Local admin does not work after first start - OIDC Force

[mircowokasch]

DE:
Hallo,
ich habe nun zum ersten mal den OpenCloud Container gestartet und wollte mich mit dem lokalen Admin und dem initialen Passwort anmelden, laufe aber auf einen Timeout. Als Meldung kommt: Nicht angemeldet
Das könnte aufgrund einer routinemäßigen Abmeldung aus Sicherheitsgründen geschehen sein oder Ihr Benutzerkonto ist inaktiv oder noch nicht freigeschaltet. Bitte versuchen Sie es nach einiger Zeit erneut oder wenden Sie sich an Ihre Administration.

Ich sehe, dass er versucht sich via OpenID Connect versucht anzumelden, was ich aber nicht explizit eingestellt habe. Wie stelle ich ein, dass OpenCloud lokale User verwenden soll?

Danke für eure Hilfe!

EN:
Hello,

I've started the OpenCloud container for the first time and wanted to log in with the local admin account and initial password, but I'm getting a timeout. The message is: Not logged in
This could be due to a routine logout for security reasons, or your user account is inactive or not yet activated. Please try again after a while or contact your administrator.

I see that it's trying to log in via OpenID Connect, which I haven't explicitly configured. How do I configure OpenCloud to use local users?

Thanks for your help!

[micbar]

There is only OIDC login possible. OpenCloud bundles an OIDC provider. So it needs to be reachable on a public domain with ssl.

[mircowokasch]

Hi Michael,
i understood that from other posts in the meantime :D
I tested if the server and the docker container can reach https://server.domain/.well-known/openid-configuration, and it both works. Last week I got this message in the docker logs:
{"level":"error","service":"proxy","error":"failed to verify access token: Get "https://server.domain/.well-known/openid-configuration\": context deadline exceeded (Client.Timeout exceeded while awaiting headers)","authenticator":"oidc","path":"/api/v0/settings/roles-list","line":"github.com/opencloud-eu/opencloud/services/proxy/pkg/middleware/oidc_auth.go:198","message":"failed to authenticate the request"}

Today I got:
{"level":"error","service":"proxy","error":"failed to verify access token: Get "https://server.domain/.well-known/openid-configuration\": context deadline exceeded (Client.Timeout exceeded while awaiting headers)","authenticator":"oidc","path":"/graph/v1.0/me","line":"github.com/opencloud-eu/opencloud/services/proxy/pkg/middleware/oidc_auth.go:198","message":"failed to authenticate the request"}

Really appreciate the help!!

[micbar]

The proxy error indicates that openCloud cannot connect to its own public domain.

[mircowokasch]

How can i verify that openCloud can connect to its public domain? I can do nslookup and curl succuessfully with the public domain.

[micbar]

Check with curl inside the opencloud container

[mircowokasch]

Yes curl works just fine inside the container. I've already tested that.

[micbar]

The get request from your log file should work with curl.

[mircowokasch]

So, to summarize:

I can successfully curl the address "https://server.domain/.well-known/openid-configuration" both directly in the shell and within the container itself. Nslookup also resolves the correct IP address locally and within the container. The following is still logged:

{"level":"info","service":"proxy","proto":"HTTP/1.0","request-id":"ebe8ec2e-3e75-47ca-9c5e-deaccedfd0aa","traceid":"610fae42ae9b944ad71f93486af3d467","remote-addr":"10.240.72.250","method":"GET","status":401,"path":"/graph/v1.0/me","duration":20000.656854,"bytes":0,"time":"2026-03-09T07:49:42Z","line":"github.com/opencloud-eu/opencloud/services/proxy/pkg/middleware/accesslog.go:34","message":"access-log"}
{"level":"error","service":"proxy","error":"failed to verify access token: Get "https://server.domain/.well-known/openid-configuration\": context deadline exceeded (Client.Timeout exceeded while awaiting headers)","authenticator":"oidc","path":"/ocs/v2.php/apps/notifications/api/v1/notifications/sse","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0","client.address":"185.101.4.22, 10.240.72.250","network.peer.address":"","network.peer.port":"","time":"2026-03-09T07:49:52Z","line":"github.com/opencloud-eu/opencloud/services/proxy/pkg/middleware/oidc_auth.go:198","message":"failed to authenticate the request"}
{"level":"info","service":"proxy","proto":"HTTP/1.0","request-id":"78bdb1ad-cd5d-4649-897b-0a2d26c5797a","traceid":"3013d579e37bd4262f1d5a26dbe72ca0","remote-addr":"10.240.72.250","method":"GET","status":401,"path":"/ocs/v2.php/apps/notifications/api/v1/notifications/sse","duration":10328.62895,"bytes":0,"time":"2026-03-09T07:49:52Z","line":"github.com/opencloud-eu/opencloud/services/proxy/pkg/middleware/accesslog.go:34","message":"access-log"}