I was banging my head against this problem for the last day, and I could really use some help on it. I was tasked to setup Seafile Pro as a POC at work, but I can’t get the SSO portion working. Reverse proxy is handled via Traefik, and everything has valid certs.
Here is the integration guide I used www. authelia .com /integration/openid-connect/seafile/
Seafile redirects to authelia for authentication, but after passing it back to seafile it just gives a generic “Error, please contact administrator.” I don’t see anything in the logs as to why.
Using seafile image seafileltd/seafile-pro-mc:12.0-latest
seahub_settings.py
OAUTH_ENABLE_INSECURE_TRANSPORT = False
OAUTH_CLIENT_ID = "your_client_id"
OAUTH_CLIENT_SECRET = "your_plaintext_secret"
OAUTH_REDIRECT_URL = "https://files.example.com/oauth/callback/"
OAUTH_PROVIDER_DOMAIN = "authelia.example.com"
OAUTH_AUTHORIZATION_URL = "https://authelia.example.com/api/oidc/authorization"
OAUTH_TOKEN_URL = "https://authelia.example.com/api/oidc/token"
OAUTH_USER_INFO_URL = "https://authelia.example.com/api/oidc/userinfo"
OAUTH_CREATE_UNKNOWN_USER = True
OAUTH_ACTIVATE_USER_AFTER_CREATION = True
OAUTH_SCOPE = [
"openid",
"profile",
"email",
]
OAUTH_ATTRIBUTE_MAP = {
"id": (False, "not used"),
"email": (True, "email"),
"name": (False, "name"),
"sub": (True, "uid"),
}
DEBUG = True
Authelia Configuration
- client_id: "your_client_id"
client_name: "Your Client Name"
client_secret: "$pbkdf2-sha512$310000$example_salt$example_hash_value"
public: false
token_endpoint_auth_method: "client_secret_basic"
authorization_policy: "two_factor"
redirect_uris:
- "https://files.example.com/oauth/callback/"
scopes:
- "openid"
- "profile"
- "email"
userinfo_signed_response_alg: "none"
Seafile Env Vars:
environment:
- SEAFILE_SKIP_DB_INIT=true
- DB_HOST=${SEAFILE_MYSQL_DB_HOST:-db}
- SEAFILE_CADDY_ENABLED=false
- DB_PORT=${SEAFILE_MYSQL_DB_PORT:-3306}
- DB_USER=${SEAFILE_MYSQL_DB_USER:-seafile}
- DB_ROOT_PASSWD=${INIT_SEAFILE_MYSQL_ROOT_PASSWORD:-}
- DB_PASSWORD=${SEAFILE_MYSQL_DB_PASSWORD:?Variable is not set or empty}
- SEAFILE_MYSQL_DB_CCNET_DB_NAME=${SEAFILE_MYSQL_DB_CCNET_DB_NAME:-ccnet_db}
- SEAFILE_MYSQL_DB_SEAFILE_DB_NAME=${SEAFILE_MYSQL_DB_SEAFILE_DB_NAME:-seafile_db}
- SEAFILE_MYSQL_DB_SEAHUB_DB_NAME=${SEAFILE_MYSQL_DB_SEAHUB_DB_NAME:-seahub_db}
- TIME_ZONE=${TIME_ZONE:-Etc/UTC}
- INIT_SEAFILE_ADMIN_EMAIL=${INIT_SEAFILE_ADMIN_EMAIL:-me@example.com}
- INIT_SEAFILE_ADMIN_PASSWORD=${INIT_SEAFILE_ADMIN_PASSWORD:-asecret}
- SEAFILE_SERVER_LETSENCRYPT=false
- SEAFILE_SERVER_HOSTNAME=${SEAFILE_SERVER_HOSTNAME:?Variable is not set or empty}
- SEAFILE_SERVER_PROTOCOL=${SEAFILE_SERVER_PROTOCOL:-http}
- SEAHUB_GUNICORN_HOST=0.0.0.0
- SEAHUB_GUNICORN_PORT=8000
- SITE_ROOT=${SITE_ROOT:-/}
- NON_ROOT=${NON_ROOT:-false}
- JWT_PRIVATE_KEY=${JWT_PRIVATE_KEY:?Variable is not set or empty}
- SEAFILE_LOG_TO_STDOUT=${SEAFILE_LOG_TO_STDOUT:-false}
- ENABLE_SEADOC=${ENABLE_SEADOC:-true}
- SEADOC_SERVER_URL=${SEAFILE_SERVER_PROTOCOL:-http}://${SEAFILE_SERVER_HOSTNAME:?Variable is not set or empty}/sdoc-server
- INIT_S3_STORAGE_BACKEND_CONFIG=${INIT_S3_STORAGE_BACKEND_CONFIG:-false}
- INIT_S3_COMMIT_BUCKET=${INIT_S3_COMMIT_BUCKET:-}
- INIT_S3_FS_BUCKET=${INIT_S3_FS_BUCKET:-}
- INIT_S3_BLOCK_BUCKET=${INIT_S3_BLOCK_BUCKET:-}
- INIT_S3_KEY_ID=${INIT_S3_KEY_ID:-}
- INIT_S3_SECRET_KEY=${INIT_S3_SECRET_KEY:-}
- INIT_S3_USE_V4_SIGNATURE=${INIT_S3_USE_V4_SIGNATURE:-true}
- INIT_S3_AWS_REGION=${INIT_S3_AWS_REGION:-us-east-1}
- INIT_S3_HOST=${INIT_S3_HOST:-us-east-1}
- INIT_S3_USE_HTTPS=${INIT_S3_USE_HTTPS:-true}
