Getting OpenCloud to work with External OpenID SSO Provider

[MC-Friedolin]

I have been trying out OpenCloud for a few days and the features look very good overall. However, I am currently encountering a problem and cannot proceed. I want to connect my OpenCloud to an external SSO provider. This provider was preconfigured for me and I have the credentials. However, I do not see where in OpenCloud the Client_Secret is configured in order to authenticate with my SSO. In the following image, you can also see the error message in the browser console. The login via SSO works correctly. My configuration is based on the opencloud-compose repository and was only adjusted with domain names and passwords. (Domain names and other entries have been set, but were removed here)

I've also noticed that when you stop and restart the Docker container, the LDAP container does not start again. It is then missing from the running containers. The Docker LDAP volumes have to be deleted first before the LDAP container will start again.

I would be very grateful for any help ^^

.env:

## Basic Settings ##
# Define the docker compose log driver used.
# Defaults to local
LOG_DRIVER=
# If you're on an internet facing server, comment out following line.
# It skips certificate validation for various parts of OpenCloud and is
# needed when self signed certificates are used.
INSECURE=true

## Features ##
# The following variable is a convenience variable to enable or disable features of this compose project.
# Example: if you want to use traefik and letsencrypt, you can set the variable to
#COMPOSE_FILE=docker-compose.yml:traefik/opencloud.yml
# This enables you to just run `docker compose up -d` and the compose files will be added to the stack.
# As alternative approach you can run `docker compose -f docker-compose.yml -f docker-compose.traefik.yml up -d`
# Default: OpenCloud and Collabora with traefik and letsencypt
# This needs DNS entries for the domain names used in the .env file.
#COMPOSE_FILE=docker-compose.yml:weboffice/collabora.yml:traefik/opencloud.yml:traefik/collabora.yml
# If you want to use the external proxy, you can use the following combination.
# DNS entries and certificates need to be managed by the external environment.
# The domain names need to be entered into the .env file.
#COMPOSE_FILE=docker-compose.yml:weboffice/collabora.yml:external-proxy/opencloud.yml:external-proxy/collabora.yml
# Keycloak Shared User Directory
#COMPOSE_FILE=docker-compose.yml:weboffice/collabora.yml:traefik/opencloud.yml:traefik/collabora.yml:idm/ldap-keycloak.yml:traefik/ldap-keycloak.yml

## Traefik Settings ##
# Note: Traefik is always enabled and can't be disabled.
# Serve Traefik dashboard.
# Defaults to "false".
TRAEFIK_DASHBOARD=
# Domain of Traefik, where you can find the dashboard.
# Defaults to "traefik.opencloud.test"
TRAEFIK_DOMAIN=
# Basic authentication for the traefik dashboard.
# Defaults to user "admin" and password "admin"
# To create user:password pair, it's possible to use this command:
# echo $(htpasswd -nB user) | sed -e s/\\$/\\$\\$/g
TRAEFIK_BASIC_AUTH_USERS=
# Email address for obtaining LetsEncrypt certificates.
# Needs only be changed if this is a public facing server.
TRAEFIK_ACME_MAIL=
# Set to the following for testing to check the certificate process:
# "https://acme-staging-v02.api.letsencrypt.org/directory"
# With staging configured, there will be an SSL error in the browser.
# When certificates are displayed and are emitted by # "Fake LE Intermediate X1",
# the process went well and the envvar can be reset to empty to get valid certificates.
TRAEFIK_ACME_CASERVER=
# Enable the Traefik ACME (Automatic Certificate Management Environment) for automatic SSL certificate management.
TRAEFIK_SERVICES_TLS_CONFIG="tls.certresolver=letsencrypt"
# Enable Traefik to use local certificates.
#TRAEFIK_SERVICES_TLS_CONFIG="tls=true"
# You also need to provide a config file in ./config/traefik/dynamic/certs.yml
# Example:
# cat ./config/traefik/dynamic/certs.yml
# tls:
#   certificates:
#     - certFile: /certs/opencloud.test.crt
#       keyFile: /certs/opencloud.test.key
#     stores:
#       - default
#
# The certificates need to copied into ./certs/, the absolute path inside the container is /certs/.
# You can also use TRAEFIK_CERTS_DIR=/path/on/host to set the path to the certificates directory.
# Enable the access log for Traefik by setting the following variable to true.
TRAEFIK_ACCESS_LOG=
# Configure the log level for Traefik.
# Possible values are "TRACE", "DEBUG", "INFO", "WARN", "ERROR", "FATAL" and "PANIC". Default is "ERROR".
TRAEFIK_LOG_LEVEL=


## OpenCloud Settings ##
# The opencloud container image.
# For production releases: "opencloudeu/opencloud"
# For rolling releases:    "opencloudeu/opencloud-rolling"
# Defaults to production if not set otherwise
OC_DOCKER_IMAGE=opencloudeu/opencloud-rolling
# The openCloud container version.
# Defaults to "latest" and points to the latest stable tag.
OC_DOCKER_TAG=
# Domain of openCloud, where you can find the frontend.
# Defaults to "cloud.opencloud.test"
OC_DOMAIN=
# Demo users should not be created on a production instance,
# because their passwords are public. Defaults to "false".
# If demo users is set to "true", the following user accounts are created automatically:
# alan, mary, margaret, dennis and lynn - the password is 'demo' for all.
DEMO_USERS=
# Admin Password for the OpenCloud admin user.
# NOTE: This is only needed when using the built-in LDAP server (idm).
# If you are using an external LDAP server, the admin password is managed by the LDAP server.
# NOTE: This variable needs to be set before the first start of OpenCloud. Changes to this variable after the first start will be IGNORED.
# If not set, opencloud will not work properly. The container will be restarting.
# After the first initialization, the admin password can only be changed via the OpenCloud User Settings UI or by using the OpenCloud CLI.
# Documentation: https://docs.opencloud.eu/docs/admin/resources/common-issues#-change-admin-password-set-in-env
INITIAL_ADMIN_PASSWORD=
# Define the openCloud loglevel used.#
OC_OIDC_CLIENT_ID=


LOG_LEVEL=debug
# Define the kind of logging.
# The default log can be read by machines.
# Set this to true to make the log human readable.
# LOG_PRETTY=true
#
# Define the openCloud storage location. Set the paths for config and data to a local path.
# Ensure that the configuration and data directories are owned by the user and group with ID 1000:1000.
# This matches the default user inside the container and avoids permission issues when accessing files.
# Note that especially the data directory can grow big.
# Leaving it default stores data in docker internal volumes.
# OC_CONFIG_DIR=/your/local/opencloud/config
# OC_DATA_DIR=/your/local/opencloud/data
# OpenCloud Web can load extensions from a local directory.
# The default uses the bind mount to the config/opencloud/apps directory.
# Example: curl -L https://github.com/opencloud-eu/web-extensions/releases/download/unzip-v1.0.2/unzip-1.0.2.zip | tar -xz -C config/opencloud/apps
# NOTE: you need to restart the openCloud container to load the new extensions.
# OC_APPS_DIR=/your/local/opencloud/apps

# Define the ldap-server storage location. Set the paths for config and data to a local path.
# LDAP_CERTS_DIR=
# LDAP_DATA_DIR=

# S3 Storage configuration - optional
# OpenCloud supports S3 storage as primary storage.
# Per default, S3 storage is disabled and the decomposed storage driver is used.
# To enable S3 storage, add `storage/decomposeds3.yml` to the COMPOSE_FILE variable or to
# your startup command (`docker compose -f docker-compose.yml -f storage/decomposeds3.yml up`).
#
# Configure the S3 storage endpoint. Defaults to "http://minio:9000" for testing purposes.
DECOMPOSEDS3_ENDPOINT=
# S3 region. Defaults to "default".
DECOMPOSEDS3_REGION=
# S3 access key. Defaults to "opencloud"
DECOMPOSEDS3_ACCESS_KEY=
# S3 secret. Defaults to "opencloud-secret-key"
DECOMPOSEDS3_SECRET_KEY=
# S3 bucket. Defaults to "opencloud"
DECOMPOSEDS3_BUCKET=
#
# For testing purposes, add local minio S3 storage to the docker-compose file.
# The leading colon is required to enable the service.
#DECOMPOSEDS3_MINIO=:minio.yml
# Minio domain. Defaults to "minio.opencloud.test".
MINIO_DOMAIN=


# Define SMTP settings if you would like to send OpenCloud email notifications.
#
# NOTE: when configuring Inbucket, these settings have no effect, see inbucket.yml for details.
# SMTP host to connect to.
SMTP_HOST=
# Port of the SMTP host to connect to.
SMTP_PORT=
# An eMail address that is used for sending OpenCloud notification eMails
# like "opencloud notifications <noreply@yourdomain.com>".
SMTP_SENDER=
# Username for the SMTP host to connect to.
SMTP_USERNAME=
# Password for the SMTP host to connect to.
SMTP_PASSWORD=
# Authentication method for the SMTP communication.
SMTP_AUTHENTICATION=
# Encryption method for the SMTP communication. Possible values are 'starttls', 'ssltls' and 'none'
SMTP_TRANSPORT_ENCRYPTION=
# Allow insecure connections to the SMTP server. Defaults to false.
SMTP_INSECURE=

# Addititional services to be started on opencloud startup
# The following list of services is not startet automatically and must be
# manually defined for startup:
# IMPORTANT: The notification service is MANDATORY, do not delete!
# IMPORTANT: Add any services to the startup list comma separated like "notifications,antivirus" etc.
START_ADDITIONAL_SERVICES="notifications"


## Default Enabled Services ##

### Apache Tika Content Analysis Toolkit ###
# Tika (search) is disabled by default due to performance reasons.
# Tika is used to extract metadata and text from various file formats.
# Enable it by adding the following to the COMPOSE_FILE variable:
# search/tika.yml or by using the following command:
# docker compose -f docker-compose.yml -f search/tika.yml up -d
# Set the desired docker image tag or digest.
# Defaults to "apache/tika:latest-full"
TIKA_IMAGE=

### IMPORTANT Note for Online Office Apps ###
# To avoid app interlocking issues, you should select only one app to be active/configured.
# This is due the fact that there is currently no app interlocking for the same file and one
# has to wait for a lock release to open the file with another app.

### Collabora Settings ###
# Domain of Collabora, where you can find the frontend.
# Defaults to "collabora.opencloud.test"
COLLABORA_DOMAIN=
# Domain of the wopiserver which handles Collabora.
# Defaults to "wopiserver.opencloud.test"
WOPISERVER_DOMAIN=
# Admin user for Collabora.
# Defaults to "admin".
# Collabora Admin Panel URL:
# https://{COLLABORA_DOMAIN}/browser/dist/admin/admin.html
COLLABORA_ADMIN_USER=
# Admin password for Collabora.
# Defaults to "admin".
COLLABORA_ADMIN_PASSWORD=
# Set to true to enable SSL handling in Collabora Online, this is only required if you are not using a reverse proxy.
# Default is true if not specified.
COLLABORA_SSL_ENABLE=false
# If you're on an internet-facing server, enable SSL verification for Collabora Online.
# Please comment out the following line:
COLLABORA_SSL_VERIFICATION=


### Virusscanner Settings ###
# IMPORTANT: If you enable antivirus, you also MUST configure the START_ADDITIONAL_SERVICES
# envvar in the OpenCloud Settings above by adding 'antivirus' to the list.
# The maximum scan size the virus scanner can handle, needs adjustment in the scanner config as well.
# Usable common abbreviations: [KB, KiB, MB, MiB, GB, GiB, TB, TiB, PB, PiB, EB, EiB], example: 2GB.
# Defaults to "100MB"
#ANTIVIRUS_MAX_SCAN_SIZE=
# Usable modes: partial, skip.
# Defaults to "partial"
#ANTIVIRUS_MAX_SCAN_SIZE_MODE=
# Image version of the ClamAV container.
# Defaults to "latest"y
CLAMAV_DOCKER_TAG=


### Inbucket Settings ###
# Inbucket is a mail catcher tool for testing purposes.
# DO NOT use in Production.
# email server (in this case inbucket acts as mail catcher).
# Domain for Inbucket. Defaults to "mail.opencloud.test".
INBUCKET_DOMAIN=


### Compose Configuration ###
# Path separator for supplemental compose files specified in COMPOSE_FILE.
COMPOSE_PATH_SEPARATOR=:

### Ldap Settings ###
# LDAP is always needed for OpenCloud to store user data as there is no relational database.
# The built-in LDAP server should used for testing purposes or small installations only.
# For production installations, it is recommended to use an external LDAP server.
# We are using OpenLDAP as the default LDAP server because it is proven to be stable and reliable.
# This LDAP configuration is known to work with OpenCloud and provides a blueprint for
# configuring an external LDAP server based on other products like Microsoft Active Directory or other LDAP servers.
#
# Password of LDAP bind user "cn=admin,dc=opencloud,dc=eu". Defaults to "admin"
LDAP_BIND_PASSWORD=
# The LDAP server also creates an openCloud admin user dn: uid=admin,ou=users,dc=opencloud,dc=eu
# The initial password for this user is "admin"
# NOTE: This password can only be set once, if you want to change it later, you have to use the OpenCloud User Settings UI.
# If you changed the password and lost it, you need to execute the following LDAP query to reset it:
# enter the ldap-server container with `docker compose exec ldap-server sh`
# and run the following command to change the password:
# ldappasswd -H ldap://127.0.0.1:1389 -D "cn=admin,dc=opencloud,dc=eu" -W "uid=admin,ou=users,dc=opencloud,dc=eu"
# You will be prompted for the LDAP bind password.
# The output should provide you a new password for the admin user.


### Keycloak Settings ###
# Keycloak is an open-source identity and access management solution.
# We are using Keycloak as the default identity provider on production installations.
# It can be used to federate authentication with other identity providers like
# Microsoft Entra ID, ADFS or other SAML/OIDC providers.
# The use of Keycloak as bridge between OpenCloud and other identity providers creates more control over the
# authentication process, the allowed clients and the session management.
# Keycloak also manages the Role Based Access Control (RBAC) for OpenCloud.
# Keycloak can be used in two different modes:
# 1. Autoprovisioning: New users are automatically created in openCloud when they log in for the first time.
# 2. Shared User Directory: Users are created in Keycloak and can be used in OpenCloud immediately
# because the LDAP server is connected to both Keycloak and OpenCloud.
# Only use one of the two modes at a time.

## Autoprovisioning Mode ##
# Use together with idm/external-idp.yml
# If you want to use a keycloak for local testing, you can use testing/external-keycloak.yml and testing/ldap-manager.yml
# Domain of your Identity Provider.
IDP_DOMAIN=
# IdP Issuer URL, which is used to identify the Identity Provider.
# We need the complete URL, including the protocol (http or https) and the realm.
# Example: "https://keycloak.opencloud.test/realms/openCloud"
IDP_ISSUER_URL=
# Url of the account edit page from your Identity Provider.
IDP_ACCOUNT_URL=

## Shared User Directory Mode ##
# Use together with idm/ldap-keycloak.yml and traefik/ldap-keycloak.yml
# Domain for Keycloak. Defaults to "keycloak.opencloud.test".
KEYCLOAK_DOMAIN=
# Admin user login name. Defaults to "kcadmin".
KEYCLOAK_ADMIN=
# Admin user login password. Defaults to "admin".
KEYCLOAK_ADMIN_PASSWORD=
# Keycloak Database username. Defaults to "keycloak".
KC_DB_USERNAME=
# Keycloak Database password. Defaults to "keycloak".
KC_DB_PASSWORD=

### Radicale Setting ###
# Radicale is a small open-source CalDAV (calendars, to-do lists) and CardDAV (contacts) server.
# When enabled OpenCloud is configured as a reverse proxy for Radicale, providing all authenticated
# OpenCloud users access to a Personal Calendar and Addressbook
# Docker image to use for the Radicale Container
#RADICALE_DOCKER_IMAGE=opencloudeu/radicale
# Docker tag to pull for the Radicale Container
#RADICALE_DOCKER_TAG=latest
# Define the storage location for the Radicale data. Set the path to a local path.
# Ensure that the configuration and data directories are owned by the user and group with ID 1000:1000.
# This matches the default user inside the container and avoids permission issues when accessing files.
# Leaving it default stores data in docker internal volumes.
#RADICALE_DATA_DIR=/your/local/radicale/data

