Repository navigation
[BUG] Using opencloud app with Authentik not possible #4
Description
Steps to reproduce
- Setup Authentik as IdP for opencloud (OIDC)
- Create provider & application for mobile (and other) applications
- Try to login using Authentik inside the app.
Expected behavior
I'm using my Authentik instance to authenticate with the opencloud. It works great when using the web version. It detects the OIDC connection, and asks me to login. I'd expect the authentication to also work using the mobile app.
Actual behavior
What actually happens, is that because for Authentik, every application needs a dedicated provider (i.e. client), the mobile provider is using a different issuer path/URL then for the web application. The server however only promotes the endpoints to web application, which is missmatching the endpoint for the mobile application. (application/o/opencloud/.well-known/openid-configuration vs. application/o/opencloud-mobile/.well-known/openid-configuration)
Client
iOS version: 18.5 (beta)
OpenCloud app version: 1.0.1 (Testflight)
Device model: iPhone 16 Pro
Server configuration
Lates opencloudeu/opencloud-rolling docker image
Logs
OpenCloud App log
HTTP/1.1\nHost: my.auth.com\nContent-Length: 253\nUser-Agent: OpenCloudApp/1.0.1 (App/1; iOS/18.5; iPhone)\nX-Request-ID: 6E51CAFE-23A9-4ADB-B990-1D7823B8B8E9\nOriginal-Request-ID: 6E51CAFE-23A9-4ADB-B990-1D7823B8B8E9\nAuthorization: Basic [redacted:1]\nContent-Type: application/x-www-form-urlencoded\nAccept-Language: en\n\nclient_id=OpenCloudIOS&scope=openid%20offline_access%20email%20profile&refresh_token=aToken&client_secret=&grant_type=refresh_token\n, response: 400 BAD REQUEST\nContent-Type: application/json\nx-authentik-id: 3da77788fa3848838f5ea87b2c639bb2\nPragma: no-cache\nx-powered-by: authentik\nContent-Encoding: gzip\nServer: nginx\nreferrer-policy: same-origin\nCache-Control: no-store\nDate: Tue, 22 Apr 2025 07:31:44 GMT\nContent-Length: 176\nStrict-Transport-Security: max-age=63072000\nx-content-type-options: nosniff\nVary: Accept-Encoding, Cookie\nx-frame-options: DENY\n\n{"error": "invalid_grant", "error_description": "The provided authorization grant or refresh token is invalid, expired, revoked, does not match the redirection URI used in the authorization request, or was issued to another client"}\n, metrics: (null), finished: 0>, dbError=(null) [OCHTTPPipelineBackend.m:483|FULL]
Tell us what could be improved:
From what I understand, part of the issue is the hardcoded client_id which is OpenCloudIOS. That is different from the web version. I could configure the web version with WEB_OIDC_CLIENT_ID to the same client_id, but that's not really a solution for all the different clients that exist (e.g. Android app, Desktop). Making the client_id configurable in the app would be another idea, but I'm almost certain, not a good practice, as all clients would use the same client_id then.
Ideally, the client app should not look for the web configuration and instead follow its own, but I'm not sure if/how that would be possible. I'm also not sure what part PROXY_OIDC_REWRITE_WELLKNOWN plays here, since https://my.opencloud.com/.well-known/webfinger?resource=https://my.opencloud.com/ advertises only one auth endpoint & that's the wrong endpoint for all clients (only web works). So maybe the issue is with the server component of opencloud, but wanted to bring this up here as well.
There are some related issues that can be found for OCIS and/authentik, however, then common feedback is that it needs to be properly implemented by the client applications:
- Better OIDC Support (Authentik, multiple issuer) for multiple client ids owncloud/product#354
- Multiple Client IDs per OIDC Issuer? goauthentik/authentik#7251
Any insights or thoughts a much appreciated 🙏
Activity
w-marco commentedon May 11, 2025
I agree, using Authentik the hardcoded client-ids in the Apps make it impossible to use more than one App and Web (since we can set Web to OpenCloudIOS for example, but that won't fix the desktop client).
I personally think the real solution would be to either allow the Apps to pull the client-id from the server (and rename WEB_OIDC_CLIENT_ID to OC_OIDC_CLIENT_ID for example), or to have the hardcoded client-id in all the apps be the same, so we could make Web also use that and be good.
The current way of pulling OC_OIDC_ISSUER from the server across all platforms but then having diverging client-ids seem like an odd choice (I know it comes from the fork origins, but now there's a good time to fix that).
tomorrow-nf commentedon Aug 14, 2025
I'm running into the exact same issue trying to set up the new Android app. I have about 30-40 services set up in Authentik and this is the only one I've tried that expected a hard-coded client_id rather than one I explicitly define in the configuration. Unfortunately this is a dealbreaker for now - I'll revisit it if this is ever implemented.
patchmonkey commentedon Aug 24, 2025
Yep, also having this issue, cannot get it to work. What I think would be ideal is if the OpenCloud team creates ENV variables for all of the various hardcoded Client ID values, e.g.
web,OpenCloudDesktop,OpenCloudAndroid, etc. This way for those of us who use Authentik or similar OIDC providers, we could set all of the Client IDs to the same Client ID for the single oidc app/provider that handles OpenCloud.Blacks-Army commentedon Oct 13, 2025
Will this be fixed anytime soon? I want to migrate from Nextcloud to OpenCloud but can't because client id's are hardcoded..
gpongelli commentedon Oct 30, 2025
similar issue is present with Authelia; web login can use the
WEB_OIDC_SCOPEwith custom scope, meanwhile iOS/Android/Desktop have fixed scope soPROXY_ROLE_ASSIGNMENT_DRIVER: "oidc"cannot work .using config from my discussion link, to handle this I think an app setting to add only the custom scope e.g. "opencloud_scope" , or the full list e.g. "openid profile email groups opencloud_scope", passing that config to ios-sdk could solve those kind of issue.
the same way could be done with client_id .
guruz commentedon May 5, 2026
Can you check if this works with #40 and 1.2.0 with a recent server version?
https://github.com/opencloud-eu/opencloud/blob/main/docs/adr/0003-oidc-client-config-discovery.md
MrModest commentedon May 5, 2026
Issue #40 mentions only iOS. Does it do the trick for Android users as well? 🤔Sorry, I've just noticed that I'm writing in the iOS repo 🙈
guruz commentedon May 5, 2026
@MrModest Please ideally also test Android 1.2.2 and report back with Authentik version in this Android issue: opencloud-eu/android#96 :)
(Both if it does work and does NOT work, so we have some data)
Blacks-Army commentedon May 5, 2026
Nevermind, it works. Web, iOS and MountainDuck works. OpenCloud Desktop does not work. It seems to still use the hardcoded client ID.
guruz commentedon May 5, 2026
@Blacks-Army Great. You need to track the desktop issue here: opencloud-eu/desktop#811
guruz commentedon May 22, 2026
Is this fixed with current version from App Store or Testflight plus newer server?
https://testflight.apple.com/join/2F5wWTGV
https://github.com/opencloud-eu/opencloud/blob/main/docs/adr/0003-oidc-client-config-discovery.md
MrModest commentedon May 30, 2026
Tested on wife's iPhone. Works just fine. Than you!