Authelia: Problem with user roles

[carlosjfcasero]

I have integrated Opencloud with Authelia. In web everything is working, but in desktop I get following error in server when I try to login:

opencloud  | 2025-04-18T18:50:48Z ERR Error mapping role names to role ids error="no roles in user claims" line=github.com/opencloud-eu/opencloud/services/proxy/pkg/userroles/oidcroles.go:84 request-id=58733e08-061f-4caa-876a-d68132cb6a09 service=proxy userid=e15359ea-ef03-4785-8cb3-564a93372e6d
opencloud  | 2025-04-18T18:50:48Z ERR Could not get user roles error="no roles in user claims" line=github.com/opencloud-eu/opencloud/services/proxy/pkg/middleware/account_resolver.go:174 service=proxy

It seems Opencloud is not retrieving correctly the claims from Authelia, but I don't know why. I have followed integration with external OIDC doc and checked troubleshooting page but didn't find my issue.

My Authelia users configuration (only web and desktop part, used my ocis config as reference to build it) is

      - client_id: web
        client_name: 'OpenCloud web'
        public: true
        redirect_uris:
          - 'https://opencloud.tld/'
          - 'https://opencloud.tld/oidc-callback.html'
          - 'https://opencloud.tld/oidc-silent-redirect.html'
      - client_id: 'OpenCloudDesktop'
        client_name: 'openCloud desktop client'
        public: true
        scopes:
          - openid
          - groups
          - profile
          - email
          - offline_access
        redirect_uris:
          - http://127.0.0.1
          - http://localhost
        grant_types:
          - refresh_token
          - authorization_code

[TheOneRing]

I think you might need to add PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM=groups to the environment of your OpenCloud docker-compose.

[carlosjfcasero]

I added mentioned line but nothing changed. I have role mapping defined in proxy.yml. I noticed this line that may help:

DBG extracted claims claims={"email":"myemail@mail.com","email_verified":true,"exp":XXX,"name":"Carlos","preferred_username":"carlos","sub":"XXX","updated_at":1745493612} line=github.com/opencloud-eu/opencloud/services/proxy/pkg/middleware/oidc_auth.go:135 service=proxy

This line is the same one but when I access in web (and everything works) where groups are retrieved and printed:

DBG extracted claims claims={"email":"myemail@mail.com","email_verified":true,"exp":XXX,"groups":["others","opencloud-admin"],"name":"Carlos","preferred_username":"carlos","sub":"XXX","updated_at":1745495030} line=github.com/opencloud-eu/opencloud/services/proxy/pkg/middleware/oidc_auth.go:135 service=proxy

It seems either Authelia is not sending roles to OpenCloud or OpenCloud desktop is not handling them correctly.

[K900]

The problem is that the desktop client does not request the groups scope, so it is never put into the token. This means that when the token is sent to the server, it can't do role mapping, because there are no roles in the token.

[Ichnafi]

Can someone confim, that iOS App (and maybe Android too?) is suffering from the same issue?

[carlosjfcasero]

I'm facing the same issue in iOS app too

[Falex163]

I just wish they'd just implement a native 2fa solution because I ran into the same problems. Web was working fine with authelia, desktop client app and iOS / iPadOS no access....

[github-actions]

This issue was marked stale because it has been open for 30 days with no activity. Remove the stale label or comment or this will be closed in 7 days.

[carlosjfcasero]

Not stale

[samolego]

Exact same thing is happening to me too. Web works fine, desktop doesn't. Using authelia too.

[TheOneRing]

I think you might need to add PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM=groups to the environment of your OpenCloud docker-compose.

Has anyone tried to apply this setting?

[carlosjfcasero]

I think you might need to add PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM=groups to the environment of your OpenCloud docker-compose.

Has anyone tried to apply this setting?

I did:

I added mentioned line but nothing changed. I have role mapping defined in proxy.yml. I noticed this line that may help:

DBG extracted claims claims={"email":"myemail@mail.com","email_verified":true,"exp":XXX,"name":"Carlos","preferred_username":"carlos","sub":"XXX","updated_at":1745493612} line=github.com/opencloud-eu/opencloud/services/proxy/pkg/middleware/oidc_auth.go:135 service=proxy

This line is the same one but when I access in web (and everything works) where groups are retrieved and printed:

DBG extracted claims claims={"email":"myemail@mail.com","email_verified":true,"exp":XXX,"groups":["others","opencloud-admin"],"name":"Carlos","preferred_username":"carlos","sub":"XXX","updated_at":1745495030} line=github.com/opencloud-eu/opencloud/services/proxy/pkg/middleware/oidc_auth.go:135 service=proxy

It seems either Authelia is not sending roles to OpenCloud or OpenCloud desktop is not handling them correctly.

Nothing changed