Generic S3 and OAuth Support

[2TAP2B]

I have two questions regarding future feature plans:

General S3 Support

Currently, the project supports decomposedS3 (MinIO). Is there a plan to support a more general S3 storage backend to allow integration with various S3-compatible services like AWS or Hetzner?

OAuth2 OIDC Authentication

Is there any plan to implement OAuth2 OIDC authentication support? This would allow integration with identity providers such as Pocket ID or Authelia?

[BEBU88]

Hi,

I recently set up an OpenCloud Instance for testing purposes with Keycloak and decomposedS3 with Hetzner S3 storage. I don't know if this is officially supported yet, but I did some testing and it seemed to work fine.

[BEBU88]

Nice, that works for me as well via docker compose. Any ideas what environment variables I need to set up custom sso like authelia etcpp?

Sorry for the delayed reply...

I used this variables for keycloak:

OC_OIDC_ISSUER=IDP_URL
OC_OIDC_CLIENT_ID=CLIENT_ID
PROXY_OIDC_ACCESS_TOKEN_VERIFY_METHOD=jwt
PROXY_USER_OIDC_CLAIM=preferred_username
PROXY_USER_CS3_CLAIM=username
PROXY_AUTOPROVISION_ACCOUNTS=true
PROXY_ROLE_ASSIGNMENT_DRIVER=oidc
PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM=CLAIM_IN_TOKEN
PROXY_OIDC_REWRITE_WELLKNOWN=true
WEB_OIDC_METADATA_URL=IDP_URL/.well-known/openid-configuration
WEB_OIDC_SCOPE=openid profile email offline_access

You need to specify the user role as value for the oidc claim:

Admin = opencloudAdmin
Space Admin = opencloudSpaceAdmin
User = opencloudUser

[2TAP2B]

after setting up the oidc, im redirected to this domain: https://cloud.opencloud.test/login?redirectUrl=%2Ffiles%2Fspaces%2Fpersonal
and a endless loading animation is spinning around.
what i'm missing?
my callback url is:

https://cloud.opencloud.test/
https://cloud.opencloud.test/web-oidc-callback.html
https://cloud.opencloud.test/web-oidc-silent-redirect.html

any ideas?

[webobardewisch]

Hi,
I try to setup Opencloud also with Hetzner S3 but no success. Do I have modify only the S3 settings in the env or do I modify much more?

[2TAP2B]

Just put your s3 credentials and server information in the env and uncomment the decomposeds3.yml in line 81

[webobardewisch]

Thanks. Now it works. There was also another problem with the container. That was the reason, that it didn't work.

[2TAP2B]

Im looking for a working integration of Pocket-ID as identity provider. Maybe someone out there has this setup working and can help me out.

[micbar]

Please check docs.opencloud.eu

we have a new section about keycloak integration.

[2TAP2B]

Nice, thanks for this.