Installation with Keycloak `En cours d'identification`

[s0rau]

I'm trying to deploy latest helm with keycloak as OIDC, I've set some variables in values.yaml sections oidc.issuerURI oidc.sessionManagementLink oidc.editAccountLink, I'm stuck on that page after sucess authentication on keycloak (I've seen the user's session in keycloak web ui).

[dj4oC]

Hi 👋
thanks for reaching out and for using the oCIS Helm chart maintained by the oCIS community.

I’m David, part of the ownCloud team. I’m happy to help you get your deployment with Keycloak working smoothly.

From your description, it sounds like the OIDC flow completes successfully on the Keycloak side (session is created), but oCIS gets stuck on the “En cours d’identification” screen, which usually indicates that the session cookie is set but the user provisioning or claim mapping does not succeed.

A few things to check:

Required values to configure in values.yaml

Make sure the following are set correctly under the oidc section:

oidc:
  enabled: true
  issuerURI: https://<your-keycloak-domain>/realms/<your-realm>
  clientID: <your-client-id>
  clientSecret: <your-client-secret>
  userIDClaim: preferred_username
  scope: "openid profile email"
  autoProvisionAccounts: true

The following are optional but helpful:

editAccountLink: https:///realms//account
sessionManagementLink: https:///realms//account

Make sure clientID and clientSecret match the Keycloak client, and that the redirect URIs in Keycloak include your oCIS URL (e.g. https://ocis.example.com/*).

Common causes of being stuck after login

1. Missing or misconfigured userIDClaim. If userIDClaim doesn’t match a claim in the token, oCIS can’t identify the user and gets stuck in a loop.
2. Autoprovisioning failure. If autoProvisionAccounts is not set or fails, the login might succeed but no account gets created in oCIS, and the user isn’t recognized.
3. CS3 user backend / roles issue. In some setups, the default role assignment must be enabled explicitly.

Try adding:

roleAssignment:
  enabled: true
  defaultRole: "user"

4. Invalid cookie domain / session issues
   Ensure that your external URL and ingress configuration use the same domain and protocol as defined in your Keycloak client settings.

[s0rau]

Thanks for answer.

I've checked values in ocis section and webClientID: ocis is named as ocis in keycloak web interface.

Do you have documentation about clientSecret ? Where can I set that value ?

I've added roleAssignment option :

      roleAssignment:
        # @schema
        # type: boolean
        # required: true
        # @schema
        # -- enable OIDC role assignment.
        #enabled: false
        enabled: true
        defaultRole: "user"

Here's the helm upgrade error

# helm upgrade ocis .
Error: UPGRADE FAILED: values don't meet the specifications of the schema(s) in the following chart(s):
ocis:
- features.externalUserManagement.oidc.roleAssignment: Additional property defaultRole is not allowed

Another information I don't have ldap server does that part is necessary ? (All users are create in keycloak, we don't use ldap)

[s0rau]

I've progress a bit now

I can login thought keycloak OIDC, after login I'm redirected to ocis url with access-denied

No error log in DBG mode in
kubectl logs -n ocis proxy-84d959ff65-7vjlq -f