dank/serverAppConfigs
1
0
Fork 0
Code Issues 6 Pull Requests Actions Packages Projects Releases Wiki Activity

open-webui: quote OAUTH_SCOPES in the quadlet

Browse Source 
systemd splits unquoted Environment= values on whitespace, so
'OAUTH_SCOPES=openid email profile roles' arrived as 'openid' and the
authorize request carried a single scope — the id_token then lacked the
email claim and the callback failed. Quoted, all four scopes flow.

Also: assign the default openid/email/profile ScopeMappings to the
provider (2026.x no longer auto-creates them; without them the token
grant is the intersection with the provider's mappings = roles only,
and userinfo 403s).
This commit is contained in:
Frank
2026-09-24 20:21:10 -07:00
parent b1372d428f
commit 35381f7e9d
1 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dankclaw/open-webui/quadlet/open-webui.container
+6 -4
View File
@@ -41,9 +41,11 @@ Environment=DO_NOT_TRACK=True
# server-side code exchange works from this bridge. Roles come from the
# "Open WebUI roles" scope mapping (entitlements "Open WebUI Users" /
# "Open WebUI Admins"); OAUTH_MERGE_ACCOUNTS_BY_EMAIL folds SSO logins into
# the existing local account (frank8465@protonmail.com). These vars SEED the
# per-key config DB on first run (fill-missing only); on the live data dir
# the Admin Panel is authoritative.
# the existing local account (frank8465@protonmail.com). The OAuth vars are
# read directly from the environment at runtime (the per-key config DB holds
# only Admin-Panel overrides, so nothing is seeded on the live data dir).
# NOTE: the OAUTH_SCOPES value MUST stay quoted — systemd splits unquoted
# Environment= values on whitespace (unquoted, only "openid" survived).
EnvironmentFile=/home/dank/Containers/open-webui/env
Environment=OAUTH_CLIENT_ID=KmtzKc0bjWjaIFeM0puYudI1CLXR2p0jnPCSf4N0
Environment=OAUTH_PROVIDER_NAME=authentik
@@ -52,7 +54,7 @@ Environment=OPENID_REDIRECT_URI=https://ai.franksdank.cloud/oauth/oidc/callback
Environment=WEBUI_URL=https://ai.franksdank.cloud
Environment=ENABLE_OAUTH_SIGNUP=true
Environment=OAUTH_MERGE_ACCOUNTS_BY_EMAIL=true
Environment=OAUTH_SCOPES=openid email profile roles
Environment="OAUTH_SCOPES=openid email profile roles"
Environment=ENABLE_OAUTH_ROLE_MANAGEMENT=true
# Web search -> SearXNG, reached over the host-published port (NOT the