[HOW-TO] Setup SSO (OIDC) with Authentik (web, desktop app, iOS app)

[StafLoker]

Replace with your domain: domain.com

Opencloud

Env file (opencloud.env)

# SSO
OC_OIDC_ISSUER=https://auth.domain.com/application/o/opencloud/
WEB_OIDC_CLIENT_ID=<id>
## Proxy
PROXY_AUTOPROVISION_ACCOUNTS=true
PROXY_ROLE_ASSIGNMENT_DRIVER="oidc"
PROXY_OIDC_REWRITE_WELLKNOWN="true"
PROXY_USER_OIDC_CLAIM="preferred_username"
PROXY_USER_CS3_CLAIM="username"
## role assignment
OC_EXCLUDE_RUN_SERVICES=idp
WEB_OIDC_SCOPE=openid profile email groups
PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM=groups
GRAPH_ASSIGN_DEFAULT_USER_ROLE=false
GRAPH_USERNAME_MATCH="none"
PROXY_OIDC_ACCESS_TOKEN_VERIFY_METHOD=none

# CSP
PROXY_CSP_CONFIG_FILE_LOCATION=/etc/opencloud/csp.yaml

CSP file (csp.yaml)

directives:
  child-src:
    - '''self'''
  connect-src:
    - '''self'''
    - 'blob:'
    - 'https://raw.githubusercontent.com/opencloud-eu/awesome-apps/'
    - 'https://auth.domain.com/'
  default-src:
    - '''none'''
  font-src:
    - '''self'''
  frame-ancestors:
    - '''self'''
  frame-src:
    - '''self'''
    - 'blob:'
    # This is needed for the external-sites web extension when embedding sites
    - 'https://docs.opencloud.eu'
  img-src:
    - '''self'''
    - 'data:'
    - 'blob:'
    - 'https://raw.githubusercontent.com/opencloud-eu/awesome-apps/'
  manifest-src:
    - '''self'''
  media-src:
    - '''self'''
  object-src:
    - '''self'''
    - 'blob:'
  script-src:
    - '''self'''
    - '''unsafe-inline'''
  style-src:
    - '''self'''
    - '''unsafe-inline'''

Proxy file (proxy.yaml)

role_assignment:
  driver: oidc
  oidc_role_mapper:
    role_claim: groups
    role_mapping:
      - role_name: admin 
        claim_value: Drive Admins
      - role_name: spaceadmin
        claim_value: Drive Admins 
      - role_name: user
        claim_value: Drive
      - role_name: guest
        claim_value: Guests 

Authentik

Providers

Web

Desktop app

iOS app

Groups

Create two groups, one for admin other for users.

Apps

Other

If you hace active desktop or mobile apps session, is not repair with login.

1. Logout & Remove server from app list
2. Add server in list (like when u lunch app first time)

[irrwitzer42]

Thank you very much @StafLoker for writing that down!

This looks exactly like the solution I'd love.... but I haven't got it working as of now.
Would you please tell us/add to your howto the information, which one of the docker-compose files you are using?
I am trying with the openopencloud-compose docker version and had to add
to add the above mentioned environment variables to my custom/docker-compose.override.yml to get the recognized.

My COMPOSE_FILE variable looks like this:
COMPOSE_FILE=docker-compose.yml:weboffice/collabora.yml:external-proxy/opencloud.yml:external-proxy/collabora.yml:custom/docker-compose.override.yml

So as you can see, without idm/ldap-keycloak.yml -> no integrated LDAP or Keycloak. Maybe that is my mistake already, but not sure. I wanted to have the installation to use as few ressources for overhead as possible.

So, if you could please let us know the base-installation/your starting point for this config manual to, that would be great and maybe I'll get it working then. :-)

Thanks in advance!
Irrwitzer

[hasdf]

@irrwitzer42 did you fix the issue of being logged out after a few minutes?

The proxy.yaml is in a bind mount if you activate radicale calendar :)

[irrwitzer42]

hi @hasdf , Thanks for the info ;-) I fixed it by manually adding the bind mount for proxy.yaml to the opencloud service.
unfortunately I had to do it in the official docker-compose.yml as it didn't work in my custom/* stuff. Nevertheless it's working now for web and ios.
Still looking into auto-logout for the desktop client though.

as for the radicale idea: I don't want to add caldav to opencloud, as I want it to strictly be the filesharing part of my server. (cal|card)DAV will be handled by mailcow.
But thanks for sharing your discovery :-)

[hasdf]

@irrwitzer42 funny... opencloud desktop doesn't have timeouts for me. Just Web (in safari)

[irrwitzer42]

so it's still not working for you?
Did you add your OIDC server to csp.yaml?

That was my main issue from the start. And you can debug this with safari's developer console -- or any other browser's.
You'll see the errors for the token refresh after an hour. And that was in my case the CSP policy, that didn't allow frame-includes of my auth provider.

[hasdf]

In Safari:
It's working 60% of the time :) For the other 40% I get status 401 in the browser and nginx log... Happens a lot if opening a folder with a lot of images all the preview images are loaded, and some of them get 401.

In Firefox:
Everything works 99% of the time. If I open a folder with 100 Images, 1 image has no preview image and there is a 401 in the log for it

[micbar]

@irrwitzer42
You can just do a volume bind mount to get config/opencloud/proxy.yaml into the container.