Skip to main content

Integrate with OpenCloud

Support level: Community

What is OpenCloud?​

OpenCloud is an open-source content collaboration platform for storing, syncing, and sharing files, built on the Infinite Scale (oCIS) architecture.

-- https://opencloud.eu

Preparation​

The following placeholders are used in this guide:

  • opencloud.company is the FQDN of the OpenCloud installation.
  • authentik.company is the FQDN of the authentik installation.

This guide covers integrating authentik with the opencloud-compose Docker deployment. OpenCloud only supports authentication via OpenID Connect (OIDC).

Choose your setup below. The Web only tab logs in through the browser. The Web, desktop & mobile tab also enables the native sync clients, which each use a distinct client ID and require some extra issuer configuration.

authentik configuration​

  1. Log in to authentik as an administrator and open the Admin interface.
  2. Navigate to Applications > Applications and click New Application.
    • Application: provide a name and note the slug.
    • Choose a Provider type: select OAuth2/OpenID Connect.
    • Configure the Provider:
      • Client type: Public
      • Client ID: web
      • Redirect URIs:
        • Strict: https://opencloud.company/oidc-callback.html
        • Strict: https://opencloud.company/oidc-silent-redirect.html
        • Strict: https://opencloud.company/
      • Signing Key: select any available key.
      • Scopes: openid, profile, email.
  3. Click Submit.

OpenCloud configuration​

In the opencloud-compose project, enable the external IdP overlay in COMPOSE_FILE. This replaces OpenCloud's built-in IdP, so login goes through authentik only.

COMPOSE_FILE=docker-compose.yml:idm/external-idp.yml:custom/authentik-roles.yml

Set the OIDC values in .env:

OC_DOMAIN=opencloud.company
IDP_DOMAIN=authentik.company
IDP_ISSUER_URL=https://authentik.company/application/o/<application_slug>/
OC_OIDC_CLIENT_ID=web
OC_OIDC_CLIENT_SCOPES=openid profile email
WEBFINGER_WEB_OIDC_CLIENT_ID=web
WEBFINGER_WEB_OIDC_CLIENT_SCOPES=openid profile email
info

WEBFINGER_WEB_OIDC_CLIENT_ID is required as the Web UI reads its client ID from WebFinger, and login will not start if it is empty.

Create custom/authentik-roles.yml to assign every user the default role:

---
services:
    opencloud:
        environment:
            PROXY_ROLE_ASSIGNMENT_DRIVER: "default"
            GRAPH_ASSIGN_DEFAULT_USER_ROLE: "true"

Then reboot your docker containers.

Configuration verification​

Open https://opencloud.company in a new browser window. You are redirected to authentik to log in, and after authenticating you are returned to OpenCloud.

Resources​