From 79072ab27d1adbf2e15924a220320759be654b50 Mon Sep 17 00:00:00 2001
From: Aman Grover <aman@otcmarkets.com>
Date: Wed, 19 Aug 2026 11:02:45 -0400
Subject: [PATCH] feat: register CyberArk Identity app_id JWS header for
 joserfc

CyberArk Identity (Idaptive) adds a private 'app_id' claim to the ID token
JWS header. Since the authlib.jose -> joserfc migration, joserfc rejects
unknown header params (UnsupportedHeaderError), breaking OIDC login for
CyberArk. Register app_id, mirroring the existing Apereo CAS client_id fix.
---
 backend/open_webui/utils/oauth.py | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/backend/open_webui/utils/oauth.py b/backend/open_webui/utils/oauth.py
index 0cbfcb2ebf..06002c55bb 100644
--- a/backend/open_webui/utils/oauth.py
+++ b/backend/open_webui/utils/oauth.py
@@ -199,6 +199,12 @@ JWSRegistry.default_header_registry.setdefault(
     'client_id',
     HeaderParameter('OAuth client identifier', 'str'),
 )
+# CyberArk Identity (Idaptive) includes a private app_id in ID token JWS headers;
+# register it so joserfc does not reject the token with UnsupportedHeaderError.
+JWSRegistry.default_header_registry.setdefault(
+    'app_id',
+    HeaderParameter('CyberArk Identity application identifier', 'str'),
+)
 
 
 def _normalize_token_expiry(token: dict) -> dict: