Been bashing my head against a wall for days with this one. I previously had a Seafile 11 CE setup and working with my Authelia instance. I upgraded to 13 since I never got Seadoc working but now OAuth won’t work. I’ve done several clean reinstalls but I just can’t get it. In a futile attempt, I also tested Seafile 12 but no dice.
As it is, I can log in normally, upload/download files, Seadoc still doesn’t work but that’s for another day.
I have used the official docker configuration for install, but have disabled the built in Caddy container as I have an external Caddy instance in control of all incoming web traffic which handles all SSL with a wildcard certificate for my domain.
The problem
When I go to https://cloud.domain.com I can click on the “Single Sign-On” button and get redirected to https://auth.domain.com but authorising the request will sit there for a few minutes until it times out. I then get redirected back to Seafile, with the error page “Error, please contact administrator.”
(My) Caddyfile block
### SEAFILE - SSO
cloud.domain.com {
tls /data/caddy/certificates/wildcards/domain.com/fullchain.pem /data/caddy/certificates/wildcards/domain.com/privkey.pem
handle_path /sdoc-server/* {
reverse_proxy http://192.168.2.4:8888 {
header_up Host {host}
header_up X-Real-IP {remote_host}
}
# 100 MB upload limit
request_body {
max_size 100MB
}
}
handle_path /socket.io* {
reverse_proxy http://192.168.2.4:8888 {
header_up Host {host}
header_up X-Real-IP {remote_host}
header_up X-NginX-Proxy true
header_up Upgrade {http.request.header.Upgrade}
header_up Connection {http.request.header.Connection}
# WebSocket support (HTTP/1.1)
transport http {
versions 1.1
}
}
}
reverse_proxy http://192.168.2.4:80 {
header_up Host {host}
header_up X-Real-IP {remote_host}
header_up Connection ""
transport http {
read_timeout 310s
}
}
request_body {
max_size 0
}
}
Built-in Caddy disabled in .env
#################################
# Docker compose configurations #
#################################
#COMPOSE_FILE='seafile-server.yml,caddy.yml,seadoc.yml'
COMPOSE_FILE='seafile-server.yml,seadoc.yml'
COMPOSE_PATH_SEPARATOR=','
Seafile docker has ports uncommented, and Caddy labels blanked
services:
...
seafile:
image: ${SEAFILE_IMAGE:-seafileltd/seafile-mc:13.0-latest}
container_name: seafile
restart: unless-stopped
ports: # uncommented
- "80:80" # uncommented
...
# labels:
# caddy: ${SEAFILE_SERVER_PROTOCOL:-http}://${SEAFILE_SERVER_HOSTNAME:?Variable is not set or empty}
# caddy.reverse_proxy: "{{upstreams 80}}"
I’ve done the same to the seadoc.yml, but I’ll leave it out to exclude more walls of text.
/opt/seafile-data/seafile/conf/seahub_settings.py
ENABLE_OAUTH = True
OAUTH_CREATE_UNKNOWN_USER = True
OAUTH_ACTIVATE_USER_AFTER_CREATION = True
Usually OAuth works through SSL layer. If your server is not parametrized to allow HTTPS, some method w>
#OAUTH_ENABLE_INSECURE_TRANSPORT = True
OAUTH_ENABLE_INSECURE_TRANSPORT = False
OAUTH_CLIENT_ID = “*random-client-string*”
OAUTH_CLIENT_SECRET = “secret-plaintext”
Callback url when user authentication succeeded. Note, the redirect url you input when you register you>
OAUTH_REDIRECT_URL = ‘https://cloud.domain.com/oauth/callback/’
#OAUTH_PROVIDER_DOMAIN = ‘auth.domain.com’
OAUTH_PROVIDER = ‘auth.domain.com’
OAUTH_AUTHORIZATION_URL = ‘https://auth.domain.com/api/oidc/authorization/’
OAUTH_TOKEN_URL = ‘https://auth.domain.com/api/oidc/token/’
OAUTH_USER_INFO_URL = ‘https://auth.domain.com/api/oidc/userinfo/’
OAUTH_SCOPE = [
“openid”,
“profile”,
“email”,
]
OAUTH_ATTRIBUTE_MAP = {
“id”: {True, “email”),
"uid / id / username": (True, "uid"),
“preferred_username”: (True, “uid”), # Seafile v11.0 +
"name": (False, "name"),
"email": (False, "contact_email"),
}
Authelia Configuration
### SEAFILE
- client_id: '*random-client-string*'
client_name: 'Seafile'
client_secret: '*secret-hashed*'
public: false
authorization_policy: 'two_factor'
require_pkce: false
pkce_challenge_method: ''
redirect_uris:
- 'https://cloud.domain.com/oauth/callback/'
scopes:
- 'openid'
- 'profile'
- 'email'
response_types:
- 'code'
grant_types:
- 'authorization_code'
access_token_signed_response_alg: 'none'
userinfo_signed_response_alg: 'none'
token_endpoint_auth_method: 'client_secret_basic'
# consent_mode: implicit
Caddy and Seafile are on separate hosts, but Caddy and Authelia are running together on a single docker stack with a shared network.
I know Seafile can reach Authelia as I can get a response from within the container’s shell:
# curl https://auth.domain.com
<!doctype html>
<html lang="en">
<head>
<base href="https://auth.domain.com/" />
<meta property="csp-nonce" content="N94ORwOOjjlxctT4mdzD5Cv8A0UsF8kJ" />
<meta charset="utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1" />
<meta name="theme-color" content="#000000" />
<link rel="manifest" href="./manifest.json" />
<link rel="icon" href="./favicon.ico" />
<title></title>
<script type="module" crossorigin src="./static/js/index.J4YSomth.js"></script>
<link rel="stylesheet" crossorigin href="./static/css/index.ChexMFeY.css">
</head>
<body
data-basepath=""
data-duoselfenrollment="false"
data-logooverride="false"
data-privacypolicyurl=""
data-privacypolicyaccept="false"
data-passkeylogin="false"
data-rememberme="true"
data-resetpassword="true"
data-resetpasswordcustomurl=""
data-theme="auto"
>
<noscript>You need to enable JavaScript to run this app.</noscript>
<div id="root"></div>
</body>
</html>
And likewise, connecting to Seafile from the Authelia shell:
/app # wget cloud.domain.com
--2025-12-25 07:06:27-- http://cloud.domain.com/
Resolving cloud.domain.com (cloud.domain.com)... 10.15.1.218
Connecting to cloud.domain.com (cloud.domain.com)|10.15.1.218|:80... connected.
HTTP request sent, awaiting response... 308 Permanent Redirect
Location: https://cloud.domain.com/ [following]
--2025-12-25 07:06:27-- https://cloud.domain.com/
Connecting to cloud.domain.com (cloud.domain.com)|10.15.1.218|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: /accounts/login/?next=/ [following]
--2025-12-25 07:06:27-- https://cloud.domain.com/accounts/login/?next=/
Reusing existing connection to cloud.domain.com:443.
HTTP request sent, awaiting response... 200 OK
Length: 14825 (14K) [text/html]
Saving to: 'index.html'
index.html 100%[==============================================================================================================================================>] 14.48K --.-KB/s in 0.001s
2025-12-25 07:06:27 (21.3 MB/s) - 'index.html' saved [14825/14825]
