.oauth:update_user_groups:222 - User's current groups: [] - {} openwebui | 2025-06-18 13:43:01.248 | DEBUG | open_webui.utils.oauth:update_user_groups:223 - All groups available in OpenWebUI: [] - {} ```
GiteaMirror commented 2025-11-11 16:24:59 -06:00
Author
Owner
Copy Link
Copy Source

@scalenow commented on GitHub (Jun 19, 2025):

your end file should look like this # Ollama URL for the backend to connect

OLLAMA_BASE_URL='http://localhost:11434'

OPENAI_API_BASE_URL=''
OPENAI_API_KEY=''

SCARF_NO_ANALYTICS=true
DO_NOT_TRACK=true
ANONYMIZED_TELEMETRY=false
export WEBUI_NAME="scalenow AI"

ENABLE_OAUTH_SIGNUP="true"
OAUTH_CLIENT_ID=openwebui
OAUTH_CLIENT_SECRET=ABCD(Use your key)
OAUTH_PROVIDER_NAME=KeyCloak
OAUTH_SCOPES="openid email profile"
OAUTH_REDIRECT_URI=https://www.scalenowai.com.au:5004/oauth/oidc/callback
OPENID_PROVIDER_URL=https://www.scalenowai.com.au/realms/scalenowAI/.well-known/openid-configuration

OAUTH_ROLE_CLAIM=resource_access.openwebui.roles
OAUTH_ADMIN_ROLE=admin

This was flawlessly till 6.13 from 6.14 onwards it works fine with out any issue till you refresh the page .on refreshing the page gets username and password is. not valid.I have to signout from keycloak and it works again.The aboeve script will let you login and will work till you refresh the page @tjbck mate ,any suggestions

@scalenow commented on GitHub (Jun 19, 2025): your end file should look like this # Ollama URL for the backend to connect OLLAMA_BASE_URL='http://localhost:11434' OPENAI_API_BASE_URL='' OPENAI_API_KEY='' SCARF_NO_ANALYTICS=true DO_NOT_TRACK=true ANONYMIZED_TELEMETRY=false export WEBUI_NAME="scalenow AI" ENABLE_OAUTH_SIGNUP="true" OAUTH_CLIENT_ID=openwebui OAUTH_CLIENT_SECRET=ABCD(Use your key) OAUTH_PROVIDER_NAME=KeyCloak OAUTH_SCOPES="openid email profile" OAUTH_REDIRECT_URI=https://www.scalenowai.com.au:5004/oauth/oidc/callback OPENID_PROVIDER_URL=https://www.scalenowai.com.au/realms/scalenowAI/.well-known/openid-configuration OAUTH_ROLE_CLAIM=resource_access.openwebui.roles OAUTH_ADMIN_ROLE=admin This was flawlessly till 6.13 from 6.14 onwards it works fine with out any issue till you refresh the page .on refreshing the page gets username and password is. not valid.I have to signout from keycloak and it works again.The aboeve script will let you login and will work till you refresh the page @tjbck mate ,any suggestions
GiteaMirror commented 2025-11-11 16:24:59 -06:00
Author
Owner
Copy Link
Copy Source

@jackthgu commented on GitHub (Jun 19, 2025):

The issue stems from how OpenWebUI's OAuth callback handler processes user data. The code first inspects the ID Token. If the ID Token contains the user's email, the application uses the claims from the token directly and does not make a separate request to the UserInfo endpoint to fetch additional user details.

By default, Keycloak's realm roles mapper adds role information to the UserInfo response but not necessarily to the ID Token. As a result, if the role claims are missing from the ID Token, OpenWebUI never sees them, and the oauth_roles list remains empty.

The solution is to configure Keycloak to include the realm_access.roles claim directly within the ID Token.

Here are the steps:

  1. In your Keycloak Admin Console, navigate to Client Scopes.
  2. Click on the roles scope (or the one you are using).
  3. Go to the Mappers tab.
  4. Click on the realm roles mapper.
  5. In the mapper configuration, enable the "Add to ID token" toggle switch.
  6. Click Save.

Image

After applying this change, Keycloak will include the user's roles in the ID Token, allowing OpenWebUI to correctly parse them and enforce role-based access control.

