Stucking at loading screen

[Viko1690]

Hi all,
I finally got Opencloud with Authentik as external IDP working (more or less like this how-to #1014 ). Authentication and auto provisioning works fine, for web, iOS and Desktop clients.

When I access my OpenCloud instance after a while (I am still logged into Authentik) I often stuck in a loading screen. Then I have to add to my OpenCloud URL the subpath /login to trigger the redirect and re-authentication through authentik.

Does anyone else facing this issue? Any hints?

Thank you in advance.

These are my env variables for the integration of authentik:

IDP_DOMAIN=my-secret-authentik-url.de
IDP_ACCESS_TOKEN_EXPIRATION=2592000
IDP_ID_TOKEN_EXPIRATION=2592000
IDP_ISSUER_URL=https://${IDP_DOMAIN}/application/o/opencloud/
OC_OIDC_ISSUER=https://${IDP_DOMAIN}/application/o/opencloud/
OC_OIDC_CLIENT_ID=xxx
OC_EXCLUDE_RUN_SERVICES=idp
OC_OIDC_SCOPE=openid profile email groups
PROXY_AUTOPROVISION_ACCOUNTS=true
PROXY_ROLE_ASSIGNMENT_DRIVER=oidc
PROXY_OIDC_REWRITE_WELLKNOWN="true"
PROXY_USER_OIDC_CLAIM="preferred_username"
PROXY_AUTOPROVISION_CLAIM_USERNAME="preferred_username"
PROXY_USER_CS3_CLAIM="username"
PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM=groups
PROXY_OIDC_ACCESS_TOKEN_VERIFY_METHOD=none
PROXY_OIDC_SKIP_VERIFICATION="false"
GRAPH_ASSIGN_DEFAULT_USER_ROLE=true

[micbar]

Please check the browser console for errors.

[Viko1690]

Hi micbar, thank you for your hint. The console shown following error.

silent token renewal failed (attempt 2/5, error: b) b {name: "ErrorTimeout"}

[micbar]

Looks like a CSP or CORS issue. There is a docs section about external IDP.

[Viko1690]

After some further research I was able to fix this issue. The root problem was that authentik did not allow iframe embedding which is nessecary for silent token renewal. I added X_FRAME_OPTIONS = "allow-from *" to the file "/data/user_settings.py" of my authentik instance. In addition I had to add the authentik url to the frame-ancestors in my csp.yaml.

I will share this into #1014 maybe someone else is also facing this problem.

Now, the only fault that appears in the browser console after loading opencloud is "Unable to load groupware config". I can't find further information about this but I think, it is related to using the community version and therefore the configs for enterprise groupware functionalities are missing, isn' it?