OCIS 8.1 with ldap and nginx .. help for config

Server
1

Dear all,
I’d like to test owncloud-is version 8.1 in a virtual machine
almalinux 9.8 with 32GB of RAM, 4 cores, a 50GB root disk, and
a 1.3TB disk for owncloud-is data (/owncloud).

I need help creating a test instance that is integrated with LDAP and

uses Nginx as a proxy for web access.

I ran a first test using ocis --init and setting some variables in the ocis.env

OCIS_URL=https://a.b.c.d

# Logging

OCIS_LOG_LEVEL=info

# Configurazione

OCIS_CONFIG_DIR=/etc/ocis

# Metadata interni

OCIS_BASE_DATA_PATH=/owncloud/ocis/metadata

# Storage utenti

STORAGE_USERS_DRIVER=posix

STORAGE_USERS_POSIX_ROOT=/owncloud/ocis/data

#SECRET
OCIS_JWT_SECRET=
OCIS_TRANSFER_SECRET=
OCIS_SYSTEM_USER_API_KEY=
OCIS_MACHINEAUTH_API_KEY=
# Reverse proxy HTTPS

PROXY_TLS=false

PROXY_HTTP_ADDR=0.0.0.0:9200

#OCIS_EXCLUDE_RUN_SERVICES=idm
OCIS_EXCLUDE_RUN_SERVICES=idm

GRAPH_LDAP_URI=ldap://1.2.3.4:389
GRAPH_LDAP_STARTTLS=true
GRAPH_LDAP_BIND_DN=cn=XXXXXX,dc=pg,dc=infn,dc=it
GRAPH_LDAP_BIND_PASSWORD=
GRAPH_LDAP_USER_BASE_DN=ou=people,dc=infn,dc=it
GRAPH_LDAP_USER_FILTER=(isMemberOf=g:infn:pg:owncloud:users::*)
GRAPH_USERNAME_MATCH=none
GRAPH_LDAP_USER_SCHEMA_USERNAME=uid
GRAPH_LDAP_USER_SCHEMA_MAIL=mail
GRAPH_LDAP_USER_SCHEMA_DISPLAYNAME=cn
GRAPH_LDAP_USER_SCHEMA_ID=infnUUID
GRAPH_ASSIGN_DEFAULT_ROLE_TO_ALL_USERS=true
GRAPH_DEFAULT_ROLE=user
GRAPH_LDAP_ROLE_MAPPING=none

#REDIS
OCIS_CACHE_STORE=redis
OCIS_CACHE_STORE_NODES=127.0.0.1:6379
STORAGE_USERS_ID_CACHE_STORE=redis
STORAGE_USERS_ID_CACHE_STORE_NODES=127.0.0.1:6379

# IDP LDAP authentication

IDP_LDAP_URI=ldap://1.2.3.4:389
IDP_LDAP_STARTTLS=true
IDP_LDAP_BIND_DN=cn=XXXXXX,dc=pg,dc=infn,dc=it
IDP_LDAP_BIND_PASSWORD=
IDP_LDAP_BASE_DN=ou=people,dc=infn,dc=it
IDP_LDAP_LOGIN_ATTRIBUTE=uid
IDP_LDAP_UUID_ATTRIBUTE=infnUUID
IDP_LDAP_UUID_ATTRIBUTE_TYPE=string
IDP_LDAP_USER_SCHEMA_USERNAME=uid

GRAPH_LDAP_INSECURE=false
GRAPH_LDAP_CACERT=/etc/ocis/certs/ds1_ca.pem
IDP_LDAP_CACERT=/etc/ocis/certs/ds1_ca.pem
AUTH_BASIC_LDAP_CACERT=/etc/ocis/certs/ds1_ca.pem
GROUPS_LDAP_CACERT=/etc/ocis/certs/ds1_ca.pem

#
PROXY_USER_OIDC_CLAIM=preferred_username
PROXY_USER_CS3_CLAIM=username

These are other details of my installation:
user ocis, home directory /opt/ocis
env file /etc/ocis/ocis.env
yaml file /etc/ocis/ocis.yaml
ocis exec /usr/local/bin/ocis

