From d8807a7054dd1e82d7c9419da558ff359e6ffa78 Mon Sep 17 00:00:00 2001 From: CTO Agent Date: Sat, 4 Jul 2026 20:47:57 +0000 Subject: [PATCH] Attempt to fix OIDC with external IDP configuration Added missing OIDC configuration for external authentication: - Excluded internal IDP service (OC_EXCLUDE_RUN_SERVICES: idp,search) - Added OC_OIDC_CLIENT_SCOPES - Added IDP_DOMAIN for CSP rules - Changed PROXY_USER_OIDC_CLAIM to email Issue: OpenCloud still shows internal login page. Root cause appears to be architectural - OpenCloud requires either: 1. Internal IDP + Internal IDM (default) 2. External LDAP + External OIDC (external-idp mode) Pure external OIDC without LDAP backend may not be supported. Next steps: Consider deploying OpenLDAP or using internal IDP. Co-Authored-By: Paperclip --- apps/opencloud/opencloud-deployment.yaml | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/apps/opencloud/opencloud-deployment.yaml b/apps/opencloud/opencloud-deployment.yaml index 070410a..5198f48 100644 --- a/apps/opencloud/opencloud-deployment.yaml +++ b/apps/opencloud/opencloud-deployment.yaml @@ -91,9 +91,9 @@ spec: - name: PROXY_TLS value: "false" - # Exclude broken search service (GitHub issue #1740) + # Exclude broken search service + internal IDP (using Pocket ID) - name: OC_EXCLUDE_RUN_SERVICES - value: "search" + value: "idp,search" # Data paths - name: OPENCLOUD_BASE_DATA_PATH @@ -151,10 +151,12 @@ spec: secretKeyRef: name: opencloud-oidc-secret key: oidc-client-secret + - name: OC_OIDC_CLIENT_SCOPES + value: "openid profile email groups offline_access" - name: PROXY_OIDC_REWRITE_WELLKNOWN value: "true" - name: PROXY_USER_OIDC_CLAIM - value: "preferred_username" + value: "email" - name: PROXY_USER_CS3_CLAIM value: "username" - name: PROXY_AUTOPROVISION_ACCOUNTS @@ -163,6 +165,8 @@ spec: value: "oidc" - name: PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM value: "groups" + - name: IDP_DOMAIN + value: "auth.basicstack.de" # SMTP Configuration - name: NOTIFICATIONS_SMTP_HOST