Authelia: Problem with user roles

I have integrated Opencloud with Authelia. In web everything is working, but in desktop I get following error in server when I try to login:

opencloud  | 2025-04-18T18:50:48Z ERR Error mapping role names to role ids error="no roles in user claims" line=github.com/opencloud-eu/opencloud/services/proxy/pkg/userroles/oidcroles.go:84 request-id=58733e08-061f-4caa-876a-d68132cb6a09 service=proxy userid=e15359ea-ef03-4785-8cb3-564a93372e6d
opencloud  | 2025-04-18T18:50:48Z ERR Could not get user roles error="no roles in user claims" line=github.com/opencloud-eu/opencloud/services/proxy/pkg/middleware/account_resolver.go:174 service=proxy

It seems Opencloud is not retrieving correctly the claims from Authelia, but I don't know why. I have followed integration with external OIDC doc and checked troubleshooting page but didn't find my issue.

My Authelia users configuration (only web and desktop part, used my ocis config as reference to build it) is

      - client_id: web
        client_name: 'OpenCloud web'
        public: true
        redirect_uris:
          - 'https://opencloud.tld/'
          - 'https://opencloud.tld/oidc-callback.html'
          - 'https://opencloud.tld/oidc-silent-redirect.html'
      - client_id: 'OpenCloudDesktop'
        client_name: 'openCloud desktop client'
        public: true
        scopes:
          - openid
          - groups
          - profile
          - email
          - offline_access
        redirect_uris:
          - http://127.0.0.1
          - http://localhost
        grant_types:
          - refresh_token
          - authorization_code

I think you might need to add PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM=groups to the environment of your OpenCloud docker-compose.

I added mentioned line but nothing changed. I have role mapping defined in proxy.yml. I noticed this line that may help:

DBG extracted claims claims={"email":"myemail@mail.com","email_verified":true,"exp":XXX,"name":"Carlos","preferred_username":"carlos","sub":"XXX","updated_at":1745493612} line=github.com/opencloud-eu/opencloud/services/proxy/pkg/middleware/oidc_auth.go:135 service=proxy

This line is the same one but when I access in web (and everything works) where groups are retrieved and printed:

DBG extracted claims claims={"email":"myemail@mail.com","email_verified":true,"exp":XXX,"groups":["others","opencloud-admin"],"name":"Carlos","preferred_username":"carlos","sub":"XXX","updated_at":1745495030} line=github.com/opencloud-eu/opencloud/services/proxy/pkg/middleware/oidc_auth.go:135 service=proxy

It seems either Authelia is not sending roles to OpenCloud or OpenCloud desktop is not handling them correctly.

The problem is that the desktop client does not request the groups scope, so it is never put into the token. This means that when the token is sent to the server, it can't do role mapping, because there are no roles in the token.

Can someone confim, that iOS App (and maybe Android too?) is suffering from the same issue?

I'm facing the same issue in iOS app too

I just wish they'd just implement a native 2fa solution because I ran into the same problems. Web was working fine with authelia, desktop client app and iOS / iPadOS no access....

This issue was marked stale because it has been open for 30 days with no activity. Remove the stale label or comment or this will be closed in 7 days.

Not stale

Exact same thing is happening to me too. Web works fine, desktop doesn't. Using authelia too.

fix: request groups for oidc (opencloud-eu#217)

I think you might need to add PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM=groups to the environment of your OpenCloud docker-compose.

Has anyone tried to apply this setting?

I think you might need to add PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM=groups to the environment of your OpenCloud docker-compose.

Has anyone tried to apply this setting?

I did:

I added mentioned line but nothing changed. I have role mapping defined in proxy.yml. I noticed this line that may help:
DBG extracted claims claims={"email":"myemail@mail.com","email_verified":true,"exp":XXX,"name":"Carlos","preferred_username":"carlos","sub":"XXX","updated_at":1745493612} line=github.com/opencloud-eu/opencloud/services/proxy/pkg/middleware/oidc_auth.go:135 service=proxy
This line is the same one but when I access in web (and everything works) where groups are retrieved and printed:
DBG extracted claims claims={"email":"myemail@mail.com","email_verified":true,"exp":XXX,"groups":["others","opencloud-admin"],"name":"Carlos","preferred_username":"carlos","sub":"XXX","updated_at":1745495030} line=github.com/opencloud-eu/opencloud/services/proxy/pkg/middleware/oidc_auth.go:135 service=proxy
It seems either Authelia is not sending roles to OpenCloud or OpenCloud desktop is not handling them correctly.

Nothing changed

Would somebody put a branch on our compose project with a working or semi working authelia setup?

That would enable us to collaborate on a solution.

@miberecz

@miberecz your WEB_OIDC_SCOPE are malformed

they should look like:

WEBFINGER_WEB_OIDC_CLIENT_SCOPES: 'openid,profile,email,groups'
WEBFINGER_IOS_OIDC_CLIENT_SCOPES: 'openid,profile,email,groups,offline_access'

@miberecz your WEB_OIDC_SCOPE are malformed

they should look like:

WEBFINGER_WEB_OIDC_CLIENT_SCOPES: 'openid,profile,email,groups'
WEBFINGER_IOS_OIDC_CLIENT_SCOPES: 'openid,profile,email,groups,offline_access'

Ah okay, nice catch I'm missing the offline_access

Actually, never had any problems to make me review this part.

