From 464462b22eee2557f17f630318838379b6880c83 Mon Sep 17 00:00:00 2001
From: Timothy Jaeryang Baek <tim@openwebui.com>
Date: Sat, 21 Mar 2026 19:50:50 -0500
Subject: [PATCH] enh: WEBUI_AUTH_TRUSTED_ROLE_HEADER

---
 backend/open_webui/env.py           |  1 +
 backend/open_webui/routers/auths.py | 11 +++++++++++
 2 files changed, 12 insertions(+)

diff --git a/backend/open_webui/env.py b/backend/open_webui/env.py
index 043fa3c6d..aab88cdfb 100644
--- a/backend/open_webui/env.py
+++ b/backend/open_webui/env.py
@@ -473,6 +473,7 @@ WEBUI_ADMIN_NAME = os.environ.get('WEBUI_ADMIN_NAME', 'Admin')
 WEBUI_AUTH_TRUSTED_EMAIL_HEADER = os.environ.get('WEBUI_AUTH_TRUSTED_EMAIL_HEADER', None)
 WEBUI_AUTH_TRUSTED_NAME_HEADER = os.environ.get('WEBUI_AUTH_TRUSTED_NAME_HEADER', None)
 WEBUI_AUTH_TRUSTED_GROUPS_HEADER = os.environ.get('WEBUI_AUTH_TRUSTED_GROUPS_HEADER', None)
+WEBUI_AUTH_TRUSTED_ROLE_HEADER = os.environ.get('WEBUI_AUTH_TRUSTED_ROLE_HEADER', None)
 
 
 ENABLE_PASSWORD_VALIDATION = os.environ.get('ENABLE_PASSWORD_VALIDATION', 'False').lower() == 'true'
diff --git a/backend/open_webui/routers/auths.py b/backend/open_webui/routers/auths.py
index af45552ca..8cf6b6b1a 100644
--- a/backend/open_webui/routers/auths.py
+++ b/backend/open_webui/routers/auths.py
@@ -35,6 +35,7 @@ from open_webui.env import (
     WEBUI_AUTH_TRUSTED_EMAIL_HEADER,
     WEBUI_AUTH_TRUSTED_NAME_HEADER,
     WEBUI_AUTH_TRUSTED_GROUPS_HEADER,
+    WEBUI_AUTH_TRUSTED_ROLE_HEADER,
     WEBUI_AUTH_COOKIE_SAME_SITE,
     WEBUI_AUTH_COOKIE_SECURE,
     WEBUI_AUTH_SIGNOUT_REDIRECT_URL,
@@ -572,6 +573,16 @@ async def signin(
             if group_names:
                 Groups.sync_groups_by_group_names(user.id, group_names, db=db)
 
+        if WEBUI_AUTH_TRUSTED_ROLE_HEADER and user:
+            trusted_role = request.headers.get(WEBUI_AUTH_TRUSTED_ROLE_HEADER, '').lower().strip()
+            if trusted_role in {'admin', 'user', 'pending'}:
+                if user.role != trusted_role:
+                    Users.update_user_role_by_id(user.id, trusted_role, db=db)
+            elif trusted_role:
+                log.warning(
+                    f'Ignoring invalid trusted role header value: {trusted_role}'
+                )
+
     elif WEBUI_AUTH == False:
         admin_email = 'admin@localhost'
         admin_password = 'admin'