[HOW-TO] Setup SSO (OIDC) with Authentik (web, desktop app, iOS app)

[StafLoker]

Replace with your domain: domain.com

Opencloud

Env file (opencloud.env)

# SSO
OC_OIDC_ISSUER=https://auth.domain.com/application/o/opencloud/
WEB_OIDC_CLIENT_ID=<id>
## Proxy
PROXY_AUTOPROVISION_ACCOUNTS=true
PROXY_ROLE_ASSIGNMENT_DRIVER="oidc"
PROXY_OIDC_REWRITE_WELLKNOWN="true"
PROXY_USER_OIDC_CLAIM="preferred_username"
PROXY_USER_CS3_CLAIM="username"
## role assignment
OC_EXCLUDE_RUN_SERVICES=idp
WEB_OIDC_SCOPE=openid profile email groups
PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM=groups
GRAPH_ASSIGN_DEFAULT_USER_ROLE=false
GRAPH_USERNAME_MATCH="none"
PROXY_OIDC_ACCESS_TOKEN_VERIFY_METHOD=none

# CSP
PROXY_CSP_CONFIG_FILE_LOCATION=/etc/opencloud/csp.yaml

CSP file (csp.yaml)

directives:
  child-src:
    - '''self'''
  connect-src:
    - '''self'''
    - 'blob:'
    - 'https://raw.githubusercontent.com/opencloud-eu/awesome-apps/'
    - 'https://auth.domain.com/'
  default-src:
    - '''none'''
  font-src:
    - '''self'''
  frame-ancestors:
    - '''self'''
  frame-src:
    - '''self'''
    - 'blob:'
    # This is needed for the external-sites web extension when embedding sites
    - 'https://docs.opencloud.eu'
  img-src:
    - '''self'''
    - 'data:'
    - 'blob:'
    - 'https://raw.githubusercontent.com/opencloud-eu/awesome-apps/'
  manifest-src:
    - '''self'''
  media-src:
    - '''self'''
  object-src:
    - '''self'''
    - 'blob:'
  script-src:
    - '''self'''
    - '''unsafe-inline'''
  style-src:
    - '''self'''
    - '''unsafe-inline'''

Proxy file (proxy.yaml)

role_assignment:
  driver: oidc
  oidc_role_mapper:
    role_claim: groups
    role_mapping:
      - role_name: admin 
        claim_value: Drive Admins
      - role_name: spaceadmin
        claim_value: Drive Admins 
      - role_name: user
        claim_value: Drive
      - role_name: guest
        claim_value: Guests 

Authentik

Providers

Web

Desktop app

iOS app

Groups

Create two groups, one for admin other for users.

Apps

Other

If you hace active desktop or mobile apps session, is not repair with login.

1. Logout & Remove server from app list
2. Add server in list (like when u lunch app first time)

[irrwitzer42]

Thank you very much @StafLoker for writing that down!

This looks exactly like the solution I'd love.... but I haven't got it working as of now.
Would you please tell us/add to your howto the information, which one of the docker-compose files you are using?
I am trying with the openopencloud-compose docker version and had to add
to add the above mentioned environment variables to my custom/docker-compose.override.yml to get the recognized.

My COMPOSE_FILE variable looks like this:
COMPOSE_FILE=docker-compose.yml:weboffice/collabora.yml:external-proxy/opencloud.yml:external-proxy/collabora.yml:custom/docker-compose.override.yml

So as you can see, without idm/ldap-keycloak.yml -> no integrated LDAP or Keycloak. Maybe that is my mistake already, but not sure. I wanted to have the installation to use as few ressources for overhead as possible.

So, if you could please let us know the base-installation/your starting point for this config manual to, that would be great and maybe I'll get it working then. :-)

Thanks in advance!
Irrwitzer

[irrwitzer42]

so it's still not working for you?
Did you add your OIDC server to csp.yaml?

That was my main issue from the start. And you can debug this with safari's developer console -- or any other browser's.
You'll see the errors for the token refresh after an hour. And that was in my case the CSP policy, that didn't allow frame-includes of my auth provider.

[hasdf]

In Safari:
It's working 60% of the time :) For the other 40% I get status 401 in the browser and nginx log... Happens a lot if opening a folder with a lot of images all the preview images are loaded, and some of them get 401.

In Firefox:
Everything works 99% of the time. If I open a folder with 100 Images, 1 image has no preview image and there is a 401 in the log for it

[Viko1690]

Hi @hasdf, @irrwitzer42,

any updates about this issue? I am facing the same problem about auto-logout after a few minutes (Safari and somtimes Microsoft Edge). I have already added my Authentik-Server to the csp.yaml.

Thank you!

[irrwitzer42]

Hi @Viko1690 ,

Well... I stopped working on it for now, as I'm out of ideas where to look.
My desktop client on OSX still needs reauthentication every couple of days. Windows and mobile seems fine.
The webUI (Safari) is fine, but some actions cause an unauthorised error message, providing a like to reauthenticate, then it's working fine again...

It's not perfect, but I can work with it.
I'm still on version 2.0.4 (webui 2.1.1) if that matters for you.