COMPOSE_FILE=docker-compose.yml:traefik/opencloud.yml:idm/external-idp.yml

docker-compose-yml:

services:
  opencloud:
    image: ${OC_DOCKER_IMAGE:-opencloudeu/opencloud-rolling}:${OC_DOCKER_TAG:-latest}
    # changelog: https://github.com/opencloud-eu/opencloud/tree/main/changelog
    # release notes: https://docs.opencloud.eu/opencloud_release_notes.html
    networks:
      opencloud-net:
    entrypoint:
      - /bin/sh
    # run opencloud init to initialize a configuration file with random secrets
    # it will fail on subsequent runs, because the config file already exists
    # therefore we ignore the error and then start the opencloud server
    command: ["-c", "opencloud init || true; opencloud server"]
    environment:
      # enable services that are not started automatically
      OC_ADD_RUN_SERVICES: ${START_ADDITIONAL_SERVICES}
      OC_URL: https://${OC_DOMAIN:-cloud.opencloud.test}
      OC_LOG_LEVEL: ${LOG_LEVEL:-info}
      OC_LOG_COLOR: "${LOG_PRETTY:-false}"
      OC_LOG_PRETTY: "${LOG_PRETTY:-false}"
      # do not use SSL between the reverse proxy and OpenCloud
      PROXY_TLS: "false"
      # INSECURE: needed if OpenCloud / reverse proxy is using self generated certificates
      OC_INSECURE: "${INSECURE:-false}"
      # basic auth (not recommended, but needed for eg. WebDav clients that do not support OpenID Connect)
      PROXY_ENABLE_BASIC_AUTH: "${PROXY_ENABLE_BASIC_AUTH:-false}"
      # demo users
      IDM_CREATE_DEMO_USERS: "${DEMO_USERS:-false}"
      # admin password
      IDM_ADMIN_PASSWORD: "${INITIAL_ADMIN_PASSWORD}"
      # email server (if configured)
      NOTIFICATIONS_SMTP_HOST: "${SMTP_HOST}"
      NOTIFICATIONS_SMTP_PORT: "${SMTP_PORT}"
      NOTIFICATIONS_SMTP_SENDER: "${SMTP_SENDER:-OpenCloud notifications <notifications@${OC_DOMAIN:-cloud.opencloud.test}>}"
      NOTIFICATIONS_SMTP_USERNAME: "${SMTP_USERNAME}"
      NOTIFICATIONS_SMTP_PASSWORD: "${SMTP_PASSWORD}"
      NOTIFICATIONS_SMTP_INSECURE: "${SMTP_INSECURE}"
      NOTIFICATIONS_SMTP_AUTHENTICATION: "${SMTP_AUTHENTICATION}"
      NOTIFICATIONS_SMTP_ENCRYPTION: "${SMTP_TRANSPORT_ENCRYPTION:-none}"
      FRONTEND_ARCHIVER_MAX_SIZE: "10000000000"
      PROXY_CSP_CONFIG_FILE_LOCATION: /etc/opencloud/csp.yaml
      # enable to allow using the banned passwords list
      OC_PASSWORD_POLICY_BANNED_PASSWORDS_LIST: banned-password-list.txt
      # control the password enforcement and policy for public shares
      OC_SHARING_PUBLIC_SHARE_MUST_HAVE_PASSWORD: "${OC_SHARING_PUBLIC_SHARE_MUST_HAVE_PASSWORD:-true}"
      OC_SHARING_PUBLIC_WRITEABLE_SHARE_MUST_HAVE_PASSWORD: "${OC_SHARING_PUBLIC_WRITEABLE_SHARE_MUST_HAVE_PASSWORD:-true}"
      OC_PASSWORD_POLICY_DISABLED: "${OC_PASSWORD_POLICY_DISABLED:-false}"
      OC_PASSWORD_POLICY_MIN_CHARACTERS: "${OC_PASSWORD_POLICY_MIN_CHARACTERS:-8}"
      OC_PASSWORD_POLICY_MIN_LOWERCASE_CHARACTERS: "${OC_PASSWORD_POLICY_MIN_LOWERCASE_CHARACTERS:-1}"
      OC_PASSWORD_POLICY_MIN_UPPERCASE_CHARACTERS: "${OC_PASSWORD_POLICY_MIN_UPPERCASE_CHARACTERS:-1}"
      OC_PASSWORD_POLICY_MIN_DIGITS: "${OC_PASSWORD_POLICY_MIN_DIGITS:-1}"
      OC_PASSWORD_POLICY_MIN_SPECIAL_CHARACTERS: "${OC_PASSWORD_POLICY_MIN_SPECIAL_CHARACTERS:-1}"
    volumes:
      - ./config/opencloud/csp.yaml:/etc/opencloud/csp.yaml
      - ./config/opencloud/banned-password-list.txt:/etc/opencloud/banned-password-list.txt
      # configure the .env file to use own paths instead of docker internal volumes
      - ${OC_CONFIG_DIR:-opencloud-config}:/etc/opencloud
      - ${OC_DATA_DIR:-opencloud-data}:/var/lib/opencloud
      - ${OC_APPS_DIR:-./config/opencloud/apps}:/var/lib/opencloud/web/assets/apps
    logging:
      driver: ${LOG_DRIVER:-local}
    restart: always

volumes:
  opencloud-config:
  opencloud-data:

networks:
  opencloud-net:

opencloud.yml:

