github-starred/open-webui
2
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-08-25 17:21:00 -05:00
Code Issues 2.4k Packages Projects Releases 129 Wiki Activity

[GH-ISSUE #24155] bug: OAuth 2.1 (Static) MCP redirect_uri with mcp: prefix fails post-SAML validation #90950

New Issue
Closed
opened 2026-05-15 16:15:05 -05:00 by GiteaMirror · 2 comments
GiteaMirror commented 2026-05-15 16:15:05 -05:00
Owner
Copy Link
Copy Source

Originally created by @NorEliYehShi on GitHub (Apr 26, 2026).
Original GitHub issue: https://github.com/open-webui/open-webui/issues/24155

Check Existing Issues

  • I have searched for any existing and/or related issues.
  • I have searched for any existing and/or related discussions.
  • I have also searched in the CLOSED issues AND CLOSED discussions and found no related items (your issue might already be addressed on the development branch!).
  • I am using the latest version of Open WebUI.

Installation Method

Docker

Open WebUI Version

v0.9.2

Ollama Version (if applicable)

No response

Operating System

macOS 26

Browser (if applicable)

No response

Confirmation

  • I have read and followed all instructions in README.md.
  • I am using the latest version of both Open WebUI and Ollama.
  • I have included the browser console logs.
  • I have included the Docker container logs.
  • I have provided every relevant configuration, setting, and environment variable used in my setup.
  • I have clearly listed every relevant configuration, custom setting, environment variable, and command-line option that influences my setup (such as Docker Compose overrides, .env values, browser settings, authentication configurations, etc).
  • I have documented step-by-step reproduction instructions that are precise, sequential, and leave nothing to interpretation. My steps:
  • Start with the initial platform/version/OS and dependencies used,
  • Specify exact install/launch/configure commands,
  • List URLs visited, user input (incl. example values/emails/passwords if needed),
  • Describe all options and toggles enabled or changed,
  • Include any files or environmental changes,
  • Identify the expected and actual result at each stage,
  • Ensure any reasonably skilled user can follow and hit the same issue.

Expected Behavior

After completing the OAuth 2.1 (Static) authentication flow with Asana's V2 MCP server,
the user should be redirected back to Open WebUI successfully and the Asana MCP tool
should become active in the chat.

Actual Behavior

After completing SAML authentication via Microsoft Entra ID (triggered by Asana's SSO),
Asana performs a second redirect_uri validation and returns:

invalid_request: The `redirect_uri` parameter does not match a valid url for the application.

The OAuth flow fails and the Asana MCP tool cannot be enabled.

The root cause is that Open WebUI generates the redirect URI with a : character in the path:

http://localhost:3000/oauth/clients/mcp:asana/callback

When this URI is URL-encoded in the OAuth request it becomes:

redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Foauth%2Fclients%2Fmcp%3Aasana%2Fcallback

Asana performs two separate validations:

Stage Behavior Result
Pre-SAML Loose validation ✅ Passes
Post-SAML Strict exact string match ❌ Fails

The post-SAML validation does not normalize/decode the URI before comparing,
so mcp%3Aasana does not match the registered mcp:asana.

Additionally, : in a URL path segment is invalid per RFC 3986, which may
cause other strict OAuth providers to reject it as well.

Steps to Reproduce

  1. Run Open WebUI v0.9.2 via Docker with WEBUI_SECRET_KEY and Microsoft Entra ID SSO configured:
docker run -d --name open-webui \
  -p 3000:8080 \
  -v open-webui:/app/backend/data \
  -e WEBUI_SECRET_KEY='your-secret-key' \
  -e MICROSOFT_CLIENT_ID='your-client-id' \
  -e MICROSOFT_CLIENT_TENANT_ID='your-tenant-id' \
  -e MICROSOFT_CLIENT_SECRET='your-client-secret' \
  -e ENABLE_OAUTH_SIGNUP=true \
  ghcr.io/open-webui/open-webui:v0.9.2
  1. Go to Admin Settings → External Tools → click +
  2. Set:
    • Type: MCP Streamable HTTP
    • Name: asana
    • ID: asana
    • URL: https://mcp.asana.com/v2/mcp
    • Auth: OAuth 2.1 (Static)
    • Enter Client ID and Client Secret from the Asana developer console
  3. Click Register Client, then Save
  4. Open a chat → click + → Integrations → Tools → toggle Asana on
  5. Browser redirects to Asana OAuth page
  6. Enter email → redirected to Microsoft Entra ID SAML login
  7. Complete SAML authentication successfully
  8. Observe the error:
invalid_request: The `redirect_uri` parameter does not match a valid url for the application.

