From f0e4df95a1e0629ca9bb4c5d0b2ba5812eda7d2e Mon Sep 17 00:00:00 2001
From: "andreas.leinen" <andreas.leinen@basicstack.de>
Date: Sun, 5 Jul 2026 11:50:58 +0000
Subject: [PATCH] apps/opencloud/opencloud-deployment.yaml aktualisiert

---
 apps/opencloud/opencloud-deployment.yaml | 35 +++++++++++++++++-------
 1 file changed, 25 insertions(+), 10 deletions(-)

diff --git a/apps/opencloud/opencloud-deployment.yaml b/apps/opencloud/opencloud-deployment.yaml
index fd0beba..7c88f2b 100644
--- a/apps/opencloud/opencloud-deployment.yaml
+++ b/apps/opencloud/opencloud-deployment.yaml
@@ -160,22 +160,33 @@ spec:
             secretKeyRef:
               name: opencloud-oidc-secret
               key: oidc-client-id
-        - name: OC_OIDC_CLIENT_SECRET
-          valueFrom:
-            secretKeyRef:
-              name: opencloud-oidc-secret
-              key: oidc-client-secret
+        #- name: OC_OIDC_CLIENT_SECRET
+        #  valueFrom:
+        #    secretKeyRef:
+        #      name: opencloud-oidc-secret
+        #      key: oidc-client-secret
         - name: OC_OIDC_CLIENT_SCOPES
-          value: "openid profile email groups offline_access"
+          value: "openid profile email groups"
 
         # Proxy service OIDC configuration
+        - name: PROXY_OIDC_ISSUER
+          value: "https://auth.basicstack.de"
         - name: PROXY_OIDC_REWRITE_WELLKNOWN
           value: "true"
+        - name: PROXY_OIDC_ACCESS_TOKEN_VERIFY_METHOD
+          value: "none"
         - name: PROXY_USER_OIDC_CLAIM
-          value: "email"
-        # Temporarily enable basic auth for testing (OIDC redirect not working)
+          value: "preferred_username"
+        - name: PROXY_USER_CS3_CLAIM
+          value: "username"
         - name: PROXY_ENABLE_BASIC_AUTH
-          value: "true"
+          value: "false"
+        
+        # Role assignment — reads the opencloud_role custom claim set on Pocket ID groups
+        - name: PROXY_ROLE_ASSIGNMENT_DRIVER
+          value: "oidc"
+        - name: PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM
+          value: "opencloud_role"
 
         # Disable demo user creation (using OIDC auto-provisioning only)
         - name: IDM_CREATE_DEMO_USERS
@@ -194,7 +205,7 @@ spec:
         - name: WEB_OIDC_RESPONSE_TYPE
           value: "code"
         - name: WEB_OIDC_SCOPE
-          value: "openid profile email groups offline_access"
+          value: "openid profile email groups"
 
         # SMTP Configuration
         - name: NOTIFICATIONS_SMTP_HOST
@@ -336,6 +347,10 @@ spec:
             secretKeyRef:
               name: opencloud-config-secrets
               key: service-account-secret
+        - name: GRAPH_ASSIGN_DEFAULT_USER_ROLE
+          value: "false"
+        - name: GRAPH_USERNAME_MATCH
+          value: "none"
         - name: IDP_LDAP_BIND_PASSWORD
           valueFrom:
             secretKeyRef: