[HOW-TO] Setup SSO (OIDC) with Authentik (web, desktop app, iOS app)

[StafLoker]

Replace with your domain: domain.com

Opencloud

Env file (opencloud.env)

# SSO
OC_OIDC_ISSUER=https://auth.domain.com/application/o/opencloud/
WEB_OIDC_CLIENT_ID=<id>
## Proxy
PROXY_AUTOPROVISION_ACCOUNTS=true
PROXY_ROLE_ASSIGNMENT_DRIVER="oidc"
PROXY_OIDC_REWRITE_WELLKNOWN="true"
PROXY_USER_OIDC_CLAIM="preferred_username"
PROXY_USER_CS3_CLAIM="username"
## role assignment
OC_EXCLUDE_RUN_SERVICES=idp
WEB_OIDC_SCOPE=openid profile email groups
PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM=groups
GRAPH_ASSIGN_DEFAULT_USER_ROLE=false
GRAPH_USERNAME_MATCH="none"
PROXY_OIDC_ACCESS_TOKEN_VERIFY_METHOD=none

# CSP
PROXY_CSP_CONFIG_FILE_LOCATION=/etc/opencloud/csp.yaml

CSP file (csp.yaml)

directives:
  child-src:
    - '''self'''
  connect-src:
    - '''self'''
    - 'blob:'
    - 'https://raw.githubusercontent.com/opencloud-eu/awesome-apps/'
    - 'https://auth.domain.com/'
  default-src:
    - '''none'''
  font-src:
    - '''self'''
  frame-ancestors:
    - '''self'''
  frame-src:
    - '''self'''
    - 'blob:'
    # This is needed for the external-sites web extension when embedding sites
    - 'https://docs.opencloud.eu'
  img-src:
    - '''self'''
    - 'data:'
    - 'blob:'
    - 'https://raw.githubusercontent.com/opencloud-eu/awesome-apps/'
  manifest-src:
    - '''self'''
  media-src:
    - '''self'''
  object-src:
    - '''self'''
    - 'blob:'
  script-src:
    - '''self'''
    - '''unsafe-inline'''
  style-src:
    - '''self'''
    - '''unsafe-inline'''

Proxy file (proxy.yaml)

role_assignment:
  driver: oidc
  oidc_role_mapper:
    role_claim: groups
    role_mapping:
      - role_name: admin 
        claim_value: Drive Admins
      - role_name: spaceadmin
        claim_value: Drive Admins 
      - role_name: user
        claim_value: Drive
      - role_name: guest
        claim_value: Guests 

Authentik

Providers

Web

Desktop app

iOS app

Groups

Create two groups, one for admin other for users.

Apps

Other

If you hace active desktop or mobile apps session, is not repair with login.

1. Logout & Remove server from app list
2. Add server in list (like when u lunch app first time)

[irrwitzer42]

Thank you very much @StafLoker for writing that down!

This looks exactly like the solution I'd love.... but I haven't got it working as of now.
Would you please tell us/add to your howto the information, which one of the docker-compose files you are using?
I am trying with the openopencloud-compose docker version and had to add
to add the above mentioned environment variables to my custom/docker-compose.override.yml to get the recognized.

My COMPOSE_FILE variable looks like this:
COMPOSE_FILE=docker-compose.yml:weboffice/collabora.yml:external-proxy/opencloud.yml:external-proxy/collabora.yml:custom/docker-compose.override.yml

So as you can see, without idm/ldap-keycloak.yml -> no integrated LDAP or Keycloak. Maybe that is my mistake already, but not sure. I wanted to have the installation to use as few ressources for overhead as possible.

So, if you could please let us know the base-installation/your starting point for this config manual to, that would be great and maybe I'll get it working then. :-)

Thanks in advance!
Irrwitzer

[irrwitzer42]

so it's still not working for you?
Did you add your OIDC server to csp.yaml?

That was my main issue from the start. And you can debug this with safari's developer console -- or any other browser's.
You'll see the errors for the token refresh after an hour. And that was in my case the CSP policy, that didn't allow frame-includes of my auth provider.

[hasdf]

In Safari:
It's working 60% of the time :) For the other 40% I get status 401 in the browser and nginx log... Happens a lot if opening a folder with a lot of images all the preview images are loaded, and some of them get 401.

