A working config example for Open-WebUI ?

[luochen1990]

I'm using following config for dex:

enablePasswordDB: true
frontend:
  dir: ''
  issuer: dex
  logoURL: theme/logo.png
  theme: light
issuer: https://sso.my-domain.com:2080/dex
logger:
  format: text
  level: debug
staticClients:
- id: open-webui
  name: Open WebUI (from LC)
  redirectURIs:
  - https://ai.my-domain.com:2080/oauth/oidc/callback
  secret: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx=
storage:
  config:
    host: /var/lib/dex/dex.db
  type: sqlite3
web:
  http: 127.0.0.1:5556

And for OpenWebUI:

        ENABLE_OAUTH_SIGNUP = "True";
        OAUTH_MERGE_ACCOUNTS_BY_EMAIL = "True"; #TODO 关闭 #NOTE: 合并账号，但只能临时开启，以免帐号被意外接管
        OAUTH_USERNAME_CLAIM = "True";
        OAUTH_PICTURE_CLAIM = "True";
        OAUTH_EMAIL_CLAIM = "True";
        OAUTH_CLIENT_ID = "open-webui";
        OAUTH_CLIENT_SECRET = "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx=";
        OPENID_PROVIDER_URL = "https://sso.my-domain.com:2080/dex/auth/local";
        OAUTH_PROVIDER_NAME = "SSO (lc)";
        OPENID_REDIRECT_URI = "https://ai.my-domain.com:2080/oauth/oidc/callback";

But always got 404 error, is there any working configuration example?

[adamoutler]

Hello. I am using Gitea I set up Settings->Applications->Create Application
Application Name: Open Web UI
RedirectURL: https://my.com/oauth2/callback

Then I created a Dockerfile:

version: '3.8'
services:
  ollama:
    image: ollama/ollama:latest
    deploy:
      placement:
        constraints:
          - node.hostname == shark-wrangler
      resources:
        reservations:
          devices:
            - capabilities: ["gpu"]
    ports:
      - "11434:11434"
    volumes:
      - ollama:/root/.ollama
    restart: always
    container_name: ollama
    networks:
      - shared_net

  open_webui:
    image: ghcr.io/open-webui/open-webui:main
    environment:
      - ENABLE_LOGIN_FORM=true
      - ENABLE_OAUTH_SIGNUP=true
      - OAUTH_USERNAME_CLAIM=name
      - OAUTH_MERGE_ACCOUNTS_BY_EMAIL=true
      - OAUTH_PROVIDER_NAME=git.my.com SSO
      - WEBUI_URL=https://ai.my.com
      - OPENID_PROVIDER_URL=https://git.my.com/.well-known/openid-configuration
      - OPENID_REDIRECT_URI=https://ai.my.com/oauth/oidc/callback
      - OLLAMA_BASE_URL=http://ollama:11434
      - OPENAI_API_KEY=secret
      - OAUTH_CLIENT_ID=secret
      - OAUTH_CLIENT_SECRET=secret

    deploy:
      placement:
        constraints:
          - node.hostname == shark-wrangler
    ports:
      - "3000:8080"
    volumes:
      - open-webui:/app/backend/data
    restart: always
    container_name: open-webui
    networks:
      - shared_net

volumes:
  ollama:
  open-webui:

networks:
  shared_net:

In the above, my server git.my.com is the oauth2 provider. I am using the full path to the well-known config. The ai.my.com is my Open WebUI instance. I have replaced the tokens and IDs with the word secret.

Note: claims are the name of the claim you wish to use. not "true". Also never quote anything, and you have a choice between your oauth provider's values to use. I chose to use the name because username and preferred-username is not really useful, but name gives a full name.