[AUTH] OAuth support

[diegosc78]

CONTEXT:

In open webui it's allowed to configure connections with terminal using several auth methods. See https://github.com/open-webui/open-webui/blob/01f4282f1ffe0d6212f58d3afbeae21fffd0c4be/backend/open_webui/utils/tools.py#L1350-L1359

Specifically it's allowed forward oauth token

PROPOSAL:

Implement OAuth token support (aditional to simple api-key). This implies:

• Receive it in authentication bearer header
• Validate and refresh it against SSO
• Use it to decode user id (equivalent to X-user-id header)

ADVANTAGE:

• Higher security
• Easier to implement in the future connections from commands inside openterminal (eg. python scripts created by LLM) to other systems (eg. MCP) using that session token (propagating user session to backyard)

[maurerle]

what is the benefit of this? the open-terminal works in a multiuser setup with oauth configured in open-webui.

I would close this.

[diegosc78]

Maybe I'm wrong,... but I think we are considering two different uses:

• 1. OpenWebUI-OpenTerminal authentication
• 2. Agents running code (eg python scripts) INSIDE OpenTerminal using user OAUTH TOKEN for calling other services (eg. an MCP)

Second is my main interest, because it's not the same that the agent in OpenWebUI must have the full context (tokens expensive, attention problems) than the agent programmes a python script that maybe calls and chains "n" MCPs with user authentication in a deterministic way.

IMHO simplest way would be only propagating the token, maybe implementing an GET endpoint in OpenTerminal API for letting the agent to get it.

The harder but I think more secure way would be implement an HTTP proxy inside OpenTerminal configured with some URL patterns in order to intercept outgoing http calls, filter them with url patterns and dinamically inject in them the authentication header with Oauth token. This way scripts running inside OpenTerminal would NEVER see the token.

Anyway... if you consider it's not a good idea close the ticket. Sorry for bothering.