OpenID Connect #

The app logs people in through an external identity provider that speaks OpenID Connect, for example Keycloak, AD FS, or Microsoft Entra ID. The provider then manages passwords, multi-factor rules, and account locks; owncloud.online only checks its tokens. Desktop and mobile clients can log in through the provider as well.

Requirements #

Set up the memory cache before you configure the app, see Security and setup warnings.

Installation #

In the web interface: open Market from the app menu at the top left, search for "OpenID Connect", and click Install.

On the command line:

sudo -u www-data php8.4 occ market:install openidconnect

market:install downloads, installs, and enables the app. If the app is already present but disabled, this is enough:

sudo -u www-data php8.4 occ app:enable openidconnect

Register owncloud.online with the identity provider #

Create a client for owncloud.online at the provider and enter these addresses (replace cloud.example.com with your own address):

Configuration #

You can maintain the values in two places: in the form under Settings → Admin → OpenID Connect or in config/config.php. Required fields are marked with *.

Values saved in the form go into the app configuration and take precedence over config/config.php. At the top of the form, Configuration source shows which source applies: appconfig (form), system (config.php), or empty. Use system config deletes the form values; after that, config/config.php applies again.

Main fields #

With the defaults, the app compares the email claim with the user ID. This only works if the user IDs are email addresses. Otherwise, set Lookup mode to Email or choose a different claim.

Provisioning claim and Provisioning attribute (provisioning-claim, provisioning-attribute) work together as a filter: an account is only created if the named claim contains the attribute.

Example for config.php #

'openid-connect' => [
    'provider-url' => 'https://idp.example.com',
    'client-id' => 'owncloud-online',
    'client-secret' => '…',
    'loginButtonName' => 'Log in with your company account',
    'mode' => 'userid',
    'search-attribute' => 'preferred_username',
    'auto-provision' => [
        'enabled' => true,
        'groups' => ['oidc-users'],
        'email-claim' => 'email',
        'display-name-claim' => 'name',
        'update' => ['enabled' => true],
    ],
],

Command line #

The app has no occ commands of its own. The core commands are enough:

# show the form values
sudo -u www-data php8.4 occ config:app:get openidconnect openid-connect

# discard the form values; config.php applies again afterwards
sudo -u www-data php8.4 occ config:app:delete openidconnect openid-connect

# check the block in config.php
sudo -u www-data php8.4 occ config:list system

Desktop client #

When the desktop client sets up an account, it requests /.well-known/openid-configuration from the server. If that fails, it silently logs in through the OAuth2 app instead of the provider. The web server therefore has to redirect this address to /index.php/apps/openidconnect/config. The rules for Apache and nginx are in Login with OAuth2 and OpenID Connect.

Usage #

The login page shows a button with the configured text below the login form. Clicking it leads to the provider; after logging in there, the person is logged in to owncloud.online. With Redirect login page automatically, the browser goes straight to the provider without a button. Logging out of owncloud.online also ends the session at the provider if the provider offers a logout endpoint (end_session_endpoint).

Limitations and notes #

• Local login with automatic redirect: With Redirect login page automatically, the local login form is no longer reachable. Make sure first that an administrator can log in through the provider. To undo it on the command line, occ config:app:delete openidconnect openid-connect discards the form values. If the redirect is set in config/config.php, remove autoRedirectOnLoginPage there.
• Encryption: Logging in through the provider does not supply an account password. With encryption, only the master key works.
• Tokens of other clients: Access tokens must be issued for this instance (check token-aud-check, on by default). owncloud.online rejects tokens that the same provider issued for a different client.
• Several server nodes: For a logout initiated by the provider to work everywhere, all nodes must share the same distributed cache.
• Together with OAuth2: Both apps can be active at the same time. Local OAuth2 clients and login through the provider then work side by side.

Troubleshooting #

Detailed messages of the app are in the server log, see Server log and error messages.