From 201c8437dd7d76e601edff3f95f824e0437a1f6d Mon Sep 17 00:00:00 2001 From: Frank Date: Thu, 24 Sep 2026 20:56:38 -0700 Subject: [PATCH] docs(open-webui): record the SSO-only flip + qa-e2e-admin demotion The local username/password path is retired (ENABLE_LOGIN_FORM + ENABLE_PASSWORD_AUTH false, ui.enable_login_form DB override false) and qa-e2e-admin is out of the authentik Admins group. Documented in the SSO section and History. --- serverAppConfigs-docs/Dankclaw/OpenWebUI.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/serverAppConfigs-docs/Dankclaw/OpenWebUI.md b/serverAppConfigs-docs/Dankclaw/OpenWebUI.md index 3b86116..85cffb0 100644 --- a/serverAppConfigs-docs/Dankclaw/OpenWebUI.md +++ b/serverAppConfigs-docs/Dankclaw/OpenWebUI.md @@ -116,6 +116,14 @@ browser-driven and only touches the two exempt vhosts (`ai.` and `auth.`). Panel is authoritative. To rotate the client secret: create a new token in authentik, update the host env file, and set the new value in the Admin Panel (or the DB), then restart the container. +- **SSO-only (2026-09-24):** after the OIDC round-trip was verified, the local + username/password path was retired. `ENABLE_LOGIN_FORM=false` hides the form + and `ENABLE_PASSWORD_AUTH=false` refuses password logins, so the only way in + is the authentik OIDC flow. The `ui.enable_login_form` config-DB override was + flipped to `false` in the same change — the per-key DB wins over env, so both + must agree, and the DB value is the one to change on a live data dir. To + restore the password form: set `ui.enable_login_form` back to `true` in the + Admin Panel (or DB) and drop the two env vars from the quadlet. ## Boot persistence (Quadlet) @@ -160,6 +168,8 @@ The quadlet carries a built-in healthcheck (30s interval, 3 retries, 300s start - **2026-09-24 — SSO via authentik.** OIDC authorization-code flow wired per the [SSO (authentik)](#sso-authentik) section: application/provider/entitlements created in authentik, client secret in the host env file, roles from the `roles` scope claim. E2E coverage in `tests/e2e/specs/18-openwebui-sso.spec.ts`. +- **2026-09-24 — flipped to SSO-only.** The OIDC round-trip verified in a real browser (login view renders no password form, only "Continue with authentik", and the flow lands on a signed-in session), so the local username/password path was retired: `ENABLE_LOGIN_FORM=false` + `ENABLE_PASSWORD_AUTH=false` in the quadlet and `ui.enable_login_form` set to `false` in the config DB (the DB wins over env, so both were changed together). `qa-e2e-admin` was demoted out of the `authentik Admins` group (it keeps `openwebui_users` / `homepage-admins` for app access). + ## See Also - [[Dankclaw Stack]]