services:
  opencloud:
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.opencloud.entrypoints=https"
      - "traefik.http.routers.opencloud.rule=Host(`${OC_DOMAIN:-cloud.opencloud.test}`)"
      - "traefik.http.routers.opencloud.service=opencloud"
      - "traefik.http.services.opencloud.loadbalancer.server.port=9200"
      - "traefik.http.routers.opencloud.${TRAEFIK_SERVICES_TLS_CONFIG}"
  traefik:
    image: traefik:v3.3.1
    # release notes: https://github.com/traefik/traefik/releases
    networks:
      opencloud-net:
        aliases:
          - ${OC_DOMAIN:-cloud.opencloud.test}
    entrypoint: [ "/bin/sh", "/opt/traefik/bin/docker-entrypoint-override.sh"]
    environment:
      - "TRAEFIK_SERVICES_TLS_CONFIG=${TRAEFIK_SERVICES_TLS_CONFIG:-tls.certresolver=letsencrypt}"
      - "TRAEFIK_ACME_MAIL=${TRAEFIK_ACME_MAIL:-example@example.org}"
      - "TRAEFIK_ACME_CASERVER=${TRAEFIK_ACME_CASERVER:-https://acme-v02.api.letsencrypt.org/directory}"
      - "TRAEFIK_LOG_LEVEL=${TRAEFIK_LOG_LEVEL:-ERROR}"
      - "TRAEFIK_ACCESS_LOG=${TRAEFIK_ACCESS_LOG:-false}"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "${DOCKER_SOCKET_PATH:-/var/run/docker.sock}:/var/run/docker.sock:ro"
      - "./config/traefik/docker-entrypoint-override.sh:/opt/traefik/bin/docker-entrypoint-override.sh"
      - "/etc/ssl/traefik:/certs:ro"
      - "./config/traefik/dynamic:/etc/traefik/dynamic"
    labels:
      - "traefik.enable=${TRAEFIK_DASHBOARD:-false}"
      # defaults to admin:admin
      - "traefik.http.middlewares.traefik-auth.basicauth.users=${TRAEFIK_BASIC_AUTH_USERS:-admin:$$apr1$$4vqie50r$$YQAmQdtmz5n9rEALhxJ4l.}"
      - "traefik.http.routers.traefik.entrypoints=https"
      - "traefik.http.routers.traefik.rule=Host(`${TRAEFIK_DOMAIN:-traefik.opencloud.test}`)"
      - "traefik.http.routers.traefik.middlewares=traefik-auth"
      - "traefik.http.routers.traefik.${TRAEFIK_SERVICES_TLS_CONFIG}"
      - "traefik.http.routers.traefik.service=api@internal"
    logging:
      driver: ${LOG_DRIVER:-local}
    restart: always

external-idp.yml:

services:
  opencloud:
    environment:
      # Ldap IDP specific configuration
      OC_LDAP_URI: ldaps://ldap-server:1636
      OC_LDAP_INSECURE: "true"
      OC_LDAP_BIND_DN: "cn=admin,dc=opencloud,dc=eu"
      OC_LDAP_BIND_PASSWORD: ${LDAP_BIND_PASSWORD:-admin}
      OC_LDAP_GROUP_BASE_DN: "ou=groups,dc=opencloud,dc=eu"
      OC_LDAP_USER_BASE_DN: "ou=users,dc=opencloud,dc=eu"
      OC_LDAP_USER_FILTER: "(objectclass=inetOrgPerson)"
      GRAPH_LDAP_SERVER_UUID: "false"
      GRAPH_LDAP_REFINT_ENABLED: "true" # osixia has refint enabled.
      FRONTEND_READONLY_USER_ATTRIBUTES: "user.onPremisesSamAccountName,user.displayName,user.mail,user.passwordProfile,user.accountEnabled,user.appRoleAssignments"
      PROXY_OIDC_REWRITE_WELLKNOWN: "true"
      WEB_OIDC_CLIENT_ID: ${OC_OIDC_CLIENT_ID:-web}
      PROXY_ROLE_ASSIGNMENT_DRIVER: "oidc"
      OC_OIDC_ISSUER: ${IDP_ISSUER_URL:-https://keycloak.opencloud.test/realms/openCloud}
      # This specifies to start all services except idm and idp. These are replaced by external services.
      OC_EXCLUDE_RUN_SERVICES: idm,idp
      # IdP specific configuration for auto-provisioning
      OC_LDAP_SERVER_WRITE_ENABLED: "true"
      PROXY_AUTOPROVISION_ACCOUNTS: "true"
      # Use the `sub` claim from the IdP for the user ID
      # Most IdPs use the internal user ID as the `sub` claim
      PROXY_USER_OIDC_CLAIM: "sub"
      # Use the `sub` claim as identifier during autoprovisioning
      # That mitigates problems when a user is renamed in the IdP
      PROXY_AUTOPROVISION_CLAIM_USERNAME: "sub"
      PROXY_USER_CS3_CLAIM: "username"
      # This is the default value, we need to set it here because we overwrite the values
      OC_LDAP_USER_SCHEMA_ID: "opencloudUUID"
      # This is the default value, we need to set it here because we overwrite the values
      OC_LDAP_GROUP_SCHEMA_ID: "opencloudUUID"
      # This is the default value, we need to set it here because we overwrite the values
      OC_LDAP_DISABLE_USER_MECHANISM: "attribute"
      OC_ADMIN_USER_ID: ""
      SETTINGS_SETUP_DEFAULT_ASSIGNMENTS: "false"
      GRAPH_ASSIGN_DEFAULT_USER_ROLE: "false"
      GRAPH_USERNAME_MATCH: "none"
      # We need to set the IDP_DOMAIN to allow the CSP rules to be set correctly
      IDP_DOMAIN: ${IDP_DOMAIN:-keycloak.opencloud.test}
      # The openCloud users need to be able to edit their account in the externa IdP
      WEB_OPTION_ACCOUNT_EDIT_LINK_HREF: ${IDP_ACCOUNT_URL}
  ldap-server:
    image: bitnami/openldap:2.6
    networks:
      opencloud-net:
    entrypoint: [ "/bin/sh", "/opt/bitnami/scripts/openldap/docker-entrypoint-override.sh", "/opt/bitnami/scripts/openldap/run.sh" ]
    environment:
      BITNAMI_DEBUG: true
      LDAP_TLS_VERIFY_CLIENT: never
      LDAP_ENABLE_TLS: "yes"
      LDAP_TLS_CA_FILE: /opt/bitnami/openldap/share/openldap.crt
      LDAP_TLS_CERT_FILE: /opt/bitnami/openldap/share/openldap.crt
      LDAP_TLS_KEY_FILE: /opt/bitnami/openldap/share/openldap.key
      LDAP_ROOT: "dc=opencloud,dc=eu"
      LDAP_ADMIN_PASSWORD: ${LDAP_BIND_PASSWORD:-admin}
    ports:
      - "127.0.0.1:389:1389"
      - "127.0.0.1:636:1636"
    volumes:
      # Only use the base ldif file to create the base structure
      - ./config/ldap/ldif/10_base.ldif:/ldifs/10_base.ldif
      # Use the custom schema from opencloud because we are in full control of the ldap server
      - ./config/ldap/schemas/10_opencloud_schema.ldif:/schemas/10_opencloud_schema.ldif
      - ./config/ldap/docker-entrypoint-override.sh:/opt/bitnami/scripts/openldap/docker-entrypoint-override.sh
      - ${LDAP_CERTS_DIR:-ldap-certs}:/opt/bitnami/openldap/share
      - ${LDAP_DATA_DIR:-ldap-data}:/bitnami/openldap

