Problem: Nicht angemeldet

[dancgn]

Hallo zusammen,

ich mach es mal auf deutsch. Leider kämpfe ich immer noch mit Opencloud.

Es läuft auf einem eigenständigen LXC-Container (Ubuntu) auf einem Proxmox. Caddy ist als Reverse Proxy im Einsatz und kennt 3 Domain (cloud.meine.de, wopiserver.meine.de und collabora.meine.de). Die werden auf die jeweiligen Ports weitergeleitet. IP:9200, IP:9300 und IP:9980.

Also alles was traefik betrifft ist raus.

Wenn ich mich einloggen will, bekomme ich:

`
Nicht angemeldet

Das könnte aufgrund einer routinemäßigen Abmeldung aus Sicherheitsgründen geschehen sein oder Ihr Benutzerkonto ist inaktiv oder noch nicht freigeschaltet. Bitte versuchen Sie es nach einiger Zeit erneut oder wenden Sie sich an Ihre Administration.

OpenCloud – Excellent file sharing
`

Keine KI kann mir helfen bzw. scheine ich mich im Kreis zu drehen.

Danke für eine Info

[micbar]

Wir bräuchten Logs 🤩

Ist OC_URL auf https://cloud.meine.de gesetzt?

[dancgn]

Also, ja ist gesetzt. Hier meine docker-compose

`services:

collabora:
cap_add:
- MKNOD
command:
- coolconfig generate-proof-key && /start-collabora-online.sh
entrypoint:
- /bin/bash
- -c
environment:
DONT_GEN_SSL_CERT: "YES"
extra_params: |
--o:ssl.enable=false
--o:ssl.ssl_verification=false
--o:ssl.termination=true
--o:welcome.enable=false
--o:net.frame_ancestors=cloud.meine.de
password: admin
username: admin
healthcheck:
test:
- CMD
- curl
- -f
- http://localhost:9980/hosting/discovery
image: collabora/code:24.04.13.2.1
networks:
opencloud-net:
aliases:
- collabora.meine.de
restart: always
expose:
- "9980"
ports:
- "9980:9980"

collaboration:
command:
- -c
- opencloud collaboration server
depends_on:
collabora:
condition: service_healthy
required: true
opencloud:
condition: service_started
required: true
entrypoint:
- /bin/sh
environment:
COLLABORATION_APP_ADDR: http://192.168.1.xxx:9980
COLLABORATION_WOPI_SRC: http://192.168.1.xxx:9980
COLLABORATION_APP_ICON: http://192.168.1.xxx:9980/favicon.ico
COLLABORATION_APP_INSECURE: "true"
COLLABORATION_APP_NAME: CollaboraOnline
COLLABORATION_APP_PRODUCT: Collabora
COLLABORATION_CS3API_DATAGATEWAY_INSECURE: "true"
COLLABORATION_GRPC_ADDR: 0.0.0.0:9301
COLLABORATION_HTTP_ADDR: 0.0.0.0:9300
COLLABORATION_LOG_LEVEL: info
MICRO_REGISTRY: nats-js-kv
MICRO_REGISTRY_ADDRESS: opencloud:9233
OC_URL: https://cloud.meine.de
image: opencloudeu/opencloud-rolling:latest
networks:
opencloud-net:
aliases:
- wopiserver.meine.de
restart: always
expose:
- "9300"
ports:
- "9300:9300"
volumes:
- type: volume
source: opencloud-config
target: /etc/opencloud

