Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

website/integrations: Open WebUI #12939

Merged
merged 10 commits into from
Feb 13, 2025
Merged

website/integrations: Open WebUI #12939

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
be91a23
initial release
nicedevil007 Feb 5, 2025
cafe952
Ready for PR
nicedevil007 Feb 5, 2025
b3652d4
index.md aktualisieren
nicedevil007 Feb 5, 2025
f6763fb
Add stuff for dominic-r :)
nicedevil007 Feb 5, 2025
206d785
index.md aktualisieren
nicedevil007 Feb 5, 2025
8ebe33a
index.md aktualisieren
nicedevil007 Feb 5, 2025
1511f02
make website...
nicedevil007 Feb 10, 2025
9e9725d
make website...
nicedevil007 Feb 10, 2025
141bf63
changes from comments
nicedevil007 Feb 10, 2025
be98bc6
changes from comments
nicedevil007 Feb 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
59 changes: 59 additions & 0 deletions website/integrations/services/open-webui/index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,59 @@
---
title: Integrate with Open WebUI
sidebar_label: Open WebUI
---

# Integrate with Open WebUI

<span class="badge badge--secondary">Support level: Community</span>

## What is Open WebUI

> Open WebUI is a simple, self-hosted AI platform that works entirely offline. It supports tools like Ollama and OpenAI-style APIs and has a built-in engine for RAG tasks.
>
> -- https://openwebui.com/

## Preparation

The following placeholders are used in this guide:

- `openwebui.company` is the FQDN of the Open WebUI installation.
- `authentik.company` is the FQDN of the authentik installation.

:::note
This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application.
:::

## authentik configuration
tanberry marked this conversation as resolved.
Show resolved Hide resolved

[Create](https://docs.goauthentik.io/docs/add-secure-apps/applications/manage_apps#add-new-applications) an OAuth2/OpenID provider and an application in authentik using the wizard.

Provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations.
- Note the **Client ID**, **Client Secret**, and **slug** values for later use.
- Set the redirect URI to <kbd>https://<em>openwebui.company</em>/oauth/oidc/callback</kbd>.
- Select any available signing key.

## Open WebUI configuration

You need to set the environment variables according to your deployment method—either.
nicedevil007 marked this conversation as resolved.
Show resolved Hide resolved

Enter the following details from the authentik provider:
- Set **OAUTH_CLIENT_ID** to the Client ID copied from authentik.
- Set **OAUTH_CLIENT_SECRET** to the Client Secret copied from authentik.
- Set **OAUTH_PROVIDER_NAME** to `authentik`.
- Set **OPENID_PROVIDER_URL** to <kbd>https://<em>authentik.company</em>/o/<em>slug</em>/.well-known/openid-configuration</kbd>.

## Configuration verification

- Open your web browser and go to: <kbd>https://<em>openwebui.company</em></kbd>.
nicedevil007 marked this conversation as resolved.
Show resolved Hide resolved
nicedevil007 marked this conversation as resolved.
Show resolved Hide resolved
- Make sure you are logged off any previous session.
- Click **Continue with authentik** to log in.
- After logging in, authentik will redirect you back to <kbd>https://<em>openwebui.company</em></kbd>.
- If you successfully return to the Open WebUI, the login is working correctly.

:::note
Users are automatically created, but an administrator must update their role to at least **User** via the WebGUI.
To do so, log in as an administrator and access the **Admin Panel** (URL: <kbd>https://openwebui.company</kbd>/admin/users).
Click on the user whose role should be increased from **Pending** to at least **User**.
More details on how to administer Open WebUI can be found here <kbd>https://docs.openwebui.com/</kbd>.
:::
Comment on lines +56 to +61
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

From the docs, this can be managed by providing a custom claim with proper roles. It would be a better user experience to indicate that in the docs instead of manually requiring the admin to change the role every time a user is created.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Heya, this is absolutely true but I thought the aim of the docs on authentik should only get anyone to the point to be able to login and any additional configuration should be done by yourself. Otherwise we have to do an analysis for each service provider and write the same docs here as it is pointed out in each of the service providers' documentation.

I mean I can do it but I guess this going against the note that is in each guide right now. (Guide includes only settings that should be changed from default values....)

@tanberry @dominic-r should I do it or leave this version as it is right now?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There are a bunch of places where we do provide that information, for instance the Grafana docs. IMO this should've made it in. At the very least, there should've been a pointer to that specific version in the upstream docs. If you're up for it, I'd love a follow up PRs with instructions for this

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, while true that we can try to keep these integration instructions as generic as possible (to your point @nicedevil007 ), it's more important to provide docs that follow "best practices"... so if a best practice is to use a custom claim with proper roles, we should document that. At very least, mention it.

Would this work:

Users are automatically created, but an administrator must update their role to at least **User** via the WebGUI. Alternatively, you can use [OAuth role management](https://docs.openwebui.com/features/sso/#oauth-role-management) to configure the provider to return roles in the access token.

Apologies I merged this without seeing your comment @rissson.

1 change: 1 addition & 0 deletions website/sidebarsIntegrations.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -133,6 +133,7 @@ module.exports = {
"services/jellyfin/index",
"services/komga/index",
"services/node-red/index",
"services/open-webui/index",
"services/semaphore/index",
"services/sonar-qube/index",
"services/sonarr/index",
Expand Down
Loading