volumes:
  ldap-certs:
  ldap-data:

LDAP-Container Logs:

 13:59:28.55 INFO  ==> ** Starting LDAP setup **
 13:59:28.57 INFO  ==> Validating settings in LDAP_* env vars
 13:59:28.57 INFO  ==> Initializing OpenLDAP...
 13:59:28.58 DEBUG ==> Ensuring expected directories/files exist...
 13:59:28.58 INFO  ==> Creating LDAP online configuration
 13:59:28.58 INFO  ==> Creating slapd.ldif
 13:59:28.59 INFO  ==> Starting OpenLDAP server in background
68a72640.23ef9e73 0x75135b279740 @(#) $OpenLDAP: slapd 2.6.10 (May 23 2025 04:19:14) $
        @79176fda6d74:/bitnami/blacksmith-sandox/openldap-2.6.10/servers/slapd
68a72640.24c269b1 0x75135b279740 slapd starting
 13:59:29.60 INFO  ==> Configure LDAP credentials for admin user
SASL/EXTERNAL authentication started
68a72641.24228c95 0x75131a3fe6c0 conn=1000 fd=12 ACCEPT from PATH=/opt/bitnami/openldap/var/run/ldapi (PATH=/opt/bitnami/openldap/var/run/ldapi)
68a72641.24237e83 0x751319bfd6c0 conn=1000 op=0 BIND dn="" method=163
68a72641.242406c4 0x751319bfd6c0 conn=1000 op=0 BIND authcid="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth" authzid="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth"
68a72641.24242e0d 0x751319bfd6c0 conn=1000 op=0 BIND dn="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth" mech=EXTERNAL bind_ssf=0 ssf=71
68a72641.24246fb2 0x751319bfd6c0 conn=1000 op=0 RESULT tag=97 err=0 qtime=0.000010 etime=0.000079 text=
SASL username: gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth
SASL SSF: 0
68a72641.2425fb60 0x75131a3fe6c0 conn=1000 op=1 MOD dn="olcDatabase={2}mdb,cn=config"
68a72641.24263759 0x75131a3fe6c0 conn=1000 op=1 MOD attr=olcSuffix
68a72641.242a81a8 0x75131a3fe6c0 conn=1000 op=1 RESULT tag=103 err=0 qtime=0.000006 etime=0.000326 text=
68a72641.242ba9d9 0x751319bfd6c0 conn=1000 op=2 MOD dn="olcDatabase={2}mdb,cn=config"
68a72641.242be65f 0x751319bfd6c0 conn=1000 op=2 MOD attr=olcRootDN
68a72641.244796cb 0x751319bfd6c0 conn=1000 op=2 RESULT tag=103 err=0 qtime=0.000006 etime=0.001843 text=
68a72641.24482a2a 0x75131a3fe6c0 conn=1000 op=3 MOD dn="olcDatabase={2}mdb,cn=config"
68a72641.24485c15 0x75131a3fe6c0 conn=1000 op=3 MOD attr=olcRootPW
68a72641.244b0578 0x75131a3fe6c0 conn=1000 op=3 RESULT tag=103 err=0 qtime=0.000005 etime=0.000200 text=
68a72641.244c1a06 0x751319bfd6c0 conn=1000 op=4 MOD dn="olcDatabase={1}monitor,cn=config"
68a72641.244c4d31 0x751319bfd6c0 conn=1000 op=4 MOD attr=olcAccess
modifying entry "olcDatabase={2}mdb,cn=config"

modifying entry "olcDatabase={2}mdb,cn=config"

modifying entry "olcDatabase={2}mdb,cn=config"

modifying entry "olcDatabase={1}monitor,cn=config"

68a72641.244ef5a4 0x751319bfd6c0 conn=1000 op=4 RESULT tag=103 err=0 qtime=0.000007 etime=0.000202 text=
68a72641.244fca09 0x75131a3fe6c0 conn=1000 op=5 UNBIND
68a72641.2450133b 0x75131a3fe6c0 conn=1000 fd=12 closed
 13:59:29.61 INFO  ==> Adding LDAP extra schemas
SASL/EXTERNAL authentication started
68a72641.248e99a6 0x751319bfd6c0 conn=1001 fd=12 ACCEPT from PATH=/opt/bitnami/openldap/var/run/ldapi (PATH=/opt/bitnami/openldap/var/run/ldapi)
68a72641.248f06cd 0x751319bfd6c0 conn=1001 op=0 BIND dn="" method=163
68a72641.248f3528 0x751319bfd6c0 conn=1001 op=0 BIND authcid="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth" authzid="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth"
68a72641.248f5691 0x751319bfd6c0 conn=1001 op=0 BIND dn="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth" mech=EXTERNAL bind_ssf=0 ssf=71
68a72641.248facb7 0x751319bfd6c0 conn=1001 op=0 RESULT tag=97 err=0 qtime=0.000004 etime=0.000047 text=
SASL username: gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth
SASL SSF: 0
68a72641.249211b7 0x75131a3fe6c0 conn=1001 op=1 ADD dn="cn=cosine,cn=schema,cn=config"
68a72641.249e1842 0x75131a3fe6c0 conn=1001 op=1 RESULT tag=105 err=0 qtime=0.000006 etime=0.000811 text=
adding new entry "cn=cosine,cn=schema,cn=config"

