Opencloud with Authelia OIDC

[Rhiig]

Hey there,
first off I'd like to say that I'm really grateful that opencloud exists. Nextcloud is way to big for my setup and I could improve my site loading speed tremendously. Now to my problem:
I know that Opencloud, at least in theory, supports using Authelia as an OIDC and I've already seen some other discussions about it but I just cant get it to work. After configuring the environment variables like this:
OC_OIDC_ISSUER={auth.mydomain.com}
OC_EXCLUDE_RUN_SERVICES=idp
PROXY_USER_OIDC_CLAIM=preferred_username
PROXY_USER_CS3_CLAIM=username
PROXY_AUTOPROVISION_ACCOUNTS=true
GRAPH_USERNAME_MATCH=none
PROXY_ROLE_ASSIGNMENT_DRIVER=oidc
GRAPH_ASSIGN_DEFAULT_USER_ROLE=false

...my opencloud starts but the site just looks like this:

Also what about the client_secret required to setup Authelia? Where does it go in the opencloud environment?
This is my authelia configuration for the opencloud oidc:
clients:
- client_id: 'web'
client_name: 'Public Opencloud'
client_secret: '{what should be here? - it cant be empty}'
redirect_uris:
- https://{mydomain}/
- https://{mydomain}/oidc-callback.html
- https://{mydomain}/oidc-silent-redirect.html
scopes:
- 'openid'
- 'groups'
- 'email'
- 'profile'
grant_types:
- refresh_token
- authorization_code
response_modes:
- 'form_post'
- 'query'
authorization_policy: 'two_factor'

Also when I put Authelia in front of Opencloud (as a middleware), without the oidc enabled the Site just shows access denied. Why? How do I fix that?

Maybe important info: My Opencloud runs inside truenas as the current app version: 4.0.1 and 1.0.27 (truenas app version)

I'd really appreciate any help! Thanks already

[Diekos]

Did you add those envvars to the .env file?
You should also look in the docker-compose.yml file as some variables are not defined there by default under 'environment', so they will never be picked up.
You could add them to the docker-compose.yml file directly or create a docker-compose.override.yml and define your custom envvars there.

[Rhiig]

This helps quite a lot! The IDP_DOMAIN didnt create the correct CSP rules though.
The last thing the logs say now is:

2025-12-22 18:00:02.683907+00:00Starting OpenCloud...
2025-12-22 18:00:22.124000+00:00{"level":"error","service":"idm","bind_dn":"uid=reva,ou=sysusers,o=libregraph-idm","op":"bind","remote_addr":"127.0.0.1:55344","time":"2025-12-22T18:00:22Z","message":"invalid credentials"}
2025-12-22 18:00:22.606705+00:00{"level":"error","service":"idm","bind_dn":"uid=libregraph,ou=sysusers,o=libregraph-idm","op":"bind","remote_addr":"127.0.0.1:55346","time":"2025-12-22T18:00:22Z","message":"invalid credentials"}
2025-12-22 18:00:22.606793+00:00{"level":"error","service":"graph","request-id":"884932e4eee2/PkxXp2ySh5-000025","error":"LDAP Result Code 49 \"Invalid Credentials\": ","time":"2025-12-22T18:00:22Z","message":"failed to add user"}
2025-12-22 18:00:22.606801+00:00{"level":"error","service":"graph","request-id":"884932e4eee2/PkxXp2ySh5-000025","error":"generalException: failed to add user","time":"2025-12-22T18:00:22Z","message":"could not create user: backend error"}
2025-12-22 18:00:22.606983+00:00{"level":"error","service":"proxy","error":"500 Internal Server Error","time":"2025-12-22T18:00:22Z","message":"Error creating user"}
2025-12-22 18:00:22.607004+00:00{"level":"error","service":"proxy","error":"500 Internal Server Error","time":"2025-12-22T18:00:22Z","message":"Autoprovisioning user failed"}
2025-12-22 18:00:27.699335+00:00{"level":"error","service":"idm","bind_dn":"uid=reva,ou=sysusers,o=libregraph-idm","op":"bind","remote_addr":"127.0.0.1:55348","time":"2025-12-22T18:00:27Z","message":"invalid credentials"}
2025-12-22 18:00:27.712609+00:00{"level":"error","service":"idm","bind_dn":"uid=libregraph,ou=sysusers,o=libregraph-idm","op":"bind","remote_addr":"127.0.0.1:55356","time":"2025-12-22T18:00:27Z","message":"invalid credentials"}
2025-12-22 18:00:27.712722+00:00{"level":"error","service":"graph","request-id":"884932e4eee2/PkxXp2ySh5-000030","error":"LDAP Result Code 49 \"Invalid Credentials\": ","time":"2025-12-22T18:00:27Z","message":"failed to add user"}
2025-12-22 18:00:27.712749+00:00{"level":"error","service":"graph","request-id":"884932e4eee2/PkxXp2ySh5-000030","error":"generalException: failed to add user","time":"2025-12-22T18:00:27Z","message":"could not create user: backend error"}
2025-12-22 18:00:27.712915+00:00{"level":"error","service":"proxy","error":"500 Internal Server Error","time":"2025-12-22T18:00:27Z","message":"Error creating user"}
2025-12-22 18:00:27.712923+00:00{"level":"error","service":"proxy","error":"500 Internal Server Error","time":"2025-12-22T18:00:27Z","message":"Autoprovisioning user failed"}

