How to configure (Admin) Role Mapping with OpenCloud, Authelia and LLDAP

[therealschosch]

Solution: How to configure (Admin) Role Mapping with OpenCloud, Authelia and LLDAP

For anyone stumbling over the same issue, here is the solution on how to correctly map the Admin role via OIDC from LLDAP through Authelia to OpenCloud.

The core realization: OpenCloud does not have a local "bypass" admin login when OIDC is enabled. It strictly relies on the OIDC token claims provided by Authelia. To make a user an Admin, Authelia must send a specific group in the groups claim, and OpenCloud must be configured to evaluate this claim.

Architecture Overview
Here is a quick look at the setup:

+-------------------------------------------------------------+
|                       User Browser                          |
+-----------------------------+-------------------------------+
                              | HTTPS
+-----------------------------v-------------------------------+
|                  Caddy (Reverse Proxy)                      |
+---------+-------------------+-------------------+-----------+
          |                   |                   |
    auth.example.net    cloud.example.net         |
          |                   |                   |
+---------v-------+   +-------v-------+   +-------v-------+
|                 |   |               |   |               |
|    Authelia     |   |   OpenCloud   |   |     LLDAP     |
|   (OIDC IDP)    |   | (OIDC Client) |   | (User Backend)|
|                 |   |               |   |               |
+---------+-------+   +---------------+   +-------+-------+
          |                                       |
          +---------------------------------------+
                LDAP bind & group resolution

Step-by-Step Configuration

1. LLDAP:
Create a group in LLDAP (e.g., admin) and assign your administrator user to this group. This group will be passed down the chain.

2. Authelia (configuration.yml):
Ensure that Authelia fetches the groups from LLDAP and that your OpenCloud OIDC client is allowed to request the groups scope.
In your OIDC clients section for OpenCloud, make sure the scopes look like this:

identity_providers:
  oidc:
    clients:
      - client_id: opencloud
        # ... other settings ...
        scopes:
          - openid
          - profile
          - email
          - groups

3. OpenCloud (docker-compose.yml):
You need to explicitly tell the OpenCloud proxy to use the OIDC token to assign roles. By default, OpenCloud/oCIS grants the Admin role to users who are members of the admin group.
Add the following environment variables to your OpenCloud container:

environment:
  # Enable role mapping via OIDC
  - PROXY_ROLE_ASSIGNMENT_DRIVER=oidc
  - PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM=groups
  
  # Ensure the web frontend and backend request the correct scopes
  - WEB_OIDC_SCOPE=openid profile email groups
  - OIDC_SCOPES=openid profile email groups

How it works:
When your user logs in, Authelia authenticates against LLDAP and reads the group membership (admin). Authelia creates an OIDC token containing the claim "groups": ["admin"]. When OpenCloud receives this token, the Proxy evaluates the groups claim (PROXY_ROLE_ASSIGNMENT_DRIVER=oidc). Because the user is in the admin group, OpenCloud automatically elevates the user's role to Administrator, giving you access to the Admin Settings in the UI.