Hope this helps others who run into the same issue!

@jackthgu commented on GitHub (Jun 19, 2025): The issue stems from how OpenWebUI's OAuth callback handler processes user data. The code first inspects the **ID Token**. If the ID Token contains the user's email, the application uses the claims from the token directly and **does not** make a separate request to the UserInfo endpoint to fetch additional user details. By default, Keycloak's `realm roles` mapper adds role information to the UserInfo response but not necessarily to the ID Token. As a result, if the role claims are missing from the ID Token, OpenWebUI never sees them, and the `oauth_roles` list remains empty. The solution is to configure Keycloak to include the `realm_access.roles` claim directly within the **ID Token**. Here are the steps: 1. In your Keycloak Admin Console, navigate to **Client Scopes**. 2. Click on the **`roles`** scope (or the one you are using). 3. Go to the **Mappers** tab. 4. Click on the **`realm roles`** mapper. 5. In the mapper configuration, enable the **"Add to ID token"** toggle switch. 6. Click **Save**. ![Image](https://github.com/user-attachments/assets/011d67fb-a050-4b97-be25-90f1e5c279b9) After applying this change, Keycloak will include the user's roles in the ID Token, allowing OpenWebUI to correctly parse them and enforce role-based access control. Hope this helps others who run into the same issue!
GiteaMirror commented 2025-11-11 16:24:59 -06:00
Author
Owner
Copy Link
Copy Source

@scalenow commented on GitHub (Jun 19, 2025):

@jackthgu This is exactly what I have implemented ,however on refreshing the page gets gets username and password is. not valid ,I will review your suggestions once again ,thanks for your help

@scalenow commented on GitHub (Jun 19, 2025): @jackthgu This is exactly what I have implemented ,however on refreshing the page gets gets username and password is. not valid ,I will review your suggestions once again ,thanks for your help
GiteaMirror commented 2025-11-11 16:25:00 -06:00
Author
Owner
Copy Link
Copy Source

@jackthgu commented on GitHub (Jun 25, 2025):

@infra823 Have the issues been resolved based on our previous discussions?

@jackthgu commented on GitHub (Jun 25, 2025): @infra823 Have the issues been resolved based on our previous discussions?
GiteaMirror commented 2025-11-11 16:25:00 -06:00
Author
Owner
Copy Link
Copy Source

@swein commented on GitHub (Jul 1, 2025):

The issue stems from how OpenWebUI's OAuth callback handler processes user data. The code first inspects the ID Token. If the ID Token contains the user's email, the application uses the claims from the token directly and does not make a separate request to the UserInfo endpoint to fetch additional user details.

By default, Keycloak's realm roles mapper adds role information to the UserInfo response but not necessarily to the ID Token. As a result, if the role claims are missing from the ID Token, OpenWebUI never sees them, and the oauth_roles list remains empty.

The solution is to configure Keycloak to include the realm_access.roles claim directly within the ID Token.

Here are the steps:

  1. In your Keycloak Admin Console, navigate to Client Scopes.
  2. Click on the roles scope (or the one you are using).
  3. Go to the Mappers tab.
  4. Click on the realm roles mapper.
  5. In the mapper configuration, enable the "Add to ID token" toggle switch.
  6. Click Save.

Image

After applying this change, Keycloak will include the user's roles in the ID Token, allowing OpenWebUI to correctly parse them and enforce role-based access control.

Hope this helps others who run into the same issue!

Are you using these values for multivalued and claim json?

Image

@swein commented on GitHub (Jul 1, 2025): > The issue stems from how OpenWebUI's OAuth callback handler processes user data. The code first inspects the **ID Token**. If the ID Token contains the user's email, the application uses the claims from the token directly and **does not** make a separate request to the UserInfo endpoint to fetch additional user details. > > By default, Keycloak's `realm roles` mapper adds role information to the UserInfo response but not necessarily to the ID Token. As a result, if the role claims are missing from the ID Token, OpenWebUI never sees them, and the `oauth_roles` list remains empty. > > The solution is to configure Keycloak to include the `realm_access.roles` claim directly within the **ID Token**. > > Here are the steps: > > 1. In your Keycloak Admin Console, navigate to **Client Scopes**. > 2. Click on the **`roles`** scope (or the one you are using). > 3. Go to the **Mappers** tab. > 4. Click on the **`realm roles`** mapper. > 5. In the mapper configuration, enable the **"Add to ID token"** toggle switch. > 6. Click **Save**. > > ![Image](https://github.com/user-attachments/assets/011d67fb-a050-4b97-be25-90f1e5c279b9) > > After applying this change, Keycloak will include the user's roles in the ID Token, allowing OpenWebUI to correctly parse them and enforce role-based access control. > > Hope this helps others who run into the same issue! Are you using these values for multivalued and claim json? ![Image](https://github.com/user-attachments/assets/d7fafa9e-f671-4ff4-a4e3-4ee0cbec5586)
GiteaMirror commented 2025-11-11 16:25:00 -06:00
Author
Owner
Copy Link
Copy Source

@scalenow commented on GitHub (Jul 9, 2025):

@swein please the image your instructions are not in alignment with the image

Image
@scalenow commented on GitHub (Jul 9, 2025): @swein please the image your instructions are not in alignment with the image <img width="1662" height="829" alt="Image" src="https://github.com/user-attachments/assets/254cd0c2-9d57-4e32-a109-6d36936db2cc" />
GiteaMirror commented 2025-11-11 16:25:01 -06:00
Author
Owner
Copy Link
Copy Source

@scalenow commented on GitHub (Jul 15, 2025):

@swein did not solve the problem ,still says username and password incorrect

@scalenow commented on GitHub (Jul 15, 2025): @swein did not solve the problem ,still says username and password incorrect
GiteaMirror commented 2025-11-11 16:25:01 -06:00
Author
Owner
Copy Link
Copy Source

@swein commented on GitHub (Jul 15, 2025):

@swein please the image your instructions are not in alignment with the image

Image

I figured it out finally. was a misconfiguration on realm.roles mappers types with multivariate json needing to be a string type, not JSON type.

@swein commented on GitHub (Jul 15, 2025): > [@swein](https://github.com/swein) please the image your instructions are not in alignment with the image > > <img alt="Image" width="1662" height="829" src="https://private-user-images.githubusercontent.com/68556364/464184509-254cd0c2-9d57-4e32-a109-6d36936db2cc.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3NTI2MDIyNTksIm5iZiI6MTc1MjYwMTk1OSwicGF0aCI6Ii82ODU1NjM2NC80NjQxODQ1MDktMjU0Y2QwYzItOWQ1Ny00ZTMyLWExMDktNmQzNjkzNmRiMmNjLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNTA3MTUlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjUwNzE1VDE3NTIzOVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWIyMDEyOTdjZjc5MWFmODlkYTIyMTY0ZmE5ZGM4MDJhNzAzMDY5Y2QzY2UxNmEzYThhYzQ0NDQwNzExYWVlNjAmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0In0.dSYgl-whEUvcj-y4eHxwj71gVkTYI92YQDc84Wb1wpc"> I figured it out finally. was a misconfiguration on realm.roles mappers types with multivariate json needing to be a string type, not JSON type.
GiteaMirror commented 2025-11-11 16:25:01 -06:00
Author
Owner
Copy Link
Copy Source

@scalenow commented on GitHub (Jul 17, 2025):

Image @swein these are my settings still get an error this has started since version 6.12
@scalenow commented on GitHub (Jul 17, 2025): <img width="1253" height="826" alt="Image" src="https://github.com/user-attachments/assets/6fd996f3-5d36-4423-9cef-d7e65daedc81" /> @swein these are my settings still get an error this has started since version 6.12
GiteaMirror commented 2025-11-11 16:25:01 -06:00
Author
Owner
Copy Link
Copy Source

@scalenow commented on GitHub (Jul 19, 2025):

@swein the issue it works fine without iframe but when you embed in iframe on refreshing the page gets username and password error

@scalenow commented on GitHub (Jul 19, 2025): @swein the issue it works fine without iframe but when you embed in iframe on refreshing the page gets username and password error
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
confirmed
confirmed issue
core
documentation
enhancement
good first issue
help wanted
non-core
pull-request
Mirrored from GitHub Pull Request
 python
question
testing wanted
No labels bug
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/open-webui#5575