[GH-ISSUE #18542] feat: Support OAUTH_*_ROLES that include a comma #57295

New Issue

GiteaMirror · 2026-05-05T20:49:34-05:00

GiteaMirror commented

2026-05-05 20:49:34 -05:00

Originally created by @attilaolah on GitHub (Oct 23, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/18542

Check Existing Issues

I have searched all existing open AND closed issues and discussions for similar requests. I have found none that is comparable to my request.

Problem Description

I am in the unfortunate position that my Identity Provider sets groups in the token using an LDAP-like syntax, so instead of something like mygroup, I get values like cn=mygroup,ou=myunit,o=myorg.

These cannot be used with OAUTH_ALLOWED_ROLES or OAUTH_ADMIN_ROLES because the commas are used as a separator, so the value is treated as if I specified the parts as individual roles, see here: 7a83e7dfa3/backend/open_webui/config.py (L579-L592)

Desired Solution you'd like

Switching the separator to something else like a semicolon would work as a quick fix, but would be a breaking change, even worse, it would cause the same issue for the other unfortunate people who might have semicolons in the role names.

A simple thing that comes to mind would be to escape the comma with backslashes, but then you'd need to split them with a lookbehind, maybe with a regex.

Maybe a nicer approach would be to try to parse the env var as JSON, and only if that fails, treat it as a comma-separated list?

I'm happy to send a PR if you can advise what kind of solution would you be willing to accept.

Alternatives Considered

We have a workaround for now, which is to use another claim for the roles, but that is less than ideal.

Additional Context

No response

Originally created by @attilaolah on GitHub (Oct 23, 2025). Original GitHub issue: https://github.com/open-webui/open-webui/issues/18542 ### Check Existing Issues - [x] I have searched all existing open AND closed issues and discussions for similar requests. I have found none that is comparable to my request. ### Problem Description I am in the unfortunate position that my Identity Provider sets groups in the token using an LDAP-like syntax, so instead of something like `mygroup`, I get values like `cn=mygroup,ou=myunit,o=myorg`. These cannot be used with `OAUTH_ALLOWED_ROLES` or `OAUTH_ADMIN_ROLES` because the commas are used as a separator, so the value is treated as if I specified the parts as individual roles, see here: https://github.com/open-webui/open-webui/blob/7a83e7dfa367d19f762ec17cac5e4a94ea2bd97d/backend/open_webui/config.py#L579-L592 ### Desired Solution you'd like Switching the separator to something else like a semicolon would work as a quick fix, but would be a breaking change, even worse, it would cause the same issue for the other unfortunate people who might have semicolons in the role names. A simple thing that comes to mind would be to escape the comma with backslashes, but then you'd need to split them with a lookbehind, maybe with a regex. Maybe a nicer approach would be to try to parse the env var as JSON, and only if that fails, treat it as a comma-separated list? I'm happy to send a PR if you can advise what kind of solution would you be willing to accept. ### Alternatives Considered We have a workaround for now, which is to use another claim for the roles, but that is less than ideal. ### Additional Context _No response_

GiteaMirror closed this issue

2026-05-05 20:49:35 -05:00

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#57295