ownCloud + KeyCloak SSO + FreeIPA LDAP. Personal Spaces are not available for Admin

[ivan-trinityq]

We've installed:

• Helm Chart version 0.7.0 from https://github.com/owncloud/ocis-charts.git
• FreeIPA LDAP
• Keycloak (uses UsersFederation from LDAP)

values.yaml

externalDomain: cloud.example.com

features:
  externalUserManagement:
    adminUUID: owncloud-admin
    enabled: true
    ldap:
      bindDN: "uid=svc_owncloud,cn=users,cn=accounts,dc=example,dc=dom"
      group:
        baseDN: "cn=groups,cn=accounts,dc=example,dc=dom"
        schema:
          id: cn
      insecure: true
      uri: "ldap://dc01.example.com:389"
      user:
        baseDN: "cn=users,cn=accounts,dc=example,dc=dom"
        schema:
          id: uid
      writeable: false
    oidc:
      issuerURI: "https://sso.example.com/realms/ocis"
      userIDClaim: preferred_username

ingress:
  annotations:
    cert-manager.io/cluster-issuer: "letsencrypt"
    nginx.ingress.kubernetes.io/proxy-body-size: "1024m"
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
  enabled: true
  ingressClassName: nginx
  tls:
    - secretName: cloud.example.com-tls
      hosts:
        - cloud.example.com

services:
  nats:
    persistence:
      accessModes:
        - ReadWriteOnce
      chownInitContainer: true
      enabled: true
  ocm:
    persistence:
      chownInitContainer: true
      accessModes:
        - ReadWriteOnce
      enabled: true
  search:
    persistence:
      accessModes:
        - ReadWriteOnce
      chownInitContainer: true
      enabled: true
  storagesystem:
    persistence:
      accessModes:
        - ReadWriteOnce
      chownInitContainer: true
      enabled: true
  storageusers:
    persistence:
      accessModes:
        - ReadWriteOnce
      chownInitContainer: true
      enabled: true
  thumbnails:
    persistence:
      accessModes:
        - ReadWriteOnce
      chownInitContainer: true
      enabled: true
  web:
    config:
      oidc:
        webClientID: owncloud-web
    persistence:
      accessModes:
        - ReadWriteOnce
      chownInitContainer: true
      enabled: true

After installation I cal login as user 'owncloud-admin', but we found a couple of issues:

TAB Personal is not available

Also Android App can't use Personal Space , create Spaces and upload automatically Photos

But user is the Admin:

---

Environment with features.externalUserManagement.enabled: false

[ivan-trinityq]

kubectl logs -l helm.sh/chart=ocis-0.7.0 --all-containers=true -n owncloud --max-log-requests 40

