Use google OIDC provider for user login

[aacebedo]

Hello

I would like to use google OIDC provider as identity provider on my opencloud instance like almost all my other services.

I deploy opencloud using the community helm chart found here https://github.com/opencloud-eu/helm/tree/main/charts/opencloud

I've set the following env vars in the container:

        - name: OC_KEYCLOAK_CLIENT_SECRET
          value: <secret_from_google_console>
        - name: OC_KEYCLOAK_CLIENT_ID
          value: <id_from_google_console>
        - name: OC_CORS_ALLOW_ORIGINS
          value: https://accounts.google.com
        - name: WEB_OIDC_SCOPE
          value: "openid email profile"
        - name: OC_OIDC_ISSUER
          value: https://accounts.google.com
        - name: PROXY_OIDC_REWRITE_WELLKNOWN
          value: "true"
        - name: WEB_OIDC_CLIENT_ID
          value: web
        - name: PROXY_USER_OIDC_CLAIM
          value: "preferred_username"
        - name: PROXY_USER_CS3_CLAIM
          value: "username"
        - name: OC_ADMIN_USER_ID
          value: ""
        - name: GRAPH_ASSIGN_DEFAULT_USER_ROLE
          value: "false"
        - name: GRAPH_USERNAME_MATCH
          value: "none"
        - name: PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM
          value: "roles"
        - name: PROXY_OIDC_ACCESS_TOKEN_VERIFY_METHOD
          value: "jwt"
        - name: WEB_OIDC_METADATA_URL
          value: "https://accounts.google.com/.well-known/openid-configuration"

When I try to access the opencloud gui, it redirects me to the google auth page but with the following error:

What am I missing here ?

[aacebedo]

I was able to go to the "please wait, you are being redirected screen" by setting WEB_OIDC_CLIENT_ID with the client ID from the google console.
Now it stays stuck on this page, with a console error saying "POST https://oauth2.googleapis.com/token 400 (Bad Request)"
In the response detail, it says the client_secret is missing

[micbar]

@aacebedo
I am sorry to say, but we have no clue what people are doing in the community Helm chart. Too many variations and too much vibe coding.

[aacebedo]

the helm chart is not the problem I think, it is more the configuration and the env variables I need to setup for opencloud.
The chart itself is not very complicated.
I did not find any tutorial or documentation to configure such identity provider.

[micbar]

Use keycloak with OIDC federation.