Distributed email based federated cloud id discovery

Please use the 👍 reaction to show that you are also in favor of this feature - we are using this information to decide which features to include in upcoming Nextcloud versions. Please don't comment if you have no relevant information to add!

Federated cloud ids are often far from ideal (foo@bar@example.com, foo@example.com/cloud foo@cloud.example.com instead of just foo@example.com) because it needs to contain all information needed to contact the remote server.

It would be a lot nicer for users if they can just enter an email in the share field and have automatically resolve that to a remote (or local) user.

One option to resolve emails would be to have one (or more) centralized servers which contain a mapping but centralized components is something which should be avoided where possible.

For instances where people use their own domain for emails (which would cover most larger instances) we could use the control the admin has over the mail domain to setup a distributed resolver.
Some ways this could be done would be

• have a TXT dns entry which points to the resolver endpoint
• have something like example.com/.well-known/cloud-resolver point to the resolver endpoint

Where the resolver would be a simple api that matches federated cloud ids to emails for all users in the instance.

(note that we can't have the resolver itself in .well-known since it needs to be possible to have the resolver on a different server than the one that server the main site.)

The full process when sharing would be something like

1. Check if the provided email belongs to a local user
2. See if the domain provides a resolver
3. Check if the email belongs to a cloud id
4. setup the share with the discovered cloud id

Nothing of it should be hard to implement we just need to make sure we decide on some standard way an admin can setup a resolver.

Personally I would prefer the dns route but either of the discovery methods should work (or we could just support both)

cc @LukasReschke @karlitschek @schiessle @rullzer @jancborchardt

The issue names no files, tests, or entry points. Start by reviewing the existing federated sharing and user lookup flows, then establish the resolver discovery standard, API behavior, and security requirements; done means an email can be resolved to a local or remote cloud ID during sharing.