Cloudron Forum

Will be fixed with next release: https://git.cloudron.io/cloudron/box/-/commit/ec7dabc1c72c2f34c3f3474bc4b3c903bb2d693d

I want my users to OIDC via Cloudron to Cloudflares App Launcher where I can put all avialiable softwares some are from cloudron others are just SAAS (cloudflare can do SAML for SAAS) Screenshot 2024-04-11 at 19.57.11.png Cloudron => Cloudflare Launcher => AWS

@nebulon has fixed this now for the next release. The first login (from admin setup or via invite) of admin account and normal users now has an OIDC session automatically. This means that when you click the first OIDC app, you are logged in automatically.

Currently our OpenID provider does not issue any refresh_tokens yet. All clients created without the refresh_token grant type.

For the moment it is only useful as an identity provider as such. But we will extend it further based on requirements. Will look into this for the coming releases.

@akammeyer rIght, that's my understanding as well. My wording was a bit confusing. When I said "email domain" , I meant that the domain name of that email address must be hosted on cloudron (not email hosting but the bare domain hosting).

I will move this to Feature request, adding well-known input box for this in Domains UI would be the solution.

@p44 this was a bug in how cloudron parses names. I have added a workaround in https://git.cloudron.io/cloudron/box/-/commit/8a63f0368e5573014739d4c31ea9c2d53ac00701 for the next Cloudron release.

@marcusquinn Yes.. I tried to copy and paste that url, but it seems part of a redirection process, so pasted urls seems to be not good (or expired)...

Oops, I stand corrected about the login screen translation.

OK.

This was very exciting.

I read some documentation. Specifically, https://docs.opnsense.org/manual/how-tos/nat_reflection.html.

Once I slowed down, undid all the weird thrashing I did with various DNS shortcuts for route domains internally/directly (e.g. changing my unbound config, or creating aliases for my domain), and instead read the documentation for both reflection and hairpin NAT in OpnSense, I was good to go.

Thank you for joining me on this journey where I create noise on the forum and discover that, by reading the manual, I can solve my own problems. 🙂

Already fixed bugs are the best bugs 😆

The package with OpenID integration for Cloudron SSO is released. However this currently only works with new app instances.

@luckow Thank you very much for the detailed explanation. It doesn't seem so complicated anymore. You have helped me a lot. Thank you very much indeed. 👍

Link to docs for future reference - https://docs.cloudron.io/user-management/#endpoints

The following configuration needs to be added to the identifier registration of Kopano Konnect to enable SSO with Rocketchat:

- id: rocketchat.9wd.eu name: Rocketchat trusted: true application_type: web redirect_uris: - https://rocketchat.9wd.eu/_oauth/konnect

Remember to restart Konnect after modifying the registry. If you want to verify that the configuration was properly loaded you have to modify log_level in /app/data/konnectd.cfg to read /app/data/konnectd.cfg. With another restart Konnect will then print a message like the following at startup:

Apr 20 20:21:30 time="2020-04-20T18:21:30Z" level=debug msg="registered client" application_type=web client_id=rocketchat.9wd.eu insecure=false origins="[https://rocketchat.9wd.eu]" redirect_uris="[https://rocketchat.9wd.eu/_oauth/konnect]" trusted=true with_client_secret=false

In Rocket.chat the following configuration needs to be added. For this go into the admin backend, select "OAuth" and there "Add custom oauth". I am using the following settings:

URL: https://meet.9wd.eu Token Path: /konnect/v1/token Token Sent Via: Header Identity Token Sent Via: Same as "Token Sent Via" Identity Path: /konnect/v1/userinfo Authorize Path: /signin/v1/identifier/_/authorize Scope: openid profile email Id: rocketchat.9wd.eu Secret: rocketchat Login Style: Default Button Text: Kopano Konnect (needs to be something the user can relate to) Button Text Color: #FFFFFF Button Color: #13679A Username field: preferred_username Merge users: false

After storing these log out of Rocket.chat and you will see a new button on your login page titled "Kopano Konnect", which will then use the new login method.

Since we have added an OpenID connect and thus some OAuth2 compatibility, I will mark this as solved finally.