[0.1.10] [macOS (Apple Silicon)] Authentication gateway redirects prevent adding an Open WebUI connection

[mueller-maximilian]

Version

0.1.10

Platform

macOS (Apple Silicon)

Description

I cannot add an Open WebUI instance protected by an authentication gateway. Tether rejects the redirect to the identity provider before presenting a login window.

My deployment uses Google Cloud IAP. The underlying issue appears to be how connection validation handles external authentication redirects; other gateways have not been tested.

Actual behavior

Connection setup stops with:

Error invoking remote method 'connections:add': Error: WebUI redirects to a different address. Edit the connection to use its final address, including https:// if required.

The URL is already the correct HTTPS address. The redirect is part of authentication, rather than a change in the deployment address.

Expected behavior

Allow the user to authenticate with the gateway, retain the gateway session, and then validate and connect to Open WebUI. If the gateway is unsupported, show an error explaining that limitation.

Steps to reproduce

1. Launch Tether v0.1.10.
2. Enter the HTTPS URL of an Open WebUI instance protected by Google Cloud IAP.
3. Click Connect.
4. Observe the redirect error; no gateway login window opens.

Additional context

Diagnostic findings

Running the connection validator extracted from the installed v0.1.10 app against the affected instance reproduces the exact error:

GET https://<webui-host>
HTTP 302 -> https://accounts.google.com/o/oauth2/v2/auth
OAuth callback points to iap.googleapis.com
Recognized gateway login: false
Validation fails after the first request with the error above

Requests to /api/config and /api/version also return the IAP authentication redirect when unauthenticated.

In the installed code:

• validateConnectionURL() rejects redirects outside the connection origin.
• isAccessLogin() recognizes Cloudflare Access login URLs, but does not recognize the Google IAP redirect.
• accessCookies() forwards only CF_Authorization and CF_Binding.

As a result, the gateway login flow is never opened. Supporting IAP appears to require both login-flow recognition and gateway session handling for subsequent requests, rather than simply allowing the initial redirect.

Open WebUI server version: not verified during this investigation.

[tjbck]

Moving this to Discussions to explore Google IAP support. Browser sign-in and WebUI session handoff alone are insufficient. We still need to verify whether the IAP cookie can be securely transferred to Tether and renewed without extra configuration.