Cannot create space with OIDC

[damru]

Hey there,

I'm running OpenCloud:

• in k8s with helm
• with Pocket ID for OIDC
• using a storage volume mounted with samba for user files

Everything is running fine besides the space feature, I always get an error when trying to create one:

opencloud {"level":"error","service":"storage-users","host.name":"opencloud-opencloud-0","pkg":"rgrpc","traceid":"19b8588816029a96c802652d8095a20d","error":"Failed to set all xattrs: xattr.Set /var/lib/opencloud/storage/users/projects/d884cf12-ca03-43a3-ab17-9570efd07f30 user.oc.grant.u:374216f5-ee77-4c07-ad65-c3cd14847051: invalid argument","principal":"u:374216f5-ee77-4c07-ad65-c3cd14847051","time":"2025-12-09T09:58:01Z","line":"github.com/opencloud-eu/reva/v2@v2.40.1/pkg/storage/pkg/decomposedfs/grants.go:355","message":"Could not set grant for principal"}
opencloud {"level":"error","service":"storage-users","host.name":"opencloud-opencloud-0","pkg":"rgrpc","traceid":"19b8588816029a96c802652d8095a20d","error":"Failed to set all xattrs: xattr.Set /var/lib/opencloud/storage/users/projects/d884cf12-ca03-43a3-ab17-9570efd07f30 user.oc.grant.u:374216f5-ee77-4c07-ad65-c3cd14847051: invalid argument","status":{"code":15,"message":"error creating space","trace":"19b8588816029a96c802652d8095a20d"},"request":{"type":"project","name":"Nouvel espace","quota":{"quota_max_bytes":1000000000}},"time":"2025-12-09T09:58:01Z","line":"github.com/opencloud-eu/reva/v2@v2.40.1/internal/grpc/services/storageprovider/storageprovider.go:540","message":"failed to create storage space"}

After seing the error in the UI, I can still see the space under Administration page but it's not assigned to any user.

The id_token contains the following info (most data are obfuscated):

{
  "aud": [
    "ab503f31-52fc-40fe-8686-165890a33e87"
  ],
  "display_name": "xxx",
  "email": "xxx@xxx.xxx",
  "email_verified": false,
  "exp": 1765279824,
  "family_name": "xxx",
  "given_name": "xxx",
  "iat": 1765276224,
  "iss": "https://<my_pocketid_domain>",
  "name": "xxx",
  "opencloud_role": "opencloudAdmin",
  "picture": "xxx",
  "preferred_username": "xxx",
  "sub": "<sub UUID>",
  "type": "id-token"
}

ℹ️ The opencloud_role is correctly used with PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM environment variable.

And the JWT:

{
  "aud": [
    "ab503f31-52fc-40fe-8686-165890a33e87"
  ],
  "exp": 1765279824,
  "iat": 1765276224,
  "iss": "https://<my_pocketid_domain>",
  "sub": "<sub UUID>",
  "type": "oauth-access-token"
}

Any idea on this ?
I can share other information if required of course.

Thanks !

[damru]

@damru Sorry to bring the bad news 🙈

in k8s with helm

Please be aware that this it not from opencloud. We have a helm chart which is closed source.

using a storage volume mounted with samba for user files

That is not possible. Samba does't support xattrs, which we depend on. NFS v4.2 should work.

[damru]

Please be aware that this it not from opencloud. We have a helm chart which is closed source.

I'm well aware of that. I was using the opensourced one but it seems that the OCI archives were deleted when the repo was archived so i had to switch 😬 😄

That is not possible. Samba does't support xattrs, which we depend on. NFS v4.2 should work.

Do you mean that the whole setup should not work or just the space feature ? Because for everything else (posix based install using this samba driver) it's ok.

Thanks 🙇‍♂️

[micbar]

Samba does not work at all. Everything is a space in opencloud, even the personal files. We are storing metadata and access control information in the xtattrs.

[damru]

Hum that's weird then, because I can assure you that my install if working fine using this volume, except for the space feature.
Maybe the k8s abstraction is making it look like a classic filesystem.

• samba storageclass:

apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: smb.opencloud
  namespace: kube-system
provisioner: smb.csi.k8s.io
parameters:
  source: //samba.external.svc.cluster.local/opencloud
  csi.storage.k8s.io/node-stage-secret-name: nextcloud-samba-creds
  csi.storage.k8s.io/node-stage-secret-namespace: kube-system
volumeBindingMode: Immediate
allowVolumeExpansion: true
mountOptions:
  - dir_mode=0750
  - file_mode=0640
  - uid=1000
  - gid=1000
  - noperm
  - mfsymlinks
  - cache=strict
  - noserverino

• pvc spec:

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: opencloud-files
  namespace: opencloud
spec:
  storageClassName: smb.opencloud
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 1Ti

• opencloud pod:

    Mounts:
      /etc/opencloud from opencloud-config (rw) --> this is a hostpath volume
      /tmp from empty-dir (rw,path="tmp-dir")
      /var/lib/opencloud from opencloud-data (rw)  --> this is a hostpath volume
      /var/lib/opencloud/storage from opencloud-files (rw) --> this is the samba volume defined above

Anyways, looking at the logs there is definitely something with the xattrs so that must be the explanation: it kind of "triggers" the fact that it should not be supported when I'm trying to create a space manually.