Federated logins not working

[andresp]

Bug Report

Description

Configured Traefik with Oauth2-Proxy and X-Forwarded-Email headers by middleware. I have verified that the header is always forwarded to open-webui through tcpdump and by the presence of the relevant info log entry:

INFO:apps.web.models.auths:authenticate_user_by_trusted_header: redacted@redacted.com
INFO:     10.42.9.0:0 - "POST /api/v1/auths/signin HTTP/1.1" 200 OK
INFO:     10.42.9.0:0 - "GET /static/favicon.png HTTP/1.1" 304 Not Modified
INFO:     10.42.9.0:0 - "GET /api/changelog HTTP/1.1" 200 OK

As seen above a first few calls succeed and the UI is partially loaded. However, subsequent requests fail and the UI faults from fully loading:

INFO:apps.ollama.main:get_all_models()
INFO:     10.42.9.0:0 - "GET /ollama/api/tags HTTP/1.1" 403 Forbidden
INFO:apps.openai.main:get_all_models()
INFO:     10.42.9.0:0 - "GET /openai/api/models HTTP/1.1" 403 Forbidden
INFO:     10.42.9.0:0 - "GET /litellm/api/v1/models HTTP/1.1" 403 Forbidden
INFO:     10.42.9.0:0 - "GET /api/v1/modelfiles/ HTTP/1.1" 403 Forbidden

As seen above, some of the ensuing API calls fail with 403. An ollama instance is running on the cluster and accepting requests, not showing any 403s.

Steps to Reproduce:

Enable federation with WEBUI_AUTH_TRUSTED_EMAIL_HEADER=X-Forwarded-Email .

Expected Behavior:

UI fully loads

Actual Behavior:

Environment

• Open WebUI Version: v0.1.124

• Ollama (if applicable): 0.1.34

• Operating System: Kubernetes Linux

• Browser (if applicable): Safari & Chrome

Reproduction Details

Confirmation:

• I have read and followed all the instructions provided in the README.md.
• I am on the latest version of both Open WebUI and Ollama.
• I have included the browser console logs.
• I have included the Docker container logs.

Logs and Screenshots

Browser Console Logs:

[Log] {status: true, name: "Open WebUI", version: "0.1.124", auth: false, default_locale: "en-US", …} (0.e26cb850.js, line 1)
[Error] Failed to load resource: the server responded with a status of 403 () (auths, line 0)
[Log] {detail: "Not authenticated"} (index.eb461bd3.js, line 1)
[Log] {id: "053069ac-0973-42f1-8a16-63eaed437f33", email: "redacted@redacted.com", name: "redacted@redacted.com", role: "admin", profile_image_url: "/user.png", …} (14.1f86cabd.js, line 23)
[Error] Failed to load resource: the server responded with a status of 403 () (tags, line 0)
[Log] {detail: "Not authenticated"} (index.dff570f5.js, line 8)
[Log] Not authenticated (index.0a369829.js, line 1)
[Error] Failed to load resource: the server responded with a status of 403 () (models, line 0)
[Log] OpenAI: Network Problem (index.0a369829.js, line 1)
[Error] Failed to load resource: the server responded with a status of 403 () (models, line 0)
[Log] {detail: "Not authenticated"} (index.0a369829.js, line 1)
[Log] LiteLLM: Network Problem (index.0a369829.js, line 1)
[Error] Failed to load resource: the server responded with a status of 403 () (modelfiles, line 0)
[Log] {detail: "Not authenticated"} (index.ea3708ab.js, line 1)
[Error] Unhandled Promise Rejection: [object Object]
	(anonymous function) (2.481a1650.js:48:4399)

Docker Container Logs:
[Include relevant Docker container logs, if applicable]

Screenshots (if applicable):

Installation Method

Helm chart

[cheahjs]

Do you have traefik configured to override the Authorization header? This sounds like something is stripping or replacing the Authorization header the frontend uses to auth to the backend APIs.

[andresp]

I don't think I have. I've followed the traefik configuration found on oauth2-proxy .

The forwardAuth middleware is configured as seen here:

apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: oauth-auth
spec:
    forwardAuth:
      address: https://oauth.<domain>/
      trustForwardHeader: true
      authResponseHeaders:
          - Authorization
          - Set-Cookie
      authResponseHeadersRegex: ^X-

[cheahjs]

Looking at Traefik's docs, authResponseHeaders: Authorization is what's breaking Open WebUI here.

The authResponseHeaders option is the list of headers to copy from the authentication server response and set on forwarded request, replacing any existing conflicting headers.

Unfortunately with the current implementation, we only use the WEBUI_AUTH_TRUSTED_EMAIL_HEADER once at sign in, and then rely on Open WebUI's internal auth using a JWT passed in a Authorization: Bearer <JWT> header.

[andresp]

I removed the Authorization header from authResponseHeaders and it fixed the issue. Was able to login properly using federation. Thanks for pointing that out.