{
  "level": "debug",
  "service": "graph",
  "request-id": "85d89be1-f480-4690-b568-16ec7d5602d6",
  "entryDN": "uid=owncloud-admin,cn=users,cn=accounts,dc=example.com",
  "time": "2025-05-19T14:08:30Z",
  "line": "github.com/owncloud/ocis/v2/services/graph/pkg/identity/ldap.go:1099",
  "message": "lookup"
}
{
  "level": "debug",
  "service": "graph",
  "backend": "ldap",
  "base": "uid=owncloud-admin,cn=users,cn=accounts,dc=example.com",
  "filter": "(objectClass=inetOrgPerson)",
  "scope": 0,
  "sizelimit": 1,
  "attributes": [
    "displayname",
    "uid",
    "mail",
    "uid",
    "sn",
    "givenname",
    "ownCloudUserEnabled",
    "ownCloudUserType",
    "oCExternalIdentity",
    "oCLastSignInTimestamp"
  ],
  "time": "2025-05-19T14:08:30Z",
  "line": "github.com/owncloud/ocis/v2/services/graph/pkg/identity/ldap.go:453",
  "message": "getEntryByDN"
}
{
  "level": "debug",
  "service": "proxy",
  "claims": "marshaling error: json: unsupported type: map[interface {}]interface {}",
  "user": {
    "id": {
      "idp": "https://sso.example.com/realms/ocis",
      "opaque_id": "owncloud-admin",
      "type": 1
    },
    "username": "owncloud-admin",
    "mail": "owncloud-admin@example.com",
    "display_name": "Owncloud Admin",
    "groups": [
      "admins",
      "ipausers",
      "rancheradmins",
      "gitlab-admins",
      "ocisadmin"
    ],
    "opaque": {
      "map": {
        "roles": {
          "decoder": "json",
          "value": "WyI3MTg4MTg4My0xNzY4LTQ2YmQtYTI0ZC1hMzU2YTJhZmRmN2YiXQ=="
        }
      }
    },
    "uid_number": 310800005,
    "gid_number": 310800005
  },
  "time": "2025-05-19T14:08:30Z",
  "line": "github.com/owncloud/ocis/v2/services/proxy/pkg/middleware/account_resolver.go:194",
  "message": "associated claims with user"
}
{
  "level": "debug",
  "service": "proxy",
  "claims": "marshaling error: json: unsupported type: map[interface {}]interface {}",
  "user": {
    "id": {
      "idp": "https://sso.example.com/realms/ocis",
      "opaque_id": "owncloud-admin",
      "type": 1
    },
    "username": "owncloud-admin",
    "mail": "owncloud-admin@example.com",
    "display_name": "Owncloud Admin",
    "groups": [
      "admins",
      "ipausers",
      "rancheradmins",
      "gitlab-admins",
      "ocisadmin"
    ],
    "opaque": {
      "map": {
        "roles": {
          "decoder": "json",
          "value": "WyI3MTg4MTg4My0xNzY4LTQ2YmQtYTI0ZC1hMzU2YTJhZmRmN2YiXQ=="
        }
      }
    },
    "uid_number": 310800005,
    "gid_number": 310800005
  },
  "time": "2025-05-19T14:08:30Z",
  "line": "github.com/owncloud/ocis/v2/services/proxy/pkg/middleware/account_resolver.go:194",
  "message": "associated claims with user"
}
{
  "RemoteAddr": "",
  "User": "",
  "URL": "",
  "Method": "",
  "UserAgent": "",
  "Time": "2025-05-19T14:06:53Z",
  "App": "admin_audit",
  "Message": "user 'owncloud-admin' created a space 'owncloud-admin!owncloud-admin' with name 'Owncloud Admin' (storage: '18be5e0f-e432-4053-b5b3-f647546e17c2')",
  "Action": "space_created",
  "CLI": false,
  "Level": 1,
  "SpaceID": "18be5e0f-e432-4053-b5b3-f647546e17c2$owncloud-admin!owncloud-admin",
  "Owner": "owncloud-admin",
  "RootItem": "18be5e0f-e432-4053-b5b3-f647546e17c2$owncloud-admin!owncloud-admin",
  "Name": "Owncloud Admin",
  "Type": "personal"
}
{
  "level": "info",
  "service": "auth-machine",
  "pkg": "rgrpc",
  "traceid": "9a36154bddffb4546e7f9feaea2cc9ab",
  "time": "2025-05-19T14:08:30Z",
  "line": "github.com/cs3org/reva/v2@v2.27.7/internal/grpc/services/authprovider/authprovider.go:146",
  "message": "user idp:\"https://sso.example.com/realms/ocis\" opaque_id:\"owncloud-admin\" type:USER_TYPE_PRIMARY authenticated"
}
{
  "level": "info",
  "service": "auth-machine",
  "pkg": "rgrpc",
  "traceid": "95e76dd2ee4c147c8d86eebd3131fe1a",
  "time": "2025-05-19T14:08:30Z",
  "line": "github.com/cs3org/reva/v2@v2.27.7/internal/grpc/services/authprovider/authprovider.go:146",
  "message": "user idp:\"https://sso.example.com/realms/ocis\" opaque_id:\"owncloud-admin\" type:USER_TYPE_PRIMARY authenticated"
}
{
  "level": "info",
  "service": "auth-machine",
  "pkg": "rgrpc",
  "traceid": "97d17c36e65a4f3dc7e1c4fd97cf5b68",
  "time": "2025-05-19T14:08:30Z",
  "line": "github.com/cs3org/reva/v2@v2.27.7/internal/grpc/services/authprovider/authprovider.go:146",
  "message": "user idp:\"https://sso.example.com/realms/ocis\" opaque_id:\"owncloud-admin\" type:USER_TYPE_PRIMARY authenticated"
}
{
  "level": "debug",
  "service": "ocis",
  "prefix": "settings/accounts/owncloud-admin",
  "time": "2025-05-19T14:06:53Z",
  "line": "github.com/owncloud/ocis/v2/services/settings/pkg/store/metadata/cache.go:157",
  "message": "removePrefix"
}
{
  "level": "debug",
  "service": "ocis",
  "key": "settings/accounts/owncloud-admin",