But since we are here, would I need all kind of *_CLIENT_SCOPES?
IOS, Android, Web, Desktop?
https://docs.opencloud.eu/docs/dev/server/services/webfinger/environment-variables/

Actually, never had any problems to make me review this part.

Are you sure? what is the result of:

curl -L https://cloud.mydomain.com/.well-known/webfinger?resource=https://cloud.opencloud.test&rel=http://openid.net/specs/connect/1.0/issuer&platform=desktop | jq

(change platform to whatever you wanna test)

But since we are here, would I need all kind of *_CLIENT_SCOPES?

If you use them sure

And lastly, you shouldnt set PROXY_ROLE_ASSIGNMENT_DRIVER to default but oidc if you use Authelia groups as OpenCloud roles. It works perfectly with it at least on web and iOS.

@micbar

Would somebody put a branch on our compose project with a working or semi working authelia setup?

That would enable us to collaborate on a solution.

@micbar I started on this, ported my setup to match the opencloud-compose structure, but I cannot create branches there. If you make one, I'm glad to commit my work so far.

The normal contributor workflow on OSS projects is fork -> create pull request

The normal contributor workflow on OSS projects is fork -> create pull request

here you go opencloud-eu/opencloud-compose#279

I just updated the iOS app on my phone and read about some OIDC improvements. So I went to work and tested it. What can I say: Web and iOS work! The desktop still does not work for me. Here are the important parts of my current setup:

I am running

Component	Version
OC server	6.1.0
iOS client	1.2.1
desktop client	3.0.3.2073 (AppImage, downloaded from GitHub release)

Warning

I might be doing something wrong with the desktop client. Please let me know in case you spot a configuration issue.

To the dev team: If I can be of further assitance, please let me know :)

OC Configuration Files

# /etc/opencloud/proxy.yaml
role_assignment:
  driver: oidc
  oidc_role_mapper:
    role_claim: groups
    role_mapping:
      - role_name: admin
        claim_value: admin
      - role_name: user
        claim_value: user
      - role_name: guest
        claim_value: guest

OC environment variables

OC_EXCLUDE_RUN_SERVICES: idp
OC_LDAP_SERVER_WRITE_ENABLED: 'true'
OC_OIDC_ISSUER: https://<AUTHELIA URI>
OC_ADMIN_USER_ID: ''
SETTINGS_SETUP_DEFAULT_ASSIGNMENTS: 'false'

EXTERNAL_OIDC_DOMAIN: <AUTHELIA URI>

PROXY_AUTOPROVISION_ACCOUNTS: 'true'
PROXY_AUTOPROVISION_CLAIM_USERNAME: preferred_username
PROXY_AUTOPROVISION_CLAIM_EMAIL: email
PROXY_AUTOPROVISION_CLAIM_DISPLAYNAME: name
PROXY_AUTOPROVISION_CLAIM_GROUPS: groups

PROXY_ENABLE_BASIC_AUTH: 'false'

PROXY_OIDC_REWRITE_WELLKNOWN: 'true'
PROXY_OIDC_ACCESS_TOKEN_VERIFY_METHOD: none

PROXY_ROLE_ASSIGNMENT_DRIVER: oidc

PROXY_USER_OIDC_CLAIM: preferred_username
PROXY_USER_CS3_CLAIM: username

GRAPH_ASSIGN_DEFAULT_USER_ROLE: 'false'
GRAPH_USERNAME_MATCH: none

WEBFINGER_WEB_OIDC_CLIENT_ID: OpenCloudWeb
WEBFINGER_WEB_OIDC_CLIENT_SCOPES: openid profile email groups

WEBFINGER_DESKTOP_OIDC_CLIENT_ID: OpenCloudDesktop
WEBFINGER_DESKTOP_OIDC_CLIENT_SCOPES: openid profile email groups offline_access

WEBFINGER_IOS_OIDC_CLIENT_ID: OpenCloudIOS
WEBFINGER_IOS_OIDC_CLIENT_SCOPES: openid profile email groups offline_access

Authelia OpenID configuration

      # -----------------------------------------------------------------------
      # OpenCloud (file storage)
      # https://docs.opencloud.eu/docs/next/admin/configuration/authentication-and-user-management/external-idp
      # -----------------------------------------------------------------------
      - client_id: OpenCloudWeb
        client_name: OpenCloud Web
        public: true
        redirect_uris:
          - https://<OC URI>/
          - https://<OC URI>/oidc-callback.html
          - https://<OC URI>/oidc-silent-redirect.html
        scopes:
          - openid
          - profile
          - email
          - groups
        authorization_policy: allow_users
        consent_mode: implicit
        require_pkce: true
        pkce_challenge_method: S256
        token_endpoint_auth_method: none

