Identity and Access Management 🔐

OpenCloud delegates authentication to the central Keycloak realm and consumes user and group data from the central OpenLDAP directory. Local password login is disabled when services.sso.enabled is true (the default), and accounts are auto-provisioned on first OIDC login.

OIDC 🪪

Issuer URL: {{ OIDC.CLIENT.ISSUER_URL }}
Client ID: shared OIDC.CLIENT.ID (one Keycloak client per realm covers every web app)
Username claim: preferred_username, mapped to OpenCloud username
Role claim: groups (Keycloak group memberships flow into OpenCloud roles)
Auto-provisioning: enabled via PROXY_AUTOPROVISION_ACCOUNTS=true
Built-in IDP excluded via OC_EXCLUDE_RUN_SERVICES=idp

Verify OIDC discovery 🩺

make compose-exec cmd="container exec opencloud sh -c 'curl -fsS {{ OIDC.CLIENT.DISCOVERY_DOCUMENT }} | head -c 200'"

LDAP 📒

OpenCloud reads users from the central svc-db-openldap service.

URI: {{ LDAP.SERVER.URI }}
Bind DN: {{ LDAP.DN.ADMINISTRATOR.DATA }}
User base DN: {{ LDAP.DN.OU.USERS }}
Group base DN: {{ LDAP.DN.OU.GROUPS }}
User filter: (objectclass=inetOrgPerson)
Group filter: (objectclass=groupOfNames)

Members of the application_administrators group (per requirement 004) gain OpenCloud admin rights when they log in.

Verify LDAP wiring 🩺

make compose-exec cmd="container exec opencloud opencloud config get ldap"

Federation 🔗

If a Keycloak user is not present in OpenLDAP, OpenCloud auto-provisions the user on first login using the preferred_username claim. To keep usernames stable across Nextcloud, OpenCloud, and OpenTalk, all three apps share the same OIDC.CLIENT.REALM and the same LDAP.DN.OU.USERS source.

1.7 KiB Raw Permalink Blame History