  "time": "2025-05-19T14:06:53Z",
  "line": "github.com/owncloud/ocis/v2/services/settings/pkg/store/metadata/cache.go:163",
  "message": "removePrefix"
}
{
  "level": "debug",
  "service": "users",
  "pkg": "rgrpc",
  "traceid": "95e76dd2ee4c147c8d86eebd3131fe1a",
  "entry": {
    "DN": "uid=owncloud-admin,cn=users,cn=accounts,dc=example.com",
    "Attributes": [
      {
        "Name": "displayname",
        "Values": [
          "Owncloud Admin"
        ],
        "ByteValues": [
          "***"
        ]
      },
      {
        "Name": "uid",
        "Values": [
          "owncloud-admin"
        ],
        "ByteValues": [
          "***="
        ]
      },
      {
        "Name": "mail",
        "Values": [
          "owncloud-admin@example.com"
        ],
        "ByteValues": [
          "***"
        ]
      },
      {
        "Name": "uidNumber",
        "Values": [
          "310800005"
        ],
        "ByteValues": [
          "MzEwODAwMDA1"
        ]
      },
      {
        "Name": "gidNumber",
        "Values": [
          "310800005"
        ],
        "ByteValues": [
          "MzEwODAwMDA1"
        ]
      }
    ]
  },
  "time": "2025-05-19T14:08:30Z",
  "line": "github.com/cs3org/reva/v2@v2.27.7/pkg/user/manager/ldap/ldap.go:144",
  "message": "entries"
}
{
  "level": "debug",
  "service": "users",
  "pkg": "rgrpc",
  "traceid": "95e76dd2ee4c147c8d86eebd3131fe1a",
  "backend": "ldap",
  "basedn": "cn=groups,cn=accounts,dc=int,dc=trinityq,dc=de",
  "filter": "(&(objectclass=groupOfNames)(member=uid=owncloud-admin,cn=users,cn=accounts,dc=example.com))",
  "scope": 2,
  "time": "2025-05-19T14:08:30Z",
  "line": "github.com/cs3org/reva/v2@v2.27.7/pkg/utils/ldap/identity.go:349",
  "message": "LDAP Search"
}
{
  "level": "debug",
  "service": "users",
  "pkg": "rgrpc",
  "traceid": "97d17c36e65a4f3dc7e1c4fd97cf5b68",
  "claim": "userid",
  "value": "owncloud-admin",
  "time": "2025-05-19T14:08:30Z",
  "line": "github.com/cs3org/reva/v2@v2.27.7/pkg/user/manager/ldap/ldap.go:137",
  "message": "GetUserByClaim"
}
{
  "level": "debug",
  "service": "users",
  "pkg": "rgrpc",
  "traceid": "97d17c36e65a4f3dc7e1c4fd97cf5b68",
  "backend": "ldap",
  "basedn": "cn=users,cn=accounts,dc=int,dc=trinityq,dc=de",
  "filter": "(&(objectclass=inetOrgPerson)(uid=owncloud-admin))",
  "scope": 2,
  "time": "2025-05-19T14:08:30Z",
  "line": "github.com/cs3org/reva/v2@v2.27.7/pkg/utils/ldap/identity.go:217",
  "message": "LDAP Search"
}
{
  "level": "debug",
  "service": "users",
  "pkg": "rgrpc",
  "traceid": "97d17c36e65a4f3dc7e1c4fd97cf5b68",
  "entry": {
    "DN": "uid=owncloud-admin,cn=users,cn=accounts,dc=example.com",
    "Attributes": [
      {
        "Name": "displayname",
        "Values": [
          "Owncloud Admin"
        ],
        "ByteValues": [
          "***"
        ]
      },
      {
        "Name": "uid",
        "Values": [
          "owncloud-admin"
        ],
        "ByteValues": [
          "***="
        ]
      },
      {
        "Name": "mail",
        "Values": [
          "owncloud-admin@example.com"
        ],
        "ByteValues": [
          "***"
        ]
      },
      {
        "Name": "uidNumber",
        "Values": [
          "310800005"
        ],
        "ByteValues": [
          "MzEwODAwMDA1"
        ]
      },
      {
        "Name": "gidNumber",
        "Values": [
          "310800005"
        ],
        "ByteValues": [
          "MzEwODAwMDA1"
        ]
      }
    ]
  },
  "time": "2025-05-19T14:08:30Z",
  "line": "github.com/cs3org/reva/v2@v2.27.7/pkg/user/manager/ldap/ldap.go:144",
  "message": "entries"
}
{
  "level": "debug",
  "service": "users",
  "pkg": "rgrpc",
  "traceid": "97d17c36e65a4f3dc7e1c4fd97cf5b68",
  "backend": "ldap",
  "basedn": "cn=groups,cn=accounts,dc=int,dc=trinityq,dc=de",
  "filter": "(&(objectclass=groupOfNames)(member=uid=owncloud-admin,cn=users,cn=accounts,dc=example.com))",
  "scope": 2,
  "time": "2025-05-19T14:08:30Z",
  "line": "github.com/cs3org/reva/v2@v2.27.7/pkg/utils/ldap/identity.go:349",
  "message": "LDAP Search"
}

[ivan-trinityq]

dn: uid=owncloud-admin,cn=users,cn=accounts,dc=example,dc=com
givenName: Owncloud
sn: Admin
uid: owncloud-admin
cn: Owncloud Admin
displayName: Owncloud Admin
initials: OA
gecos: Owncloud Admin
objectClass: top
objectClass: person
objectClass: organizationalperson
objectClass: inetorgperson
objectClass: inetuser
objectClass: posixaccount
objectClass: krbprincipalaux
objectClass: krbticketpolicyaux
objectClass: ipaobject
objectClass: ipasshuser
objectClass: ipaSshGroupOfPubKeys
objectClass: mepOriginEntry
objectClass: ipantuserattrs
loginShell: /bin/bash
homeDirectory: /home/owncloud-admin
uidNumber: 310800005
gidNumber: 310800005
ipaNTSecurityIdentifier: S-1-5-21-1257414143-3145102293-2887540473-1005