Check Existing Issues

• I have searched for any existing and/or related issues.
• I have searched for any existing and/or related discussions.
• I have also searched in the CLOSED issues AND CLOSED discussions and found no related items (your issue might already be addressed on the development branch!).
• I am using the latest version of Open WebUI.

Installation Method

Git Clone

Open WebUI Version

0.7.2

Ollama Version (if applicable)

No response

Operating System

Ubuntu 22.04

Browser (if applicable)

No response

Confirmation

• I have read and followed all instructions in README.md.
• I am using the latest version of both Open WebUI and Ollama.
• I have included the browser console logs.
• I have included the Docker container logs.
• I have provided every relevant configuration, setting, and environment variable used in my setup.
• I have clearly listed every relevant configuration, custom setting, environment variable, and command-line option that influences my setup (such as Docker Compose overrides, .env values, browser settings, authentication configurations, etc).
• I have documented step-by-step reproduction instructions that are precise, sequential, and leave nothing to interpretation. My steps:
• Start with the initial platform/version/OS and dependencies used,
• Specify exact install/launch/configure commands,
• List URLs visited, user input (incl. example values/emails/passwords if needed),
• Describe all options and toggles enabled or changed,
• Include any files or environmental changes,
• Identify the expected and actual result at each stage,
• Ensure any reasonably skilled user can follow and hit the same issue.

Expected Behavior

When creating or updating a user via the SCIM 2.0 API, the externalId provided in the request payload should be persisted in the database. Subsequent GET requests to the user endpoint should return the stored externalId. This is critical for Identity Provider (IdP) synchronization (e.g., Microsoft Entra ID / Azure AD), which relies on this field to map external directory objects to internal users.

Actual Behavior

The externalId is ignored by the backend. Even if a valid string is sent in a POST or PATCH request, the API response returns "externalId": null. The user is created or updated successfully, but the link to the external identity is lost, causing "Provision on Demand" or synchronization cycles in IdPs to fail or report inconsistencies.

Steps to Reproduce

Using a tool like Bruno or curl, send a POST request to /api/v1/scim/v2/Users with the following payload:

JSON
{
"schemas": ["urn:ietf:params:scim:schemas:core:2.0:User"],
"externalId": "my-unique-external-id",
"userName": "test.user@example.com",
"displayName": "Test User",
"name": { "givenName": "Test", "familyName": "User" },
"emails": [{ "value": "test.user@example.com", "primary": true }],
"active": true
}
Observe the HTTP 201 Created response.

Check the returned JSON: externalId is null instead of "my-unique-external-id".

Logs & Screenshots
Analysis of the source code (scim.py):
The issue is caused by a missing mapping in the SCIM router. While the Pydantic models (like SCIMUserCreateRequest) correctly include the externalId field, the actual database insertion logic does not:

Python

Current implementation in scim.py

new_user = Users.insert_new_user(
id=user_id,
name=name,
email=email,
profile_image_url=profile_image,
role="user" if user_data.active else "pending",
db=db,
# externalId is missing and therefore never saved to the DB
)
Additional Information
I am testing this using Microsoft Entra ID (Azure AD) Provisioning on Demand. The IdP expects the returned resource to reflect the externalId it just sent. Because OpenWebUI returns null, the synchronization state becomes unreliable.

Logs & Screenshots

N/A - Verified via API response and source code analysis

MICROSOFT_CLIENT_ID =
MICROSOFT_CLIENT_SECRET =
MICROSOFT_CLIENT_TENANT_ID =
MICROSOFT_REDIRECT_URI =
OPENID_PROVIDER_URL = https://login.microsoftonline.com/****/v2.0/.well-known/openid-configuration
OAUTH_SCOPE = openid email profile User.Read GroupMember.Read.All
OAUTH_EMAIL_CLAIM = email
ENABLE_OAUTH_ROLE_MANAGEMENT = true
OAUTH_ROLES_CLAIM = roles
ENABLE_OAUTH_GROUP_MANAGEMENT = true
ENABLE_OAUTH_GROUP_CREATION = true
OAUTH_GROUPS_CLAIM = groups
SCIM_ENABLED = TRUE
SCIM_TOKEN =

Additional Information

No response