Get opencloud working with Authelia and Android app

[Karstensson]

Hello, I have tried for a few days to get authelia to work with opencloud. I have managed to get browser version to work but the android app just fails. I wonder if someone could help me.

This is the authelia.log when connecting from android.

time="2025-11-09T20:13:08+01:00" level=info msg="Access to https://cloud.domain.se/.well-known/webfinger?rel=http%3A%2F%2Fopenid.net%2Fspecs%2Fconnect%2F1.0%2Fissuer&resource=https%3A%2F%2Fcloud.domain.se (method GET) is not authorized to user <anonymous>, responding with status code 401" method=GET path=/api/verify path_raw=/authelia/api/verify remote_ip=192.168.0.3
time="2025-11-09T20:13:08+01:00" level=info msg="Access to https://cloud.domain.se/status.php (method GET) is not authorized to user <anonymous>, responding with status code 401" method=GET path=/api/verify path_raw=/authelia/api/verify remote_ip=192.168.0.3
time="2025-11-09T20:13:08+01:00" level=info msg="Access to https://cloud.domain.se/status.php (method GET) is not authorized to user <anonymous>, responding with status code 401" method=GET path=/api/verify path_raw=/authelia/api/verify remote_ip=192.168.0.3
time="2025-11-09T20:13:08+01:00" level=info msg="Access to https://cloud.domain.se/status.php (method GET) is not authorized to user <anonymous>, responding with status code 401" method=GET path=/api/verify path_raw=/authelia/api/verify remote_ip=192.168.0.3
time="2025-11-09T20:13:08+01:00" level=info msg="Access to https://cloud.domain.se/status.php (method GET) is not authorized to user <anonymous>, responding with status code 401" method=GET path=/api/verify path_raw=/authelia/api/verify remote_ip=192.168.0.3

This is my authelia.conf

     - client_name: opencloud-web
        client_id: <Generated id>
        public: true
        authorization_policy: one_factor
        consent_mode: implicit 
        pre_configured_consent_duration: 1y       
        audience: [] 
        scopes:
          - openid
          - profile
          - email
          - groups
          - opencloud_scope
        redirect_uris:
          - https://cloud.domain.se/
          - https://cloud.domain.se/oidc-callback.html
          - https://cloud.domain.se/oidc-silent-redirect.html
        grant_types:
          - refresh_token
          - authorization_code
        response_types:
          - code
        response_modes:
          - form_post
          - query
          - fragment
        userinfo_signed_response_alg: none

      - client_name: opencloud-android 
        client_id: OpenCloudAndroid
        public: true
        authorization_policy: one_factor
        scopes:
          - openid
          - groups
          - profile
          - email
          - offline_access
        redirect_uris:
          - 'oc://android.opencloud.eu'
          - 'https://cloud.domain.se/index.php/apps/openidconnect/redirect'
        allow_multiple_auth_methods: true          
        grant_types:
          - authorization_code
          - refresh_token
        response_types:
          - code          
        response_modes:
          - form_post
          #- query
         # - fragment
        require_pkce: true
        pkce_challenge_method: S256
        access_token_signed_response_alg: RS256

This is my environment variables for opencloud

OC_URL="https://cloud.domain.se"
## Log settings
OC_LOG_LEVEL=info
OC_LOG_COLOR=true
OC_LOG_PRETTY=true
# OC Settings
OC_SHARING_PUBLIC_SHARE_MdUST_HAVE_PASSWORD=false
OC_ADD_RUN_SERVICES="notifications"
OC_INSECURE="true"
PROXY_HTTP_ADDR=0.0.0.0:9200
### Notifications Settings ###
NOTIFICATIONS_SMTP_HOST=smtp.gmail.com
NOTIFICATIONS_SMTP_PORT=587
NOTIFICATIONS_SMTP_SENDER="username@gmail.com"
NOTIFICATIONS_SMTP_USERNAME=username@gmail.com
NOTIFICATIONS_SMTP_PASSWORD=password
NOTIFICATIONS_SMTP_INSECURE=false
NOTIFICATIONS_SMTP_AUTHENTICATION=plain
NOTIFICATIONS_SMTP_ENCRYPTION=starttls
## Storage settings
STORAGE_USERS_DRIVER=posix
STORAGE_USERS_ID_CACHE_STORE=nats-js-kv

## Proxy for OIDC
PROXY_OIDC_ACCESS_TOKEN_VERIFY_METHOD=none
PROXY_AUTOPROVISION_ACCOUNTS="true" 
PROXY_ROLE_ASSIGNMENT_DRIVER="oidc" 
PROXY_TLS="false"
PROXY_USER_OIDC_CLAIM="preferred_username"
PROXY_USER_CS3_CLAIM="username"
PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM="groups"
PROXY_OIDC_REWRITE_WELLKNOWN='true'
PROXY_OIDC_SKIP_USER_INFO='false'
PROXY_OIDC_SKIP_VERIFICATION="false"
PROXY_OIDC_ISSUER=https://auth.domain.se:443
PROXY_AUTOPROVISION_CLAIM_USERNAME='preferred_username'
PROXY_AUTOPROVISION_CLAIM_EMAIL='email'
PROXY_AUTOPROVISION_CLAIM_DISPLAYNAME='name'
PROXY_AUTOPROVISION_CLAIM_GROUPS='groups'  

## Misc for OIDC
OC_OIDC_ISSUER=https://auth.domain.se:443
OC_EXCLUDE_RUN_SERVICES="idp"
WEB_OIDC_CLIENT_ID='generatedID'
WEB_OIDC_SCOPE="openid profile email groups"
WEB_OIDC_RESPONSE_TYPE=code
WEB_OIDC_METADATA_URL=https://auth.domain.se/.well-known/openid-configuration
WEB_OIDC_AUTHORITY=https://auth.domain.se
OIDC_REDIRECT_URI=https://cloud.domain.se/
IDP_DOMAIN="auth.domain.se"
GRAPH_ASSIGN_DEFAULT_USER_ROLE="true"
GRAPH_USERNAME_MATCH="none"       
OCIS_OIDC_ISSUER=https://auth.domain.se
FRONTEND_READONLY_USER_ATTRIBUTES="user.onPremisesSamAccountName,user.displayName,user.mail,user.passwordProfile,user.memberOf"
FRONTEND_ARCHIVER_MAX_SIZE=1099511627776   # 1 TiB
FRONTEND_ARCHIVER_MAX_NUM_FILES=500000
WEB_OPTION_DISABLE_FEEDBACK_LINK=true

PROXY_CSP_CONFIG_FILE_LOCATION="/etc/opencloud/csp.yaml"