refac

backend/open_webui/utils/oauth.py

@@ -24,6 +24,8 @@ from fastapi import (
     HTTPException,
     status,
 )
+from joserfc.jws import JWSRegistry
+from joserfc.registry import HeaderParameter
 from mcp.shared.auth import (
     OAuthClientMetadata as MCPOAuthClientMetadata,
 )
@@ -187,6 +189,14 @@ async def get_oauth_runtime_config() -> SimpleNamespace:
 DEFAULT_TOKEN_EXPIRY_SECONDS = 3600
 
 
+# Apereo CAS includes client_id in ID token JWS headers; Authlib 1.7/joserfc
+# rejects unknown headers unless we register the provider extension.
+JWSRegistry.default_header_registry.setdefault(
+    'client_id',
+    HeaderParameter('OAuth client identifier', 'str'),
+)
+
+
 def _normalize_token_expiry(token: dict) -> dict:
     """Ensure a token dict always has a numeric ``expires_at``.