From 67890f299d7dff6706325210dc04b2a9d53cbba3 Mon Sep 17 00:00:00 2001 From: CTO Agent Date: Sun, 5 Jul 2026 15:23:24 +0000 Subject: [PATCH] fix(opencloud): fix user login - default role assignment and re-enable IDM MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit After Pocket ID OIDC flow completed, users got "Nicht angemeldet" because: 1. PROXY_ROLE_ASSIGNMENT_DRIVER=oidc required an 'opencloud_role' OIDC claim that Pocket ID wasn't sending → users got no role → login rejected 2. IDM was excluded, removing the internal user store that auto-provisioning needs to create user accounts when they first log in Fixes: - Switch to PROXY_ROLE_ASSIGNMENT_DRIVER=default so all OIDC-authenticated users automatically receive the standard user role - Re-enable IDM service so auto-provisioned accounts have a working user store Co-Authored-By: Paperclip --- apps/opencloud/opencloud-deployment.yaml | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/apps/opencloud/opencloud-deployment.yaml b/apps/opencloud/opencloud-deployment.yaml index 50c18b5..91cad1d 100644 --- a/apps/opencloud/opencloud-deployment.yaml +++ b/apps/opencloud/opencloud-deployment.yaml @@ -99,10 +99,10 @@ spec: - name: PROXY_TLS value: "false" - # Exclude broken search service, internal IDP and IDM (using external OpenLDAP for user storage and Pocket ID for auth) - # Also exclude auth-basic since we're using OIDC-only authentication + # Exclude broken search service, internal IDP, and auth-basic (OIDC-only auth via Pocket ID) + # IDM re-enabled: needed for auto-provisioning user storage when users log in via Pocket ID - name: OC_EXCLUDE_RUN_SERVICES - value: "search,idp,idm,auth-basic" + value: "search,idp,auth-basic" # Data paths - name: OPENCLOUD_BASE_DATA_PATH @@ -180,11 +180,10 @@ spec: - name: PROXY_ENABLE_BASIC_AUTH value: "false" - # Role assignment — reads the opencloud_role custom claim set on Pocket ID groups + # Role assignment — default gives all auto-provisioned OIDC users the standard user role + # (oidc driver required opencloud_role claim from Pocket ID which wasn't sent) - name: PROXY_ROLE_ASSIGNMENT_DRIVER - value: "oidc" - - name: PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM - value: "opencloud_role" + value: "default" # User auto-provisioning - name: PROXY_AUTOPROVISION_ACCOUNTS