Final URL in browser:

https://app.asana.com/-/oauth_authorize?response_type=code
  &client_id=...
  &redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Foauth%2Fclients%2Fmcp%3Aasana%2Fcallback
  &state=...
  &code_challenge=...
  &code_challenge_method=S256
  &redirected_from=saml

Logs & Screenshots

Open WebUI log during the failed flow:

INFO  - HTTP Request: GET https://app.asana.com/.well-known/oauth-authorization-server "HTTP/1.1 200 OK"
INFO  - "GET /oauth/clients/mcp%3Aasana/authorize HTTP/1.1" 302
WARNING - No OAuth session found for user <user-id>, client_id mcp:asana

Additional Information

Suggested Fix

Change the redirect URI format to use a URL-safe separator instead of ::

# Current (broken)
/oauth/clients/mcp:{id}/callback

# Suggested
/oauth/clients/mcp-{id}/callback

This eliminates the : from the path without breaking routing logic and ensures
compatibility with strict OAuth providers that perform exact string matching.

Originally created by @NorEliYehShi on GitHub (Apr 26, 2026). Original GitHub issue: https://github.com/open-webui/open-webui/issues/24155 ### Check Existing Issues - [x] I have searched for any existing and/or related issues. - [x] I have searched for any existing and/or related discussions. - [x] I have also searched in the CLOSED issues AND CLOSED discussions and found no related items (your issue might already be addressed on the development branch!). - [x] I am using the latest version of Open WebUI. ### Installation Method Docker ### Open WebUI Version v0.9.2 ### Ollama Version (if applicable) _No response_ ### Operating System macOS 26 ### Browser (if applicable) _No response_ ### Confirmation - [x] I have read and followed all instructions in `README.md`. - [x] I am using the latest version of **both** Open WebUI and Ollama. - [x] I have included the browser console logs. - [x] I have included the Docker container logs. - [x] I have **provided every relevant configuration, setting, and environment variable used in my setup.** - [x] I have clearly **listed every relevant configuration, custom setting, environment variable, and command-line option that influences my setup** (such as Docker Compose overrides, .env values, browser settings, authentication configurations, etc). - [x] I have documented **step-by-step reproduction instructions that are precise, sequential, and leave nothing to interpretation**. My steps: - Start with the initial platform/version/OS and dependencies used, - Specify exact install/launch/configure commands, - List URLs visited, user input (incl. example values/emails/passwords if needed), - Describe all options and toggles enabled or changed, - Include any files or environmental changes, - Identify the expected and actual result at each stage, - Ensure any reasonably skilled user can follow and hit the same issue. ### Expected Behavior After completing the OAuth 2.1 (Static) authentication flow with Asana's V2 MCP server, the user should be redirected back to Open WebUI successfully and the Asana MCP tool should become active in the chat. ### Actual Behavior After completing SAML authentication via Microsoft Entra ID (triggered by Asana's SSO), Asana performs a second redirect_uri validation and returns: ``` invalid_request: The `redirect_uri` parameter does not match a valid url for the application. ``` The OAuth flow fails and the Asana MCP tool cannot be enabled. The root cause is that Open WebUI generates the redirect URI with a `:` character in the path: ``` http://localhost:3000/oauth/clients/mcp:asana/callback ``` When this URI is URL-encoded in the OAuth request it becomes: ``` redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Foauth%2Fclients%2Fmcp%3Aasana%2Fcallback ``` Asana performs two separate validations: | Stage | Behavior | Result | |---|---|---| | Pre-SAML | Loose validation | ✅ Passes | | Post-SAML | Strict exact string match | ❌ Fails | The post-SAML validation does not normalize/decode the URI before comparing, so `mcp%3Aasana` does not match the registered `mcp:asana`. Additionally, `:` in a URL path segment is invalid per RFC 3986, which may cause other strict OAuth providers to reject it as well. ### Steps to Reproduce 1. Run Open WebUI v0.9.2 via Docker with `WEBUI_SECRET_KEY` and Microsoft Entra ID SSO configured: ```bash docker run -d --name open-webui \ -p 3000:8080 \ -v open-webui:/app/backend/data \ -e WEBUI_SECRET_KEY='your-secret-key' \ -e MICROSOFT_CLIENT_ID='your-client-id' \ -e MICROSOFT_CLIENT_TENANT_ID='your-tenant-id' \ -e MICROSOFT_CLIENT_SECRET='your-client-secret' \ -e ENABLE_OAUTH_SIGNUP=true \ ghcr.io/open-webui/open-webui:v0.9.2 ``` 2. Go to Admin Settings → External Tools → click `+` 3. Set: - Type: `MCP Streamable HTTP` - Name: `asana` - ID: `asana` - URL: `https://mcp.asana.com/v2/mcp` - Auth: `OAuth 2.1 (Static)` - Enter Client ID and Client Secret from the Asana developer console 4. Click **Register Client**, then **Save** 5. Open a chat → click `+` → Integrations → Tools → toggle Asana on 6. Browser redirects to Asana OAuth page 7. Enter email → redirected to Microsoft Entra ID SAML login 8. Complete SAML authentication successfully 9. Observe the error: ``` invalid_request: The `redirect_uri` parameter does not match a valid url for the application. ``` Final URL in browser: ``` https://app.asana.com/-/oauth_authorize?response_type=code &client_id=... &redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Foauth%2Fclients%2Fmcp%3Aasana%2Fcallback &state=... &code_challenge=... &code_challenge_method=S256 &redirected_from=saml ``` ### Logs & Screenshots Open WebUI log during the failed flow: ``` INFO - HTTP Request: GET https://app.asana.com/.well-known/oauth-authorization-server "HTTP/1.1 200 OK" INFO - "GET /oauth/clients/mcp%3Aasana/authorize HTTP/1.1" 302 WARNING - No OAuth session found for user <user-id>, client_id mcp:asana ``` ### Additional Information ## Suggested Fix Change the redirect URI format to use a URL-safe separator instead of `:`: ``` # Current (broken) /oauth/clients/mcp:{id}/callback # Suggested /oauth/clients/mcp-{id}/callback ``` This eliminates the `:` from the path without breaking routing logic and ensures compatibility with strict OAuth providers that perform exact string matching.
GiteaMirror added the bug label 2026-05-15 16:15:05 -05:00
GiteaMirror commented 2026-05-15 16:15:08 -05:00
Author
Owner
Copy Link
Copy Source

