From 71f8b6d5b4ebecbfd707e8ddbd08ffad9e9eeee6 Mon Sep 17 00:00:00 2001 From: G30 <50341825+silentoplayz@users.noreply.github.com> Date: Sun, 26 Jul 2026 18:43:21 -0400 Subject: [PATCH] feat: add a master OAuth / OIDC enable toggle in Authentication settings (#26988) The OAuth / OIDC section in Admin Settings > Authentication had no enable/disable switch, unlike the LDAP section above it. Add one that persists via the existing Save flow and actually gates OAuth sign-in, mirroring how the LDAP toggle works. - config: new ENABLE_OAUTH persistent config ('oauth.enable'), defaulting to True so existing deployments with a provider configured keep working. - oauth: expose ENABLE_OAUTH via the OAuth runtime config and reject the login and callback handlers with 404 when it is disabled. - /api/config: report no OAuth providers when disabled so the login page hides the OAuth buttons (and cannot auto-redirect), without clearing the admin's provider configuration. - auths: expose ENABLE_OAUTH through the admin OAuth config get/update endpoints (OAuthConfigForm + OAUTH_CONFIG_KEYS). - Authentication.svelte: bind the OAuth / OIDC header Switch to the persisted oauthConfig.ENABLE_OAUTH and collapse the section when off, matching the LDAP header (size, weight, alignment). --- backend/open_webui/config.py | 6 + backend/open_webui/main.py | 9 +- backend/open_webui/routers/auths.py | 2 + backend/open_webui/utils/oauth.py | 6 + .../admin/Settings/Authentication.svelte | 498 +++++++++--------- 5 files changed, 282 insertions(+), 239 deletions(-) diff --git a/backend/open_webui/config.py b/backend/open_webui/config.py index da26676924..0cc274483b 100644 --- a/backend/open_webui/config.py +++ b/backend/open_webui/config.py @@ -2429,6 +2429,11 @@ if JWT_EXPIRES_IN == '-1': # OAuth config #################################### +# Master switch for OAuth/OIDC sign-in. Defaults to enabled so existing +# deployments that already have a provider configured keep working; admins can +# turn it off to disable OAuth login without clearing their provider settings. +ENABLE_OAUTH = os.getenv('ENABLE_OAUTH', 'True').lower() == 'true' + ENABLE_OAUTH_SIGNUP = os.getenv('ENABLE_OAUTH_SIGNUP', 'False').lower() == 'true' OAUTH_AUTO_REDIRECT = os.getenv('OAUTH_AUTO_REDIRECT', 'False').lower() == 'true' @@ -3091,6 +3096,7 @@ DEFAULT_CONFIG = { 'auth.api_key.endpoint_restrictions': ENABLE_API_KEYS_ENDPOINT_RESTRICTIONS, 'auth.api_key.allowed_endpoints': API_KEYS_ALLOWED_ENDPOINTS, 'auth.jwt_expiry': JWT_EXPIRES_IN, + 'oauth.enable': ENABLE_OAUTH, 'oauth.enable_signup': ENABLE_OAUTH_SIGNUP, 'oauth.auto_redirect': OAUTH_AUTO_REDIRECT, 'oauth.refresh_token.include_scope': OAUTH_REFRESH_TOKEN_INCLUDE_SCOPE, diff --git a/backend/open_webui/main.py b/backend/open_webui/main.py index 38ac43262c..12efc21ab1 100644 --- a/backend/open_webui/main.py +++ b/backend/open_webui/main.py @@ -1998,6 +1998,7 @@ async def get_app_config(request: Request): license_metadata = getattr(app.state, 'LICENSE_METADATA', None) user_count = await Users.get_num_users() if license_metadata else None config = await Config.get_many( + 'oauth.enable', 'oauth.auto_redirect', 'ldap.enable', 'ui.enable_signup', @@ -2052,7 +2053,13 @@ async def get_app_config(request: Request): 'version': VERSION, 'default_locale': str(DEFAULT_LOCALE), 'oauth': { - 'providers': {name: config.get('name', name) for name, config in OAUTH_PROVIDERS.items()}, + # Hide providers (and thus the login buttons / auto-redirect) when OAuth + # is disabled, without clearing the admin's provider configuration. + 'providers': ( + {name: provider.get('name', name) for name, provider in OAUTH_PROVIDERS.items()} + if config.get('oauth.enable', True) + else {} + ), 'auto_redirect': config.get('oauth.auto_redirect'), }, 'features': { diff --git a/backend/open_webui/routers/auths.py b/backend/open_webui/routers/auths.py index ca81918b37..be936128cb 100644 --- a/backend/open_webui/routers/auths.py +++ b/backend/open_webui/routers/auths.py @@ -1304,6 +1304,7 @@ class OAuthConfigForm(BaseModel): """All OAuth/OIDC settings exposed to the admin panel.""" # General OAuth + ENABLE_OAUTH: bool | None = None ENABLE_OAUTH_SIGNUP: bool | None = None OAUTH_MERGE_ACCOUNTS_BY_EMAIL: bool | None = None OAUTH_AUTO_REDIRECT: bool | None = None @@ -1359,6 +1360,7 @@ OAUTH_COMMA_LIST_FIELDS = { OAUTH_CONFIG_KEYS = { + 'ENABLE_OAUTH': 'oauth.enable', 'ENABLE_OAUTH_SIGNUP': 'oauth.enable_signup', 'OAUTH_MERGE_ACCOUNTS_BY_EMAIL': 'oauth.merge_accounts_by_email', 'OAUTH_AUTO_REDIRECT': 'oauth.auto_redirect', diff --git a/backend/open_webui/utils/oauth.py b/backend/open_webui/utils/oauth.py index 63c72eeac3..91d76d819d 100644 --- a/backend/open_webui/utils/oauth.py +++ b/backend/open_webui/utils/oauth.py @@ -35,6 +35,7 @@ from mcp.shared.auth import ( from open_webui.config import ( DEFAULT_USER_ROLE, ENABLE_OAUTH_GROUP_CREATION, + ENABLE_OAUTH, ENABLE_OAUTH_GROUP_MANAGEMENT, ENABLE_OAUTH_ROLE_MANAGEMENT, ENABLE_OAUTH_SIGNUP, @@ -120,6 +121,7 @@ OAUTH_RESOURCE_PARAMETER_MODES = {'auto', 'include', 'omit'} OAUTH_RUNTIME_CONFIG = { 'DEFAULT_USER_ROLE': ('ui.default_user_role', DEFAULT_USER_ROLE), + 'ENABLE_OAUTH': ('oauth.enable', ENABLE_OAUTH), 'ENABLE_OAUTH_SIGNUP': ('oauth.enable_signup', ENABLE_OAUTH_SIGNUP), 'OAUTH_REFRESH_TOKEN_INCLUDE_SCOPE': ( 'oauth.refresh_token.include_scope', @@ -1670,6 +1672,8 @@ class OAuthManager: async def handle_login(self, request, provider): auth_config = await get_oauth_runtime_config() + if not auth_config.ENABLE_OAUTH: + raise HTTPException(404) if provider not in OAUTH_PROVIDERS: raise HTTPException(404) # If the provider has a custom redirect URL, use that, otherwise automatically generate one @@ -1690,6 +1694,8 @@ class OAuthManager: async def handle_callback(self, request, provider, response, db=None): auth_config = await get_oauth_runtime_config() + if not auth_config.ENABLE_OAUTH: + raise HTTPException(404) if provider not in OAUTH_PROVIDERS: raise HTTPException(404) diff --git a/src/lib/components/admin/Settings/Authentication.svelte b/src/lib/components/admin/Settings/Authentication.svelte index e7a6a8b177..a03f3540d8 100644 --- a/src/lib/components/admin/Settings/Authentication.svelte +++ b/src/lib/components/admin/Settings/Authentication.svelte @@ -523,283 +523,305 @@ {#if oauthConfig} -
- - - - - - - -
- -
- - - - - - - -
- -
- - - - - - - -
- -
- - - - - - - -
- -
- - - - - - - -
- - + - - - - - - - - - - - - - - - - - {#if oauthConfig.ENABLE_OAUTH_ROLE_MANAGEMENT} + {#if oauthConfig.ENABLE_OAUTH}
- - - - {/if} +
+ + + - - - + + + +
+ +
+ + + + + + + +
+ +
+ + + + + + + +
+ +
+ + + + + + + +
- {#if oauthConfig.ENABLE_OAUTH_GROUP_MANAGEMENT} + + + + -
- - - + + + + + + + + + + + + + {#if oauthConfig.ENABLE_OAUTH_ROLE_MANAGEMENT} +
+ + + + + + + +
-
+ {/if} + + + + + + {#if oauthConfig.ENABLE_OAUTH_GROUP_MANAGEMENT} + + + + +
+ + + + + + + +
+ {/if} + + + + + + + + + + + + {/if} - - - - - - - - - - - - {/if}