From 35381f7e9dc73d82a9648d2ebf1143b155830181 Mon Sep 17 00:00:00 2001 From: Frank Date: Thu, 24 Sep 2026 20:21:10 -0700 Subject: [PATCH] open-webui: quote OAUTH_SCOPES in the quadlet MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit systemd splits unquoted Environment= values on whitespace, so 'OAUTH_SCOPES=openid email profile roles' arrived as 'openid' and the authorize request carried a single scope — the id_token then lacked the email claim and the callback failed. Quoted, all four scopes flow. Also: assign the default openid/email/profile ScopeMappings to the provider (2026.x no longer auto-creates them; without them the token grant is the intersection with the provider's mappings = roles only, and userinfo 403s). --- dankclaw/open-webui/quadlet/open-webui.container | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/dankclaw/open-webui/quadlet/open-webui.container b/dankclaw/open-webui/quadlet/open-webui.container index 37c9951..c46d9c3 100644 --- a/dankclaw/open-webui/quadlet/open-webui.container +++ b/dankclaw/open-webui/quadlet/open-webui.container @@ -41,9 +41,11 @@ Environment=DO_NOT_TRACK=True # server-side code exchange works from this bridge. Roles come from the # "Open WebUI roles" scope mapping (entitlements "Open WebUI Users" / # "Open WebUI Admins"); OAUTH_MERGE_ACCOUNTS_BY_EMAIL folds SSO logins into -# the existing local account (frank8465@protonmail.com). These vars SEED the -# per-key config DB on first run (fill-missing only); on the live data dir -# the Admin Panel is authoritative. +# the existing local account (frank8465@protonmail.com). The OAuth vars are +# read directly from the environment at runtime (the per-key config DB holds +# only Admin-Panel overrides, so nothing is seeded on the live data dir). +# NOTE: the OAUTH_SCOPES value MUST stay quoted — systemd splits unquoted +# Environment= values on whitespace (unquoted, only "openid" survived). EnvironmentFile=/home/dank/Containers/open-webui/env Environment=OAUTH_CLIENT_ID=KmtzKc0bjWjaIFeM0puYudI1CLXR2p0jnPCSf4N0 Environment=OAUTH_PROVIDER_NAME=authentik @@ -52,7 +54,7 @@ Environment=OPENID_REDIRECT_URI=https://ai.franksdank.cloud/oauth/oidc/callback Environment=WEBUI_URL=https://ai.franksdank.cloud Environment=ENABLE_OAUTH_SIGNUP=true Environment=OAUTH_MERGE_ACCOUNTS_BY_EMAIL=true -Environment=OAUTH_SCOPES=openid email profile roles +Environment="OAUTH_SCOPES=openid email profile roles" Environment=ENABLE_OAUTH_ROLE_MANAGEMENT=true # Web search -> SearXNG, reached over the host-published port (NOT the