# OpenCloud OIDC Authentication Fix

## Problem
OpenCloud deployment was configured for internal authentication (IDM/IDP services) but login was not working. The goal is to use Pocket ID (external OIDC provider) for authentication only.

## Root Cause
The configuration was switched to internal authentication mode with:
- `IDM_CREATE_DEMO_USERS=true` - Created internal demo users
- `PROXY_ENABLE_BASIC_AUTH=true` - Enabled basic auth
- Internal IDP/IDM services running
- Missing OIDC client configuration

## Solution Applied
Modified `apps/opencloud/opencloud-deployment.yaml`:

### 1. Disabled Internal Auth Services
```yaml
OC_EXCLUDE_RUN_SERVICES: "search,idp,idm"
```
- Excluded internal IDP (Identity Provider) service
- Excluded internal IDM (Identity Management) service
- Kept search service excluded (known to crash in v7.2.0)

### 2. Configured External OIDC (Pocket ID)
```yaml
# Global OIDC settings
OC_OIDC_ISSUER: "https://auth.basicstack.de"
OC_OIDC_CLIENT_ID: (from opencloud-oidc-secret)
OC_OIDC_CLIENT_SECRET: (from opencloud-oidc-secret)
OC_OIDC_CLIENT_SCOPES: "openid profile email groups offline_access"
```

### 3. Configured Proxy Service for OIDC
```yaml
PROXY_OIDC_REWRITE_WELLKNOWN: "true"
PROXY_USER_OIDC_CLAIM: "email"
PROXY_ENABLE_BASIC_AUTH: "false"
```

### 4. Configured Web Service for OIDC
```yaml
WEB_OIDC_CLIENT_ID: (from opencloud-oidc-secret)
WEB_OIDC_AUTHORITY: "https://auth.basicstack.de"
WEB_OIDC_METADATA_URL: "https://auth.basicstack.de/.well-known/openid-configuration"
WEB_OIDC_RESPONSE_TYPE: "code"
WEB_OIDC_SCOPE: "openid profile email groups offline_access"
```

### 5. Removed Internal Auth Flags
Deleted:
- `IDM_CREATE_DEMO_USERS=true`
- `PROXY_ENABLE_BASIC_AUTH=true` (duplicate, now set to false above)

## Expected Result
- Users will authenticate via Pocket ID (auth.basicstack.de)
- No internal user management or LDAP
- No basic authentication with username/password
- Single Sign-On experience through OIDC

## Deployment
Apply the updated configuration:
```bash
kubectl apply -f apps/opencloud/opencloud-deployment.yaml
kubectl rollout restart deployment/opencloud -n opencloud
```

## Verification
1. Navigate to https://opencloud.basicstack.de
2. Should redirect to Pocket ID (https://auth.basicstack.de)
3. Login with Pocket ID credentials
4. Should be redirected back to OpenCloud authenticated

## References
- OpenCloud Docs: https://docs.opencloud.eu/de/docs/dev/server/configuration/
- OIDC sealed secret: apps/opencloud/opencloud-oidc-sealed.yaml
- Previous attempt: git commit d8807a7