feat: support custom "token_endpoint_auth_method" as configurable env var #5680

New Issue

GiteaMirror · 2025-11-11T16:29:09-06:00

GiteaMirror commented

2025-11-11 16:29:09 -06:00

Originally created by @zachwalton on GitHub (Jul 1, 2025).

Check Existing Issues

I have searched the existing issues and discussions.

Problem Description

My company's OIDC provider doesn't support the default authlib token_endpoint_auth_method value of client_secret_basic; I get a 401 back from the token API.

Desired Solution you'd like

I had to apply the following patch to make it work:

diff --git a/backend/open_webui/config.py b/backend/open_webui/config.py
index 2848d21d6..9b7931800 100644
--- a/backend/open_webui/config.py
+++ b/backend/open_webui/config.py
@@ -628,6 +628,7 @@ def load_oauth_providers():
         def oidc_oauth_register(client):
             client_kwargs = {
                 "scope": OAUTH_SCOPES.value,
+                'token_endpoint_auth_method': 'client_secret_post',
                 **(
                     {"timeout": int(OAUTH_TIMEOUT.value)} if OAUTH_TIMEOUT.value else {}
                 ),

It would be great to make this configurable as an env var.

Alternatives Considered

No response

Additional Context

No response

Originally created by @zachwalton on GitHub (Jul 1, 2025). ### Check Existing Issues - [x] I have searched the existing issues and discussions. ### Problem Description My company's OIDC provider doesn't support the [default authlib](https://docs.authlib.org/en/latest/client/frameworks.html#using-oauth-2-0-to-log-in) `token_endpoint_auth_method` value of `client_secret_basic`; I get a 401 back from the token API. ### Desired Solution you'd like I had to apply the following patch to make it work: ``` diff --git a/backend/open_webui/config.py b/backend/open_webui/config.py index 2848d21d6..9b7931800 100644 --- a/backend/open_webui/config.py +++ b/backend/open_webui/config.py @@ -628,6 +628,7 @@ def load_oauth_providers(): def oidc_oauth_register(client): client_kwargs = { "scope": OAUTH_SCOPES.value, + 'token_endpoint_auth_method': 'client_secret_post', **( {"timeout": int(OAUTH_TIMEOUT.value)} if OAUTH_TIMEOUT.value else {} ), ``` It would be great to make this configurable as an env var. ### Alternatives Considered _No response_ ### Additional Context _No response_

GiteaMirror closed this issue

2025-11-11 16:29:09 -06:00

GiteaMirror commented

2025-11-11 16:29:11 -06:00

@tjbck commented on GitHub (Jul 16, 2025):

Addressed with 4f5d949af6 in dev

@tjbck commented on GitHub (Jul 16, 2025): Addressed with 4f5d949af6adab869d812412cd1737dd43f99da2 in dev

GiteaMirror commented

2025-11-11 16:29:11 -06:00

@zachwalton commented on GitHub (Jul 16, 2025):

Thanks for the fast turnaround!

@zachwalton commented on GitHub (Jul 16, 2025): Thanks for the fast turnaround!