      - client_id: OpenCloudDesktop
        client_name: OpenCloud Desktop
        public: true
        redirect_uris:
          - http://127.0.0.1
          - http://localhost
        scopes:
          - openid
          - profile
          - email
          - groups
          - offline_access
        response_types:
          - code
        grant_types:
          - refresh_token
          - authorization_code
        response_modes:
          - form_post
          - query
          - fragment
        authorization_policy: allow_users
        consent_mode: implicit
        require_pkce: true
        pkce_challenge_method: S256

      - client_id: OpenCloudIOS
        client_name: OpenCloud iOS
        public: true
        redirect_uris:
          - oc://ios.opencloud.eu
          - oc.ios://ios.opencloud.com
        scopes:
          - openid
          - profile
          - email
          - groups
          - offline_access
        response_types:
          - code
        grant_types:
          - refresh_token
          - authorization_code
        response_modes:
          - form_post
          - query
          - fragment
        authorization_policy: allow_users
        consent_mode: implicit
        require_pkce: true
        pkce_challenge_method: S256

I see the following warnings in the log (but likely unrelated)

{"level":"warn","service":"frontend","host.name":"opencloud","pkg":"rhttp","traceid":"9f1e299eb72bfd939aa9e7285f8d09cf","time":"2026-05-06T23:30:40+02:00","line":"github.com/opencloud-eu/reva/v2@v2.43.0/internal/http/interceptors/auth/auth.go:248","message":"core access token not set"}

Then there are errors (after logging into web and iOS)

{"level":"error","service":"proxy","remoteAddr":"10.0.10.20","request-id":"","proto":"HTTP/1.1","method":"GET","path":"/themes/opencloud/assets/favicon.svg","query":"","fragment":"","error":"context canceled","time":"2026-05-06T23:30:28+02:00","line":"github.com/opencloud-eu/opencloud/services/proxy/pkg/proxy/proxy.go:52","message":"error happened in MultiHostReverseProxy"}
{"level":"error","service":"proxy","error":"invalid key format","time":"2026-05-06T23:30:40+02:00","line":"github.com/opencloud-eu/opencloud/services/proxy/pkg/middleware/oidc_auth.go:128","message":"failed to build subject.session"}

Now, when I try to log into the desktop app, I see the following errors

{"level":"error","service":"proxy","error":"invalid key format","time":"2026-05-06T23:41:00+02:00","line":"github.com/opencloud-eu/opencloud/services/proxy/pkg/middleware/oidc_auth.go:128","message":"failed to build subject.session"}
{"level":"error","service":"proxy","request-id":"04e1a30a-d44f-4f91-a86f-8e021248d890","userid":"0acacb3e-693b-44be-ad28-3f504b5b1a6c","error":"no roles in user claims","time":"2026-05-06T23:41:00+02:00","line":"github.com/opencloud-eu/opencloud/services/proxy/pkg/userroles/oidcroles.go:84","message":"Error mapping role names to role ids"}
{"level":"error","service":"proxy","error":"no roles in user claims","time":"2026-05-06T23:41:00+02:00","line":"github.com/opencloud-eu/opencloud/services/proxy/pkg/middleware/account_resolver.go:225","message":"Could not get user roles"}

@RichardFevrier

It works perfectly with it at least on web and iOS.

I just updated the iOS app on my phone and read about some OIDC improvements.

@RichardFevrier @georglauterbach Happy it works for iOS and web!
You can track the progress for desktop implementing the real fix for this here: #811

fix(theme): request 'groups' OIDC scope in OpenCloud theme

Hi all, Testing of pre-release with webfinger client_id/scope support would be appreciated.
It's installable seperately from the main version, so there should be no collision.
https://github.com/opencloud-eu/desktop/releases/tag/v4.0.0-rc.1

If there is an issue still, please comment + re-open.

I'm all set with Authelia! 😄
Thanks for the release!

Looking good 🚀

Navigation Menu

Repository navigation

Authelia: Problem with user roles #217

83 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Authelia: Problem with user roles #217

Description

Activity

TheOneRing commented on Apr 22, 2025

carlosjfcasero commented on Apr 24, 2025

K900 commented on May 7, 2025

Ichnafi commented on May 10, 2025

carlosjfcasero commented on May 10, 2025

Falex163 commented on May 16, 2025

github-actions commented on Jun 16, 2025

carlosjfcasero commented on Jun 20, 2025

samolego commented on Jun 25, 2025

TheOneRing commented on Jun 25, 2025

carlosjfcasero commented on Jun 25, 2025

83 remaining items

micbar commented on Apr 24, 2026

RichardFevrier commented on Apr 24, 2026

RichardFevrier commented on Apr 24, 2026

miberecz commented on Apr 24, 2026

RichardFevrier commented on Apr 24, 2026

miberecz commented on Apr 27, 2026

micbar commented on Apr 27, 2026

miberecz commented on Apr 27, 2026

georglauterbach commented on May 6, 2026

guruz commented on May 7, 2026

guruz commented on Sep 2, 2026

RichardFevrier commented on Sep 2, 2026

georglauterbach commented on Sep 4, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions