basicstack/stack.basicstack.de
2
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

fix(opencloud): fix user login - default role assignment and re-enable IDM

Browse source 
After Pocket ID OIDC flow completed, users got "Nicht angemeldet" because:
1. PROXY_ROLE_ASSIGNMENT_DRIVER=oidc required an 'opencloud_role' OIDC claim
   that Pocket ID wasn't sending → users got no role → login rejected
2. IDM was excluded, removing the internal user store that auto-provisioning
   needs to create user accounts when they first log in

Fixes:
- Switch to PROXY_ROLE_ASSIGNMENT_DRIVER=default so all OIDC-authenticated
  users automatically receive the standard user role
- Re-enable IDM service so auto-provisioned accounts have a working user store

Co-Authored-By: Paperclip <noreply@paperclip.ing>
This commit is contained in:
CTO Agent 2026-07-05 15:23:24 +00:00
parent 6b29f46f3b
commit 67890f299d
1 changed files with 6 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
apps/opencloud/opencloud-deployment.yaml
View file

@ -99,10 +99,10 @@ spec:
- name: PROXY_TLS - name: PROXY_TLS
value: "false" value: "false"
# Exclude broken search service, internal IDP and IDM (using external OpenLDAP for user storage and Pocket ID for auth) # Exclude broken search service, internal IDP, and auth-basic (OIDC-only auth via Pocket ID)
# Also exclude auth-basic since we're using OIDC-only authentication # IDM re-enabled: needed for auto-provisioning user storage when users log in via Pocket ID
- name: OC_EXCLUDE_RUN_SERVICES - name: OC_EXCLUDE_RUN_SERVICES
value: "search,idp,idm,auth-basic" value: "search,idp,auth-basic"
# Data paths # Data paths
- name: OPENCLOUD_BASE_DATA_PATH - name: OPENCLOUD_BASE_DATA_PATH
@ -180,11 +180,10 @@ spec:
- name: PROXY_ENABLE_BASIC_AUTH - name: PROXY_ENABLE_BASIC_AUTH
value: "false" value: "false"
# Role assignment — reads the opencloud_role custom claim set on Pocket ID groups # Role assignment — default gives all auto-provisioned OIDC users the standard user role
# (oidc driver required opencloud_role claim from Pocket ID which wasn't sent)
- name: PROXY_ROLE_ASSIGNMENT_DRIVER - name: PROXY_ROLE_ASSIGNMENT_DRIVER
value: "oidc" value: "default"
- name: PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM
value: "opencloud_role"
# User auto-provisioning # User auto-provisioning
- name: PROXY_AUTOPROVISION_ACCOUNTS - name: PROXY_AUTOPROVISION_ACCOUNTS