In Firefox:
Everything works 99% of the time. If I open a folder with 100 Images, 1 image has no preview image and there is a 401 in the log for it

[Viko1690]

Hi @hasdf, @irrwitzer42,

any updates about this issue? I am facing the same problem about auto-logout after a few minutes (Safari and somtimes Microsoft Edge). I have already added my Authentik-Server to the csp.yaml.

Thank you!

[irrwitzer42]

Hi @Viko1690 ,

Well... I stopped working on it for now, as I'm out of ideas where to look.
My desktop client on OSX still needs reauthentication every couple of days. Windows and mobile seems fine.
The webUI (Safari) is fine, but some actions cause an unauthorised error message, providing a like to reauthenticate, then it's working fine again...

It's not perfect, but I can work with it.
I'm still on version 2.0.4 (webui 2.1.1) if that matters for you.

Good luck with your issues!

[Viko1690]

Hi @irrwitzer42 ,

thanks for your reply. I set the access token validity for the webclient provider to "hours=24" and the auto-logout seems to appear only after on day. I think this is okay for daily use. Maybe it would also take a positive impact if this is set for the other providers too, but I am not sure if this will cause any security risks...

[micbar]

@irrwitzer42
You can just do a volume bind mount to get config/opencloud/proxy.yaml into the container.

[blackstormlab]

i just used this example and ended up with this:

this shows up after attempting to login

and this shows up in the logs

[blackstormlab]

i am sending the role claim which has me stumped

[blackstormlab]

This is my proxy.yaml

and here you can see it is also sending the group claim

[blackstormlab]

this is also in the logs.

{"level":"debug","service":"proxy","claims":{"email":"redacted","email_verified":true,"exp":1757107417,"given_name":"blackstorm","groups":["authentik Admins","Homelab admin","gituser","gitadmin","immich_user","immich_admin","opencloud_user","opencloud_admin"],"name":"blackstorm","nickname":"blackstorm","opencloud_role":"user","preferred_username":"blackstorm","sub":"redacted"},"time":"2025-09-05T21:23:27Z","line":"github.com/opencloud-eu/opencloud/services/proxy/pkg/middleware/oidc_auth.go:135","message":"extracted claims"}

[kapuett]

Am currently stuck at the same point. Did you ever figure this out @blackstormlab?

[jenkinsmichpa]

I had this issue and solved it by mapping the proxy.yaml file as a volume as below. It being mapped by default is currently tied to using the radicale.yml compose file or not.

services:
  opencloud:
    volumes:
          - ./config/opencloud/proxy.yaml:/etc/opencloud/proxy.yaml

[chiragkrishna]

thanks a lot, it is working perfectly.
have a doubt, is it possible to have the default login, but with a button saying login with Authentik? instead of directly redirecting to Authentik.

[uptonking]

🤔 i built opencloud from source according to the Install Bare-Metal | OpenCloud Docs , but where should i put csp.yaml, proxy.yaml files ?

• The compiled binary is opencloud/bin/opencloud, i can start it by opencloud/bin/opencloud server, it works with default admin user.
• but i cannot get local opencloud working with authentik. I set environment vars as the OP pasted. but I dont understand where to put csp.yaml, proxy.yaml files .
• I tried create folder /etc/opencloud/ on my mac, and put the two files in it, but it still dosenot work.
• i have set env var PROXY_CSP_CONFIG_FILE_LOCATION=/etc/opencloud/csp.yaml, but there is still error as below

{"level":"error","service":"proxy","request-id":"6f08b634-a8c5-4b9f-9f46-b67a08dc49bb","userid":"cf65dbc7-5cdb-4adf-8cbe-5af292eb89df","error":"no role in claim maps to an OpenCloud role","time":"2025-09-27T08:04:42+08:00"}
{"level":"error","service":"proxy","error":"no role in claim maps to an OpenCloud role","time":"2025-09-27T08:04:42+08:00","message":"Could not get user roles"}

[thokich]

Big Thanks of all here. It runs on Authentik 2025.10.2
or in my frankonia language "passt scho"

[hashtagsheep]

Thanks for the guide 👍

I’m running OpenCloud 4.0.1 with Authentik 2025.10.3, and authentication generally behaves as expected. iOS and desktop apps work without issues.

The only remaining problem is that I occasionally get logged out in the browser for no obvious reason. I suspect something around refresh tokens not being picked up or refreshed correctly by the browser/WebDAV flow.

I see this in the OpenCloud proxy logs from time to time:

error="token is expired"
authenticator="oidc"
path="/remote.php/dav/..."

It’s not constant, but happens sporadically. Has anyone else seen similar behavior or found specific Authentik token/refresh settings that work best with OpenCloud?

[Alulu2401]

i had the same issue not sporadically but linked to the refresh token, added offline_access scope to WEB_OIDC_SCOPE variable in the compose file did the trick

[hashtagsheep]

That did the trick mostly, the error still is in the logs, together with other auth error. Could you check if you have the same?

Thanks

[chiragkrishna]

yes after adding offline_access, still getting this error, but not random logouts

{"level":"warn","service":"frontend","host.name":"85ce7781d580","pkg":"rhttp","traceid":"af1e6ff1cef1098e48ddfdcef0d7c8af","time":"2025-12-28T01:45:29Z","message":"core access token not set"}

now collabora is not working

Failed to establish socket connection or socket connection closed unexpectedly. The reverse proxy might be misconfigured, please contact the administrator. For more info on proxy configuration please checkout https://sdk.collaboraonline.com/docs/installation/Proxy_settings.html

[Alulu2401]

That did the trick mostly, the error still is in the logs, together with other auth error. Could you check if you have the same?

Thanks

Nope no errors in my logs, sorry :(

[kapuett]

@chiragkrishna the error

now collabora is not working

is unrelated, see opencloud-eu/opencloud-compose#173.

[chiragkrishna]

was banging my head from past 2 days, thanks a lot.

[Etzeo]

Reference for anyone that wants to configure it for android as well, this is what I got working:

Provider

Application

[trimacdo]

Thanks so much for the guide. I wanted to share some issues I ran into while I was setting up my authentik SSO that may help anyone else following along.

This environment variable is important when using Authentik, as you have to setup different providers for each of the different apps and then the token issuer does not match the main "web" server when using the applications on mobile/desktop.
.env
PROXY_OIDC_ACCESS_TOKEN_VERIFY_METHOD=none

I'm not 100% sure the security implications of setting it to none, however I am running everything on my LAN behind VPN.

I also ended up using a property mapping in Authentik to place the claims of the scopes "roles" into "profile". [Customization->Property Mappings]

In the opencloud documentation this notated as the following on page: https://docs.opencloud.eu/docs/admin/configuration/authentication-and-user-management/external-idp

"As the OpenCloud clients currently only request a hardcoded list of scopes, the automatic role-assignment currently requires the IDP to be able to provide additional claims in the Access Token and the UserInfo endpoint independent of the requested scopes. If your IDP does not support this, automatic role assignment will not work."

# Standard profile claims
   profile_claims = {
       "name": request.user.name,
       "given_name": request.user.name,
       "preferred_username": request.user.username,
       "nickname": request.user.username,
   }
   
   # Add OpenCloud roles
   if ak_is_group_member(request.user, name="OpenCloud Admins"):
       profile_claims["roles"] = ["opencloudAdmin"]
   elif ak_is_group_member(request.user, name="OpenCloud Space Admins"):
       profile_claims["roles"] = ["opencloudSpaceAdmin"]
   elif ak_is_group_member(request.user, name="OpenCloud Users"):
       profile_claims["roles"] = ["opencloudUser"]
   else:
       profile_claims["roles"] = ["opencloudGuest"]
   
   return profile_claims

In addition, you remove the "openid profile" scope mapping from the opencloud providers, as this includes the standard profile claims. You can then make the following groups in Authentik and assign your users to them.

OpenCloud Admins
OpenCloud Space Admins
OpenCloud Users

[trimacdo]

It would be great if opencloud could add on to their "OC_OIDC_ISSUER" environment variable, and create one for each different app. such as

OC_WEB_OIDC_ISSUER
OC_IOS_OIDC_ISSUER
OC_DESKTOP_OIDC_ISSUER
OC_ANDROID_OIDC_ISSUER

[ierturk]

This works for browser with Authelia but iOS app claims roles and won't work. Authelia does not have default attribute roles and needs to be expanded with extra attributes which is inconvenient. The LDAP server LLDAP also provides groups by default. We need a setup or environment variable for Desktop, iOS or Android app settings such that DESTOP/IOS/ANDROID_ROLE_ASSIGNMENT_OIDC_CLAIM and DESTOP/IOS/ANDROID_OIDC_SCOPE.

