Support OpenStack Application Credentials for Swift Storage (External & Primary)

[!TIP]

Help move this idea forward

• Use the 👍 reaction to show support for this feature.
• Avoid commenting unless you have relevant information to add; unnecessary comments create noise for subscribers.
• Subscribe to receive notifications about status changes and new comments.

Is your feature request related to a problem? Please describe.

Yes. Nextcloud currently supports mounting Swift/OpenStack Object Storage as External Storage and as Primary Storage, but only using OpenStack user credentials (username + password + project/domain). This grants the Nextcloud instance full access to the entire OpenStack project, which violates the principle of least privilege. It also prevents the use of 2FA on the OpenStack user account, since automated services like Nextcloud cannot complete interactive authentication.

In environments where security and compliance matter, this forces administrators to either disable 2FA (less secure) or use overly permissive credentials (less safe). OpenStack’s application credentials provide a clean solution: they allow scoped, role-based, non-interactive authentication for services like Nextcloud, while remaining bound to a real user’s permissions.

Describe the solution you'd like

Add support for OpenStack Application Credentials in the Swift storage backend for both External Storage and Primary Storage. In the config.php, allow configuration via:
'objectstore' => [ 'class' => 'OC\\Files\\ObjectStore\\Swift', 'arguments' => [ 'application_credential_id' => 'your-app-cred-id', 'application_credential_secret' => 'your-app-cred-secret', 'authUrl' => 'https://keystone.example.com/v3', 'region' => 'RegionOne', 'container' => 'nextcloud-primary', ], ],

Backend Implementation
Modify Swift.php in /lib/private/Files/ObjectStore/ to:
Accept application_credential_id and application_credential_secret
Use these to request a token via Keystone’s /v3/auth/tokens with application_credential body:

{ "auth": { "identity": { "methods": ["application_credential"], "application_credential": { "id": "YOUR_APP_CRED_ID", "secret": "YOUR_APP_CRED_SECRET" } }, "scope": { "project": { "id": "PROJECT_ID" } } } }

In the Admin UI, add a toggle “Use OpenStack Application Credentials” that hides the username/pass fields and shows fields for Application Credential ID and Secret instead.

Only one authentication method should be allowed: either username/password OR application_credential_id/secret — not both.

Describe alternatives you've considered

The only current option is to use full OpenStack user credentials (username/password + project/domain) for authentication. While functional, this approach grants overly broad permissions to the Nextcloud instance, violating the principle of least privilege and increasing the attack surface. It also prevents the use 2FA protection in openstack project.

One can workaround using OpenStack’s S3-compatible API with Nextcloud’s S3 external storage backend. However, this introduces additional complexity and instability, as it relies on an abstraction layer that may not fully mirror Swift’s behavior and performance characteristics. We experienced that this workaround is unstable and causes various problems when performing large file operations.

Additional context
OpenStack has supported Application Credentials since the Queens release: https://docs.openstack.org/keystone/queens/user/application_credentials.html
Easy breakdown of how application credentials work in openstack:
https://docs.infomaniak.cloud/identity/applications_credentials/
Nextcloud forum entries about this topic:
https://help.nextcloud.com/t/is-openstack-application-credentials-support-implemented-for-swift-storage-in-nextcloud/219930
https://help.nextcloud.com/t/openstack-swift-application-credentials/137202/3

Start by reading lib/private/Files/ObjectStore/Swift.php and the existing Swift configuration for External Storage and Primary Storage. Then trace the Admin UI fields and the Keystone /v3/auth/tokens flow described in the issue. Done means either username/password or application credentials can be configured, application credentials authenticate Swift, and the UI exposes the corresponding fields without allowing both methods.