dank/serverAppConfigs
1
0
Fork 0
Code Issues 6 Pull Requests Actions Packages Projects Releases Wiki Activity

docs(open-webui): record the SSO-only flip + qa-e2e-admin demotion

Browse Source 
The local username/password path is retired (ENABLE_LOGIN_FORM +
ENABLE_PASSWORD_AUTH false, ui.enable_login_form DB override false) and
qa-e2e-admin is out of the authentik Admins group. Documented in the SSO
section and History.
This commit is contained in:
Frank
2026-09-24 20:56:38 -07:00
parent 33cdeca41e
commit 201c8437dd
1 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
serverAppConfigs-docs/Dankclaw/OpenWebUI.md
+10
View File
@@ -116,6 +116,14 @@ browser-driven and only touches the two exempt vhosts (`ai.` and `auth.`).
Panel is authoritative. To rotate the client secret: create a new token in
authentik, update the host env file, and set the new value in the Admin
Panel (or the DB), then restart the container.
- **SSO-only (2026-09-24):** after the OIDC round-trip was verified, the local
username/password path was retired. `ENABLE_LOGIN_FORM=false` hides the form
and `ENABLE_PASSWORD_AUTH=false` refuses password logins, so the only way in
is the authentik OIDC flow. The `ui.enable_login_form` config-DB override was
flipped to `false` in the same change — the per-key DB wins over env, so both
must agree, and the DB value is the one to change on a live data dir. To
restore the password form: set `ui.enable_login_form` back to `true` in the
Admin Panel (or DB) and drop the two env vars from the quadlet.
## Boot persistence (Quadlet)
@@ -160,6 +168,8 @@ The quadlet carries a built-in healthcheck (30s interval, 3 retries, 300s start
- **2026-09-24 — SSO via authentik.** OIDC authorization-code flow wired per the [SSO (authentik)](#sso-authentik) section: application/provider/entitlements created in authentik, client secret in the host env file, roles from the `roles` scope claim. E2E coverage in `tests/e2e/specs/18-openwebui-sso.spec.ts`.
- **2026-09-24 — flipped to SSO-only.** The OIDC round-trip verified in a real browser (login view renders no password form, only "Continue with authentik", and the flow lands on a signed-in session), so the local username/password path was retired: `ENABLE_LOGIN_FORM=false` + `ENABLE_PASSWORD_AUTH=false` in the quadlet and `ui.enable_login_form` set to `false` in the config DB (the DB wins over env, so both were changed together). `qa-e2e-admin` was demoted out of the `authentik Admins` group (it keeps `openwebui_users` / `homepage-admins` for app access).
## See Also
- [[Dankclaw Stack]]