stack.basicstack.de/apps/opencloud/OIDC_TROUBLESHOOTING.md

OpenCloud OIDC Authentication Troubleshooting

Issue Summary

OpenCloud deployment configured for Pocket ID (external OIDC) authentication, but the web frontend continues to serve a page instead of redirecting to OIDC provider.

All Configuration Changes Applied

1. Deployment Environment Variables (caf32a3, 64ec709)

# OIDC Configuration
OC_OIDC_ISSUER: "https://auth.basicstack.de"
OC_OIDC_CLIENT_ID: (from opencloud-oidc-secret)
OC_OIDC_CLIENT_SECRET: (from opencloud-oidc-secret)
OC_OIDC_CLIENT_SCOPES: "openid profile email groups offline_access"
OC_JWT_SECRET: (from opencloud-jwt-secret) ✓ Added per user suggestion

# Proxy OIDC
PROXY_OIDC_REWRITE_WELLKNOWN: "true"
PROXY_USER_OIDC_CLAIM: "email"
PROXY_ENABLE_BASIC_AUTH: "false"

# Web Service OIDC
WEB_OIDC_CLIENT_ID: (from opencloud-oidc-secret)
WEB_OIDC_AUTHORITY: "https://auth.basicstack.de"
WEB_OIDC_METADATA_URL: "https://auth.basicstack.de/.well-known/openid-configuration"
WEB_OIDC_RESPONSE_TYPE: "code"
WEB_OIDC_SCOPE: "openid profile email groups offline_access"

# Disable Demo Users
IDM_CREATE_DEMO_USERS: "false"

2. ConfigMap Changes (169cd31, c993aaf, 4c89d5d)

Proxy Service:

proxy:
  oidc:
    issuer: https://auth.basicstack.de
    insecure: false
    auto_provision_accounts: true  # ✓ Enables auto-provisioning
    user_oidc_claim: email
    role_assignment:
      driver: oidc
      oidc_role_mapper:
        role_claim: groups
        role_mapping:
          - role_name: admin
            claim_value: opencloudAdmin
          - role_name: spaceadmin
            claim_value: opencloudSpaceAdmin
          - role_name: user
            claim_value: opencloudUser
          - role_name: guest
            claim_value: opencloudGuest
  enable_basic_auth: false  # ✓ Disabled

Service Architecture:

• IDP (Identity Provider) = EXCLUDED (Pocket ID handles authentication)
• IDM (Identity Management) = KEPT (provides LDAP storage for auto-provisioned users)
• OC_EXCLUDE_RUN_SERVICES: "search,idp"

User/Group Storage:

users:
  drivers:
    ldap:  # Connected to internal IDM LDAP
      bind_password: ${OC_USERS_LDAP_BIND_PASSWORD}

groups:
  drivers:
    ldap:  # Connected to internal IDM LDAP
      bind_password: ${OC_GROUPS_LDAP_BIND_PASSWORD}

3. Removed Local User Creation (56d9063)

• Removed --admin-password flag from opencloud init
• Command now: opencloud init --insecure=true --force-overwrite (no local admin)
• IDM_CREATE_DEMO_USERS=false

Verified Working

• ✓ IDM service running (LDAP listener on 127.0.0.1:9236)
• ✓ OIDC config present in /config.json:

  {
    "metadata_url": "https://auth.basicstack.de/.well-known/openid-configuration",
    "authority": "https://auth.basicstack.de",
    "client_id": "2f3c0cea-697f-4dbc-9573-6f6e8adfd4b0",
    "response_type": "code",
    "scope": "openid profile email groups offline_access"
  }
  

• ✓ Pocket ID accessible (https://auth.basicstack.de/.well-known/openid-configuration returns 200)
• ✓ OpenCloud pod healthy and running
• ✓ No errors in logs
• ✓ oidc-client-ts module loaded by frontend

Current Behavior

When accessing https://opencloud.basicstack.de:

1. Frontend HTML loads successfully (HTTP 200)
2. /config.json loads with OIDC configuration
3. /themes/opencloud/theme.json loads
4. oidc-client-ts JavaScript module loads
5. But: No redirect to Pocket ID occurs
6. Page serves content instead of redirecting

Log evidence shows normal page serving:

• GET / → 200
• GET /config.json → 200
• GET /app/list → 200
• Warning: "core access token not set" (normal for unauthenticated)

Expected Behavior

With OIDC configured and no local users:

1. Frontend loads
2. JavaScript detects OIDC config
3. JavaScript detects no local auth available
4. Automatic redirect to: https://auth.basicstack.de/authorize?...
5. User authenticates with Pocket ID
6. Redirect back to OpenCloud with auth code
7. Token exchange and user auto-provisioning

Possible Causes

1. Frontend Logic Issue

The OpenCloud web SPA may have additional logic that prevents OIDC-only mode:

• Checks for local user availability before deciding to redirect
• Requires a specific config option we haven't found
• Has a bug in OIDC-only detection logic

2. Missing Configuration

Possible undocumented configuration options:

• Web service option to disable password login UI
• Proxy option to force OIDC redirect
• ConfigMap option to set "OIDC-only mode"

3. Version-Specific Issue

OpenCloud v7.2.0 may have:

• Incomplete OIDC-only support
• Bug in auto-redirect logic
• Regression from earlier versions

Next Steps for Investigation

1. Check OpenCloud Source Code

Examine the web frontend (SPA) source to understand:

• How it decides to redirect to OIDC vs show login form
• What configuration flags control this behavior
• Whether there's a "force OIDC" option

2. Test with curl/API

Try to trigger OIDC flow manually:

# Try to initiate OIDC flow
curl -i "https://opencloud.basicstack.de/signin-oidc"

# Try to access protected resource
curl -i "https://opencloud.basicstack.de/app/list"

3. Check OpenCloud Community

• Search OpenCloud GitHub issues for OIDC-only configuration
• Check OpenCloud documentation for OIDC-only examples
• Ask in OpenCloud community channels

4. Try Alternative Approach

Consider if OpenCloud requires a different architecture:

• Keep IDP running but configure it to proxy to Pocket ID
• Use a different authentication flow
• Check if web service needs additional OIDC configuration

5. Browser Developer Tools

Have user check browser console for JavaScript errors:

• Press F12 to open dev tools
• Check Console tab for errors
• Check Network tab for failed API calls
• Check if OIDC client initialization fails

Configuration Files

All changes committed to: https://forgejo.basicstack.de/basicstack/stack.basicstack.de

Key files:

• apps/opencloud/opencloud-deployment.yaml - Environment variables
• apps/opencloud/opencloud-configmap.yaml - Service configuration
• apps/opencloud/opencloud-oidc-sealed.yaml - OIDC client credentials

Commits Applied

1. caf32a3 - Initial OIDC deployment config
2. 169cd31 - ConfigMap user/group drivers
3. c993aaf - Proxy auto-provisioning
4. 4c89d5d - IDM service architecture fix
5. 56d9063 - Removed admin password
6. 64ec709 - Added OC_JWT_SECRET

Contact Points

• OpenCloud Docs: https://docs.opencloud.eu/
• OpenCloud GitHub: https://github.com/opencloud-eu/opencloud
• Configuration we followed: https://docs.opencloud.eu/de/docs/dev/server/configuration/