IOS app works without role assignment with export PROXY_ROLE_ASSIGNMENT_DRIVER="default"

# .env
export PROXY_ROLE_ASSIGNMENT_DRIVER="oidc"   
export PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM="groups"

# export WEB_OIDC_SCOPE="openid profile email groups roles_scope"
export WEB_OIDC_SCOPE="openid profile email groups"

# proxy.yaml
role_assignment:
  driver: oidc
  oidc_role_mapper:
    role_claim: groups
    role_mapping:
      - role_name: admin
        claim_value: opencloudAdmin
      - role_name: spaceadmin
        claim_value: opencloudSpaceAdmin
      - role_name: user
        claim_value: opencloudUser
      - role_name: guest
        claim_value: opencloudGuest

# Authelia config

    #claims_policies:
    #  roles_policy:
    #    custom_claims:
    #      roles:
    #        attribute: 'roles'
    #scopes:
    #  roles_scope:
    #    claims:
    #      - 'roles'

    clients:
      # OpenCloud
      - client_id: "oc-web"
        client_name: "OpenCloud Web Client"
        public: true
        authorization_policy: 'one_factor'
        require_pkce: true
        # pkce_challenge_method: 'S256'
        # claims_policy: 'roles_policy'
        scopes:
          - 'openid'
          - 'offline_access'
          - 'groups'
          - 'profile'
          - 'email'
          # - 'roles_scope'
        redirect_uris:
          - 'https://cloud.erturk.me/'
          - 'https://cloud.erturk.me/oidc-callback.html'
          - 'https://cloud.erturk.me/oidc-silent-redirect.html'
          - 'https://cloud.erturk.me/apps/openidconnect/redirect'
        response_types:
          - 'code'
        grant_types:
          - 'authorization_code'
          - 'refresh_token'
        access_token_signed_response_alg: 'none'
        userinfo_signed_response_alg: 'none'
        token_endpoint_auth_method: 'none'

      - client_id: 'OpenCloudIOS'          # Must match exactly
        client_name: 'OpenCloud iOS App'
        public: true                     # Public client (no secret)
        authorization_policy: 'two_factor' # Or one_factor if you prefer
        consent_mode: 'auto'
        require_pkce: true
        pkce_challenge_method: 'S256'
        redirect_uris:
          - 'oc://ios.opencloud.eu'
        scopes:
          - 'openid'
          - 'profile'
          - 'email'
          - 'groups'
          - 'offline_access'

authentication_backend:
  password_reset:
    disable: false
  ldap:
    implementation: lldap
    address: 'ldap://IP:3890'
    base_dn: 'dc=erturk,dc=me'
    additional_users_dn: 'ou=people'
    additional_groups_dn: 'ou=groups'
    user: 'uid=authelia_bind_user,ou=people,dc=erturk,dc=me'
    password: 'super_secret'
    #attributes:
    #  username:
    #  display_name: displayName
    #  mail: mail
    #  extra:
    #    roles:
    #      multi_valued: true
    #      value_type: 'string'
    #

[micbar]

#2072 is going to be merged soon to simplify that config process drastically.

Last chance for feedback & reviews.

[MannixTT]

Has anyone tried this again after that pull request getting merched in the latest version?
https://github.com/opencloud-eu/web/pull/2152

Unfortunately, there's no way to use multiple issuer URLs (per client in Authentik), or am I mistaken?

I’ve been tinkering with this for two days now, diligently reading GitHub PRs, discussions, etc., and testing things out, and I’m slowly reaching my limits.

If anyone has gotten it working, I’d appreciate a quick chat. I’d also be happy to help update the documentation.

[micbar]

Set the same issuer for all clients.

note: so far, only the android app has the change.

[netsho]

Same, I've been tinkering since the latest release of the android app v1.2.0. Then, using the same issuer for all clients resolved it for me.

Delete the application and provider for the android client.
Update the web provider (this will be the default issuer):

• Edit the Client ID for whatever client id you want. In my case, I used opencloud
• Add android RedirectURIs besides web RedirectURIs: oc://android.opencloud.eu

• Add offline_access scope

Add the env variables to the opencloud container:
WEBFINGER_WEB_OIDC_CLIENT_ID=opencloud
WEBFINGER_ANDROID_OIDC_CLIENT_ID=opencloud

[MannixTT]

Same, I've been tinkering since the latest release of the android app v1.2.0. Then, using the same issuer for all clients resolved it for me.

