Steps to reproduce
- Deploy using the following helm values
- Try to login
- Im quite sure I configured something wrong on either the helm value or keycloak. The error messages arent really useful (to me). Please guide me on how to debug the issue
externalDomain: cloud.sub.domain.com
ingress:
enabled: true
ingressClassName: nginx
tls:
- secretName: wildcard-tls
hosts:
- cloud.sub.domain.com
services:
nats:
persistence:
enabled: true
search:
persistence:
enabled: true
storagesystem:
persistence:
enabled: true
accessModes:
- ReadWriteOnce
storageusers:
persistence:
enabled: true
accessModes:
- ReadWriteOnce
thumbnails:
persistence:
enabled: true
accessModes:
- ReadWriteOnce
web:
persistence:
enabled: true
accessModes:
- ReadWriteOnce
config:
oidc:
webClientID: "ocis"
features:
externalUserManagement:
enabled: true
oidc:
issuerURI: "https://login.domain.com/realms/myrealm"
userIDClaim: "preferred_username"
userIDClaimAttributeMapping: "username"
roleAssignment:
enabled: true
autoprovisionAccounts:
enabled: true
ldap:
user:
userNameMatch: "none"
logging:
level: "debug"
pretty: "true"
color: "true"
Expected behaviour
Able to login
Actual behaviour
Tell us what happens instead
Server configuration
Operating system:
Web server:
Database:
PHP version:
ownCloud version:
OCIS 6.3.0
Updated from an older ownCloud or fresh install:
Fresh
Where did you install ownCloud from:
Client configuration
Browser:
Brave
Operating system:
Ubuntu 24.04
Logs
Web server error log
DBG rewrite hook found line=github.com/owncloud/ocis/v2/services/proxy/pkg/router/router.go:222 method=GET path=/ocs/v1.php/cloud/capabilities policy=ocis prefix=/ocs/ routeType=prefix service=proxy
2024-09-07T13:00:04Z DBG parsed access token access token={"aud":["account"],"exp":1725714304,"iat":1725714004,"iss":"https://login.domain.com/realms/myrealm","jti":"aba2a446-a298-4f88-8126-5e5c3bdb2615","sid":"f8d0ab9e-66b5-47c4-be8c-a17e2855700d","sub":"sub"} line=github.com/owncloud/ocis/v2/ocis-pkg/oidc/client.go:305 service=proxy
2024-09-07T13:00:04Z DBG Expiration Time from access_token exp="2024-09-07 13:05:04 +0000 UTC" line=github.com/owncloud/ocis/v2/services/proxy/pkg/middleware/oidc_auth.go:141 service=proxy
2024-09-07T13:00:04Z DBG extracted claims claims={"allowed-origins":["https://cloud.sub.domain.com"],"aud":"account","auth_time":1725706475,"azp":"ocis","email":"name@internal.domain.com","email_verified":false,"exp":1725714304,"family_name":"lastname","given_name":"name","group":["/AccountingGroup/AccountingUserGroup/AccountingAdminGroup","/MinioReadOnly","/SuperAdminGroup"],"iat":1725714004,"iss":"https://login.domain.com/realms/myrealm","jti":"aba2a446-a298-4f88-8126-5e5c3bdb2615","name":"name lastname","preferred_username":"name","realm_access":{"roles":["ocisAdmin"]},"resource_access":{"account":{"roles":["manage-account","manage-account-links","view-profile"]}},"roles":["ocisAdmin"],"scope":"openid profile groups email","sid":"f8d0ab9e-66b5-47c4-be8c-a17e2855700d","sub":"sub","typ":"Bearer"} line=github.com/owncloud/ocis/v2/services/proxy/pkg/middleware/oidc_auth.go:131 service=proxy
2024-09-07T13:00:04Z DBG successfully authenticated request authenticator=oidc line=github.com/owncloud/ocis/v2/services/proxy/pkg/middleware/oidc_auth.go:200 path=/ocs/v1.php/cloud/capabilities service=proxy
2024-09-07T13:00:04Z DBG User by claim not found claim=preferred_username line=github.com/owncloud/ocis/v2/services/proxy/pkg/middleware/account_resolver.go:117 service=proxy value=name
2024-09-07T13:00:04Z DBG Autoprovisioning user claims={"allowed-origins":["https://cloud.ppcl.platwo.com"],"aud":"account","auth_time":1725706475,"azp":"ocis","email":"name@internal.platwo.com","email_verified":false,"exp":1725714304,"family_name":"lastname","given_name":"name","group":["/AccountingGroup/AccountingUserGroup/AccountingAdminGroup","/MinioReadOnly","/SuperAdminGroup"],"iat":1725714004,"iss":"https://login.platwo.com/realms/ppcl","jti":"aba2a446-a298-4f88-8126-5e5c3bdb2615","name":"name lastname","preferred_username":"name","realm_access":{"roles":["Accounting_User_Role","Super_Admin_Role","offline_access","Accounting_Viewer_Role","uma_authorization","default-roles-ppcl","ocisAdmin","Accounting_Admin_Role"]},"resource_access":{"account":{"roles":["manage-account","manage-account-links","view-profile"]}},"roles":["ocisAdmin"],"scope":"openid profile groups email","sid":"f8d0ab9e-66b5-47c4-be8c-a17e2855700d","sub":"sub","typ":"Bearer"} line=github.com/owncloud/ocis/v2/services/proxy/pkg/middleware/accoufnt_resolver.go:123 service=proxy
2024-09-07T13:00:04Z WRN Error Response OData Error="failed to add user" line=github.com/owncloud/ocis/v2/services/proxy/pkg/user/backend/cs3.go:464 service=proxy
2024-09-07T13:00:04Z ERR Error creating user error="500 Internal Server Error" line=github.com/owncloud/ocis/v2/services/proxy/pkg/user/backend/cs3.go:214 service=proxy
2024-09-07T13:00:04Z ERR Autoprovisioning user failed error="500 Internal Server Error" line=github.com/owncloud/ocis/v2/services/proxy/pkg/middleware/account_resolver.go:126 service=proxy