caf32a3b36
Problem: OpenCloud was configured for internal authentication but login wasn't working. Changes: - Exclude internal IDP/IDM services (OC_EXCLUDE_RUN_SERVICES=search,idp,idm) - Configure external OIDC with Pocket ID (auth.basicstack.de) - Disable basic authentication (PROXY_ENABLE_BASIC_AUTH=false) - Configure web service OIDC client settings - Remove internal demo user creation (IDM_CREATE_DEMO_USERS) Result: Users will authenticate via Pocket ID only, no internal auth methods. Co-Authored-By: Paperclip <noreply@paperclip.ing>
76 lines
2.5 KiB
Markdown
76 lines
2.5 KiB
Markdown
# OpenCloud OIDC Authentication Fix
|
|
|
|
## Problem
|
|
OpenCloud deployment was configured for internal authentication (IDM/IDP services) but login was not working. The goal is to use Pocket ID (external OIDC provider) for authentication only.
|
|
|
|
## Root Cause
|
|
The configuration was switched to internal authentication mode with:
|
|
- `IDM_CREATE_DEMO_USERS=true` - Created internal demo users
|
|
- `PROXY_ENABLE_BASIC_AUTH=true` - Enabled basic auth
|
|
- Internal IDP/IDM services running
|
|
- Missing OIDC client configuration
|
|
|
|
## Solution Applied
|
|
Modified `apps/opencloud/opencloud-deployment.yaml`:
|
|
|
|
### 1. Disabled Internal Auth Services
|
|
```yaml
|
|
OC_EXCLUDE_RUN_SERVICES: "search,idp,idm"
|
|
```
|
|
- Excluded internal IDP (Identity Provider) service
|
|
- Excluded internal IDM (Identity Management) service
|
|
- Kept search service excluded (known to crash in v7.2.0)
|
|
|
|
### 2. Configured External OIDC (Pocket ID)
|
|
```yaml
|
|
# Global OIDC settings
|
|
OC_OIDC_ISSUER: "https://auth.basicstack.de"
|
|
OC_OIDC_CLIENT_ID: (from opencloud-oidc-secret)
|
|
OC_OIDC_CLIENT_SECRET: (from opencloud-oidc-secret)
|
|
OC_OIDC_CLIENT_SCOPES: "openid profile email groups offline_access"
|
|
```
|
|
|
|
### 3. Configured Proxy Service for OIDC
|
|
```yaml
|
|
PROXY_OIDC_REWRITE_WELLKNOWN: "true"
|
|
PROXY_USER_OIDC_CLAIM: "email"
|
|
PROXY_ENABLE_BASIC_AUTH: "false"
|
|
```
|
|
|
|
### 4. Configured Web Service for OIDC
|
|
```yaml
|
|
WEB_OIDC_CLIENT_ID: (from opencloud-oidc-secret)
|
|
WEB_OIDC_AUTHORITY: "https://auth.basicstack.de"
|
|
WEB_OIDC_METADATA_URL: "https://auth.basicstack.de/.well-known/openid-configuration"
|
|
WEB_OIDC_RESPONSE_TYPE: "code"
|
|
WEB_OIDC_SCOPE: "openid profile email groups offline_access"
|
|
```
|
|
|
|
### 5. Removed Internal Auth Flags
|
|
Deleted:
|
|
- `IDM_CREATE_DEMO_USERS=true`
|
|
- `PROXY_ENABLE_BASIC_AUTH=true` (duplicate, now set to false above)
|
|
|
|
## Expected Result
|
|
- Users will authenticate via Pocket ID (auth.basicstack.de)
|
|
- No internal user management or LDAP
|
|
- No basic authentication with username/password
|
|
- Single Sign-On experience through OIDC
|
|
|
|
## Deployment
|
|
Apply the updated configuration:
|
|
```bash
|
|
kubectl apply -f apps/opencloud/opencloud-deployment.yaml
|
|
kubectl rollout restart deployment/opencloud -n opencloud
|
|
```
|
|
|
|
## Verification
|
|
1. Navigate to https://opencloud.basicstack.de
|
|
2. Should redirect to Pocket ID (https://auth.basicstack.de)
|
|
3. Login with Pocket ID credentials
|
|
4. Should be redirected back to OpenCloud authenticated
|
|
|
|
## References
|
|
- OpenCloud Docs: https://docs.opencloud.eu/de/docs/dev/server/configuration/
|
|
- OIDC sealed secret: apps/opencloud/opencloud-oidc-sealed.yaml
|
|
- Previous attempt: git commit d8807a7
|