@pr-validator-bot commented on GitHub (Apr 26, 2026):

⚠️ Missing Issue Title Prefix

@NorEliYehShi, your issue title is missing a prefix (e.g., bug:, feat:, docs:).

Please update your issue title to include one of the following prefixes:

  • bug: Bug report or error you've encountered
  • feat: Feature request or enhancement suggestion
  • docs: Documentation issue or improvement request
  • question: Question about usage or functionality
  • help: Request for help or support

Example: bug: Login fails when using special characters in password

<!-- gh-comment-id:4322219379 --> @pr-validator-bot commented on GitHub (Apr 26, 2026): # ⚠️ Missing Issue Title Prefix @NorEliYehShi, your issue title is missing a prefix (e.g., `bug:`, `feat:`, `docs:`). Please update your issue title to include one of the following prefixes: - **bug**: Bug report or error you've encountered - **feat**: Feature request or enhancement suggestion - **docs**: Documentation issue or improvement request - **question**: Question about usage or functionality - **help**: Request for help or support Example: `bug: Login fails when using special characters in password`
GiteaMirror commented 2026-05-15 16:15:09 -05:00
Author
Owner
Copy Link
Copy Source

@tjbck commented on GitHub (May 8, 2026):

This is not really an Open WebUI bug. The : character is perfectly valid in URL path segments per RFC 3986. The actual problem is on Asana's side: their post-SAML redirect validation is comparing URL-encoded strings (mcp%3Aasana) against the raw registered URI (mcp:asana) without decoding first. That's Asana's OAuth implementation being broken, not Open WebUI's.

<!-- gh-comment-id:4408706569 --> @tjbck commented on GitHub (May 8, 2026): This is not really an Open WebUI bug. The : character is perfectly valid in URL path segments per RFC 3986. The actual problem is on Asana's side: their post-SAML redirect validation is comparing URL-encoded strings (mcp%3Aasana) against the raw registered URI (mcp:asana) without decoding first. That's Asana's OAuth implementation being broken, not Open WebUI's.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
confirmed
confirmed issue
core
documentation
enhancement
good first issue
help wanted
non-core
pull-request
Mirrored from GitHub Pull Request
 python
question
testing wanted
No labels bug
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/open-webui#90950