mirror of
https://github.com/open-webui/open-webui.git
synced 2026-06-03 23:38:13 -05:00
issue: Exception during token refresh for provider oidc: Constructor parameter should be str #6522
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/open-webui#6522
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @davidshen84 on GitHub (Sep 27, 2025).
Check Existing Issues
Installation Method
Docker
Open WebUI Version
0.6.31
Ollama Version (if applicable)
No response
Operating System
Linux+k3s
Browser (if applicable)
Chrome
Confirmation
README.md.Expected Behavior
There are repetitive errors and warnings related to OAuth; however, I was able to log in and use the app using OAuth authentication.
Actual Behavior
Repeatitive messages like the following.
Steps to Reproduce
Set up the openweb-ui container with OAuth support using OIDC.
Logs & Screenshots
Additional Information
I don't fully understand how to use the
ENABLE_OAUTH_PERSISTENT_CONFIGsettings, so I set it to false.I wonder if the error is related to the value in
OAUTH_SESSION_TOKEN_ENCRYPTION_KEY. The key value is not some random string. It is a Fernet encryption key, but there's no mention of it in the document. I wonder if there are other hidden requirements of this key or other related settings that I didn't set correctly.@tjbck commented on GitHub (Sep 28, 2025):
Do you have
WEBUI_SECRET_KEYset?@davidshen84 commented on GitHub (Sep 28, 2025):
No. I thinks the doc says if I set OAUTH_SESSION_TOKEN_ENCRYPTION_KEY, I
don't need to set the web secret key. Also, the log says it generated one
on startup.
If I set the web secret key, do I need to reset the database?
On Mon, 29 Sept 2025, 02:53 Tim Jaeryang Baek, @.***>
wrote:
@Classic298 commented on GitHub (Sep 28, 2025):
@davidshen84
incorrect, the docs say that OAUTH_SESSION_TOKEN_ENCRYPTION_KEY defaults back to WEBUI_SECRET_KEY
It does not say you don't need to set the WEBUI_SECRET_KEY
In fact, the SSO tutorial page specifically says that WEBUI_SECRET_KEY is required.
@Classic298 commented on GitHub (Sep 28, 2025):
Correction: The SSO Troubleshooting Tutorial says it, not the normal one. Updating the docs rn!
But the troubleshooting tutorial should have been conducted first before opening an issue
@davidshen84 commented on GitHub (Sep 28, 2025):
Ok, thanks for the clarification.
On Mon, 29 Sept 2025, 06:26 Classic298, @.***> wrote:
@davidshen84 commented on GitHub (Sep 29, 2025):
I have set both
WEBUI_SECRET_KEYandOAUTH_SESSION_TOKEN_ENCRYPTION_KEYto the same value and still get this Error. The site still seems to be functional.Perhaps it's related to my OIDC provider? I am using cloud-iam.com, which uses KeyCloak for its service.
@tjbck commented on GitHub (Sep 30, 2025):
We're unable to reproduce here, are you able to provide any other relevant logs to help with troubleshooting?
@davidshen84 commented on GitHub (Sep 30, 2025):
I enabled the global debugging log, but I don't find anything useful.
Here's the full container log https://0x0.st/KBRE.log.
Is there any particular log or configuration setting you are looking for?
Also, I found the error did not occur right after I logged in, but after I
started a new chat session. The error log only occurred once, but the
warning log repeated.
Thanks
On Tue, 30 Sept 2025 at 13:47, Tim Jaeryang Baek @.***>
wrote:
@gvo commented on GitHub (Oct 1, 2025):
My provider is Microsoft.
The typo mentioned in https://github.com/open-webui/open-webui/issues/17585 - fixed in 0.6.32 - was intended to call get_server_metadata_url.
Per my tests with 0.6.32, get_server_metadata_url() is returning
Nonewhich throws the error during _perform_token_refresh. Same error as the OP. My provider is microsoft.I know this works instead of calling get_server_metadata_url - perhaps it may be of some use.
Maybe an issue with specific providers?
@tjbck commented on GitHub (Oct 1, 2025):
e493562735may have addressed this issue in dev, testing wanted here!@brainboutique commented on GitHub (Oct 3, 2025):
Same issue here.
open_webui.utils.oauth:get_oauth_token:654 - No OAuth session found for user xxx, session yybut only after some time (I suspect after access token expiry). I do NOT have any log entries from
open_webui.utils.oauth:_perform_token_refreshYes, secret keys are set. Will keep monitoring and try the fix mentioned above.
@BrysonCrookDrewlo commented on GitHub (Oct 3, 2025):
Issue Report:
This issue still seems to be persisting. I’m currently running the latest
devbuild. However, when my token is close to expiring and I trigger a tool that relies on it, the refresh process fails with the following errors:My OAuth provider is Microsoft.
I have all required environment variables set.
@jshelman commented on GitHub (Oct 6, 2025):
I was having exact same issue and errors in the log using Microsoft provider as well.
The issue appears to be that
self.get_server_metadata_url(client_id)returns None?, and throws this exception at08f8713ee1/backend/open_webui/utils/oauth.py (L477C15-L479C24)I haven't dug into root cause of that yet, but hard coding it to 'https://login.microsoftonline.com/{mytenantid}/v2.0/.well-known/openid-configuration' resolves the issue.
maybe this should be getting it from OPENID_PROVIDER_URL, but isn't?
@tjbck commented on GitHub (Oct 23, 2025):
I believe this issue has been resolved, please flag again if the issue persists!