This PR implements support for semicolon-separated OAuth group claims, addressing issue #18979.
Changes
Added OAUTH_GROUPS_SEPARATOR environment variable in config.py with default value of semicolon
Updated update_user_groups function in oauth.py to split string claims by the configured separator
Maintains backward compatibility: if separator is not found, treats claim as single group name
Use Case
Many OIDC providers like CILogon (supporting thousands of universities worldwide) return group membership as semicolon-separated strings in the affiliation claim (e.g., Faculty@ucsc.edu;Employee@ucsc.edu;Member@ucsc.edu).
Previously, this was treated as a single monolithic group name. Now it's properly parsed into individual groups.
Configuration
Users can customize the separator via the OAUTH_GROUPS_SEPARATOR environment variable (defaults to semicolon).
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/open-webui/open-webui/pull/18982
**Author:** [@rndmcnlly](https://github.com/rndmcnlly)
**Created:** 11/6/2025
**Status:** ❌ Closed
**Base:** `dev` ← **Head:** `feat/oauth-groups-separator`
---
### 📝 Commits (1)
- [`96b98cd`](https://github.com/open-webui/open-webui/commit/96b98cd13cbd2826e0524c92d61173221ce3cbe2) feat: add OAUTH_GROUPS_SEPARATOR for configurable group parsing
### 📊 Changes
**2 files changed** (+8 additions, -1 deletions)
<details>
<summary>View changed files</summary>
📝 `backend/open_webui/config.py` (+2 -0)
📝 `backend/open_webui/utils/oauth.py` (+6 -1)
</details>
### 📄 Description
## Description
This PR implements support for semicolon-separated OAuth group claims, addressing issue #18979.
## Changes
- Added OAUTH_GROUPS_SEPARATOR environment variable in config.py with default value of semicolon
- Updated update_user_groups function in oauth.py to split string claims by the configured separator
- Maintains backward compatibility: if separator is not found, treats claim as single group name
## Use Case
Many OIDC providers like CILogon (supporting thousands of universities worldwide) return group membership as semicolon-separated strings in the affiliation claim (e.g., Faculty@ucsc.edu;Employee@ucsc.edu;Member@ucsc.edu).
Previously, this was treated as a single monolithic group name. Now it's properly parsed into individual groups.
## Configuration
Users can customize the separator via the OAUTH_GROUPS_SEPARATOR environment variable (defaults to semicolon).
Fixes #18979
I agree to the contributor license agreement.
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/open-webui/open-webui/pull/18982
Author: @rndmcnlly
Created: 11/6/2025
Status: ❌ Closed
Base:
dev← Head:feat/oauth-groups-separator📝 Commits (1)
96b98cdfeat: add OAUTH_GROUPS_SEPARATOR for configurable group parsing📊 Changes
2 files changed (+8 additions, -1 deletions)
View changed files
📝
backend/open_webui/config.py(+2 -0)📝
backend/open_webui/utils/oauth.py(+6 -1)📄 Description
Description
This PR implements support for semicolon-separated OAuth group claims, addressing issue #18979.
Changes
Use Case
Many OIDC providers like CILogon (supporting thousands of universities worldwide) return group membership as semicolon-separated strings in the affiliation claim (e.g., Faculty@ucsc.edu;Employee@ucsc.edu;Member@ucsc.edu).
Previously, this was treated as a single monolithic group name. Now it's properly parsed into individual groups.
Configuration
Users can customize the separator via the OAUTH_GROUPS_SEPARATOR environment variable (defaults to semicolon).
Fixes #18979
I agree to the contributor license agreement.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.