Nextcloud as as OIDC provider

[D1reW0lf]

Describe the bug
Unable to use Nexcloud H2CK/oidc app as a login provider for Rally

To Reproduce
Add the following .env vars:

OIDC_NAME=Nextcloud
OIDC_DISCOVERY_URL=https://nextcloud.url/apps/oidc/openid-configuration
OIDC_ISSUER_URL=https://nextcloud.url
OIDC_CLIENT_ID=[ID]
OIDC_CLIENT_SECRET=[SECRET]
OIDC_NAME_CLAIM_PATH=name
OIDC_EMAIL_CLAIM_PATH=email
OIDC_PICTURE_CLAIM_PATH=picture

According to the app doc https://github.com/H2CK/oidc/wiki/User-Documentation#endpoints , I also tried the following endpoits:

https://nextcloud.url/apps/oidc/openid-configuration
https://nextcloud.url/index.php/apps/oidc/openid-configuration
https://nextcloud.url/.well-known/openid-configuration
https://nextcloud.url/index.php/.well-known/openid-configuration

Additional context
This is what I can find on the logs:

rallly-1     | [auth][error] cZ: "response" is not a conform Authorization Server Metadata response (unexpected HTTP status code)
rallly-1     |     at c$ (/app/apps/web/.next/server/chunks/1736.js:462:4876)
rallly-1     |     at c7 (/app/apps/web/.next/server/chunks/1736.js:462:6926)
rallly-1     |     at eM (/app/apps/web/.next/server/chunks/1736.js:462:44289)
rallly-1     |     at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
rallly-1     |     at async eO (/app/apps/web/.next/server/chunks/1736.js:462:47282)
rallly-1     |     at async eS (/app/apps/web/.next/server/chunks/1736.js:462:49958)
rallly-1     |     at async eU (/app/apps/web/.next/server/chunks/1736.js:462:54155)
rallly-1     |     at async /app/apps/web/.next/server/app/api/auth/[...nextauth]/route.js:1:20491
rallly-1     |     at async rb.do (/app/node_modules/.pnpm/[email protected]_@[email protected]_@[email protected]_@[email protected]_react-_0314d785ff5c15f857d19489caa2dd52/node_modules/next/dist/compiled/next-server/app-route.runtime.prod.js:5:21059)
rallly-1     |     at async rb.handle (/app/node_modules/.pnpm/[email protected]_@[email protected]_@[email protected]_@[email protected]_react-_0314d785ff5c15f857d19489caa2dd52/node_modules/next/dist/compiled/next-server/app-route.runtime.prod.js:5:25902)

[lukevella]

Try opening the well-known url in your browser. Inside the config should be the issuer. Make sure you're using that as OIDC_ISSUER_URL.

[D1reW0lf]

@lukevella Hi.

The issuer is my nextcloud instance URL, as I have on the .env vars.

https://nextcloud.url/apps/oidc/openid-configuration returns

{
    "issuer": "https:\/\/nextcloud.url",
    "authorization_endpoint": "https:\/\/nextcloud.url\/apps\/oidc\/authorize",
    "token_endpoint": "https:\/\/nextcloud.url\/apps\/oidc\/token",
    "userinfo_endpoint": "https:\/\/nextcloud.url\/apps\/oidc\/userinfo",
    "jwks_uri": "https:\/\/nextcloud.url\/apps\/oidc\/jwks",
    "scopes_supported": [
        "openid",
        "profile",
        "email",
        "roles",
        "groups"
    ],
    "response_types_supported": [
        "code",
        "code id_token",
        "id_token"
    ],
    "response_modes_supported": [
        "query"
    ],
    "grant_types_supported": [
        "authorization_code",
        "implicit"
    ],
    "acr_values_supported": [
        "0"
    ],
    "subject_types_supported": [
        "public"
    ],
    "id_token_signing_alg_values_supported": [
        "RS256",
        "HS256"
    ],
    "token_endpoint_auth_methods_supported": [
        "client_secret_post",
        "client_secret_basic"
    ],
    "display_values_supported": [
        "page"
    ],
    "claim_types_supported": [
        "normal"
    ],
    "claims_supported": [
        "iss",
        "sub",
        "aud",
        "exp",
        "auth_time",
        "iat",
        "acr",
        "azp",
        "preferred_username",
        "scope",
        "nbf",
        "jti",
        "roles",
        "name",
        "updated_at",
        "website",
        "email",
        "email_verified",
        "phone_number",
        "address",
        "picture",
        "quota"
    ],
    "end_session_endpoint": "https:\/\/nextcloud.url\/apps\/oidc\/logout"
}

[lukevella]

Not sure then. The error usually appears when there is some misconfiguration. Usually it's the issuer url. Let me know know if you figure it out.