fix: Default Group ID assignment on SSO/OAUTH and LDAP (#19685)

* fix (#99)

Co-authored-by: Tim Baek <tim@openwebui.com>
Co-authored-by: Claude <noreply@anthropic.com>

* Update auths.py

* unified logic

* PUSH

* remove getattr

* rem getattr

* whitespace

* Update oauth.py

* trusted header group sync

Added default group re-application after trusted header group sync

* not apply after syncs

* .

* rem

---------

Co-authored-by: Tim Baek <tim@openwebui.com>
Co-authored-by: Claude <noreply@anthropic.com>

backend/open_webui/utils/groups.py

@@ -0,0 +1,24 @@
+import logging
+from open_webui.models.groups import Groups
+
+log = logging.getLogger(__name__)
+
+
+def apply_default_group_assignment(
+    default_group_id: str,
+    user_id: str,
+) -> None:
+    """
+    Apply default group assignment to a user if default_group_id is provided.
+    
+    Args:
+        default_group_id: ID of the default group to add the user to
+        user_id: ID of the user to add to the default group
+    """
+    if default_group_id:
+        try:
+            Groups.add_users_to_group(default_group_id, [user_id])
+        except Exception as e:
+            log.error(
+                f"Failed to add user {user_id} to default group {default_group_id}: {e}"
+            )

backend/open_webui/utils/oauth.py

@@ -72,6 +72,7 @@ from open_webui.env import (
 from open_webui.utils.misc import parse_duration
 from open_webui.utils.auth import get_password_hash, create_token
 from open_webui.utils.webhook import post_webhook
+from open_webui.utils.groups import apply_default_group_assignment
 
 from mcp.shared.auth import (
     OAuthClientMetadata as MCPOAuthClientMetadata,
@@ -1167,7 +1168,6 @@ class OAuthManager:
                 log.debug(
                     f"Removing user from group {group_model.name} as it is no longer in their oauth groups"
                 )
-
                 Groups.remove_users_from_group(group_model.id, [user.id])
 
                 # In case a group is created, but perms are never assigned to the group by hitting "save"
@@ -1478,6 +1478,12 @@ class OAuthManager:
                                 "user": user.model_dump_json(exclude_none=True),
                             },
                         )
+
+                    apply_default_group_assignment(
+                        request.app.state.config.DEFAULT_GROUP_ID,
+                        user.id,
+                    )
+
                 else:
                     raise HTTPException(
                         status.HTTP_403_FORBIDDEN,