[PR #1435] [CLOSED] docs: correct the SSO, LDAP, OneDrive and MCP tutorials against the OAuth provider registration and sign-out code #1401

New issue

Closed

opened 2026-10-18 14:19:24 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-18 14:19:24 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/open-webui/docs/pull/1435
Author: @silentoplayz
Created: 9/18/2026
Status: ❌ Closed

Base: main ← Head: docs/sso-tutorial-pages

📝 Commits (1)

e4e0aad docs: correct the SSO, LDAP, OneDrive and MCP tutorials against the OAuth provider registration and sign-out code

📊 Changes

6 files changed (+29 additions, -33 deletions)

View changed files

📝 docs/tutorials/auth-sso/azure-ad-ds-ldap.mdx (+2 -2)
📝 docs/tutorials/auth-sso/dual-oauth-configuration.mdx (+12 -13)
📝 docs/tutorials/auth-sso/entra-group-name-sync.md (+5 -8)
📝 docs/tutorials/auth-sso/okta-oidc-sso.md (+5 -5)
📝 docs/tutorials/integrations/mcp-notion.mdx (+1 -1)
📝 docs/tutorials/integrations/onedrive-sharepoint.mdx (+4 -4)

📄 Description

Summary

I compared the SSO tutorials, the LDAP guide, the OneDrive page and the MCP Notion page with the OAuth provider registration, sign-out and LDAP code.

Dual OAuth: Google, Microsoft, GitHub and Feishu are separate built-in providers registered independently of the generic OIDC slot, so Microsoft plus Google is supported rather than an unofficial workaround. Microsoft is not "handled via the generic OIDC flow": it uses its own tenant discovery URL, and OPENID_PROVIDER_URL registers nothing without OAUTH_CLIENT_ID. Sign-out discovers the end-session endpoint from the session's provider, so OPENID_PROVIDER_URL is not required for Microsoft logout (removed from the Entra page too). Login callback URIs come from *_REDIRECT_URI or the request, not WEBUI_URL, which only sets where the browser lands after sign-in. The rest of the dual OAuth page (description, overview, configuration logic) now matches, and so do the Entra test step and the OneDrive toggle wording.
Entra and Okta: admin group memberships have been synced like everyone else's since Open WebUI v0.8.11. The current variable name is OAUTH_GROUPS_CLAIM (the old name is a fallback). An empty claim touches nothing, and OAUTH_BLOCKED_GROUPS are never changed.
LDAP: LDAP_USE_TLS means LDAPS from connect (no STARTTLS), and in Docker certificates go through LDAP_CA_CERT_FILE: without it the LDAP client uses the CA store of the machine or container it runs in, and a container does not see the host's store.
OneDrive: ENABLE_ONEDRIVE_INTEGRATION=true seeds the admin toggle on a fresh database. The toggle only overrides it once a stored value exists.
MCP Notion: Import opens a file chooser rather than accepting pasted JSON.

None.

Checklist

I have reviewed the relevant documentation and matched the existing style.
This PR meets Open WebUI's contribution standards: it is accurate, relevant to users, narrowly scoped, maintainable, and not promotional content, advertising, lead generation, SEO placement, or a request to list a product, service, provider, integration, gateway, tool, or company primarily for visibility.
I understand that PRs that do not meet these standards may be closed without review and will not be merged. Repeated, low-quality, off-topic, promotional, or intentionally misleading submissions may result in the contributor being blocked from future participation in Open WebUI repositories.