Good luck with your issues!

[Viko1690]

Hi @irrwitzer42 ,

thanks for your reply. I set the access token validity for the webclient provider to "hours=24" and the auto-logout seems to appear only after on day. I think this is okay for daily use. Maybe it would also take a positive impact if this is set for the other providers too, but I am not sure if this will cause any security risks...

[micbar]

@irrwitzer42
You can just do a volume bind mount to get config/opencloud/proxy.yaml into the container.

[blackstormlab]

i just used this example and ended up with this:

this shows up after attempting to login

and this shows up in the logs

[blackstormlab]

i am sending the role claim which has me stumped

[blackstormlab]

This is my proxy.yaml

and here you can see it is also sending the group claim

[blackstormlab]

this is also in the logs.

{"level":"debug","service":"proxy","claims":{"email":"redacted","email_verified":true,"exp":1757107417,"given_name":"blackstorm","groups":["authentik Admins","Homelab admin","gituser","gitadmin","immich_user","immich_admin","opencloud_user","opencloud_admin"],"name":"blackstorm","nickname":"blackstorm","opencloud_role":"user","preferred_username":"blackstorm","sub":"redacted"},"time":"2025-09-05T21:23:27Z","line":"github.com/opencloud-eu/opencloud/services/proxy/pkg/middleware/oidc_auth.go:135","message":"extracted claims"}

[kapuett]

Am currently stuck at the same point. Did you ever figure this out @blackstormlab?

[jenkinsmichpa]

I had this issue and solved it by mapping the proxy.yaml file as a volume as below. It being mapped by default is currently tied to using the radicale.yml compose file or not.

services:
  opencloud:
    volumes:
          - ./config/opencloud/proxy.yaml:/etc/opencloud/proxy.yaml

[chiragkrishna]

thanks a lot, it is working perfectly.
have a doubt, is it possible to have the default login, but with a button saying login with Authentik? instead of directly redirecting to Authentik.

[uptonking]

🤔 i built opencloud from source according to the Install Bare-Metal | OpenCloud Docs , but where should i put csp.yaml, proxy.yaml files ?

• The compiled binary is opencloud/bin/opencloud, i can start it by opencloud/bin/opencloud server, it works with default admin user.
• but i cannot get local opencloud working with authentik. I set environment vars as the OP pasted. but I dont understand where to put csp.yaml, proxy.yaml files .
• I tried create folder /etc/opencloud/ on my mac, and put the two files in it, but it still dosenot work.
• i have set env var PROXY_CSP_CONFIG_FILE_LOCATION=/etc/opencloud/csp.yaml, but there is still error as below

{"level":"error","service":"proxy","request-id":"6f08b634-a8c5-4b9f-9f46-b67a08dc49bb","userid":"cf65dbc7-5cdb-4adf-8cbe-5af292eb89df","error":"no role in claim maps to an OpenCloud role","time":"2025-09-27T08:04:42+08:00"}
{"level":"error","service":"proxy","error":"no role in claim maps to an OpenCloud role","time":"2025-09-27T08:04:42+08:00","message":"Could not get user roles"}

[thokich]

Big Thanks of all here. It runs on Authentik 2025.10.2
or in my frankonia language "passt scho"

[hashtagsheep]

Thanks for the guide 👍

I’m running OpenCloud 4.0.1 with Authentik 2025.10.3, and authentication generally behaves as expected. iOS and desktop apps work without issues.

The only remaining problem is that I occasionally get logged out in the browser for no obvious reason. I suspect something around refresh tokens not being picked up or refreshed correctly by the browser/WebDAV flow.

I see this in the OpenCloud proxy logs from time to time:

error="token is expired"
authenticator="oidc"
path="/remote.php/dav/..."

It’s not constant, but happens sporadically. Has anyone else seen similar behavior or found specific Authentik token/refresh settings that work best with OpenCloud?

[Alulu2401]

i had the same issue not sporadically but linked to the refresh token, added offline_access scope to WEB_OIDC_SCOPE variable in the compose file did the trick

[hashtagsheep]

That did the trick mostly, the error still is in the logs, together with other auth error. Could you check if you have the same?

Thanks

[chiragkrishna]

yes after adding offline_access, still getting this error, but not random logouts

{"level":"warn","service":"frontend","host.name":"85ce7781d580","pkg":"rhttp","traceid":"af1e6ff1cef1098e48ddfdcef0d7c8af","time":"2025-12-28T01:45:29Z","message":"core access token not set"}

now collabora is not working

Failed to establish socket connection or socket connection closed unexpectedly. The reverse proxy might be misconfigured, please contact the administrator. For more info on proxy configuration please checkout https://sdk.collaboraonline.com/docs/installation/Proxy_settings.html

[Alulu2401]

That did the trick mostly, the error still is in the logs, together with other auth error. Could you check if you have the same?

Thanks

Nope no errors in my logs, sorry :(

[kapuett]

@chiragkrishna the error

now collabora is not working

is unrelated, see opencloud-eu/opencloud-compose#173.

[chiragkrishna]

was banging my head from past 2 days, thanks a lot.