From caf32a3b36603905db9404fe903a2ad9bf47b961 Mon Sep 17 00:00:00 2001 From: CTO Agent Date: Sun, 5 Jul 2026 08:18:34 +0000 Subject: [PATCH] Fix OpenCloud authentication - Switch to Pocket ID OIDC only Problem: OpenCloud was configured for internal authentication but login wasn't working. Changes: - Exclude internal IDP/IDM services (OC_EXCLUDE_RUN_SERVICES=search,idp,idm) - Configure external OIDC with Pocket ID (auth.basicstack.de) - Disable basic authentication (PROXY_ENABLE_BASIC_AUTH=false) - Configure web service OIDC client settings - Remove internal demo user creation (IDM_CREATE_DEMO_USERS) Result: Users will authenticate via Pocket ID only, no internal auth methods. Co-Authored-By: Paperclip --- apps/opencloud/OIDC_FIX_SUMMARY.md | 76 ++++++++++++++++++++++++ apps/opencloud/opencloud-deployment.yaml | 49 ++++++++++++--- 2 files changed, 117 insertions(+), 8 deletions(-) create mode 100644 apps/opencloud/OIDC_FIX_SUMMARY.md diff --git a/apps/opencloud/OIDC_FIX_SUMMARY.md b/apps/opencloud/OIDC_FIX_SUMMARY.md new file mode 100644 index 0000000..bde7a6c --- /dev/null +++ b/apps/opencloud/OIDC_FIX_SUMMARY.md @@ -0,0 +1,76 @@ +# OpenCloud OIDC Authentication Fix + +## Problem +OpenCloud deployment was configured for internal authentication (IDM/IDP services) but login was not working. The goal is to use Pocket ID (external OIDC provider) for authentication only. + +## Root Cause +The configuration was switched to internal authentication mode with: +- `IDM_CREATE_DEMO_USERS=true` - Created internal demo users +- `PROXY_ENABLE_BASIC_AUTH=true` - Enabled basic auth +- Internal IDP/IDM services running +- Missing OIDC client configuration + +## Solution Applied +Modified `apps/opencloud/opencloud-deployment.yaml`: + +### 1. Disabled Internal Auth Services +```yaml +OC_EXCLUDE_RUN_SERVICES: "search,idp,idm" +``` +- Excluded internal IDP (Identity Provider) service +- Excluded internal IDM (Identity Management) service +- Kept search service excluded (known to crash in v7.2.0) + +### 2. Configured External OIDC (Pocket ID) +```yaml +# Global OIDC settings +OC_OIDC_ISSUER: "https://auth.basicstack.de" +OC_OIDC_CLIENT_ID: (from opencloud-oidc-secret) +OC_OIDC_CLIENT_SECRET: (from opencloud-oidc-secret) +OC_OIDC_CLIENT_SCOPES: "openid profile email groups offline_access" +``` + +### 3. Configured Proxy Service for OIDC +```yaml +PROXY_OIDC_REWRITE_WELLKNOWN: "true" +PROXY_USER_OIDC_CLAIM: "email" +PROXY_ENABLE_BASIC_AUTH: "false" +``` + +### 4. Configured Web Service for OIDC +```yaml +WEB_OIDC_CLIENT_ID: (from opencloud-oidc-secret) +WEB_OIDC_AUTHORITY: "https://auth.basicstack.de" +WEB_OIDC_METADATA_URL: "https://auth.basicstack.de/.well-known/openid-configuration" +WEB_OIDC_RESPONSE_TYPE: "code" +WEB_OIDC_SCOPE: "openid profile email groups offline_access" +``` + +### 5. Removed Internal Auth Flags +Deleted: +- `IDM_CREATE_DEMO_USERS=true` +- `PROXY_ENABLE_BASIC_AUTH=true` (duplicate, now set to false above) + +## Expected Result +- Users will authenticate via Pocket ID (auth.basicstack.de) +- No internal user management or LDAP +- No basic authentication with username/password +- Single Sign-On experience through OIDC + +## Deployment +Apply the updated configuration: +```bash +kubectl apply -f apps/opencloud/opencloud-deployment.yaml +kubectl rollout restart deployment/opencloud -n opencloud +``` + +## Verification +1. Navigate to https://opencloud.basicstack.de +2. Should redirect to Pocket ID (https://auth.basicstack.de) +3. Login with Pocket ID credentials +4. Should be redirected back to OpenCloud authenticated + +## References +- OpenCloud Docs: https://docs.opencloud.eu/de/docs/dev/server/configuration/ +- OIDC sealed secret: apps/opencloud/opencloud-oidc-sealed.yaml +- Previous attempt: git commit d8807a7 diff --git a/apps/opencloud/opencloud-deployment.yaml b/apps/opencloud/opencloud-deployment.yaml index 1815b04..a6053e9 100644 --- a/apps/opencloud/opencloud-deployment.yaml +++ b/apps/opencloud/opencloud-deployment.yaml @@ -91,9 +91,9 @@ spec: - name: PROXY_TLS value: "false" - # Exclude broken search service only (using internal IDP) + # Exclude broken search service and internal IDP/IDM (using external OIDC via Pocket ID) - name: OC_EXCLUDE_RUN_SERVICES - value: "search" + value: "search,idp,idm" # Data paths - name: OPENCLOUD_BASE_DATA_PATH @@ -138,6 +138,45 @@ spec: name: opencloud-config-secrets key: admin-user-id + # External OIDC Configuration (Pocket ID) + - name: OC_OIDC_ISSUER + value: "https://auth.basicstack.de" + - name: OC_OIDC_CLIENT_ID + valueFrom: + secretKeyRef: + name: opencloud-oidc-secret + key: oidc-client-id + - name: OC_OIDC_CLIENT_SECRET + valueFrom: + secretKeyRef: + name: opencloud-oidc-secret + key: oidc-client-secret + - name: OC_OIDC_CLIENT_SCOPES + value: "openid profile email groups offline_access" + + # Proxy service OIDC configuration + - name: PROXY_OIDC_REWRITE_WELLKNOWN + value: "true" + - name: PROXY_USER_OIDC_CLAIM + value: "email" + - name: PROXY_ENABLE_BASIC_AUTH + value: "false" + + # Web service OIDC configuration + - name: WEB_OIDC_CLIENT_ID + valueFrom: + secretKeyRef: + name: opencloud-oidc-secret + key: oidc-client-id + - name: WEB_OIDC_AUTHORITY + value: "https://auth.basicstack.de" + - name: WEB_OIDC_METADATA_URL + value: "https://auth.basicstack.de/.well-known/openid-configuration" + - name: WEB_OIDC_RESPONSE_TYPE + value: "code" + - name: WEB_OIDC_SCOPE + value: "openid profile email groups offline_access" + # SMTP Configuration - name: NOTIFICATIONS_SMTP_HOST value: "mail.basicstack.de" @@ -362,12 +401,6 @@ spec: name: opencloud-config-secrets key: thumbnails-transfer-secret - # Enable internal authentication - - name: IDM_CREATE_DEMO_USERS - value: "true" - - name: PROXY_ENABLE_BASIC_AUTH - value: "true" - ports: - containerPort: 9200 name: http