From 9562f036f880f92b2d7d622b66c63c6510d4a2cf Mon Sep 17 00:00:00 2001
From: Timothy Jaeryang Baek <tim@openwebui.com>
Date: Wed, 1 Jul 2026 02:57:29 -0500
Subject: [PATCH] refac

---
 backend/open_webui/utils/oauth.py | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/backend/open_webui/utils/oauth.py b/backend/open_webui/utils/oauth.py
index 67b66d1a0d..0d72a24efe 100644
--- a/backend/open_webui/utils/oauth.py
+++ b/backend/open_webui/utils/oauth.py
@@ -24,6 +24,8 @@ from fastapi import (
     HTTPException,
     status,
 )
+from joserfc.jws import JWSRegistry
+from joserfc.registry import HeaderParameter
 from mcp.shared.auth import (
     OAuthClientMetadata as MCPOAuthClientMetadata,
 )
@@ -187,6 +189,14 @@ async def get_oauth_runtime_config() -> SimpleNamespace:
 DEFAULT_TOKEN_EXPIRY_SECONDS = 3600
 
 
+# Apereo CAS includes client_id in ID token JWS headers; Authlib 1.7/joserfc
+# rejects unknown headers unless we register the provider extension.
+JWSRegistry.default_header_registry.setdefault(
+    'client_id',
+    HeaderParameter('OAuth client identifier', 'str'),
+)
+
+
 def _normalize_token_expiry(token: dict) -> dict:
     """Ensure a token dict always has a numeric ``expires_at``.