diff --git a/charts/ocis/Chart.yaml b/charts/ocis/Chart.yaml
index b212bc563..6e8228a33 100644
--- a/charts/ocis/Chart.yaml
+++ b/charts/ocis/Chart.yaml
@@ -10,7 +10,7 @@ maintainers:
     url: https://owncloud.com
 type: application
 version: 0.5.0
-appVersion: 5.0.0-alpha.3
+appVersion: 5.0.0-alpha.4
 kubeVersion: "" # please see https://doc.owncloud.com/ocis/next/deployment/container/orchestration/orchestration.html#get-the-chart for compatible Kubernetes versions
 sources:
   - https://github.com/owncloud/ocis-charts
diff --git a/charts/ocis/README.md b/charts/ocis/README.md
index a64ef21ac..fa6758ccc 100644
--- a/charts/ocis/README.md
+++ b/charts/ocis/README.md
@@ -2,7 +2,7 @@
 [comment]: # (DONT EDIT THIS FILE, it is autogenerated. Instead you need to edit README.md.gotmpl)
 
 # ownCloud Infinite Scale (oCIS) Helm chart
-![Version: 0.5.0](https://img.shields.io/badge/Version-0.5.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 5.0.0-alpha.3](https://img.shields.io/badge/AppVersion-5.0.0--alpha.3-informational?style=flat-square)
+![Version: 0.5.0](https://img.shields.io/badge/Version-0.5.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 5.0.0-alpha.4](https://img.shields.io/badge/AppVersion-5.0.0--alpha.4-informational?style=flat-square)
 
 Installs [ownCloud Infinite Scale](https://doc.owncloud.com/ocis/next/).
 
diff --git a/charts/ocis/docs/values-desc-table.adoc b/charts/ocis/docs/values-desc-table.adoc
index 88d8b72dc..297b371f3 100644
--- a/charts/ocis/docs/values-desc-table.adoc
+++ b/charts/ocis/docs/values-desc-table.adoc
@@ -808,7 +808,7 @@ a| [subs=-attributes]
 a| [subs=-attributes]
 +string+
 a| [subs=-attributes]
-`"3b056182307344f79544f44d91808dabf9014c200554f9ed17719366b526bf63"`
+`"13e5447c5e11de9068fbab07f362a793fbdc32edd8ad14eff0db1d21dfa2a5b8"`
 | Image sha / digest (optional).
 | image.tag
 a| [subs=-attributes]
diff --git a/charts/ocis/docs/values.adoc.yaml b/charts/ocis/docs/values.adoc.yaml
index 9fea8d358..27ac508bf 100644
--- a/charts/ocis/docs/values.adoc.yaml
+++ b/charts/ocis/docs/values.adoc.yaml
@@ -7,7 +7,7 @@ image:
   # -- Image tag. Defaults to the chart's appVersion.
   tag: "latest"
   # -- Image sha / digest (optional).
-  sha: "3b056182307344f79544f44d91808dabf9014c200554f9ed17719366b526bf63" # oCIS as of 5.0.0-alpha.3
+  sha: "13e5447c5e11de9068fbab07f362a793fbdc32edd8ad14eff0db1d21dfa2a5b8" # oCIS as of 5.0.0-alpha.4
   # -- Image pull policy
   pullPolicy: IfNotPresent
   # -- Names of the secret containing the credentials to pull an image from the registry. More
@@ -1820,6 +1820,10 @@ services:
         target: ""
         # Specifies a URL under which web can be integrated via iFrame. This needs to be specified when web is running in "embed"-mode.
         messagesOrigin: ""
+        # Specifies if web delegates the authentication to the embedding parent application. Defaults to not being set (= web handles the authentication).
+        delegateAuthentication: ""
+        # Specifies the allowed message origin host when posting access tokens from the embedding parent application to web. Defaults to not being set, which is only recommended for development environments.
+        delegateAuthenticationOrigin: ""
 
     # -- Persistence settings.
     # @default -- see detailed persistence configuration options below
diff --git a/charts/ocis/templates/web/deployment.yaml b/charts/ocis/templates/web/deployment.yaml
index 765b3c84c..421e9ec3c 100644
--- a/charts/ocis/templates/web/deployment.yaml
+++ b/charts/ocis/templates/web/deployment.yaml
@@ -86,6 +86,16 @@ spec:
               value: {{ .Values.services.web.config.embed.messagesOrigin | quote }}
             {{- end }}
 
+            {{- if .Values.services.web.config.embed.delegateAuthentication }}
+            - name: WEB_OPTION_EMBED_DELEGATE_AUTHENTICATION
+              value: {{ .Values.services.web.config.embed.delegateAuthentication | quote }}
+            {{- end }}
+
+            {{- if .Values.services.web.config.embed.delegateAuthenticationOrigin }}
+            - name: WEB_OPTION_EMBED_DELEGATE_AUTHENTICATION_ORIGIN
+              value: {{ .Values.services.web.config.embed.delegateAuthenticationOrigin | quote }}
+            {{- end }}
+
             - name: WEB_UI_CONFIG_SERVER
               value: "https://{{ .Values.externalDomain }}"
 
diff --git a/charts/ocis/values.yaml b/charts/ocis/values.yaml
index 5dd49e915..d58cfbb66 100644
--- a/charts/ocis/values.yaml
+++ b/charts/ocis/values.yaml
@@ -6,7 +6,7 @@ image:
   # -- Image tag. Defaults to the chart's appVersion.
   tag: "latest"
   # -- Image sha / digest (optional).
-  sha: "3b056182307344f79544f44d91808dabf9014c200554f9ed17719366b526bf63" # oCIS as of 5.0.0-alpha.3
+  sha: "13e5447c5e11de9068fbab07f362a793fbdc32edd8ad14eff0db1d21dfa2a5b8" # oCIS as of 5.0.0-alpha.4
   # -- Image pull policy
   pullPolicy: IfNotPresent
   # -- Names of the secret containing the credentials to pull an image from the registry. More
@@ -1819,6 +1819,10 @@ services:
         target: ""
         # Specifies a URL under which web can be integrated via iFrame. This needs to be specified when web is running in "embed"-mode.
         messagesOrigin: ""
+        # Specifies if web delegates the authentication to the embedding parent application. Defaults to not being set (= web handles the authentication).
+        delegateAuthentication: ""
+        # Specifies the allowed message origin host when posting access tokens from the embedding parent application to web. Defaults to not being set, which is only recommended for development environments.
+        delegateAuthenticationOrigin: ""
 
     # -- Persistence settings.
     # @default -- see detailed persistence configuration options below