Roles in authentik are for permissions in authentik. You want a group instead. Group memberships are send via OIDC.
this post was submitted on 22 Feb 2025
11 points (92.3% liked)
Selfhosted
42765 readers
1572 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 2 years ago
MODERATORS
tried this, created a group called ocisAdmin and added the admin user to it, it still gives the same error. Seems like I need to define a proxy.yaml file in owncloud with the roles, I did this and it still doesn't work.
In the oidc provider in authentik you have to enable sending the groups. I forgot what its called.
not an authentik user, but after skimming their docs i think you have to:
- create a role "ocisAdmin" via authentiks admin interface
- give this role to a group in the admin interface or create one.
- assign a user thats supposed to be an owncloud admin to the group
it might be that you also have to define somekind of mapper to include this in the informations owncloud receives from authentik, but as i said i only skimmed the docs and would personally just try it without the mapper.
tried this and also tried making a role in authentik assigned to the group called ocisAdmin and added the admin user to it, it still gives the same error. Seems like I need to define a proxy.yaml file in owncloud with the roles, I did this and it still doesn't work.
does authentik offer an option to preview a jwt for a given user? might be as simple as that the claim is not named "ocisAdmin" or is not a toplevel entry in the jwt.
Reminds me of the group limit attribute in nextcloud. You could try looking at the 'Custom profile scope' section of https://docs.goauthentik.io/integrations/services/nextcloud/ to see if it helps to work out what to do
this is great info, thanks. I don't think its the issue right now, I think I need to define the roles in owncloud which I tried to do but it still doesn't work. I'll ask on the owncloud forums but these custom scopes might still be needed at some point. thanks.