[QA] documented COMPOSE_FILE= for collabora+tika fails on initial login

[jnweiger]

Describe the bug

oc-7.0.0-rc.0 started at hetzner cloud via docker compose according to https://docs.opencloud.eu/docs/admin/getting-started/container/docker-compose/docker-compose-base/
Browser: Firefox 140.9.0esr openSUSE 15.6

I'd like to enable collabora in my docker compose setup and keep things minimal otherwise.

• Instructions at https://docs.opencloud.eu/docs/next/admin/configuration/collabora/ have no hint about the correct combination of COMPOSE_FILE settings. BAD.
• Ressorting to https://github.com/opencloud-eu/opencloud-compose/blob/main/README.md#with-collabora-online which eplains to use

COMPOSE_FILE=docker-compose.yml:weboffice/collabora.yml:traefik/opencloud.yml:traefik/collabora.yml

and the relevant DNS settings. This seems consistent with the example lines and comments in the .env.template file. OKish.

I am combining this with the tika files, my end result is:
COMPOSE_FILE=docker-compose.yml:search/tika.yml:weboffice/collabora.yml:traefik/opencloud.yml:traefik/collabora.yml

The server starts just fine and presents a login page.

The admin user cannot log in. BAD
The user sees:
Unexpected HTTP response: 500. Please check your connection and try again.

The logs have:

opencloud-1      | {"level":"error","service":"idm","bind_dn":"uid=idp,ou=sysusers,o=libregraph-idm","op":"bind","remote_addr":"127.0.0.1:47824","time":"2026-05-20T16:23:03Z","line":"github.com/opencloud-eu/opencloud/pkg/log/logrus_wrapper.go:50","message":"not found"}ch
opencloud-1      | {"level":"error","service":"idp","error":"ldap identifier backend logon connect error: LDAP Result Code 49 \"Invalid Credentials\": ","time":"2026-05-20T16:23:03Z","line":"github.com/opencloud-eu/opencloud/pkg/log/logrus_wrapper.go:50","message":"identifier failed to logon with backend"}
opencloud-1      | {"level":"info","service":"proxy","proto":"HTTP/1.1","request-id":"92b9cfc3577c/eqruJzG5S7-001443","traceid":"47dd8d436d399b2bcb7baa6184a55cff","remote-addr":"87.148.44.85","method":"POST","status":500,"path":"/signin/v1/identifier/_/logon","duration":15.860392,"bytes":44,"time":"2026-05-20T16:23:03Z","line":"github.com/opencloud-eu/opencloud/services/proxy/pkg/middleware/accesslog.go:34","message":"access-log"}

Expected behavior

instructions for setting up opencloud with collabora support should work.

Actual behavior

The admin docs are thin, resorting to README.md and .env.example does not work.

Is ldap-keycloak.yml a pre-requisite for collabora+tika?
Are tika and collabora incompatible?
If so, the docs should mention that.

[micbar]

This looks like a non-cleaned previous installation.

LDAP says "invalid credentials".

[jnweiger]

Investigated further. My initial report was not quite exact. Sorry. Key issue here (and edited above):

The issue actually is the combination of tika and collabora.

• Works: COMPOSE_FILE=docker-compose.yml:weboffice/collabora.yml:traefik/opencloud.yml:traefik/collabora.yml

• Works: COMPOSE_FILE=docker-compose.yml:search/tika.yml:traefik/opencloud.yml

• Fails: COMPOSE_FILE=docker-compose.yml:search/tika.yml:weboffice/collabora.yml:traefik/opencloud.yml:traefik/collabora.yml

[jnweiger]

Recovery procedure:

• docker compose down
• edit .env to remove :search/tika.yml: from the COMPOSE_FILE line.
• docker volume rm opencloud-compose_opencloud-config
• docker volume rm opencloud-compose_opencloud-data
• docker compose up
• now the initial admin login works.

Deleting the config volume alone is not sufficient, the error persists. I have to delete the data volume too.
(Insufficient config/data separation?)

[micbar]

The problem is very basic.

The shipped ldap server (idm) uses a boltdb store. This data is stored on the data volume.

The bind password is randomized when the init step runs. So if you do not delete the data the ldap server is initialized with the old bind password.

This is relatively inconvenient but production systems should use an external LDAP server anyway. This can be seen in the ldap keycloak example.