I think the last issues are with some kind of password missmatch between some things or that opencloud doesnt handle the roles of authelia correctly. Standart for my account in authelia I have the rules "admins" and "dev". It may be that Opencloud expects "admin" or "user"

[Diekos]

The documentation mentions:
The default role_claim (or PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM) is roles. The default role_mapping is:

• role_name: admin
  claim_value: opencloudAdmin
• role_name: spaceadmin
  claim_value: opencloudSpaceAdmin
• role_name: user
  claim_value: opencloudUser
• role_name: guest
  claim_value: opencloudGuest

So I have claims called "roles" with the above values (claim_value). You should create those roles in Authelia or change how OpenCloud maps roles, but I think creating those OIDC claims in Authelia is easier.

[Rhiig]

Sadly this was not the answer. I tried it with every role but that didnt fix anything. My last guess is that opencloud somehow got a password missmatch internally.

currrent logs are:
(Opencloud logs)

2025-12-23 09:59:52.188528+00:00Starting OpenCloud...
2025-12-23 10:00:28.253079+00:00{"level":"error","service":"idm","bind_dn":"uid=reva,ou=sysusers,o=libregraph-idm","op":"bind","remote_addr":"127.0.0.1:42316","time":"2025-12-23T10:00:28Z","message":"invalid credentials"}
2025-12-23 10:00:28.787288+00:00{"level":"error","service":"idm","bind_dn":"uid=libregraph,ou=sysusers,o=libregraph-idm","op":"bind","remote_addr":"127.0.0.1:42320","time":"2025-12-23T10:00:28Z","message":"invalid credentials"}
2025-12-23 10:00:28.787443+00:00{"level":"error","service":"graph","request-id":"e1fa59708b9a/aDyQrXLsHm-000033","error":"LDAP Result Code 49 \"Invalid Credentials\": ","time":"2025-12-23T10:00:28Z","message":"failed to add user"}
2025-12-23 10:00:28.787464+00:00{"level":"error","service":"graph","request-id":"e1fa59708b9a/aDyQrXLsHm-000033","error":"generalException: failed to add user","time":"2025-12-23T10:00:28Z","message":"could not create user: backend error"}
2025-12-23 10:00:28.787643+00:00{"level":"error","service":"proxy","error":"500 Internal Server Error","time":"2025-12-23T10:00:28Z","message":"Error creating user"}
2025-12-23 10:00:28.787652+00:00{"level":"error","service":"proxy","error":"500 Internal Server Error","time":"2025-12-23T10:00:28Z","message":"Autoprovisioning user failed"}
2025-12-23 10:00:34.515506+00:00{"level":"error","service":"idm","bind_dn":"uid=reva,ou=sysusers,o=libregraph-idm","op":"bind","remote_addr":"127.0.0.1:53016","time":"2025-12-23T10:00:34Z","message":"invalid credentials"}
2025-12-23 10:00:34.556824+00:00{"level":"error","service":"idm","bind_dn":"uid=libregraph,ou=sysusers,o=libregraph-idm","op":"bind","remote_addr":"127.0.0.1:53022","time":"2025-12-23T10:00:34Z","message":"invalid credentials"}
2025-12-23 10:00:34.557037+00:00{"level":"error","service":"graph","request-id":"e1fa59708b9a/aDyQrXLsHm-000038","error":"LDAP Result Code 49 \"Invalid Credentials\": ","time":"2025-12-23T10:00:34Z","message":"failed to add user"}
2025-12-23 10:00:34.557096+00:00{"level":"error","service":"graph","request-id":"e1fa59708b9a/aDyQrXLsHm-000038","error":"generalException: failed to add user","time":"2025-12-23T10:00:34Z","message":"could not create user: backend error"}
2025-12-23 10:00:34.557304+00:00{"level":"error","service":"proxy","error":"500 Internal Server Error","time":"2025-12-23T10:00:34Z","message":"Error creating user"}
2025-12-23 10:00:34.557328+00:00{"level":"error","service":"proxy","error":"500 Internal Server Error","time":"2025-12-23T10:00:34Z","message":"Autoprovisioning user failed"}

