owncloud / owncloud/ocis

Remove /.well-known/openid-configuration hack

Open
#11,542 7 comments 0 reactions 0 assignees View on GitHub
Type:Technical-Debt
Dominant language
Go
Stars
2.1k
Forks
274
Avg merge
2d 1h
Merged PRs (30d)
103

Description

## Is your feature request related to a problem? Please describe.

The /.well-known/openid-configuration hack, which originates from oC10 (https://doc.owncloud.com/server/next/admin_manual/configuration/user/oidc/oidc.html#set-up-service-discovery), was implemented via https://github.com/owncloud/ocis/issues/2819 / https://github.com/owncloud/ocis/pull/4346

According to https://openid.net/specs/openid-connect-discovery-1_0.html, this hack is not allowed:

> 4.3. OpenID Provider Configuration Validation
If any of the validation procedures defined in this specification fail, any operations requiring the information that failed to correctly validate MUST be aborted and the information that failed to validate MUST NOT be used.
>
> The issuer value returned MUST be identical to the Issuer URL that was used as the prefix to /.well-known/openid-configuration to retrieve the configuration information. This MUST also be identical to the iss Claim value in ID Tokens issued from this Issuer.

## Describe the solution you'd like
Remove what has been introduced with https://github.com/owncloud/ocis/pull/4346

[Meanwhile clients (Desktop / iOS / Desktop) should use the Webfinger API for IDP discovery anyways. ](https://github.com/owncloud/ocis/issues/6316#issuecomment-1559413161)

## Describe alternatives you've considered

Keeping the hack.

## Additional context

- see also https://github.com/owncloud/ocis/issues/6316#issuecomment-2630066258
- issues that can arise from the hack: https://github.com/owncloud/ocis/issues/8672

cc @DeepDiver1975

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.