[GH-ISSUE #23670] Bug: AddToolServerModal sends tool server ID as client_id during OAuth 2.1 static registration #58708

New Issue

GiteaMirror · 2026-05-05T23:44:35-05:00

GiteaMirror commented

2026-05-05 23:44:35 -05:00

Originally created by @dhruvalgupta2003 on GitHub (Apr 13, 2026).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/23670

Summary

When an admin registers an MCP tool server with auth_type: oauth_2.1_static, the frontend POSTs the tool server's internal ID (the value bound to id in the form) as client_id instead of the OAuth Client ID entered into the "Client ID" input (oauthClientId). The correct client_secret is sent, but the client_id is wrong.

Location

src/lib/components/AddToolServerModal.svelte, registerOAuthClientHandler():

// lines 81–94
const formData: { url: string; client_id: string; client_secret?: string } = {
    url: url,
    client_id: id          // <-- tool server id, not the OAuth client id
};

if (auth_type === 'oauth_2.1_static') {
    if (!oauthClientId || !oauthClientSecret) {
        toast.error($i18n.t('Please enter Client ID and Client Secret'));
        return;
    }
    formData.client_id = id;            // <-- line 92: still the tool server id
    formData.client_secret = oauthClientSecret;
}

The correct binding exists just a few lines down — when building info for the save payload (line ~340):

...(auth_type === 'oauth_2.1_static'
    ? { oauth_client_id: oauthClientId, oauth_client_secret: oauthClientSecret }
    : {})

So the UI state has the right value; it just isn't used at registration time.

Impact

Registration against the IdP is attempted with the wrong client_id, which the IdP rejects (or, worse, silently accepts and stores a useless record).
Users entering valid Entra AD / M365 client credentials see "Registration failed" even though the credentials are correct.

Suggested fix

Line 92:

- formData.client_id = id;
+ formData.client_id = oauthClientId;

Originally created by @dhruvalgupta2003 on GitHub (Apr 13, 2026). Original GitHub issue: https://github.com/open-webui/open-webui/issues/23670 ### Summary When an admin registers an MCP tool server with `auth_type: oauth_2.1_static`, the frontend POSTs the tool server's internal ID (the value bound to `id` in the form) as `client_id` instead of the OAuth Client ID entered into the "Client ID" input (`oauthClientId`). The correct `client_secret` is sent, but the `client_id` is wrong. ### Location `src/lib/components/AddToolServerModal.svelte`, `registerOAuthClientHandler()`: ```ts // lines 81–94 const formData: { url: string; client_id: string; client_secret?: string } = { url: url, client_id: id // <-- tool server id, not the OAuth client id }; if (auth_type === 'oauth_2.1_static') { if (!oauthClientId || !oauthClientSecret) { toast.error($i18n.t('Please enter Client ID and Client Secret')); return; } formData.client_id = id; // <-- line 92: still the tool server id formData.client_secret = oauthClientSecret; } ``` The correct binding exists just a few lines down — when building `info` for the save payload (line ~340): ```ts ...(auth_type === 'oauth_2.1_static' ? { oauth_client_id: oauthClientId, oauth_client_secret: oauthClientSecret } : {}) ``` So the UI state has the right value; it just isn't used at registration time. ### Impact - Registration against the IdP is attempted with the wrong `client_id`, which the IdP rejects (or, worse, silently accepts and stores a useless record). - Users entering valid Entra AD / M365 client credentials see "Registration failed" even though the credentials are correct. ### Suggested fix Line 92: ```diff - formData.client_id = id; + formData.client_id = oauthClientId; ```

GiteaMirror closed this issue

2026-05-05 23:44:36 -05:00

GiteaMirror commented

2026-05-05 23:44:38 -05:00

@tjbck commented on GitHub (Apr 13, 2026):

Addressed in dev.

@tjbck commented on GitHub (Apr 13, 2026): Addressed in dev.

Sign in to join this conversation.

Branches Tags

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/open-webui#58708