OpenCloud with Pangolin can't start Collaboration container without disabling SSO Authentication

[nefariouslegion]

Hi,

I've been trying for hours now to get OpenCloud up and running with only slight success. My problem is I use Pangolin for a reverse proxy. But because of this when I try to spin up the OpenCloud containers the collaboration container just crashes instantly.

Looking at the logs it seems to be due to the collaboration container not being able to communicate to the Collabora container. It can't communicate because when the collaboration container tries to reach https://collabora.[redacted].com/hosting/discovery it ends up hitting the Pangolin SSO authenatication instead.

Where I had slight success was that by disabling SSO on the collabora subdomain it allows the collaboration container to work. But of course I'd prefer to have SSO authentication on.

In pangolin I tried various bypass rules but the only one that worked was to tell pangolin the collaboration container IP specifically is allowed to bypass authentication. If I tried just using the opencloud docker network subnet it doesn't work. Problem with using the specific IP is that docker IP addresses can change.

In OpenCloud .env file I have uncommented "COMPOSE_FILE=docker-compose.yml:weboffice/collabora.yml:external-proxy/opencloud.yml:external-proxy/collabora.yml". But tbh I'm not sure what that's meant to do or if there is anything else I need to do to make OpenCloud work properly with Pangolin.

So any help would be appreciated!

[sorentorp]

I have same problem. Following

[micbar]

Where I had slight success was that by disabling SSO on the collabora subdomain it allows the collaboration container to work. But of course I'd prefer to have SSO authentication on.

Maybe i am missing the point, but what SSO authentication is needed for collabora?

Collabora is a service which has no authentication except the "Admin Settings" which are not mandatory for using.

The https://collabora.[redacted].com/hosting/discovery is a public unprotected endpoint by the wopi spec to discover the features of the web Office suite.

[nefariouslegion]

I guess it’s not necessarily that it’s needed. But more so that my thinking was that the less publicly accessible domains there are is just more secure

[europacafe]

Even without collaboration, OpenCloud behind Pangolin reverse proxy doesn't work if Pangolin SSO is on.

[micbar]

We need more info to help you, because we do not know Pangolin SSO.