mirror of
https://github.com/open-webui/open-webui.git
synced 2026-08-15 02:03:15 -06:00
Juan Calderon-Perez
ca2d7c9deb
* feat: expose LDAP group sync settings in admin config LDAP group synchronization was already wired into the login flow but its settings (group management, auto-creation, and the group attribute) could only be set via environment variables. OAuth, by contrast, exposes its group-mapping settings through the admin config API and UI. Bring LDAP to parity: - Add enable_group_management, enable_group_creation and attribute_for_groups to LdapServerConfig and LDAP_SERVER_CONFIG_KEYS so the /admin/config/ldap/server endpoint reads and persists them. - Add a "Group Mapping / Auto-Create Groups / Group Attribute" section to the LDAP admin settings UI, mirroring the OAuth group-mapping controls. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TtCvvQ7dcadoufbRpCKcpe * fix: harden LDAP group sync config and login flow Address review findings on the LDAP group-sync settings: - ldap_auth: move the auto-create-groups call inside the try/except that wraps group sync, so a group-creation error is logged instead of bubbling to the broad handler and failing the whole login. - update_ldap_server: reject saving with group management enabled but an empty group attribute, which would otherwise make sync silently no-op (mirrors the existing required-field validation). - Authentication.svelte: merge the LDAP server config response into the client defaults instead of replacing the object, so any key an older backend omits keeps its default value. Note: the empty-directory-groups behavior was reviewed and already matches OAuth (both skip removal when no groups are returned), so it was left unchanged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TtCvvQ7dcadoufbRpCKcpe * fix: default blank LDAP group attribute to memberOf before save The Group Attribute field advertises "Default to memberOf", but the backend now rejects an empty group attribute when group management is enabled. Fall back to the memberOf default client-side when the field is left blank, so the advertised default holds and the save isn't rejected. The backend validation remains as defense-in-depth for direct API calls. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TtCvvQ7dcadoufbRpCKcpe * fix: initialize LDAP port default as null instead of empty string The backend LdapServerConfig types port as `int | None`, but the frontend initialized it to an empty string. If a save carried that default (e.g. when the backend response omits port under version skew), Pydantic would reject the empty string. `null` matches the model and is also what the type="number" input yields when the field is empty. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TtCvvQ7dcadoufbRpCKcpe * fix: parse LDAP group DNs correctly instead of splitting on commas Group CN extraction split the DN on raw commas and sliced off "CN=", which mangles any group whose name contains an escaped separator (e.g. "CN=Sales\, EMEA,OU=...") into a truncated, wrong name that then fails to match the intended Open WebUI group. Use ldap3's parse_dn to split the DN respecting RFC 4514 escaping, and unescape the resulting value so the CN matches what an administrator sees. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TtCvvQ7dcadoufbRpCKcpe * chore: address review feedback on _unescape_ldap_dn_value Trim the docstring and rename the loop index to a more descriptive name (i -> pos) per review feedback on the group DN unescaping helper. No behavior change. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TtCvvQ7dcadoufbRpCKcpe --------- Co-authored-by: Claude <noreply@anthropic.com>