basicstack/stack.basicstack.de
2
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions
stack.basicstack.de/apps/opencloud/OIDC_FIX_SUMMARY.md
CTO Agent caf32a3b36 Fix OpenCloud authentication - Switch to Pocket ID OIDC only 
Problem: OpenCloud was configured for internal authentication but login wasn't working.

Changes:
- Exclude internal IDP/IDM services (OC_EXCLUDE_RUN_SERVICES=search,idp,idm)
- Configure external OIDC with Pocket ID (auth.basicstack.de)
- Disable basic authentication (PROXY_ENABLE_BASIC_AUTH=false)
- Configure web service OIDC client settings
- Remove internal demo user creation (IDM_CREATE_DEMO_USERS)

Result: Users will authenticate via Pocket ID only, no internal auth methods.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-07-05 08:18:34 +00:00

2.5 KiB
Raw Blame History

OpenCloud OIDC Authentication Fix

Problem

OpenCloud deployment was configured for internal authentication (IDM/IDP services) but login was not working. The goal is to use Pocket ID (external OIDC provider) for authentication only.

Root Cause

The configuration was switched to internal authentication mode with:

  • IDM_CREATE_DEMO_USERS=true - Created internal demo users
  • PROXY_ENABLE_BASIC_AUTH=true - Enabled basic auth
  • Internal IDP/IDM services running
  • Missing OIDC client configuration

Solution Applied

Modified apps/opencloud/opencloud-deployment.yaml:

1. Disabled Internal Auth Services

OC_EXCLUDE_RUN_SERVICES: "search,idp,idm"
  • Excluded internal IDP (Identity Provider) service
  • Excluded internal IDM (Identity Management) service
  • Kept search service excluded (known to crash in v7.2.0)

2. Configured External OIDC (Pocket ID)

# Global OIDC settings
OC_OIDC_ISSUER: "https://auth.basicstack.de"
OC_OIDC_CLIENT_ID: (from opencloud-oidc-secret)
OC_OIDC_CLIENT_SECRET: (from opencloud-oidc-secret)
OC_OIDC_CLIENT_SCOPES: "openid profile email groups offline_access"

3. Configured Proxy Service for OIDC

PROXY_OIDC_REWRITE_WELLKNOWN: "true"
PROXY_USER_OIDC_CLAIM: "email"
PROXY_ENABLE_BASIC_AUTH: "false"

4. Configured Web Service for OIDC

WEB_OIDC_CLIENT_ID: (from opencloud-oidc-secret)
WEB_OIDC_AUTHORITY: "https://auth.basicstack.de"
WEB_OIDC_METADATA_URL: "https://auth.basicstack.de/.well-known/openid-configuration"
WEB_OIDC_RESPONSE_TYPE: "code"
WEB_OIDC_SCOPE: "openid profile email groups offline_access"

5. Removed Internal Auth Flags

Deleted:

  • IDM_CREATE_DEMO_USERS=true
  • PROXY_ENABLE_BASIC_AUTH=true (duplicate, now set to false above)

Expected Result

  • Users will authenticate via Pocket ID (auth.basicstack.de)
  • No internal user management or LDAP
  • No basic authentication with username/password
  • Single Sign-On experience through OIDC

Deployment

Apply the updated configuration:

kubectl apply -f apps/opencloud/opencloud-deployment.yaml
kubectl rollout restart deployment/opencloud -n opencloud

Verification

  1. Navigate to https://opencloud.basicstack.de
  2. Should redirect to Pocket ID (https://auth.basicstack.de)
  3. Login with Pocket ID credentials
  4. Should be redirected back to OpenCloud authenticated

References