Custom Attributes in Authentik OIDC
from Lem453@lemmy.ca to selfhosted@lemmy.world on 22 Feb 08:32
https://lemmy.ca/post/39544309
from Lem453@lemmy.ca to selfhosted@lemmy.world on 22 Feb 08:32
https://lemmy.ca/post/39544309
I’m trying to setup owncloud with single sign on using Authentik. I have it working for normal users. There is a feature that allows automatic role assignment to users so that admin users from authentik become admin users for owncloud.
This is described here: doc.owncloud.com/ocis/next/…/proxy.html#automatic….
In this document, they describe having attributes like
- role_name: admin claim_value: ocisAdmin
The problem I have is I don’t know how to input this information into an Authentik user. As a result, owncloud is giving me this error:
ERR Error mapping role names to role ids error="no roles in user claims" line=github.com/owncloud/ocis/v2/services/proxy/pkg/userroles/oidcroles.go:84 request-id=5a6d0e69-ad1b-4479-b2d9-30d4b4afb8f2 service=proxy userid=05b283cd-606c-424f-ae67-5d0016f2152c
Any authentik experts out there?
I tried putting this under the attributes section of the user profile in authentik:
role_name: admin claim_value: ocisAdmin
It doesn’t work and it won’t let me format YAML like the documentation where the claim_value is a child of the role_name.
threaded - newest
not an authentik user, but after skimming their docs i think you have to:
it might be that you also have to define somekind of mapper to include this in the informations owncloud receives from authentik, but as i said i only skimmed the docs and would personally just try it without the mapper.
tried this and also tried making a role in authentik assigned to the group called ocisAdmin and added the admin user to it, it still gives the same error. Seems like I need to define a proxy.yaml file in owncloud with the roles, I did this and it still doesn’t work.
Reminds me of the group limit attribute in nextcloud. You could try looking at the ‘Custom profile scope’ section of docs.goauthentik.io/integrations/…/nextcloud/ to see if it helps to work out what to do
this is great info, thanks. I don’t think its the issue right now, I think I need to define the roles in owncloud which I tried to do but it still doesn’t work. I’ll ask on the owncloud forums but these custom scopes might still be needed at some point. thanks.
Roles in authentik are for permissions in authentik. You want a group instead. Group memberships are send via OIDC.
tried this, created a group called ocisAdmin and added the admin user to it, it still gives the same error. Seems like I need to define a proxy.yaml file in owncloud with the roles, I did this and it still doesn’t work.