(browser logs)

Content-Security-Policy: The page’s settings blocked a script (script-src-elem) at https://static.cloudflareinsights.com/beacon.min.js/{someString} from being executed because it violates the following directive: “script-src 'self' 'unsafe-inline'” [web-oidc-callback](https://{cloud.example.com}/web-oidc-callback?code=authelia_ac_{someString}&iss=https%3A%2F%2F{auth.example.com}&scope=openid+profile+email+groups&state={someString})
Content-Security-Policy: The page’s settings blocked a JavaScript eval (script-src) from being executed because it violates the following directive: “script-src 'self' 'unsafe-inline'” (Missing 'unsafe-eval') (https://{cloud.example.com}/js/chunks/PortalTarget.vue_vue_type_script_lang-BtcHSdI5.mjs)
[authService:initializeContext] - updating context with saved access_token (https://{cloud.example.com}/js/index.html-CGFTrQAi.mjs)
Object { message: "Request failed with status code 500", name: "AxiosError", code: "ERR_BAD_RESPONSE", config: {…}, request: XMLHttpRequest, response: {…}, status: 500, stack: "", … }
code: "ERR_BAD_RESPONSE"
config: Object { timeout: 0, xsrfCookieName: "XSRF-TOKEN", xsrfHeaderName: "X-XSRF-TOKEN", … }
message: "Request failed with status code 500"
name: "AxiosError"
request: XMLHttpRequest { readyState: 4, timeout: 0, withCredentials: false, … }
response: Object { data: "", status: 500, statusText: "", … }
stack: "ws@https://{cloud.example.com}/js/chunks/resources-BWoPmQl0.mjs:3:1080\nq@https://{cloud.example.com}/js/chunks/resources-BWoPmQl0.mjs:3:5818\n"
status: 500
<prototype>: Object { constructor: E(e, t, s, r, a), toJSON: toJSON()
, stack: "", … }
initializeContext https://{cloud.example.com}/js/index.html-CGFTrQAi.mjs:37

[Rhiig]

I somehow got it working. The password mismatch somehow happened while I was configuring the idp.
I've now completely reset opencloud, its config and data through a fresh install and now the mismatch is no more!

Thank you for all your help!

[Rhiig]

One last question:
How do I get my user to be a opencloud admin?
Groups is purely visual, right? I gave myself groups: admin and roles: admin in authelia but I'm not admin in opencloud. What do I have to do for that?

[Diekos]

For the roles claim you should set it to "opencloudAdmin". That is what Opencloud uses by default.

[Rhiig]

That didnt work somehow. I tried it with "admin", with "opencloudAdmin" and that as the groups inside Authelia or as roles inside authelia. I even tried adding it to the auth scope if that is needed. I reinstalled opencloud between every attempt and deleted the volumes as it could have been that it only adds that permission on signup and not afterwards.
Sadly nothing worked.