External idp | new variables for various clients by MannixTT · Pull Request #270 · opencloud-eu/opencloud-compose

MannixTT · 2026-04-08T22:21:24Z

I removed legacy environment variables and added the new variables to be able to setup authentik for example.

adapt docker compose for new variables regarding external idp

Update environment variables for new variables regarding external idp settings

adapt defaults - otherwise it will not behave as expected

streaminganger

actually there are many more changes that will break stuff. before going into all that, woouldnt it better to contribute an authentik config override rather than change the generic idp configs? check out #196 and #71

streaminganger · 2026-04-09T14:05:22Z

+# claim_role to opencloud mapping
+OC_OIDC_CLIENT_SCOPES="openid profile email roles offline_access"
+# Unfortunetely needed at the moment (be careful to set it to none in prod)
+# PROXY_OIDC_ACCESS_TOKEN_VERIFY_METHOD=none


this can be misunderstood as being a var you can activate by uncommenting

I think it should be clear that the vars there are only available when you reference the dockerfile external-idp as mentioned above in this section

All vars should default to empty

streaminganger · 2026-04-09T14:05:28Z

+# Unfortunetely needed at the moment (be careful to set it to none in prod)
+# PROXY_OIDC_ACCESS_TOKEN_VERIFY_METHOD=none
+# Allow OpenCloud, to show Authentik Login-Frame
+PROXY_CSP_CONFIG_FILE_LOCATION="/etc/ocis/csp.yaml"


ocis? wouldnt it break csp?

please remove that line.

streaminganger · 2026-04-09T14:05:47Z

  ldap-server:
    image: bitnamilegacy/openldap:2.6
+    # Bitnami images require GID 0 to write to internal socket and PID directories
+    user: ${LDAP_UID_GID:-1000:0}


what issue does this fix

I owned the complete stack with my docker user, but the container isn't able to run rootless.

I owned the complete stack with my docker user, but the container isn't able to run rootless.

looks like it will help those using rootless. i think you can consider decoupling this fix into a separate pr

please keep the scope of this PR small. That should be a different PR.

micbar · 2026-04-16T09:24:47Z

      FRONTEND_READONLY_USER_ATTRIBUTES: "user.onPremisesSamAccountName,user.displayName,user.mail,user.passwordProfile,user.accountEnabled,user.appRoleAssignments"
      PROXY_OIDC_REWRITE_WELLKNOWN: "true"
-      WEB_OIDC_CLIENT_ID: ${OC_OIDC_CLIENT_ID:-web}
+      OC_OIDC_CLIENT_ID: ${OC_OIDC_CLIENT_ID:-web}


This is only the override value. We should have that empty.

micbar · 2026-04-16T09:25:02Z

      PROXY_OIDC_REWRITE_WELLKNOWN: "true"
-      WEB_OIDC_CLIENT_ID: ${OC_OIDC_CLIENT_ID:-web}
+      OC_OIDC_CLIENT_ID: ${OC_OIDC_CLIENT_ID:-web}
+      OC_OIDC_CLIENT_SCOPES: ${PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM:-openid profile email roles offline_access}


Same here, just an empty value will be enough

micbar · 2026-04-16T09:25:41Z

+      OC_OIDC_CLIENT_ID: ${OC_OIDC_CLIENT_ID:-web}
+      OC_OIDC_CLIENT_SCOPES: ${PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM:-openid profile email roles offline_access}
+      PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM: ${PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM:-roles}
+      WEBFINGER_WEB_OIDC_CLIENT_ID: ${WEBFINGER_WEB_OIDC_CLIENT_ID:-${OC_OIDC_CLIENT_ID}}


This should default to empty, the default of the opencloud code is already web

micbar · 2026-04-16T09:27:44Z

+      OC_OIDC_CLIENT_SCOPES: ${PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM:-openid profile email roles offline_access}
+      PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM: ${PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM:-roles}
+      WEBFINGER_WEB_OIDC_CLIENT_ID: ${WEBFINGER_WEB_OIDC_CLIENT_ID:-${OC_OIDC_CLIENT_ID}}
+      WEBFINGER_WEB_OIDC_CLIENT_SCOPES: ${WEBFINGER_WEB_OIDC_CLIENT_SCOPES:-${OC_OIDC_CLIENT_SCOPES}}


This should default to openid profile email roles without offline_access.

Explanation: Web can refresh its access token without offline access, caused by the nature of it being a wen client. Giving a refresh token to an untrusted client is not good. On top: offline tokens are causing heavy load on OIDC Provider session handling.

micbar · 2026-04-16T09:28:45Z

+      PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM: ${PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM:-roles}
+      WEBFINGER_WEB_OIDC_CLIENT_ID: ${WEBFINGER_WEB_OIDC_CLIENT_ID:-${OC_OIDC_CLIENT_ID}}
+      WEBFINGER_WEB_OIDC_CLIENT_SCOPES: ${WEBFINGER_WEB_OIDC_CLIENT_SCOPES:-${OC_OIDC_CLIENT_SCOPES}}
+      WEBFINGER_ANDROID_OIDC_CLIENT_ID: ${WEBFINGER_ANDROID_OIDC_CLIENT_ID:-${OC_OIDC_CLIENT_ID}}