This is nginx config:

server {

    listen 443 ssl http2;
    server_name A.B.C.D;

    ssl_certificate     /etc/pki/tls/certs/server.pem;
    ssl_certificate_key /etc/pki/tls/private/server.key;

    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:10m;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers off;

    client_max_body_size 50G;
    proxy_read_timeout 3600;
    proxy_send_timeout 3600;
    proxy_connect_timeout 300;

    location / {

        proxy_pass http://127.0.0.1:9200;

        proxy_http_version 1.1;

        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Port 443;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

               proxy_buffering on;
        proxy_buffers 16 16k;
        proxy_buffer_size 32k;
        proxy_max_temp_file_size 0; 
    }

}
server {

    listen 80;

    server_name A.B.C.D;

    return 301 https://$host$request_uri;

}

The current setup isn’t working well. I’m getting errors when logging in:

Jul 15 12:15:34 owncloud-is ocis[25134]: {"level":"error","service":"proxy","remoteAddr":"1.1.1.1","request-id":"","proto":"HTTP/1.1","method":"GET","path":"/js/chunks/locale-DicwRaQd.mjs","query":"","fragment":"","error":"context canceled","time":"2026-07-15T12:15:34+02:00","line":"github.com/owncloud/ocis/v2/services/proxy/pkg/proxy/proxy.go:53","message":"error happened in MultiHostReverseProxy"}
Jul 15 12:15:34 owncloud-is ocis[25134]: {"level":"info","service":"proxy","proto":"HTTP/1.1","request-id":"A.B.C.C/TgubzHOlT8-000061","traceid":"95004504848fdb7954f72edb886d73d2","remote-addr":"1.1.1.1","method":"GET","status":502,"path":"/js/chunks/locale-DicwRaQd.mjs","duration":0.226554,"bytes":0,"time":"2026-07-15T12:15:34+02:00","line":"github.com/owncloud/ocis/v2/services/proxy/pkg/middleware/accesslog.go:34","message":"access-log"}

Jul 15 12:16:12 owncloud-is ocis[25134]: {"level":"error","service":"proxy","error":"failed to verify access token: token has invalid claims: token is expired","authenticator":"oidc","path":"/ocs/v2.php/cloud/capabilities","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0","client.address":"1.1.1.1","network.peer.address":"","network.peer.port":"","time":"2026-07-15T12:16:12+02:00","line":"github.com/owncloud/ocis/v2/services/proxy/pkg/middleware/oidc_auth.go:198","message":"failed to authenticate the request"}
Jul 15 12:16:12 owncloud-is ocis[25134]: {"level":"info","service":"frontend","pkg":"rhttp","traceid":"bc329828447747963322049e2a589b3e","time":"2026-07-15T12:16:12+02:00","line":"github.com/owncloud/reva/v2@v2.0.0-20260702095801-b6833225e5d0/internal/http/interceptors/auth/auth.go:247","message":"skipping auth check for: /ocs/v2.php/cloud/capabilities"}
Jul 15 12:16:12 owncloud-is ocis[25134]: {"level":"info","service":"proxy","proto":"HTTP/1.1","request-id":"6c8578b6-97bc-4fbc-8f7e-4c64308afd66","traceid":"049a9b099ce7b1794ef1c24b32b8a4e1","remote-addr":"1.1.1.1","method":"GET","status":200,"path":"/ocs/v2.php/cloud/capabilities","duration":68.585949,"bytes":3428,"time":"2026-07-15T12:16:12+02:00","line":"github.com/owncloud/ocis/v2/services/proxy/pkg/middleware/accesslog.go:34","message":"access-log"}
Jul 15 12:16:12 owncloud-is ocis[25134]: {"level":"error","service":"proxy","error":"failed to verify access token: token has invalid claims: token is expired","authenticator":"oidc","path":"/api/v0/settings/roles-list","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0","client.address":"1.1.1.1","network.peer.address":"","network.peer.port":"","time":"2026-07-15T12:16:12+02:00","line":"github.com/owncloud/ocis/v2/services/proxy/pkg/middleware/oidc_auth.go:198","message":"failed to authenticate the request"}
Jul 15 12:16:12 owncloud-is ocis[25134]: {"level":"info","service":"proxy","proto":"HTTP/1.1","request-id":"2645d7a3-a435-4ca2-9750-935af2f53ecf","traceid":"aad2720ead6fb64152eca97e62823d5a","remote-addr":"1.1.1.1","method":"POST","status":401,"path":"/api/v0/settings/roles-list","duration":0.611414,"bytes":0,"time":"2026-07-15T12:16:12+02:00","line":"github.com/owncloud/ocis/v2/services/proxy/pkg/middleware/accesslog.go:34","message":"access-log"}
Jul 15 12:16:12 owncloud-is ocis[25134]: {"level":"error","service":"proxy","error":"failed to verify access token: token has invalid claims: token is expired","authenticator":"oidc","path":"/graph/v1.0/me","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0","client.address":"1.1.1.1","network.peer.address":"","network.peer.port":"","time":"2026-07-15T12:16:12+02:00","line":"github.com/owncloud/ocis/v2/services/proxy/pkg/middleware/oidc_auth.go:198","message":"failed to authenticate the request"}
Jul 15 12:16:12 owncloud-is ocis[25134]: {"level":"info","service":"proxy","proto":"HTTP/1.1","request-id":"247a81ef-0ac4-422a-8e47-97833a39ee83","traceid":"47e8299f52b09fd4380ced3c1fe4496e","remote-addr":"1.1.1.1","method":"GET","status":401,"path":"/graph/v1.0/me","duration":0.690132,"bytes":0,"time":"2026-07-15T12:16:12+02:00","line":"github.com/owncloud/ocis/v2/services/proxy/pkg/middleware/accesslog.go:34","message":"access-log"}

I’d like to know if there’s a web-based procedure for compiling the
configuration files, or if I have to use a vi editor.

I’d like to know if it’s important to have the ocis.yaml file and if the one
I’m using is correct.

token_manager:
  jwt_secret:
machine_auth_api_key: d
system_user_api_key: d
transfer_secret:
system_user_id: 827f4450-e319-4c44-922d-312ae9cfb7f8
admin_user_id: 2e0b3697-3017-4150-9c0b-71f7b6999f96
graph:
  application:
    id: 259edd28-659c-4d6b-977d-5b1d162e3544
  events:
    tls_insecure: false
  spaces:
    insecure: false
  identity:
    ldap:
      bind_password:
  service_account:
    service_account_id: 1917543b-543b-41bb-906f-4c62fa29b0cd
    service_account_secret:
idp:
  ldap:
    bind_password:
    uri: ldap://1.2.3.4:389
    uuid_attribute: infnUUID
    uuid_attribute_type: string
    login_attribute: uid
idm:
  service_user_passwords:
    admin_password:
    idm_password:
    reva_password:
    idp_password:
collaboration:
  wopi:
    secret:
  app:
    insecure: false
proxy:
  oidc:
    insecure: false
  insecure_backends: false
  service_account:
    service_account_id: 1917543b-543b-41bb-906f-4c62fa29b0cd
    service_account_secret:
frontend:
  app_handler:
    insecure: false
  archiver:
    insecure: false
  service_account:
    service_account_id: 1917543b-543b-41bb-906f-4c62fa29b0cd
    service_account_secret:
auth_basic:
  auth_providers:
    ldap:
      bind_password:
auth_bearer:
  auth_providers:
    oidc:
      insecure: false
users:
  drivers:
    ldap:
      bind_password:
groups:
  drivers:
    ldap:
      bind_password:
ocdav:
  insecure: false
ocm:
  service_account:
    service_account_id: 1917543b-543b-41bb-906f-4c62fa29b0cd
    service_account_secret:
thumbnails:
  thumbnail:
    transfer_secret:
    webdav_allow_insecure: false
    cs3_allow_insecure: false
search:
  events:
    tls_insecure: false
  service_account:
    service_account_id: 1917543b-543b-41bb-906f-4c62fa29b0cd
    service_account_secret:
audit:
  events:
    tls_insecure: false
settings:
  service_account_ids:
  - 1917543b-543b-41bb-906f-4c62fa29b0cd
sharing:
  events:
    tls_insecure: false
storage_users:
  events:
    tls_insecure: false
  mount_id: 563f1e8e-6179-44bf-a532-e6ca7dafd6c3
  service_account:
    service_account_id: 1917543b-543b-41bb-906f-4c62fa29b0cd
    service_account_secret:
notifications:
  notifications:
    events:
      tls_insecure: false
  service_account:
    service_account_id: 1917543b-543b-41bb-906f-4c62fa29b0cd
    service_account_secret:
nats:
  nats:
    tls_skip_verify_client_cert: false
gateway:
  storage_registry:
    storage_users_mount_id: 563f1e8e-6179-44bf-a532-e6ca7dafd6c3
userlog:
  service_account:
    service_account_id: 1917543b-543b-41bb-906f-4c62fa29b0cd
    service_account_secret
auth_service:
  service_account:
    service_account_id: 1917543b-543b-41bb-906f-4c62fa29b0cd
    service_account_secret:
clientlog:
  service_account:
    service_account_id: 1917543b-543b-41bb-906f-4c62fa29b0cd
    service_account_secret:
activitylog:
  service_account:
    service_account_id: 1917543b-543b-41bb-906f-4c62fa29b0cd
    service_account_secret:

