Remove /.well-known/openid-configuration hack
- Dominant language
- Go
- Stars
- 2.1k
- Forks
- 274
- Avg merge
- 2d 1h
- Merged PRs (30d)
- 103
Description
## Is your feature request related to a problem? Please describe.
The /.well-known/openid-configuration hack, which originates from oC10 (https://doc.owncloud.com/server/next/admin_manual/configuration/user/oidc/oidc.html#set-up-service-discovery), was implemented via https://github.com/owncloud/ocis/issues/2819 / https://github.com/owncloud/ocis/pull/4346
According to https://openid.net/specs/openid-connect-discovery-1_0.html, this hack is not allowed:
> 4.3. OpenID Provider Configuration Validation
If any of the validation procedures defined in this specification fail, any operations requiring the information that failed to correctly validate MUST be aborted and the information that failed to validate MUST NOT be used.
>
> The issuer value returned MUST be identical to the Issuer URL that was used as the prefix to /.well-known/openid-configuration to retrieve the configuration information. This MUST also be identical to the iss Claim value in ID Tokens issued from this Issuer.
## Describe the solution you'd like
Remove what has been introduced with https://github.com/owncloud/ocis/pull/4346
[Meanwhile clients (Desktop / iOS / Desktop) should use the Webfinger API for IDP discovery anyways. ](https://github.com/owncloud/ocis/issues/6316#issuecomment-1559413161)
## Describe alternatives you've considered
Keeping the hack.
## Additional context
- see also https://github.com/owncloud/ocis/issues/6316#issuecomment-2630066258
- issues that can arise from the hack: https://github.com/owncloud/ocis/issues/8672
cc @DeepDiver1975
Contributor guide
Assessment
This issue has not been assessed yet.