68a72641.24a13387 0x751319bfd6c0 conn=1001 op=2 UNBIND
68a72641.24a18c38 0x751319bfd6c0 conn=1001 fd=12 closed
SASL/EXTERNAL authentication started
68a72641.24c10719 0x75131a3fe6c0 conn=1002 fd=12 ACCEPT from PATH=/opt/bitnami/openldap/var/run/ldapi (PATH=/opt/bitnami/openldap/var/run/ldapi)
68a72641.24c232cf 0x75131a3fe6c0 conn=1002 op=0 BIND dn="" method=163
68a72641.24c29d9d 0x75131a3fe6c0 conn=1002 op=0 BIND authcid="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth" authzid="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth"
68a72641.24c2b932 0x75131a3fe6c0 conn=1002 op=0 BIND dn="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth" mech=EXTERNAL bind_ssf=0 ssf=71
68a72641.24c2f12d 0x75131a3fe6c0 conn=1002 op=0 RESULT tag=97 err=0 qtime=0.000009 etime=0.000059 text=
SASL username: gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth
SASL SSF: 0
68a72641.24c446ad 0x751319bfd6c0 conn=1002 op=1 ADD dn="cn=inetorgperson,cn=schema,cn=config"
adding new entry "cn=inetorgperson,cn=schema,cn=config"

68a72641.24c8af11 0x751319bfd6c0 conn=1002 op=1 RESULT tag=105 err=0 qtime=0.000003 etime=0.000302 text=
68a72641.24c9809a 0x75131a3fe6c0 conn=1002 op=2 UNBIND
68a72641.24c9ba08 0x75131a3fe6c0 conn=1002 fd=12 closed
SASL/EXTERNAL authentication started
68a72641.24ee0f09 0x751319bfd6c0 conn=1003 fd=12 ACCEPT from PATH=/opt/bitnami/openldap/var/run/ldapi (PATH=/opt/bitnami/openldap/var/run/ldapi)
68a72641.24eebff1 0x75131a3fe6c0 conn=1003 op=0 BIND dn="" method=163
68a72641.24ef4e3b 0x75131a3fe6c0 conn=1003 op=0 BIND authcid="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth" authzid="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth"
68a72641.24ef66ea 0x75131a3fe6c0 conn=1003 op=0 BIND dn="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth" mech=EXTERNAL bind_ssf=0 ssf=71
68a72641.24ef9849 0x75131a3fe6c0 conn=1003 op=0 RESULT tag=97 err=0 qtime=0.000003 etime=0.000059 text=
SASL username: gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth
SASL SSF: 0
68a72641.24f17757 0x751319bfd6c0 conn=1003 op=1 ADD dn="cn=nis,cn=schema,cn=config"
68a72641.24f8547e 0x751319bfd6c0 conn=1003 op=1 RESULT tag=105 err=0 qtime=0.000005 etime=0.000468 text=
adding new entry "cn=nis,cn=schema,cn=config"

68a72641.24f9545b 0x75131a3fe6c0 conn=1003 op=2 UNBIND
68a72641.24faa759 0x75131a3fe6c0 conn=1003 fd=12 closed
 13:59:29.62 INFO  ==> Adding custom schemas : /schemas ...
68a72641.25f3b287 0x75131abff6c0 daemon: shutdown requested and initiated.
68a72641.25fc1453 0x75131abff6c0 slapd shutdown: waiting for 0 operations/tasks to finish
68a72641.26095d78 0x75135b279740 slapd stopped.
 13:59:30.64 INFO  ==> Starting OpenLDAP server in background
68a72642.269bedd0 0x761c6c803740 @(#) $OpenLDAP: slapd 2.6.10 (May 23 2025 04:19:14) $
        @79176fda6d74:/bitnami/blacksmith-sandox/openldap-2.6.10/servers/slapd
68a72642.26f638b8 0x761c6c803740 slapd starting
 13:59:31.64 INFO  ==> Loading custom LDIF files...
 13:59:31.65 WARN  ==> Ignoring LDAP_USERS, LDAP_PASSWORDS, LDAP_USER_OU, LDAP_GROUP_OU and LDAP_GROUP environment variables...
68a72643.27272b2a 0x761c2b9fe6c0 conn=1000 fd=12 ACCEPT from PATH=/opt/bitnami/openldap/var/run/ldapi (PATH=/opt/bitnami/openldap/var/run/ldapi)
68a72643.2728d869 0x761c2b1fd6c0 conn=1000 op=0 BIND dn="cn=admin,dc=opencloud,dc=eu" method=128
68a72643.27296735 0x761c2b1fd6c0 conn=1000 op=0 BIND dn="cn=admin,dc=opencloud,dc=eu" mech=SIMPLE bind_ssf=0 ssf=71
68a72643.2729ca93 0x761c2b1fd6c0 conn=1000 op=0 RESULT tag=97 err=0 qtime=0.000011 etime=0.000115 text=
68a72643.272bc86a 0x761c2b9fe6c0 conn=1000 op=1 ADD dn="dc=opencloud,dc=eu"
68a72643.27757105 0x761c2b9fe6c0 conn=1000 op=1 RESULT tag=105 err=0 qtime=0.000020 etime=0.004865 text=
68a72643.27768560 0x761c2b1fd6c0 conn=1000 op=2 ADD dn="ou=users,dc=opencloud,dc=eu"
68a72643.27a7591a 0x761c2b1fd6c0 conn=1000 op=2 RESULT tag=105 err=0 qtime=0.000008 etime=0.003217 text=
68a72643.27a85118 0x761c2b9fe6c0 conn=1000 op=3 ADD dn="cn=admin,dc=opencloud,dc=eu"
68a72643.27da6a3c 0x761c2b9fe6c0 conn=1000 op=3 RESULT tag=105 err=0 qtime=0.000006 etime=0.003297 text=
68a72643.27dc6697 0x761c2b1fd6c0 conn=1000 op=4 ADD dn="ou=groups,dc=opencloud,dc=eu"
68a72643.27f0dc08 0x761c2b1fd6c0 conn=1000 op=4 RESULT tag=105 err=0 qtime=0.000005 etime=0.001355 text=
68a72643.27f83e85 0x761c2b9fe6c0 conn=1000 op=5 ADD dn="ou=custom,ou=groups,dc=opencloud,dc=eu"
68a72643.2818cf70 0x761c2b9fe6c0 conn=1000 op=5 RESULT tag=105 err=0 qtime=0.000429 etime=0.002573 text=
68a72643.281a8681 0x761c2b1fd6c0 conn=1000 op=6 UNBIND
68a72643.281aeced 0x761c2b1fd6c0 conn=1000 fd=12 closed
adding new entry "dc=opencloud,dc=eu"

adding new entry "ou=users,dc=opencloud,dc=eu"

adding new entry "cn=admin,dc=opencloud,dc=eu"

adding new entry "ou=groups,dc=opencloud,dc=eu"

adding new entry "ou=custom,ou=groups,dc=opencloud,dc=eu"

 13:59:31.67 INFO  ==> Configuring TLS
SASL/EXTERNAL authentication started
68a72643.285dd46c 0x761c2b9fe6c0 conn=1001 fd=12 ACCEPT from PATH=/opt/bitnami/openldap/var/run/ldapi (PATH=/opt/bitnami/openldap/var/run/ldapi)
68a72643.285e4fed 0x761c2b1fd6c0 conn=1001 op=0 BIND dn="" method=163
68a72643.285e9d8c 0x761c2b1fd6c0 conn=1001 op=0 BIND authcid="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth" authzid="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth"
68a72643.285ebf81 0x761c2b1fd6c0 conn=1001 op=0 BIND dn="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth" mech=EXTERNAL bind_ssf=0 ssf=71
68a72643.285ef23f 0x761c2b1fd6c0 conn=1001 op=0 RESULT tag=97 err=0 qtime=0.000003 etime=0.000046 text=
SASL username: gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth
SASL SSF: 0
68a72643.28602b4c 0x761c2b9fe6c0 conn=1001 op=1 MOD dn="cn=config"
68a72643.286059c7 0x761c2b9fe6c0 conn=1001 op=1 MOD attr=olcTLSCACertificateFile olcTLSCertificateFile olcTLSCertificateKeyFile olcTLSVerifyClient
68a72643.288bf143 0x761c2b9fe6c0 conn=1001 op=1 RESULT tag=103 err=0 qtime=0.000006 etime=0.002882 text=
modifying entry "cn=config"

68a72643.288d4e77 0x761c2b1fd6c0 conn=1001 op=2 UNBIND
68a72643.288ea43c 0x761c2b1fd6c0 conn=1001 fd=12 closed
68a72643.28a8645a 0x761c2c1ff6c0 daemon: shutdown requested and initiated.
68a72643.28a9ed88 0x761c2c1ff6c0 slapd shutdown: waiting for 0 operations/tasks to finish
68a72643.28b5149c 0x761c6c803740 slapd stopped.

 13:59:32.68 INFO  ==> ** LDAP setup finished! **
 13:59:32.71 INFO  ==> ** Starting slapd **
 13:59:32.71 DEBUG ==> Startup cmd: /opt/bitnami/openldap/sbin/slapd -d 256 -h ldapi:/// ldap://:1389/ ldaps://:1636/ -F /opt/bitnami/openldap/etc/slapd.d
68a72644.2a945e20 0x7c1fbccde740 @(#) $OpenLDAP: slapd 2.6.10 (May 23 2025 04:19:14) $
        @79176fda6d74:/bitnami/blacksmith-sandox/openldap-2.6.10/servers/slapd
68a72644.2b11c138 0x7c1fbccde740 slapd starting
Running custom LDAP entrypoint script...
 14:03:56.01 INFO  ==> ** Starting LDAP setup **
 14:03:56.04 INFO  ==> Validating settings in LDAP_* env vars
 14:03:56.05 INFO  ==> Initializing OpenLDAP...
 14:03:56.05 DEBUG ==> Ensuring expected directories/files exist...
 14:03:56.06 INFO  ==> Using persisted data
Terminated

[micbar]

## Autoprovisioning Mode ##
# Use together with idm/external-idp.yml
# If you want to use a keycloak for local testing, you can use testing/external-keycloak.yml and testing/ldap-manager.yml
# Domain of your Identity Provider.
IDP_DOMAIN=
# IdP Issuer URL, which is used to identify the Identity Provider.
# We need the complete URL, including the protocol (http or https) and the realm.
# Example: "https://keycloak.opencloud.test/realms/openCloud"
IDP_ISSUER_URL=
# Url of the account edit page from your Identity Provider.
IDP_ACCOUNT_URL=

You did not set these values, so you got CSP issues.

[MC-Friedolin]

The IDP_DOMAIN and IDP_ISSUER_URL are set in my configuration; I have just removed them here ^^