Improve OpenCloud ↔ Authelia integration for small self-hosted deployments

[davipro34]

Improve OpenCloud ↔ Authelia integration for small self-hosted deployments

Is your feature request related to a problem? Please describe.

Authelia is a very good fit for small self-hosted deployments because it provides OIDC and MFA while remaining lightweight.

However, the current OpenCloud ↔ Authelia integration still has several practical limitations.

Logout synchronization

Logging out from OpenCloud does not properly terminate the Authelia session.

As a result, users may believe they are fully logged out while their IdP session remains active.

User management fragmentation

Authelia does not provide a WebUI for day-to-day user administration.

For small deployments, user administration becomes fragmented between OpenCloud and the external IdP.

OpenCloud already provides user and group management capabilities, while Authelia focuses on authentication and MFA.

This creates administrative duplication and increases the risk of inconsistencies.

Groups / roles synchronization

Group and role synchronization should be reliable and predictable.

This is especially important for OpenCloud roles and Spaces access control.

In my tests, group/role mapping through OIDC claims did not behave reliably over time and could become desynchronized between OpenCloud and the IdP.

The issue seems to be around OpenCloud depending on OIDC claims such as groups for role assignment, while not having a clear and consistent synchronization model when group membership changes in the IdP.

Client consistency

The role/group mapping should behave consistently across Web, Desktop, Android and iOS clients.

There are already reports where some clients do not request or receive the expected groups claim, causing role mapping failures such as missing roles in user claims.

This makes OIDC-based role assignment fragile for real deployments.

Describe the solution you'd like

A more complete and reliable integration path between OpenCloud and lightweight OIDC providers such as Authelia.

Ideally:

• logout is synchronized correctly between OpenCloud and the IdP;
• user administration remains simple and does not require maintaining users in multiple places;
• OpenCloud and Authelia remain consistent regarding users, groups and roles;
• group and role mappings remain reliable over time;
• permissions and Spaces access behave predictably;
• Web, Desktop and mobile clients behave the same way.

Describe alternatives you've considered

Keycloak provides a more complete IAM solution, but it is significantly heavier for small deployments.

One of OpenCloud's strengths is its lightweight architecture, and Authelia appears to be a natural fit for small self-hosted installations that require OIDC and MFA without introducing a full IAM platform.

Additional context

This request is based on real-world testing of an OpenCloud + Authelia deployment.

The goal is not to replace external identity providers, but to make OpenCloud's integration with lightweight OIDC providers more reliable and easier to operate for small deployments.

[doloopuntil]

Hi @davipro34 I've got a (very) small self-hosted deployment and the solution you're asking for is almost completely achievable with OpenCloud (6.x+) in my experience. There are a couple caveats:

• It's true that OpenCloud does not support automatic termination of the Authelia session out-of-the-box. I found that to be an unnecessary requirement in my deployment, where I also have Immich and Jellyfin logging in via Authelia. I wouldn't want to be logged out of all of them when I log out of OpenCloud. The problem for me is that OpenCloud automatically logs in again via Authelia when I browse to the main OpenCloud URL again after a logout. Instead, when Immich and Jellyfin log out, they stay logged out and I need to click on a button to log in again with Authelia. I'd argue a button to login with Authelia in OpenCloud would be welcome. I don't have a solution for that.
• If you're willing to use LLDAP as identity manager (users & groups) and Authelia as identity provider, then you can relieve OpenCloud from all user management duties. I manage users and groups using LLDAP, Authelia provides authn/authz to my applications (including OpenCloud), and OpenCloud simply takes input from the other two, without being allowed to make any changes. This ensures OpenCloud stays in sync with users and groups in LLDAP.
• In my experience, it's possible to achieve consistent OIDC claims to OpenCloud role mapping via Authelia configuration, especially with the webfinger for OIDC parameter discovery that's been recently implemented (feat: support desktop and mobile specific client_id and scopes #2072). I think the only client that is still missing that feature integration at this time is the desktop one (Use webfinger for OIDC parameter discovery desktop#811). I am currently using the Android app and it works as expected. I don't have an iOS device, but I assume it works there too.

If you're interested, I can share my OpenCloud, Authelia and LLDAP configurations.

[micbar]

It's true that OpenCloud does not support automatic termination of the Authelia session out-of-the-box. I found that to be an unnecessary requirement in my deployment, where I also have Immich and Jellyfin logging in via Authelia. I wouldn't want to be logged out of all of them when I log out of OpenCloud. The problem for me is that OpenCloud automatically logs in again via Authelia when I browse to the main OpenCloud URL again after a logout. Instead, when Immich and Jellyfin log out, they stay logged out and I need to click on a button to log in again with Authelia. I'd argue a button to login with Authelia in OpenCloud would be welcome. I don't have a solution for that.

As far as I know, Authelia doesn't implement an "End Session" Endpoint. Opencloud calls this endpoint on logout.

[davipro34]

...

If you're interested, I can share my OpenCloud, Authelia and LLDAP configurations.

@doloopuntil
Thanks for the suggestion, but I don't want to integrate LDAP (even LLDAP) for this.
It would have been nice to keep managing users via the OpenCloud web UI.

[doloopuntil]

I see. Then it might be possible to set up Authelia to connect to OpenCloud's native identity manager service via LDAPS, so Authelia can validate usernames and passwords against those stored in OpenCloud. I haven't tried that. AFAIK, Authelia only offers 2 ways to authenticate users: using LDAP, or using a local YAML user file. But there's no easy way to keep Authelia's user file in sync with OpenCloud's user database.