From c993aafd26f2aa403a3ee2127d7ae0eb37981d41 Mon Sep 17 00:00:00 2001 From: CTO Agent Date: Sun, 5 Jul 2026 08:38:07 +0000 Subject: [PATCH] Enable OIDC auto-provisioning for OpenCloud Problem: Users still routed to /login page instead of OIDC redirect. Root cause: auto_provision_accounts was disabled in proxy OIDC config. Changes: - proxy.oidc.auto_provision_accounts: true (enable auto-provisioning) - proxy.oidc.user_oidc_claim: email (user identification claim) - proxy.oidc.role_assignment: Added OIDC role mapper for groups - proxy.enable_basic_auth: false (explicitly disable basic auth) Result: Users will be auto-created on first OIDC login with group-based roles. Co-Authored-By: Paperclip --- apps/opencloud/opencloud-configmap.yaml | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/apps/opencloud/opencloud-configmap.yaml b/apps/opencloud/opencloud-configmap.yaml index ad7e5a7..eb820e3 100644 --- a/apps/opencloud/opencloud-configmap.yaml +++ b/apps/opencloud/opencloud-configmap.yaml @@ -51,11 +51,27 @@ data: app: insecure: true - # Proxy service (OIDC integration) + # Proxy service (OIDC integration with auto-provisioning) proxy: oidc: issuer: https://auth.basicstack.de insecure: false + auto_provision_accounts: true + user_oidc_claim: email + role_assignment: + driver: oidc + oidc_role_mapper: + role_claim: groups + role_mapping: + - role_name: admin + claim_value: opencloudAdmin + - role_name: spaceadmin + claim_value: opencloudSpaceAdmin + - role_name: user + claim_value: opencloudUser + - role_name: guest + claim_value: opencloudGuest + enable_basic_auth: false insecure_backends: true service_account: service_account_id: ${OC_SERVICE_ACCOUNT_ID}