Thank you in advance for your help.

Best Regards

Enrico

2

If you want to test it, I’d recommend you to use docker and one of the deployment examples in the repo ( ocis/deployments/examples at master · owncloud/ocis · GitHub ) . The ocis_full has several features that are “easy” to setup.

I think Install Infinite Scale on a Server :: Documentation for ownCloud (A Kiteworks Company) is the relevant documentation. Instructions are for ubuntu, but oCIS will run inside docker containers, so you can use any other linux distribution.

Once you’re convinced to use oCIS, you can start replacing some components one by one until you have the setup you want.

Some additional notes:

  • oCIS spawn quite a bunch of services in the 9200-9399 port range. It’s unlikely that you have something running on those ports, but running oCIS with docker will prevent surprises.
  • There is no official support for nginx. You can replace / use nginx instead of traefik, but you’ll likely need to “translate” the traefik setup to nginx. It should work, but there could be problems, that’s why the recommendation is to setup oCIS with traefik first to ensure oCIS works, and then move to nginx.
  • If you want to use your own LDAP server, ownCloud uses custom attributes that are part of a custom schema ( ocis/deployments/examples/ocis_ldap/config/ldap/schemas/10_owncloud_schema.ldif at master · owncloud/ocis · GitHub ) . The default setup assumes that those attributes are available, so you’ll need to either import the custom schema, or remap the related variables to point to other attributes (importing the schema is the recommended approach). There is an ocis_ldap setup in the deployment example that you can also check.

I think that’s mostly all. As said, I’d recommend you to check one of the deployment example first and work from there.

3

Dear @jvillafanez dear all

I would like to know if after activating a test instance with docker

I can configure OCIS via web interface by enabling ldap as authenticator

and other modules that I need ?

Thanks

Bye

Enrico

4

I don’t think so. You’ll probably have to decommission the instance and then switch the authentication.

What is important is that you can start and stop the whole service stack very easily, Once you have the instance running, you can destroy the instance, make some adjustments in the docker-compose file (basically setting up your external LDAP) and then bring up a new fresh instance. If something breaks, you’ll know it’s because of one of the new changes you’ve made.

I’m not sure what you’re referring to… I don’t think there is much to configure from the web UI, but there shouldn’t be any changes if the configuration is the same.

Just to clarify, what I said in the previous post is to use an external and already-existing LDAP server, the same LDAP server that you could use for other services. If you don’t need that, you can just let oCIS handle the data internally. The setup is much easier (pretty much a default setup), although the users will be oCIS exclusive.