fix: revoke ldap groups when sync returns empty

backend/open_webui/routers/auths.py

@@ -63,6 +63,25 @@
 log = logging.getLogger(__name__)
 log.setLevel(SRC_LOG_LEVELS["MAIN"])
 
+
+def sync_ldap_user_groups(
+    user,
+    enable_group_management: bool,
+    enable_group_creation: bool,
+    user_groups: list[str],
+):
+    if user.role == "admin" or not enable_group_management:
+        return
+
+    if enable_group_creation and user_groups:
+        Groups.create_groups_by_group_names(user.id, user_groups)
+
+    try:
+        Groups.sync_groups_by_group_names(user.id, user_groups)
+        log.info(f"Successfully synced groups for user {user.id}: {user_groups}")
+    except Exception as e:
+        log.error(f"Failed to sync groups for user {user.id}: {e}")
+
 ############################
 # GetSessionUser
 ############################
@@ -408,26 +427,17 @@ async def ldap_auth(request: Request, response: Response, form_data: LdapForm):
                     secure=WEBUI_AUTH_COOKIE_SECURE,
                 )
 
+                sync_ldap_user_groups(
+                    user,
+                    ENABLE_LDAP_GROUP_MANAGEMENT,
+                    ENABLE_LDAP_GROUP_CREATION,
+                    user_groups,
+                )
+
                 user_permissions = get_permissions(
                     user.id, request.app.state.config.USER_PERMISSIONS
                 )
 
-                if (
-                    user.role != "admin"
-                    and ENABLE_LDAP_GROUP_MANAGEMENT
-                    and user_groups
-                ):
-                    if ENABLE_LDAP_GROUP_CREATION:
-                        Groups.create_groups_by_group_names(user.id, user_groups)
-
-                    try:
-                        Groups.sync_groups_by_group_names(user.id, user_groups)
-                        log.info(
-                            f"Successfully synced groups for user {user.id}: {user_groups}"
-                        )
-                    except Exception as e:
-                        log.error(f"Failed to sync groups for user {user.id}: {e}")
-
                 return {
                     "token": token,
                     "token_type": "Bearer",

backend/open_webui/test/apps/webui/routers/test_auths.py

@@ -1,3 +1,5 @@
+from types import SimpleNamespace
+
 from test.util.abstract_integration_test import AbstractPostgresTest
 from test.util.mock_user import mock_webui_user
 
@@ -97,6 +99,34 @@ def test_signin(self):
         assert data["token"] is not None and len(data["token"]) > 0
         assert data["token_type"] == "Bearer"
 
+    def test_sync_ldap_user_groups_syncs_empty_group_list(self, monkeypatch):
+        from open_webui.routers import auths
+
+        calls = []
+
+        monkeypatch.setattr(
+            auths.Groups,
+            "create_groups_by_group_names",
+            lambda user_id, group_names: calls.append(
+                ("create", user_id, group_names)
+            ),
+        )
+        monkeypatch.setattr(
+            auths.Groups,
+            "sync_groups_by_group_names",
+            lambda user_id, group_names: calls.append(("sync", user_id, group_names))
+            or True,
+        )
+
+        auths.sync_ldap_user_groups(
+            SimpleNamespace(id="user-id", role="user"),
+            enable_group_management=True,
+            enable_group_creation=True,
+            user_groups=[],
+        )
+
+        assert calls == [("sync", "user-id", [])]
+
     def test_signup(self):
         response = self.fast_api_client.post(
             self.create_url("/signup"),