opencloud:
command:
- -c
- opencloud init || true; opencloud server
depends_on:
drawio-init:
condition: service_completed_successfully
required: true
externalsites-init:
condition: service_completed_successfully
required: true
jsonviewer-init:
condition: service_completed_successfully
required: true
progressbars-init:
condition: service_completed_successfully
required: true
unzip-init:
condition: service_completed_successfully
required: true
entrypoint:
- /bin/sh
environment:
COLLABORA_DOMAIN: collabora.meine.de
COMPANION_DOMAIN: companion.meine.de
FRONTEND_APP_HANDLER_SECURE_VIEW_APP_ADDR: eu.opencloud.api.collaboration.CollaboraOnline
FRONTEND_ARCHIVER_MAX_SIZE: "10000000000"
GATEWAY_GRPC_ADDR: 0.0.0.0:9142
GRAPH_AVAILABLE_ROLES: b1e2218d-eef8-4d4c-b82d-0f1a1b48f3b5,a8d5fe5e-96e3-418d-825b-534dbdf22b99,fb6c3e19-e378-47e5-b277-9732f9de6e21,58c63c02-1d89-4572-916a-870abc5a1b7d,2d00ce52-1fc2-4dbc-8b95-a73b73395f5a,1c996275-f1c9-4e71-abdf-a42f6495e960,312c0871-5ef7-4b3a-85b6-0e4074c64049,aa97fe03-7980-45ac-9e50-b325749fd7e6
IDM_ADMIN_PASSWORD: admin
IDM_CREATE_DEMO_USERS: "false"
MICRO_REGISTRY_ADDRESS: 127.0.0.1:9233
NATS_NATS_HOST: 0.0.0.0
NATS_NATS_PORT: "9233"
NOTIFICATIONS_SMTP_SENDER: OpenCloud notifications notifications@cloud.meine.de
OC_ADD_RUN_SERVICES: notifications
OC_INSECURE: "true"
OC_LOG_COLOR: "false"
OC_LOG_LEVEL: info
OC_LOG_PRETTY: "false"
OC_PASSWORD_POLICY_BANNED_PASSWORDS_LIST: banned-password-list.txt
OC_URL: https://cloud.meine.de
ONLYOFFICE_DOMAIN: onlyoffice.meine.de
PROXY_CSP_CONFIG_FILE_LOCATION: /etc/opencloud/csp.yaml
PROXY_ENABLE_BASIC_AUTH: "false"
PROXY_TLS: "false"
image: opencloudeu/opencloud-rolling:latest
networks:
opencloud-net:
aliases:
- cloud.meine.de
restart: always
expose:
- "9200"
ports:
- "9200:9200"
volumes:
- type: bind
source: ./config/opencloud/app-registry.yaml
target: /etc/opencloud/app-registry.yaml
- type: bind
source: ./config/opencloud/csp.yaml
target: /etc/opencloud/csp.yaml
- type: bind
source: ./config/opencloud/banned-password-list.txt
target: /etc/opencloud/banned-password-list.txt
- type: volume
source: opencloud-config
target: /etc/opencloud
- type: volume
source: opencloud-data
target: /var/lib/opencloud
- type: volume
source: opencloud-apps
target: /var/lib/opencloud/web/assets/apps
- type: bind
source: ./config/opencloud/apps.yaml
target: /etc/opencloud/apps.yaml

drawio-init:
command:
- -c
- cp -R /usr/share/nginx/html/draw-io/ /apps
entrypoint:
- /bin/sh
image: opencloudeu/web-extensions:draw-io-1.0.0
networks:
opencloud-net: null
user: root
volumes:
- type: volume
source: opencloud-apps
target: /apps

externalsites-init:
command:
- -c
- cp -R /usr/share/nginx/html/external-sites/ /apps
entrypoint:
- /bin/sh
image: opencloudeu/web-extensions:external-sites-1.0.0
networks:
opencloud-net: null
user: root
volumes:
- type: volume
source: opencloud-apps
target: /apps

jsonviewer-init:
command:
- -c
- cp -R /usr/share/nginx/html/json-viewer/ /apps
entrypoint:
- /bin/sh
image: opencloudeu/web-extensions:json-viewer-1.0.0
networks:
opencloud-net: null
user: root
volumes:
- type: volume
source: opencloud-apps
target: /apps

progressbars-init:
command:
- -c
- cp -R /usr/share/nginx/html/progress-bars/ /apps
entrypoint:
- /bin/sh
image: opencloudeu/web-extensions:progress-bars-1.0.0
networks:
opencloud-net: null
user: root
volumes:
- type: volume
source: opencloud-apps
target: /apps

unzip-init:
command:
- -c
- cp -R /usr/share/nginx/html/unzip/ /apps
entrypoint:
- /bin/sh
image: opencloudeu/web-extensions:unzip-1.0.2
networks:
opencloud-net: null
user: root
volumes:
- type: volume
source: opencloud-apps
target: /apps

networks:
opencloud-net:
name: opencloud-net

volumes:
opencloud-apps:
opencloud-config:
opencloud-data:`

Hier ein Teil meiner Caddyfile

`collabora.meine.de {
import common-settings
reverse_proxy http://192.168.1.xxx:9980
}

wopiserver.meine.de {
import common-settings
reverse_proxy http://192.168.1.xxx:9300 {
header_up Access-Control-Allow-Origin *
header_up Set-Cookie *
}
}

cloud.meine.de {
import common-settings
reverse_proxy http://192.168.1.xxx:9200
}`

