Reminds me of the group limit attribute in nextcloud. You could try looking at the ‘Custom profile scope’ section of https://docs.goauthentik.io/integrations/services/nextcloud/ to see if it helps to work out what to do

I had the exact same issue.
Basically, what I wanted to do, was to have my Authentik user created as an admin, and the others to be created as users (as anyway, I would be able to change the roles of the other users from my user).

Here’s how I fixed it :
1 - In left navigation menu, went to “Directory/Groups”, then created a new “group” called “ocisAdmin”.
2 - In left navigation menu, went to “Directory/Users”, then assigned my user to this new group.
3 - In left navigation menu, went to “Customization/Property Mappings”, then, created a new “Scope Mapping” (penultimate option on my UI). Gave it a name that speaks to me (“oCIS email scope extended”, if you want to know), “email” as “Scope Name”, and this expression:

return {
  "roles": "ocisAdmin" if ak_is_group_member(request.user, group_uuid="55bb2a58-2973-4753-a16a-6ebc80bec705") else "ocisUser"
} # Replace the UUID with your group's one, I found it in the URL when modifying the group in Authentik

4 - In left navigation menu, went to “Applications/Providers”, opened each oCIS provider, clicked “Edit”, opened the sub-menu “Advanced protocol settings”, selected my custom “Property mapping” in the left “Scopes” menu, and clicked on the right pointing arrow to have it selected for those providers.

Also, make SURE that you have this property set:

PROXY_ROLE_ASSIGNMENT_DRIVER=oidc

Now, my users are properly populated into oCIS.
I still need to figure out how to make the applications work, but I have faith I’ll figure it out :)

Hope that helped !

You can do this by replacing an existing scope or creating a new one. In some cases I’ve needed to replace an existing scope with custom mappings, and add the information needed to it. For example I created a custom scope of ‘profile’, added the relevant claim needed along with the standard scope information, and then associated that to the provider.

To do that, you add an OAuth scope mapping,. That mapping will then add the desired claim information. These are created with small python scripts. Set them to add the relevant claim when a case is matched (ex. User is in group “Admins”). Name the scope “profile”, though it could be a new scope (preferred) if owncloud lets you specify them.

In the provider for owncloud add that new or replacement scope. In the Edit settings that’s found under Advanced Protocol Settings. You’d add the named scope that correlates to your recently created Claim.

Then verify everything is working as expected; Go to Preview for that Provider. While it won’t show you scope names, it will combine the claims into the JWT preview which is convenient for validating you did everything correctly. It helps reduce the extra variable of Owncloud until you get to that point.