External OIDC SSO setup issues (CORS issue?)

[cj-wong]

Hello,

I'm trying to get OpenCloud to install correctly but am having issues. I want to use my existing SSO server to be the sole login. I'm not using Docker (especially not the Compose setup), but I don't think that affects anything. So I'm just the OpenCloud (opencloud-rolling:latest) container. I'm also using an existing reverse proxy (Caddy).

Am I not supposed to setup the SSO server immediately after initializing the server? I have added the environment variables OC_OIDC_ISSUER, OC_EXCLUDE_RUN_SERVICES=idp, PROXY_OIDC_REWRITE_WELLKNOWN=true, PROXY_USER_OIDC_CLAIM=preferred_username, PROXY_USER_CS3_CLAIM=username, PROXY_AUTOPROVISION_ACCOUNTS=true, GRAPH_USERNAME_MATCH=none, PROXY_ROLE_ASSIGNMENT_DRIVER=oidc, PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM=groups, and PROXY_TLS=false as recommended here.

When I access the URL of my instance, it redirects to /login and just shows a spinning circle. Developer Tools shows: Cross-Origin Request Blocked: The Same Origin Policy disallows reading the remote resource at https://<my-sso>/.well-known/openid-configuration. (Reason: CORS request did not succeed). Status code: (null). I have tried editing the csp.yaml file and adding the OC_CORS_ALLOW_ORIGINS (and WEB_CORS_ALLOW_ORIGINS) environment variables set to my SSO server, but nothing changes. (I actually started this process with the plain opencloud image, as I care more about stability than bleeding edge, but both images behave the same with my attempt at setting up SSO.)

Now, inside the container, I can curl my SSO server so I know it's accessible there. I also do not have this issue with the handful of other containers I use with my SSO server, although they also all use client secrets.

I'm a bit lost. I can add more information as needed. Please help me in figuring this thing out.

[micbar]

The CORS issue is caused by your SSO. Make sure to allow openCloud to make a request to the well known endpoint

[micbar]

In keycloak, this is configurable in the realm settings

[cj-wong]

Thanks for the quick reply.

I added CORS configuration to my SSO server (Gitea) to no effect. I'm still getting the same CORS error. Because I don't have this issue with my other services, I have a feeling I'm just misconfiguring something in OpenCloud.

I've provided my configuration here. (The curly braced contents are there to redact my information.)

My environment variables

OC_URL=https://{my-server}
OC_OIDC_ISSUER=https://{my-sso-server}/
OC_EXCLUDE_RUN_SERVICES=idp
PROXY_OIDC_REWRITE_WELLKNOWN=true
PROXY_USER_OIDC_CLAIM=preferred_username
PROXY_USER_CS3_CLAIM=username
PROXY_AUTOPROVISION_ACCOUNTS=true
GRAPH_USERNAME_MATCH=none
PROXY_ROLE_ASSIGNMENT_DRIVER=oidc
PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM=groups
PROXY_TLS=false
PROXY_CSP_CONFIG_FILE_LOCATION=/etc/opencloud/csp.yaml
OC_ADMIN_USER_ID={admin-email}
OC_CORS_ALLOW_ORIGINS=https://{my-sso-server}/,
WEB_CORS_ALLOW_ORIGINS=https://{my-sso-server}/,
OC_INSECURE=false
MICRO_REGISTRY_ADDRESS=127.0.0.1:9233
NATS_NATS_HOST=0.0.0.0
NATS_NATS_PORT=9233

csp.yaml

directives:
  child-src:
    - '''self'''
  connect-src:
    - '''self'''
    - 'blob:'
    - 'https://raw.githubusercontent.com/opencloud-eu/awesome-apps/'
    - 'https://{my-sso-server}/'
    - 'https://{my-sso-server}/.well-known/openid-configuration'
  default-src:
    - '''none'''
  font-src:
    - '''self'''
  frame-src:
    - '''self'''
    - 'blob:'
    # This is needed for the external-sites web extension when embedding sites
    - 'https://docs.opencloud.eu'
  img-src:
    - '''self'''
    - 'data:'
    - 'blob:'
    - 'https://raw.githubusercontent.com/opencloud-eu/awesome-apps/'
  manifest-src:
    - '''self'''
  media-src:
    - '''self'''
  object-src:
    - '''self'''
    - 'blob:'
  script-src:
    - '''self'''
    - '''unsafe-inline'''
    - "https://{my-sso-server}/"
  style-src:
    - '''self'''
    - '''unsafe-inline'''
  worker-src:
    - '''self'''

Both my SSO server and OpenCloud are behind my Caddy web server. The base domains of my SSO server and OpenCloud differ. If there's anything else that can help, I can provide it.

[cj-wong]

A follow up:

I managed to narrow down the issue. It's not in the SSO server or OpenCloud, but rather I needed to set headers in Caddy to allow OpenCloud to access my Gitea SSO provider:

header {
    # Gitea UI does not load JS when default-src is not provided
    Content-Security-Policy "default-src: 'self';"
    # This is required when X-Frame-Options is set to DENY and SAMEORIGIN
    frame-ancestors https://{my-opencloud-server};
    Access-Control-Allow-Origin https://{my-opencloud-server}
}

However, I am having issues getting a role upon login. Debugging that now.

[cj-wong]

It looks like Gitea doesn't support iss claims as reported here: go-gitea/gitea#33681

So I'm going to just mark this as completed (configuration issue).