Hier ein Auszug aus der docker logs des Cloud-Containers

{"level":"info","service":"storage-system","pkg":"rgrpc","traceid":"f266b1eccc7d1d7846c5e58ab9f682c3","time":"2025-05-02T18:37:24Z","line":"github.com/opencloud-eu/reva/v2@v2.32.0/internal/grpc/services/authprovider/authprovider.go:146","message":"user idp:\"internal\" opaque_id:\"f6b060f2-4f4e-4372-baec-03065d3f8706\" type:USER_TYPE_PRIMARY authenticated"} {"level":"info","service":"storage-system","pkg":"rgrpc","traceid":"aebf51e795dd9c3a3bbb33914778b1b3","time":"2025-05-02T18:38:24Z","line":"github.com/opencloud-eu/reva/v2@v2.32.0/internal/grpc/services/authprovider/authprovider.go:146","message":"user idp:\"internal\" opaque_id:\"f6b060f2-4f4e-4372-baec-03065d3f8706\" type:USER_TYPE_PRIMARY authenticated"} {"level":"info","service":"storage-system","pkg":"rgrpc","traceid":"3aeadc5766c2057181f87961df9da2bb","time":"2025-05-02T18:39:24Z","line":"github.com/opencloud-eu/reva/v2@v2.32.0/internal/grpc/services/authprovider/authprovider.go:146","message":"user idp:\"internal\" opaque_id:\"f6b060f2-4f4e-4372-baec-03065d3f8706\" type:USER_TYPE_PRIMARY authenticated"} {"level":"info","service":"storage-system","pkg":"rgrpc","traceid":"572801a9bd875075d8bc70f4ca36b0a4","time":"2025-05-02T18:40:24Z","line":"github.com/opencloud-eu/reva/v2@v2.32.0/internal/grpc/services/authprovider/authprovider.go:146","message":"user idp:\"internal\" opaque_id:\"f6b060f2-4f4e-4372-baec-03065d3f8706\" type:USER_TYPE_PRIMARY authenticated"} {"level":"info","service":"storage-system","pkg":"rgrpc","traceid":"5c951a29ec6e8d8f8c13367a38f79c5e","time":"2025-05-02T18:41:24Z","line":"github.com/opencloud-eu/reva/v2@v2.32.0/internal/grpc/services/authprovider/authprovider.go:146","message":"user idp:\"internal\" opaque_id:\"f6b060f2-4f4e-4372-baec-03065d3f8706\" type:USER_TYPE_PRIMARY authenticated"} {"level":"info","service":"storage-system","pkg":"rgrpc","traceid":"971a38919f5baf0cd62537069a4327d5","time":"2025-05-02T18:42:24Z","line":"github.com/opencloud-eu/reva/v2@v2.32.0/internal/grpc/services/authprovider/authprovider.go:146","message":"user idp:\"internal\" opaque_id:\"f6b060f2-4f4e-4372-baec-03065d3f8706\" type:USER_TYPE_PRIMARY authenticated"}

Hoffe Ihr könnt damit was anfangen. Bin scheinbar zu blöd um einen Code-Block zu setzen.

[micbar]

Kannst du https://cloud-meine.de mit curl von innen aus dem openCloud Container erreichen?

[micbar]

Das ist das Problem. In unserem example machen wir das mit aliasen.

[dancgn]

Ich versuche, es zu verstehen.

Ich bin bestimmt nicht der Einzige mit einem solchen Setup. Also was kann man tun, damit man eure Software zum laufen bekommt :D

Bin eigentlich ganz zufrieden mit caddy.

[micbar]

Zur Erklärung:

OpenCloud bringt einen integrierten OpenIDConnect Provider mit, damit man die Software auch testen kann, ohne einen keycloak oder ähnliches aufzusetzen. Dieser IDP braucht eine public URL unter der er auch für OpenCloud erreichbar ist. Eigentlich ganz einfach 😌. Das kannst du, wenn es der caddy nicht tut, einfach mit einem Eintrag von cloud.meine.de auf localhost in /etc/hosts auf der Maschine machen.

Für ein production setup würde man einen richtigen externen Keycloak aufsetzen .

[dancgn]

Okay, also die cloud.meine.de bei Caddy drin lassen und den Rest lokal in der /etc/Hosts eintragen.
Thema Keycloak. Ich habe authentik im Einsatz und stelle gerade zum Spaß auf Pangolin um.

Ich versuche es gleich mal.

[ffuhrnew]

Did you manage to work it out with pangolin. If i protect the OpenCloud-Domain there seems to be a host header destroyed that is necessary for OC --> LOGIN FAILED ....

[marcus7501]

Hallo @dancgn
ich hatte das gleiche Problem (siehe Screenshot).

Das passiert, wenn man kein offizielles Zertifikat oder Staging-Zertifikate benutzt und gleichzeitig den Parameter 'INSECURE=true' in der .ENV-Datei nicht gesetzt oder auskommentiert hat. Dann einfach diesen Parameter setzen und es sollte laufen. :)

[dR3b]

Ich habe ein ähnliches Problem aber mir ist nicht klar, warum das nicht gehen sollte. Ich habe das Problem nur mit Opencloud. Alle anderen Container (ob intern oder extern) haben kein solches Problem. Hier ein Beispiel das ich zum testen auf meinem Notebook erstellt habe. Traefik läuft normal auf 80 und 443 mit Selfsign Zertifikaten:

networks:
  opencloud:
    name: opencloud
    external: false
  traefik:
    name: traefik
    external: true

services:
  opencloud:
    container_name: opencloud-server
    image: opencloudeu/opencloud-rolling:2.3
    restart: always
    entrypoint:
      - /bin/sh
    command: ["-c", "opencloud init || true; opencloud server"]
    environment:
      TZ: "Europe/Berlin"
      OC_URL: "https://cloud.traefik.me"
      OC_DOMAIN: "cloud.traefik.me"
      OC_LOG_LEVEL: "info"
      OC_LOG_PRETTY: "true"
      OC_INSECURE: "true"
      INSECURE: "true"
      PROXY_TLS: "false"
      IDM_ADMIN_PASSWORD: "<PASS>"
      IDM_CREATE_DEMO_USERS: "false"
    volumes:
      - ./opencloud/config:/etc/opencloud
      - ./opencloud/data:/var/lib/opencloud
    networks:
      - opencloud
      - traefik
    labels:
      traefik.enable: "true"
      traefik.docker.network: "traefik"
      traefik.http.routers.opencloud.rule: "Host(`cloud.traefik.me`)"
      traefik.http.routers.opencloud.entrypoints: "websecure"
      traefik.http.routers.opencloud.tls: "true"
      traefik.http.routers.opencloud.service: "opencloud"
      traefik.http.services.opencloud.loadbalancer.server.port: 9200

Ich habe auch schon mit der /etc/hosts gespielt aber nichts scheint zu funktionieren:

    extra_hosts:
      - cloud.traefik.me:127.0.0.1

Wenn jemand einen Input hat, wäre ich dankbar.

[lantura]

Gibt es hier inzwischen eine Lösung?
Ich möchte Opencloud i.V. mit Pangolin nutzen und erhalte denselben Fehler: "Nicht angemeldet".
INSECURE true oder false hat keinen Einfluss. Die Lösung aus #432 funktioniert leider nicht.
Andere Docker laufen mit Pangolin ohne Probleme.

Die logs liefern:
2025/08/09 11:23:58 Could not create config: config file already exists, use --force-overwrite to overwrite or --diff to show diff
{"level":"error","service":"proxy","error":"failed to verify access token: oidc: failed to decode provider discovery object: expected Content-Type = application/json, got "text/html; charset=utf-8": ","authenticator":"oidc","path":"/ocs/v1.php/cloud/capabilities","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36","client.address":"78.35.196.127","network.peer.address":"","network.peer.port":"","time":"2025-08-09T11:24:16Z","message":"failed to authenticate the request"}
{"level":"error","service":"proxy","error":"failed to verify access token: oidc: failed to decode provider discovery object: expected Content-Type = application/json, got "text/html; charset=utf-8": ","authenticator":"oidc","path":"/api/v0/settings/roles-list","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36","client.address":"78.35.196.127","network.peer.address":"","network.peer.port":"","time":"2025-08-09T11:24:17Z","message":"failed to authenticate the request"}
{"level":"error","service":"proxy","error":"failed to verify access token: oidc: failed to decode provider discovery object: expected Content-Type = application/json, got "text/html; charset=utf-8": ","authenticator":"oidc","path":"/graph/v1.0/me","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36","client.address":"78.35.196.127","network.peer.address":"","network.peer.port":"","time":"2025-08-09T11:24:17Z","message":"failed to authenticate the request"}
{"level":"error","service":"proxy","error":"failed to verify access token: oidc: failed to decode provider discovery object: expected Content-Type = application/json, got "text/html; charset=utf-8": ","authenticator":"oidc","path":"/ocs/v1.php/cloud/capabilities","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36","client.address":"78.35.196.127","network.peer.address":"","network.peer.port":"","time":"2025-08-09T11:24:18Z","message":"failed to authenticate the request"}
{"level":"error","service":"proxy","error":"failed to verify access token: oidc: failed to decode provider discovery object: expected Content-Type = application/json, got "text/html; charset=utf-8": ","authenticator":"oidc","path":"/api/v0/settings/roles-list","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36","client.address":"78.35.196.127","network.peer.address":"","network.peer.port":"","time":"2025-08-09T11:24:18Z","message":"failed to authenticate the request"}
{"level":"error","service":"proxy","error":"failed to verify access token: oidc: failed to decode provider discovery object: expected Content-Type = application/json, got "text/html; charset=utf-8": ","authenticator":"oidc","path":"/graph/v1.0/me","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36","client.address":"78.35.196.127","network.peer.address":"","network.peer.port":"","time":"2025-08-09T11:24:19Z","message":"failed to authenticate the request"}
{"level":"error","service":"proxy","error":"failed to verify access token: oidc: failed to decode provider discovery object: expected Content-Type = application/json, got "text/html; charset=utf-8": ","authenticator":"oidc","path":"/api/v0/settings/roles-list","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36","client.address":"78.35.196.127","network.peer.address":"","network.peer.port":"","time":"2025-08-09T11:29:42Z","message":"failed to authenticate the request"}
{"level":"error","service":"proxy","error":"failed to verify access token: oidc: failed to decode provider discovery object: expected Content-Type = application/json, got "text/html; charset=utf-8": ","authenticator":"oidc","path":"/ocs/v2.php/apps/notifications/api/v1/notifications/sse","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36","client.address":"78.35.196.127","network.peer.address":"","network.peer.port":"","time":"2025-08-09T11:29:42Z","message":"failed to authenticate the request"}
{"level":"error","service":"proxy","error":"failed to verify access token: oidc: failed to decode provider discovery object: expected Content-Type = application/json, got "text/html; charset=utf-8": ","authenticator":"oidc","path":"/graph/v1.0/me","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36","client.address":"78.35.196.127","network.peer.address":"","network.peer.port":"","time":"2025-08-09T11:29:42Z","message":"failed to authenticate the request"}
{"level":"error","service":"proxy","error":"failed to verify access token: oidc: failed to decode provider discovery object: expected Content-Type = application/json, got "text/html; charset=utf-8": ","authenticator":"oidc","path":"/ocs/v2.php/apps/notifications/api/v1/notifications/sse","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36","client.address":"78.35.196.127","network.peer.address":"","network.peer.port":"","time":"2025-08-09T11:30:22Z","message":"failed to authenticate the request"}
{"level":"error","service":"proxy","error":"failed to verify access token: oidc: failed to decode provider discovery object: expected Content-Type = application/json, got "text/html; charset=utf-8": ","authenticator":"oidc","path":"/ocs/v2.php/apps/notifications/api/v1/notifications/sse","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36","client.address":"78.35.196.127","network.peer.address":"","network.peer.port":"","time":"2025-08-09T11:30:56Z","message":"failed to authenticate the request"}

[daaho]

Ich hatte ein ähnliches Problem. Vielleicht kann Dir das weiterhelfen:

https://github.com/orgs/opencloud-eu/discussions/1042