Hi team,
I'm trying to integrate OpenCloud with Authentik as an external OIDC provider, and I’ve run into a series of configuration issues that I’d like some guidance on.
What I’ve done so far:
- Set up Authentik with an OIDC Provider and Application for OpenCloud.
- Set the following in .env:
IDP_ISSUER_URL=https://auth.example.com/application/o/opencloud/
IDP_DOMAIN=auth.example.com
IDP_ACCOUNT_URL="https://auth.example.com/if/user/#/settings"
OC_OIDC_CLIENT_ID=xxx
PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM=opencloudRoles
- Verified the Authentik JWKS endpoint is reachable.
- Enabled offline_access in Authentik scopes.
- LDAP provisioning works (after loading a custom schema).
Current issue:
-
After login, user receives “no roles in user claims” error:
Could not get user roles | error=no roles in user claims
I tried adding a Property Mapping in Authentik:
roles = ["user"]
if user.is_superuser and "admin" not in roles:
roles = ["admin"]
return {
"opencloudRoles": roles
}But I return to the Not logged in screen
Questions:
- What is the recommended OIDC claim format for OpenCloud role mapping?
- Does OpenCloud expect a specific claim like roles or role_ids?
- Is there a known working Property Mapping expression in Authentik that returns roles properly?
Hi team,
I'm trying to integrate OpenCloud with Authentik as an external OIDC provider, and I’ve run into a series of configuration issues that I’d like some guidance on.
What I’ve done so far:
Current issue:
After login, user receives “no roles in user claims” error:
I tried adding a Property Mapping in Authentik:
But I return to the
Not logged inscreenQuestions: