Use webfinger for OIDC parameter discovery

To solve many of the issues our users have with getting OpenCloud to work with different IDPs we
came up with a more generic way for how clients should discover their OIDC setttings (issuer, client_id and scopes). This is described here: https://github.com/opencloud-eu/opencloud/blob/main/docs/adr/0003-oidc-client-config-discovery.md

And implemented in: opencloud-eu/opencloud#2072

Now we need to implement this mechanism in our clients.

@micbar

Can you ping me when you deployed this on demo.opencloud.eu?
Seems not there yet.
https://demo.opencloud.eu/.well-known/webfinger?resource=https://demo.opencloud.eu/&rel=http://openid.net/specs/connect/1.0/issuer&platform=android (if that's the right way to call it..)

CC @micbar

That will be part of the opencloud 5.2.0 rolling release.

@Svanvith

@Svanvith @ScharfViktor can you use our instance launcher to provide an instance for @guruz with the daily release?

thanks a lot. feel free to e-mail me or write me privately on Matrix..

@rhafer

@rhafer can you please tell me, what we should enter for

WEBFINGER_ANDROID_OIDC_CLIENT_ID
WEBFINGER_ANDROID_OIDC_CLIENT_SCOPES

Only example config for testing :)

@micbar

@rhafer can you please tell me, what we should enter for
WEBFINGER_ANDROID_OIDC_CLIENT_ID
WEBFINGER_ANDROID_OIDC_CLIENT_SCOPES
Only example config for testing :)

AFAIK you already figured it out yourself, but you could e.g. change the client id for the android client in the keycloak example from OpenCloudAndroid to some other value and also set WEBFINGER_ANDROID_OIDC_CLIENT_ID to that value.

To try out custom values for WEBFINGER_ANDROID_OIDC_CLIENT_SCOPES you could set e.g. "openid, profile, email, offline_access, roles". In that case it would be useful to reconfigure Keycloak in a way to not return the roles claim for the android client unless it request the roles scope. (I think I or probably @micbar can help you with that if needed)

Webfinger: Return client_id and scope

=> #104

Webfinger: Return client_id and scope

@guruz

@guruz as a response to your comment from the iOS thread: opencloud-eu/ios#4 (comment)

Just updated my server to 6.1.0 and Android app to 1.2.2 (via F-Droid).
And after the update, I configured my Authentik SSO - works fine both on Android and Web.

Here are the changes I made to make it work: MrModest/homeserver@03b8987

Authentik user's attributes:

settings:
  locale: ""
immich_role: admin
preferred_name: Kamil
preferred_username: kamil

P.S.: Don't worry about the domain name - it gets resolved into an internal network and is not exposed to public :)

Navigation Menu

Repository navigation

Use webfinger for OIDC parameter discovery #96

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Use webfinger for OIDC parameter discovery #96

Description

Activity

guruz commented on Feb 19, 2026

micbar commented on Feb 19, 2026

micbar commented on Feb 19, 2026

guruz commented on Feb 19, 2026

Svanvith commented on Feb 23, 2026

rhafer commented on Feb 26, 2026

guruz commented on Mar 3, 2026

MrModest commented on May 5, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions