scriptoriumadmin/open-webui
1
0
Fork 0
mirror of https://github.com/open-webui/open-webui.git synced 2026-08-28 05:27:35 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

feat: register CyberArk Identity app_id JWS header for joserfc

Browse source 
CyberArk Identity (Idaptive) adds a private 'app_id' claim to the ID token
JWS header. Since the authlib.jose -> joserfc migration, joserfc rejects
unknown header params (UnsupportedHeaderError), breaking OIDC login for
CyberArk. Register app_id, mirroring the existing Apereo CAS client_id fix.
This commit is contained in:
Aman Grover 2026-08-19 11:02:45 -04:00
parent 01f4282f1f
commit 79072ab27d
1 changed files with 6 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
backend/open_webui/utils/oauth.py
View file

@ -199,6 +199,12 @@ JWSRegistry.default_header_registry.setdefault(
'client_id',
HeaderParameter('OAuth client identifier', 'str'),
)
# CyberArk Identity (Idaptive) includes a private app_id in ID token JWS headers;
# register it so joserfc does not reject the token with UnsupportedHeaderError.
JWSRegistry.default_header_registry.setdefault(
'app_id',
HeaderParameter('CyberArk Identity application identifier', 'str'),
)
def _normalize_token_expiry(token: dict) -> dict: