Fix OpenCloud authentication - Switch to Pocket ID OIDC only

Problem: OpenCloud was configured for internal authentication but login wasn't working.

Changes:
- Exclude internal IDP/IDM services (OC_EXCLUDE_RUN_SERVICES=search,idp,idm)
- Configure external OIDC with Pocket ID (auth.basicstack.de)
- Disable basic authentication (PROXY_ENABLE_BASIC_AUTH=false)
- Configure web service OIDC client settings
- Remove internal demo user creation (IDM_CREATE_DEMO_USERS)

Result: Users will authenticate via Pocket ID only, no internal auth methods.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/opencloud/OIDC_FIX_SUMMARY.md

@@ -0,0 +1,76 @@
+# OpenCloud OIDC Authentication Fix
+
+## Problem
+OpenCloud deployment was configured for internal authentication (IDM/IDP services) but login was not working. The goal is to use Pocket ID (external OIDC provider) for authentication only.
+
+## Root Cause
+The configuration was switched to internal authentication mode with:
+- `IDM_CREATE_DEMO_USERS=true` - Created internal demo users
+- `PROXY_ENABLE_BASIC_AUTH=true` - Enabled basic auth
+- Internal IDP/IDM services running
+- Missing OIDC client configuration
+
+## Solution Applied
+Modified `apps/opencloud/opencloud-deployment.yaml`:
+
+### 1. Disabled Internal Auth Services
+```yaml
+OC_EXCLUDE_RUN_SERVICES: "search,idp,idm"
+```
+- Excluded internal IDP (Identity Provider) service
+- Excluded internal IDM (Identity Management) service
+- Kept search service excluded (known to crash in v7.2.0)
+
+### 2. Configured External OIDC (Pocket ID)
+```yaml
+# Global OIDC settings
+OC_OIDC_ISSUER: "https://auth.basicstack.de"
+OC_OIDC_CLIENT_ID: (from opencloud-oidc-secret)
+OC_OIDC_CLIENT_SECRET: (from opencloud-oidc-secret)
+OC_OIDC_CLIENT_SCOPES: "openid profile email groups offline_access"
+```
+
+### 3. Configured Proxy Service for OIDC
+```yaml
+PROXY_OIDC_REWRITE_WELLKNOWN: "true"
+PROXY_USER_OIDC_CLAIM: "email"
+PROXY_ENABLE_BASIC_AUTH: "false"
+```
+
+### 4. Configured Web Service for OIDC
+```yaml
+WEB_OIDC_CLIENT_ID: (from opencloud-oidc-secret)
+WEB_OIDC_AUTHORITY: "https://auth.basicstack.de"
+WEB_OIDC_METADATA_URL: "https://auth.basicstack.de/.well-known/openid-configuration"
+WEB_OIDC_RESPONSE_TYPE: "code"
+WEB_OIDC_SCOPE: "openid profile email groups offline_access"
+```
+
+### 5. Removed Internal Auth Flags
+Deleted:
+- `IDM_CREATE_DEMO_USERS=true`
+- `PROXY_ENABLE_BASIC_AUTH=true` (duplicate, now set to false above)
+
+## Expected Result
+- Users will authenticate via Pocket ID (auth.basicstack.de)
+- No internal user management or LDAP
+- No basic authentication with username/password
+- Single Sign-On experience through OIDC
+
+## Deployment
+Apply the updated configuration:
+```bash
+kubectl apply -f apps/opencloud/opencloud-deployment.yaml
+kubectl rollout restart deployment/opencloud -n opencloud
+```
+
+## Verification
+1. Navigate to https://opencloud.basicstack.de
+2. Should redirect to Pocket ID (https://auth.basicstack.de)
+3. Login with Pocket ID credentials
+4. Should be redirected back to OpenCloud authenticated
+
+## References
+- OpenCloud Docs: https://docs.opencloud.eu/de/docs/dev/server/configuration/
+- OIDC sealed secret: apps/opencloud/opencloud-oidc-sealed.yaml
+- Previous attempt: git commit d8807a7

apps/opencloud/opencloud-deployment.yaml

@@ -91,9 +91,9 @@ spec:
         - name: PROXY_TLS
           value: "false"
 
-        # Exclude broken search service only (using internal IDP)
+        # Exclude broken search service and internal IDP/IDM (using external OIDC via Pocket ID)
         - name: OC_EXCLUDE_RUN_SERVICES
-          value: "search"
+          value: "search,idp,idm"
 
         # Data paths
         - name: OPENCLOUD_BASE_DATA_PATH
@@ -138,6 +138,45 @@ spec:
               name: opencloud-config-secrets
               key: admin-user-id
 
+        # External OIDC Configuration (Pocket ID)
+        - name: OC_OIDC_ISSUER
+          value: "https://auth.basicstack.de"
+        - name: OC_OIDC_CLIENT_ID
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-oidc-secret
+              key: oidc-client-id
+        - name: OC_OIDC_CLIENT_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-oidc-secret
+              key: oidc-client-secret
+        - name: OC_OIDC_CLIENT_SCOPES
+          value: "openid profile email groups offline_access"
+
+        # Proxy service OIDC configuration
+        - name: PROXY_OIDC_REWRITE_WELLKNOWN
+          value: "true"
+        - name: PROXY_USER_OIDC_CLAIM
+          value: "email"
+        - name: PROXY_ENABLE_BASIC_AUTH
+          value: "false"
+
+        # Web service OIDC configuration
+        - name: WEB_OIDC_CLIENT_ID
+          valueFrom:
+            secretKeyRef:
+              name: opencloud-oidc-secret
+              key: oidc-client-id
+        - name: WEB_OIDC_AUTHORITY
+          value: "https://auth.basicstack.de"
+        - name: WEB_OIDC_METADATA_URL
+          value: "https://auth.basicstack.de/.well-known/openid-configuration"
+        - name: WEB_OIDC_RESPONSE_TYPE
+          value: "code"
+        - name: WEB_OIDC_SCOPE
+          value: "openid profile email groups offline_access"
+
         # SMTP Configuration
         - name: NOTIFICATIONS_SMTP_HOST
           value: "mail.basicstack.de"
@@ -362,12 +401,6 @@ spec:
               name: opencloud-config-secrets
               key: thumbnails-transfer-secret
 
-        # Enable internal authentication
-        - name: IDM_CREATE_DEMO_USERS
-          value: "true"
-        - name: PROXY_ENABLE_BASIC_AUTH
-          value: "true"
-
         ports:
         - containerPort: 9200
           name: http