github-starred/open-webui
2
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-05-21 17:13:00 -05:00
Code Issues 2.4k Packages Projects Releases 129 Wiki Activity

[GH-ISSUE #13418] issue: When admin user is logged into via OAUTH, role is reset to user #87642

New Issue
Closed
opened 2026-05-15 12:07:42 -05:00 by GiteaMirror · 3 comments
GiteaMirror commented 2026-05-15 12:07:42 -05:00
Owner
Copy Link

Originally created by @Lutherwaves on GitHub (May 1, 2025).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/13418

Check Existing Issues

  • I have searched the existing issues and discussions.
  • I am using the latest version of Open WebUI.

Installation Method

Other

Open WebUI Version

0.6.5

Ollama Version (if applicable)

No response

Operating System

Ubuntu 22.04

Browser (if applicable)

No response

Confirmation

  • I have read and followed all instructions in README.md.
  • I am using the latest version of both Open WebUI and Ollama.
  • I have included the browser console logs.
  • I have included the Docker container logs.
  • I have listed steps to reproduce the bug in detail.

Expected Behavior

When admin user logs in via oAUTH, the user remains admin.

Actual Behavior

When a user with an email matching the email of the original Admin (first logged in user), the role of the admin is changed to user.

Steps to Reproduce

  1. Setup openwebui and login first time with a user email that you have an OAUTH user for
  2. Re-deploy the setup, now with OAUTH environment variables
  3. Logout, select "login via " and login with a user that has the same email as the original admin user
  4. Upon login, the user is no longer admin

Logs & Screenshots

Recording of login via admin, then login with same user via Auth0 changing the role
https://github.com/user-attachments/assets/e0404853-4705-4a14-b7f3-14fa27cd65d4

Additional Information

  • I initially deployed without OAUTH and added the env variables afterwards
  • Env variables (obfuscated):
- name: ENABLE_SIGNUP
    value: "false"
- name: ENABLE_LOGIN_FORM
   value: "true"
- name: ENABLE_OAUTH_SIGNUP
   value: "true"
- name: ENABLE_OAUTH_GROUP_MANAGEMENT
  value: "true"
- name: ENABLE_OAUTH_ROLE_MANAGEMENT
   value: "true"
- name: OAUTH_MERGE_ACCOUNTS_BY_EMAIL
  value: "true"
- name: OAUTH_CLIENT_ID
   value: "<CLIENT_ID>"
- name: OAUTH_CLIENT_SECRET
   value: "<SECRET>"
- name: OPENID_PROVIDER_URL
   value: "<PROVIDER>"
- name: OAUTH_PROVIDER_NAME
   value: "Auth0"
  • Fix is to edit user role directly in database (postgres)
  • If I add a new admin user (local, outside oauth) it cannot edit the "original admin" back to admin due to security restrictions
Originally created by @Lutherwaves on GitHub (May 1, 2025). Original GitHub issue: https://github.com/open-webui/open-webui/issues/13418 ### Check Existing Issues - [x] I have searched the existing issues and discussions. - [x] I am using the latest version of Open WebUI. ### Installation Method Other ### Open WebUI Version 0.6.5 ### Ollama Version (if applicable) _No response_ ### Operating System Ubuntu 22.04 ### Browser (if applicable) _No response_ ### Confirmation - [x] I have read and followed all instructions in `README.md`. - [x] I am using the latest version of **both** Open WebUI and Ollama. - [x] I have included the browser console logs. - [x] I have included the Docker container logs. - [x] I have listed steps to reproduce the bug in detail. ### Expected Behavior When admin user logs in via oAUTH, the user remains admin. ### Actual Behavior When a user with an email matching the email of the original Admin (first logged in user), the role of the admin is changed to user. ### Steps to Reproduce 1. Setup openwebui and login first time with a user email that you have an OAUTH user for 2. Re-deploy the setup, now with OAUTH environment variables 3. Logout, select "login via <your oauth name here>" and login with a user that has the same email as the original admin user 4. Upon login, the user is no longer admin ### Logs & Screenshots Recording of login via admin, then login with same user via Auth0 changing the role https://github.com/user-attachments/assets/e0404853-4705-4a14-b7f3-14fa27cd65d4 ### Additional Information * I initially deployed without OAUTH and added the env variables afterwards * Env variables (obfuscated): ``` - name: ENABLE_SIGNUP value: "false" - name: ENABLE_LOGIN_FORM value: "true" - name: ENABLE_OAUTH_SIGNUP value: "true" - name: ENABLE_OAUTH_GROUP_MANAGEMENT value: "true" - name: ENABLE_OAUTH_ROLE_MANAGEMENT value: "true" - name: OAUTH_MERGE_ACCOUNTS_BY_EMAIL value: "true" - name: OAUTH_CLIENT_ID value: "<CLIENT_ID>" - name: OAUTH_CLIENT_SECRET value: "<SECRET>" - name: OPENID_PROVIDER_URL value: "<PROVIDER>" - name: OAUTH_PROVIDER_NAME value: "Auth0" ``` * Fix is to edit user role directly in database (postgres) * If I add a new admin user (local, outside oauth) it cannot edit the "original admin" back to admin due to security restrictions
GiteaMirror added the bug label 2026-05-15 12:07:42 -05:00
GiteaMirror commented 2026-05-15 12:07:43 -05:00
Author
Owner
Copy Link

@Lutherwaves commented on GitHub (May 1, 2025):

https://discord.com/channels/1170866489302188073/1367487568622649416/1367487568622649416

<!-- gh-comment-id:2845793975 --> @Lutherwaves commented on GitHub (May 1, 2025): https://discord.com/channels/1170866489302188073/1367487568622649416/1367487568622649416
GiteaMirror commented 2026-05-15 12:07:44 -05:00
Author
Owner
Copy Link

@Lutherwaves commented on GitHub (May 2, 2025):

Actually, this seems not to be a bug when using OAUTH. In order to avoid overwriting the admin (in case users overlap), proper RBAC needs to be setup using the respective OAUTH variables and setup on the OAUTH provider.

ENABLE_SIGNUP=true
ENABLE_LOGIN_FORM=true
ENABLE_OAUTH_SIGNUP=true
ENABLE_OAUTH_GROUP_MANAGEMENT=true
ENABLE_OAUTH_ROLE_MANAGEMENT=true
OAUTH_MERGE_ACCOUNTS_BY_EMAIL=true
OAUTH_CLIENT_ID=id
OAUTH_CLIENT_SECRET=secret
OPENID_PROVIDER_URL=https://oauth/realms/dev/.well-known/openid-configuration
OAUTH_PROVIDER_NAME=<Name>
OAUTH_ROLES_CLAIM=<ROLES/CLAIM>
OAUTH_ALLOWED_ROLES=open-webui-user
OAUTH_ADMIN_ROLES=open-webui-admin
OAUTH_SCOPES=openid email profile

above ensures proper setup and this issue is no longer seen.

With that being said, there is no bug

<!-- gh-comment-id:2847209703 --> @Lutherwaves commented on GitHub (May 2, 2025): Actually, this seems not to be a bug when using OAUTH. In order to avoid overwriting the admin (in case users overlap), proper RBAC needs to be setup using the respective OAUTH variables and setup on the OAUTH provider. ``` ENABLE_SIGNUP=true ENABLE_LOGIN_FORM=true ENABLE_OAUTH_SIGNUP=true ENABLE_OAUTH_GROUP_MANAGEMENT=true ENABLE_OAUTH_ROLE_MANAGEMENT=true OAUTH_MERGE_ACCOUNTS_BY_EMAIL=true OAUTH_CLIENT_ID=id OAUTH_CLIENT_SECRET=secret OPENID_PROVIDER_URL=https://oauth/realms/dev/.well-known/openid-configuration OAUTH_PROVIDER_NAME=<Name> OAUTH_ROLES_CLAIM=<ROLES/CLAIM> OAUTH_ALLOWED_ROLES=open-webui-user OAUTH_ADMIN_ROLES=open-webui-admin OAUTH_SCOPES=openid email profile ``` above ensures proper setup and this issue is no longer seen. With that being said, there is no bug
GiteaMirror commented 2026-05-15 12:07:44 -05:00
Author
Owner
Copy Link

@xkww3n commented on GitHub (Jun 5, 2025):

Hello, I'm also using Auth0 with Open WebUI and facing exactly the same issue. I've followed lots of guidance but still got my administrator account reset to normal user. May I know the actual OAUTH_ROLES_CLAIM variable and specific Auth0 configuration? My configuration is on Discord: https://discord.com/channels/1170866489302188073/1241654544639725609/threads/1373627876192157746

<!-- gh-comment-id:2945033257 --> @xkww3n commented on GitHub (Jun 5, 2025): Hello, I'm also using Auth0 with Open WebUI and facing exactly the same issue. I've followed lots of guidance but still got my administrator account reset to normal user. May I know the actual `OAUTH_ROLES_CLAIM` variable and specific Auth0 configuration? My configuration is on Discord: https://discord.com/channels/1170866489302188073/1241654544639725609/threads/1373627876192157746
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
confirmed
confirmed issue
core
documentation
enhancement
good first issue
help wanted
non-core
pull-request
Mirrored from GitHub Pull Request
 python
question
testing wanted
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/open-webui#87642
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?