Delete the application and provider for the android client. Update the web provider (this will be the default issuer):

• Edit the Client ID for whatever client id you want. In my case, I used opencloud
• Add android RedirectURIs besides web RedirectURIs: oc://android.opencloud.eu

* Add `offline_access` scope

Add the env variables to the opencloud container: WEBFINGER_WEB_OIDC_CLIENT_ID=opencloud WEBFINGER_ANDROID_OIDC_CLIENT_ID=opencloud

Thank you very much for your reply!
I’ll give it another try—if the web and Android clients work in the first step, that would cover most of my requirements.
Just a quick question to clarify...
How would the environment variables behave if both OC_OIDC_CLIENT_ID and WEBFINGER_ANDROID_OIDC_CLIENT_ID were specified? Would WEBFINGER_ANDROID_OIDC_CLIENT_ID then act as a kind of override for the Android client, with the OC_OIDC_CLIENT_ID environment variable serving as a global fallback?

Unfortunetely my login isn't working yet. It's caused by the role mapping where I am missing something out.

# .env (relevant parts)
COMPOSE_FILE=docker-compose.yml:search/tika.yml:weboffice/collabora.yml:external-proxy/opencloud-exposed.yml:external-proxy/collabora-exposed.yml:idm/external-idp.yml:radicale/radicale.yml
## Autoprovisioning Mode ##
# Use together with idm/external-idp.yml
# If you want to use a keycloak for local testing, you can use testing/external-keycloak.yml and testing/ldap-manager.yml
# Domain of your Identity Provider.
IDP_DOMAIN="authentik.authentik.domain.tld"
# IdP Issuer URL, which is used to identify the Identity Provider.
# We need the complete URL, including the protocol (http or https) and the realm.
# Example: "https://keycloak.opencloud.test/realms/openCloud"
IDP_ISSUER_URL="https://authentik.domain.tld/application/o/opencloud/"
# Url of the account edit page from your Identity Provider.
IDP_ACCOUNT_URL="https://authentik.domain.tld/application/o/userinfo/"
OC_OIDC_CLIENT_ID="<CLIENTID>"
WEBFINGER_WEB_OIDC_CLIENT_ID="<CLIENTID>"
WEBFINGER_ANDROID_OIDC_CLIENT_ID="<CLIENTID>"

PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM="groups"
OC_OIDC_CLIENT_SCOPES="openid profile email groups"

PROXY_OIDC_ACCESS_TOKEN_VERIFY_METHOD=none
PROXY_CSP_CONFIG_FILE_LOCATION="/etc/ocis/csp.yaml"

#proxy.yaml

# This adds four additional routes to the proxy. Forwarding
# request on '/carddav/', '/caldav/' and the respective '/.well-knwown'
# endpoints to the radicale container and setting the required headers.
additional_policies:
  - name: default
    routes:
      - endpoint: /caldav/
        backend: http://radicale:5232
        remote_user_header: X-Remote-User
        skip_x_access_token: true
        additional_headers:
          - X-Script-Name: /caldav
      - endpoint: /.well-known/caldav
        backend: http://radicale:5232
        remote_user_header: X-Remote-User
        skip_x_access_token: true
        additional_headers:
          - X-Script-Name: /caldav
      - endpoint: /carddav/
        backend: http://radicale:5232
        remote_user_header: X-Remote-User
        skip_x_access_token: true
        additional_headers:
          - X-Script-Name: /carddav
      - endpoint: /.well-known/carddav
        backend: http://radicale:5232
        remote_user_header: X-Remote-User
        skip_x_access_token: true
        additional_headers:
          - X-Script-Name: /carddav

role_assignment:
  driver: oidc
  oidc_role_mapper:
    role_claim: groups
    role_mapping:
      - role_name: admin 
        claim_value: opencloudAdmin
      - role_name: spaceadmin
        claim_value: opencloudSpaceAdmin
      - role_name: user
        claim_value: opencloudUser
      - role_name: guest
        claim_value: opencloudGuest
# To enable the radicale web UI add this rule.
# "unprotected" is True because the Web UI itself ask for
# the password.
# Also set "type" to "internal" in the config/radicale/config
#      - endpoint: /caldav/.web/
#        backend: http://radicale:5232/
#        unprotected: true
#        skip_x_access_token: true
#        additional_headers:
#          - X-Script-Name: /caldav

Role Mapping in Authentik:

The user I want to log in as is a member of the “opencloudAdmin” group. I already tried the groups or roles OIDC Scope without success

Thanks in advance!