Notes for reviewers

Sources on dev: config.py (load_oauth_providers, OAUTH_GROUPS_CLAIM, DEFAULT_CONFIG), routers/auths.py (sign-out metadata lookup, the LDAP Tls and Server calls), and utils/oauth.py (update_user_groups, redirect_uri). Also the commit that removed the admin guard (a1aceb5f8, first tag v0.8.11), models/config.py (seed_defaults), and src/lib/components/AddToolServerModal.svelte.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/open-webui/docs/pull/1435 **Author:** [@silentoplayz](https://github.com/silentoplayz) **Created:** 9/18/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `docs/sso-tutorial-pages` --- ### 📝 Commits (1) - [`e4e0aad`](https://github.com/open-webui/docs/commit/e4e0aadb7aaf132ea2c3680eaa728b14244e62a2) docs: correct the SSO, LDAP, OneDrive and MCP tutorials against the OAuth provider registration and sign-out code ### 📊 Changes **6 files changed** (+29 additions, -33 deletions) <details> <summary>View changed files</summary> 📝 `docs/tutorials/auth-sso/azure-ad-ds-ldap.mdx` (+2 -2) 📝 `docs/tutorials/auth-sso/dual-oauth-configuration.mdx` (+12 -13) 📝 `docs/tutorials/auth-sso/entra-group-name-sync.md` (+5 -8) 📝 `docs/tutorials/auth-sso/okta-oidc-sso.md` (+5 -5) 📝 `docs/tutorials/integrations/mcp-notion.mdx` (+1 -1) 📝 `docs/tutorials/integrations/onedrive-sharepoint.mdx` (+4 -4) </details> ### 📄 Description ## Summary I compared the SSO tutorials, the LDAP guide, the OneDrive page and the MCP Notion page with the OAuth provider registration, sign-out and LDAP code. - Dual OAuth: Google, Microsoft, GitHub and Feishu are separate built-in providers registered independently of the generic OIDC slot, so Microsoft plus Google is supported rather than an unofficial workaround. Microsoft is not "handled via the generic OIDC flow": it uses its own tenant discovery URL, and `OPENID_PROVIDER_URL` registers nothing without `OAUTH_CLIENT_ID`. Sign-out discovers the end-session endpoint from the session's provider, so `OPENID_PROVIDER_URL` is not required for Microsoft logout (removed from the Entra page too). Login callback URIs come from `*_REDIRECT_URI` or the request, not `WEBUI_URL`, which only sets where the browser lands after sign-in. The rest of the dual OAuth page (description, overview, configuration logic) now matches, and so do the Entra test step and the OneDrive toggle wording. - Entra and Okta: admin group memberships have been synced like everyone else's since Open WebUI v0.8.11. The current variable name is `OAUTH_GROUPS_CLAIM` (the old name is a fallback). An empty claim touches nothing, and `OAUTH_BLOCKED_GROUPS` are never changed. - LDAP: `LDAP_USE_TLS` means LDAPS from connect (no STARTTLS), and in Docker certificates go through `LDAP_CA_CERT_FILE`: without it the LDAP client uses the CA store of the machine or container it runs in, and a container does not see the host's store. - OneDrive: `ENABLE_ONEDRIVE_INTEGRATION=true` seeds the admin toggle on a fresh database. The toggle only overrides it once a stored value exists. - MCP Notion: Import opens a file chooser rather than accepting pasted JSON. ## Related issue or discussion None. ## Checklist - [x] I have reviewed the relevant documentation and matched the existing style. - [x] This PR meets Open WebUI's contribution standards: it is accurate, relevant to users, narrowly scoped, maintainable, and not promotional content, advertising, lead generation, SEO placement, or a request to list a product, service, provider, integration, gateway, tool, or company primarily for visibility. - [x] I understand that PRs that do not meet these standards may be closed without review and will not be merged. Repeated, low-quality, off-topic, promotional, or intentionally misleading submissions may result in the contributor being blocked from future participation in Open WebUI repositories. ## Notes for reviewers Sources on `dev`: `config.py` (`load_oauth_providers`, `OAUTH_GROUPS_CLAIM`, `DEFAULT_CONFIG`), `routers/auths.py` (sign-out metadata lookup, the LDAP `Tls` and `Server` calls), and `utils/oauth.py` (`update_user_groups`, `redirect_uri`). Also the commit that removed the admin guard (a1aceb5f8, first tag v0.8.11), `models/config.py` (`seed_defaults`), and `src/lib/components/AddToolServerModal.svelte`. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-18 14:19:24 +00:00