owncloud / owncloud/ocis

401 Unauthorized Graph Service Errors with External OIDC

Open
#8,155 5 comments 0 reactions 0 assignees View on GitHub
Type:Bug
Dominant language
Go
Stars
2.1k
Forks
274
Avg merge
2d 1h
Merged PRs (30d)
103

Description

## Describe the bug
After enabling an external OIDC (Authentik) I am seeing errors generated in the logs. Authentication seems to work correctly, but I can't identify the issue.

## Steps to reproduce
1. Enable external OIDC
2. Confirm authentication works
3. See errors generated in logs

## Expected behavior
All authentication to work correctly.

## Actual behavior
Getting 401 unauthorized errors spammed in logs.

```console
Jan 08 13:08:59 mail3.arbetsformedlingen.se ocis[38758]: 2024-01-08T13:08:59-05:00 ERR failed to authenticate the request error="failed to get userinfo: 401 Unauthorized: " authenticator=oidc path=/graph/v1.0/me/drives service=proxy
Jan 08 13:08:59 mail3.arbetsformedlingen.se ocis[38758]: 2024-01-08T13:08:59-05:00 ERR failed to authenticate the request error="failed to get userinfo: 401 Unauthorized: " authenticator=oidc path=/remote.php/webdav/ service=proxy
```

## Setup
Started server with systemd.

ocis.env

```console
OCIS_INSECURE=false
OCIS_URL=https://mydomain.tld

OCIS_CONFIG_DIR=/mnt/data/.config/
OCIS_BASE_DATA_PATH=/mnt/data/

OCIS_OIDC_ISSUER=https://myauthdomain.tld/application/o/owncloud/
WEB_OIDC_CLIENT_ID=RandomClientId

OCIS_EXCLUDE_RUN_SERVICES=idp
```

proxy.yaml

```console
log_level: debug
enable_basic_auth: true
auto_provision_accounts: true
user_oidc_claim: preferred_username
http:
addt: 0.0.0.0:9200
tls: false
oidc:
access_token_verify_method: none
rewrite_well_known: true
role_assignment:
driver: default
oidc_role_mapper:
role_claim: groups
role_mapping:
- role_name: admin
claim_value: Admins
- role_name: user
claim_value: owncloudUsers
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.