From 33cdeca41e428577ffa8582f1148f72806fb37a3 Mon Sep 17 00:00:00 2001 From: Frank Date: Thu, 24 Sep 2026 20:52:06 -0700 Subject: [PATCH] open-webui: flip to SSO-only (disable local login form + password auth) The authentik OIDC round-trip is verified, so retire the local username/password path. ENABLE_LOGIN_FORM hides the form and ENABLE_PASSWORD_AUTH refuses password logins; the only way in is now the OIDC flow, which folds into the local account by email. The ui.enable_login_form config-DB override is flipped to false in the same change (the DB wins over env, so both must agree). --- dankclaw/open-webui/quadlet/open-webui.container | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/dankclaw/open-webui/quadlet/open-webui.container b/dankclaw/open-webui/quadlet/open-webui.container index c46d9c3..40bf3e1 100644 --- a/dankclaw/open-webui/quadlet/open-webui.container +++ b/dankclaw/open-webui/quadlet/open-webui.container @@ -56,6 +56,14 @@ Environment=ENABLE_OAUTH_SIGNUP=true Environment=OAUTH_MERGE_ACCOUNTS_BY_EMAIL=true Environment="OAUTH_SCOPES=openid email profile roles" Environment=ENABLE_OAUTH_ROLE_MANAGEMENT=true +# SSO-only (2026-09-24): the OIDC round-trip is verified, so the local +# username/password path is retired. ENABLE_LOGIN_FORM hides the form; +# ENABLE_PASSWORD_AUTH refuses password logins entirely, so the only way in +# is the authentik OIDC flow (which folds into the local account by email). +# The per-key config DB override (ui.enable_login_form) is flipped to false +# in the same change — the DB wins over env, so both must agree. +Environment=ENABLE_LOGIN_FORM=false +Environment=ENABLE_PASSWORD_AUTH=false # Web search -> SearXNG, reached over the host-published port (NOT the # search.franksdank.cloud vhost): the Anubis->Authentik guard chain is a