Should default to empty. The product default is OpenCloudAndroid

micbar · 2026-04-16T09:29:51Z

+      WEBFINGER_WEB_OIDC_CLIENT_ID: ${WEBFINGER_WEB_OIDC_CLIENT_ID:-${OC_OIDC_CLIENT_ID}}
+      WEBFINGER_WEB_OIDC_CLIENT_SCOPES: ${WEBFINGER_WEB_OIDC_CLIENT_SCOPES:-${OC_OIDC_CLIENT_SCOPES}}
+      WEBFINGER_ANDROID_OIDC_CLIENT_ID: ${WEBFINGER_ANDROID_OIDC_CLIENT_ID:-${OC_OIDC_CLIENT_ID}}
+      WEBFINGER_ANDROID_OIDC_CLIENT_SCOPES: ${WEBFINGER_ANDROID_OIDC_CLIENT_SCOPES:-${OC_OIDC_CLIENT_SCOPES}}


This should be empty. The product default is openid profile email offline_access

micbar · 2026-04-16T09:30:26Z

+      WEBFINGER_WEB_OIDC_CLIENT_SCOPES: ${WEBFINGER_WEB_OIDC_CLIENT_SCOPES:-${OC_OIDC_CLIENT_SCOPES}}
+      WEBFINGER_ANDROID_OIDC_CLIENT_ID: ${WEBFINGER_ANDROID_OIDC_CLIENT_ID:-${OC_OIDC_CLIENT_ID}}
+      WEBFINGER_ANDROID_OIDC_CLIENT_SCOPES: ${WEBFINGER_ANDROID_OIDC_CLIENT_SCOPES:-${OC_OIDC_CLIENT_SCOPES}}
+      WEBFINGER_IOS_OIDC_CLIENT_ID: ${WEBFINGER_IOS_OIDC_CLIENT_ID:-${OC_OIDC_CLIENT_ID}}


Should default to empty. The product default is OpenCloudIOS

micbar · 2026-04-16T09:30:45Z

+      WEBFINGER_ANDROID_OIDC_CLIENT_ID: ${WEBFINGER_ANDROID_OIDC_CLIENT_ID:-${OC_OIDC_CLIENT_ID}}
+      WEBFINGER_ANDROID_OIDC_CLIENT_SCOPES: ${WEBFINGER_ANDROID_OIDC_CLIENT_SCOPES:-${OC_OIDC_CLIENT_SCOPES}}
+      WEBFINGER_IOS_OIDC_CLIENT_ID: ${WEBFINGER_IOS_OIDC_CLIENT_ID:-${OC_OIDC_CLIENT_ID}}
+      WEBFINGER_IOS_OIDC_CLIENT_SCOPES: ${WEBFINGER_IOS_OIDC_CLIENT_SCOPES:-${OC_OIDC_CLIENT_SCOPES}}


This should be empty. The product default is openid profile email offline_access

micbar · 2026-04-16T09:31:04Z

+      WEBFINGER_ANDROID_OIDC_CLIENT_SCOPES: ${WEBFINGER_ANDROID_OIDC_CLIENT_SCOPES:-${OC_OIDC_CLIENT_SCOPES}}
+      WEBFINGER_IOS_OIDC_CLIENT_ID: ${WEBFINGER_IOS_OIDC_CLIENT_ID:-${OC_OIDC_CLIENT_ID}}
+      WEBFINGER_IOS_OIDC_CLIENT_SCOPES: ${WEBFINGER_IOS_OIDC_CLIENT_SCOPES:-${OC_OIDC_CLIENT_SCOPES}}
+      WEBFINGER_DESKTOP_OIDC_CLIENT_ID: ${WEBFINGER_DESKTOP_OIDC_CLIENT_ID:-${OC_OIDC_CLIENT_ID}}


Should default to empty. The product default is OpenCloudDesktop

micbar · 2026-04-16T09:31:20Z

+      WEBFINGER_IOS_OIDC_CLIENT_ID: ${WEBFINGER_IOS_OIDC_CLIENT_ID:-${OC_OIDC_CLIENT_ID}}
+      WEBFINGER_IOS_OIDC_CLIENT_SCOPES: ${WEBFINGER_IOS_OIDC_CLIENT_SCOPES:-${OC_OIDC_CLIENT_SCOPES}}
+      WEBFINGER_DESKTOP_OIDC_CLIENT_ID: ${WEBFINGER_DESKTOP_OIDC_CLIENT_ID:-${OC_OIDC_CLIENT_ID}}
+      WEBFINGER_DESKTOP_OIDC_CLIENT_SCOPES: ${WEBFINGER_DESKTOP_OIDC_CLIENT_SCOPES:-${OC_OIDC_CLIENT_SCOPES}}


This should be empty. The product default is openid profile email offline_access

MannixTT added 3 commits April 8, 2026 23:46

Update external-idp.yml

68ddb4e

adapt docker compose for new variables regarding external idp

Update .env.example

212f87a

Update environment variables for new variables regarding external idp settings

Update external-idp.yml

86f1d6f

adapt defaults - otherwise it will not behave as expected

streaminganger reviewed Apr 9, 2026

View reviewed changes

micbar reviewed Apr 16, 2026

View reviewed changes

Conversation

MannixTT commented Apr 8, 2026

Uh oh!

streaminganger left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants