Cloudron Forum

Hello @Lomeu Unfortunately I can't provide much support with the Google Workspace LDAP. Just to make sure, you did follow the google guide for LDAP clients? https://support.google.com/a/answer/9048434?sjid=18438745481174821656-EU

@jdaviescoates and @girish: Excellent. Thank you. I can work with this. Very much appreciated.

@james the developer has released v5.1.1 which is supposed to have fixed the issue, however I am still experiencing the same behavior when I try to sign into the iOS app using OpenID. Can you please test on your iPhone and advise if it is the same for you as well?

Indeed they're back when they login with OIDC, thanks for the tips. This ticket can be closed I think.

@Mamouti if you need (smallish) changes to the packages, feel free to submit MRs . All the packages are at https://git.cloudron.io/packages/

MetaMask the crypto wallet? Not sure why that could be causing problems, but maybe a question for the MetaMask people.

thanks @nebulon & @girish, this does indeed fix everything, appreciate it

In OpenID there is no well supported way to log out users from services which used the OpenID for authentication (in Cloudron case the apps). Those app have their own session and session handling. So there is mostly likely no way around this unless an app would start using OAuth2 access and refresh tokens (but implementation of that was spotty in the past which sparked OpenID connect in the first place) For a start if you logout of the dashboard, subsequent app logins (from a state where the app has no login session) then Cloudron will prompt you to login with a username. If that is not happening the Oidc session was still alive. The best way I found was to use container tabs in like firefox and probably other browsers, which maintain isolated sessions. This is also how I use other services like Digitalocean where we have multiple accounts with different roles.

Good catch, we have to fixup the docs here. The OpenID provider session logout, triggered by the app used to be there, but we found that no app supports this properly so it got removed. For nextcloud, we have some changes to soon enable OIDC login by default in the package, so may not be worth it to investigate just now in your case.

Oops nm I figured out the right Wordpress login url and redirect pattern to use

Thank you @girish - Sounds promising. Looking forward to v8.

Will be fixed with next release: https://git.cloudron.io/cloudron/box/-/commit/ec7dabc1c72c2f34c3f3474bc4b3c903bb2d693d

I want my users to OIDC via Cloudron to Cloudflares App Launcher where I can put all avialiable softwares some are from cloudron others are just SAAS (cloudflare can do SAML for SAAS) [image: 1712858310234-screenshot-2024-04-11-at-19.57.11-resized.png] Cloudron => Cloudflare Launcher => AWS

@nebulon has fixed this now for the next release. The first login (from admin setup or via invite) of admin account and normal users now has an OIDC session automatically. This means that when you click the first OIDC app, you are logged in automatically.

Currently our OpenID provider does not issue any refresh_tokens yet. All clients created without the refresh_token grant type. For the moment it is only useful as an identity provider as such. But we will extend it further based on requirements. Will look into this for the coming releases.

Seconded, also interested in this for the tailscale angle

@p44 this was a bug in how cloudron parses names. I have added a workaround in https://git.cloudron.io/cloudron/box/-/commit/8a63f0368e5573014739d4c31ea9c2d53ac00701 for the next Cloudron release.

@marcusquinn Yes.. I tried to copy and paste that url, but it seems part of a redirection process, so pasted urls seems to be not good (or expired)...

Oops, I stand corrected about the login screen translation.

OK. This was very exciting. I read some documentation. Specifically, https://docs.opnsense.org/manual/how-tos/nat_reflection.html. Once I slowed down, undid all the weird thrashing I did with various DNS shortcuts for route domains internally/directly (e.g. changing my unbound config, or creating aliases for my domain), and instead read the documentation for both reflection and hairpin NAT in OpnSense, I was good to go. Thank you for joining me on this journey where I create noise on the forum and discover that, by reading the manual, I can solve my own problems.