Edit: Additional info

[netsho]

For OC_OIDC_CLIENT_ID and WEBFINGER_ANDROID_OIDC_CLIENT_ID, I think you're right, because OC_OIDC_CLIENT_ID is alongside every webfinger platform-specific env variables. How I understand it, is that OC_OIDC_CLIENT_ID would be fallback for all clients, but I can't try it right now.
Edit: As stated here, OC_OIDC_CLIENT_ID is a fallback for all platforms.

As for the role claim, I'm thinking maybe the OpenCloud Roles Property Mappings isn't quite right (but I don't see why).
In my case, I have the same opencloud configuration as you (env variables and proxy.yaml file).
But in authentik, i have assigned each role individually to the corresponding group.

# proxy.yaml

role_assignment:
  driver: oidc
  oidc_role_mapper:
    role_claim: groups
    role_mapping:
      - role_name: admin
        claim_value: admin
      - role_name: spaceadmin
        claim_value: admin
      - role_name: user
        claim_value: contributor
      - role_name: guest
        claim_value: viewer

In authentik, i have for example contributor role and contributor group, and I assigned the role to the group. I didn't create a property mapping.

[MannixTT]

I've finally gotten it to work, but using roles via property mapping. The Authentik roles are intended solely for internal permissions within Authentik.
After checking the event log in Authentik, I noticed that even though I had defined OC_OIDC_CLIENT_SCOPES="openid profile email roles offline_access" in my .env file, Authentik only requested “openid profile email” as the scope. The reason was that the Dockerfile under idm/external-idp hadn’t set this environment variable, nor another variable that I had already added previously.

After testing, I need to transfer my own customizations back into my IaS and will then open a PR for it. Thank you very much for your input and support!

[StrangeGirlMurph]

I wish someone would cleanly rewrite this how-to now that #2072 got merged. It's so hard to keep track of all the details across all these different discussions, issues and PRs :(

Like: One or multiple providers? What do the client id(s) have to be? What issuer url should I set when I have multiple providers?

I am so confused 🥲️

[MannixTT]

Unfortunately, it seems that only the Webfinger app works on the web and Android (I can't test it on iOS), but not on the desktop. However, I need the desktop client because I'm having trouble uploading my data, and I suspect it's due to the web version and its file size limit.
If you're having trouble setting this up with Authentik, I can try to document my current configuration here over the weekend.

[StrangeGirlMurph]

Any updates?

[micbar]

The desktop client needs a release. There is currently no ETA.

[StrangeGirlMurph]

@micbar Any idea what might be wrong now with my authentik setup?

[StrangeGirlMurph]

@MannixTT can you tell what might be the problem with my setup? I am getting really desperate :(

[MannixTT]

@StrangeGirlMurph
Sorry for not responding; I simply overlooked it in my inbox.

proxy_role_assignment_oidc_claim: opencloud-roles
To do this, I created a corresponding mapping in Authentik to map the roles from Authentik to OpenCloud.

Custom Role Mapping in Authentik:

allowed_roles = [
    "app-opencloud-admin", 
    "app-opencloud-space-admin", 
    "app-opencloud-user", 
    "app-opencloud-guest"
]

all_names = set()

for group in user.ak_groups.all():
    all_names.add(group.name)
    
    for parent in group.parents.all():
        all_names.add(parent.name)

matched_roles = [r for r in all_names if r in allowed_roles]

return {
    "opencloud-roles": matched_roles
}

Finally, I’d like to add that it’s extremely frustrating that the desktop client can’t be used right now. and that there isn't a ETA for implementation. I’d like to migrate my data from my Samba share, but I haven’t been able to do so for over two months now.

[StrangeGirlMurph]

Thanks @MannixTT! In the meantime I somehow got it to work without Authentiks Property Mapping but with OpenClouds internal mapping. It felt like I just got lucky. The document is really bad