website/integrations: Open WebUI #12939
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,61 @@ | ||
| --- | ||
| title: Integrate with Open WebUI | ||
| sidebar_label: Open WebUI | ||
| --- | ||
|
|
||
| # Integrate with Open WebUI | ||
|
|
||
| <span class="badge badge--secondary">Support level: Community</span> | ||
|
|
||
| ## What is Open WebUI | ||
|
|
||
| > Open WebUI is a simple, self-hosted AI platform that works entirely offline. It supports tools like Ollama and OpenAI-style APIs and has a built-in engine for RAG tasks. | ||
| > | ||
| > -- https://openwebui.com/ | ||
|
|
||
| ## Preparation | ||
|
|
||
| The following placeholders are used in this guide: | ||
|
|
||
| - `openwebui.company` is the FQDN of the Open WebUI installation. | ||
| - `authentik.company` is the FQDN of the authentik installation. | ||
|
|
||
| :::note | ||
| This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application. | ||
| ::: | ||
|
|
||
| ## authentik configuration | ||
|
|
||
| [Create](https://docs.goauthentik.io/docs/add-secure-apps/applications/manage_apps#add-new-applications) an OAuth2/OpenID provider and an application in authentik using the wizard. | ||
|
|
||
| Provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations. | ||
|
|
||
| - Note the **Client ID**, **Client Secret**, and **slug** values for later use. | ||
| - Set the redirect URI to <kbd>https://<em>openwebui.company</em>/oauth/oidc/callback</kbd>. | ||
| - Select any available signing key. | ||
|
|
||
| ## Open WebUI configuration | ||
|
|
||
| You need to set the environment variables in the appropriate place based on your deployment method—either in the .env file or as Docker environment variables. The values themselves remain the same, only their location differs. | ||
|
|
||
| Enter the following details from the authentik provider: | ||
|
|
||
| - Set **OAUTH_CLIENT_ID** to the Client ID copied from authentik. | ||
| - Set **OAUTH_CLIENT_SECRET** to the Client Secret copied from authentik. | ||
| - Set **OAUTH_PROVIDER_NAME** to `authentik`. | ||
| - Set **OPENID_PROVIDER_URL** to <kbd>https://<em>authentik.company</em>/o/<em>slug</em>/.well-known/openid-configuration</kbd>. | ||
|
|
||
| ## Configuration verification | ||
|
|
||
| - Open your web browser and go to <kbd>https://<em>openwebui.company</em></kbd>. | ||
| - Make sure you are logged off any previous session. | ||
| - Click **Continue with authentik** to log in. | ||
| - After logging in, authentik will redirect you back to <kbd>https://<em>openwebui.company</em></kbd>. | ||
| - If you successfully return to the Open WebUI, the login is working correctly. | ||
|
|
||
| :::note | ||
| Users are automatically created, but an administrator must update their role to at least **User** via the WebGUI. | ||
| To do so, log in as an administrator and access the **Admin Panel** (URL: <kbd>https://openwebui.company</kbd>/admin/users). | ||
| Click on the user whose role should be increased from **Pending** to at least **User**. | ||
| More details on how to administer Open WebUI can be found here <kbd>https://docs.openwebui.com/</kbd>. | ||
| ::: | ||
|
Comment on lines
+56
to
+61
Member
There was a problem hiding this comment. From the docs, this can be managed by providing a custom claim with proper roles. It would be a better user experience to indicate that in the docs instead of manually requiring the admin to change the role every time a user is created.
Contributor
Author
There was a problem hiding this comment. Heya, this is absolutely true but I thought the aim of the docs on authentik should only get anyone to the point to be able to login and any additional configuration should be done by yourself. Otherwise we have to do an analysis for each service provider and write the same docs here as it is pointed out in each of the service providers' documentation. I mean I can do it but I guess this going against the note that is in each guide right now. (Guide includes only settings that should be changed from default values....) @tanberry @dominic-r should I do it or leave this version as it is right now?
Member
There was a problem hiding this comment. There are a bunch of places where we do provide that information, for instance the Grafana docs. IMO this should've made it in. At the very least, there should've been a pointer to that specific version in the upstream docs. If you're up for it, I'd love a follow up PRs with instructions for this
Contributor
There was a problem hiding this comment. Yes, while true that we can try to keep these integration instructions as generic as possible (to your point @nicedevil007 ), it's more important to provide docs that follow "best practices"... so if a best practice is to use a custom claim with proper roles, we should document that. At very least, mention it. Would this work: Apologies I merged this without seeing your comment @rissson. |
||
Uh oh!
There was an error while loading. Please reload this page.