From 8ba3ae73abc99dfa20dacb991556700622931251 Mon Sep 17 00:00:00 2001 From: Chris Coutinho Date: Mon, 22 Dec 2025 22:20:52 +0100 Subject: [PATCH] fix(helm): set OIDC client env vars when using existingSecret MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The deployment template only checked for clientId being set in values.yaml, so when using existingSecret without setting clientId, the NEXTCLOUD_OIDC_CLIENT_ID and NEXTCLOUD_OIDC_CLIENT_SECRET env vars were never created. This broke existingSecret for OIDC-based auth - the server would always fall back to DCR even when pre-registered credentials were provided via secret. Fix: Check for EITHER clientId OR existingSecret being set before creating the OIDC client credential env vars. Affects both OIDC-based auth modes: - auth.oauth.existingSecret (OAuth mode) - auth.multiUserBasic.existingSecret (multi-user BasicAuth with offline access) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Sonnet 4.5 --- charts/nextcloud-mcp-server/templates/deployment.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/nextcloud-mcp-server/templates/deployment.yaml b/charts/nextcloud-mcp-server/templates/deployment.yaml index 705b7f1..27558fb 100644 --- a/charts/nextcloud-mcp-server/templates/deployment.yaml +++ b/charts/nextcloud-mcp-server/templates/deployment.yaml @@ -100,7 +100,7 @@ spec: key: {{ .Values.auth.multiUserBasic.tokenEncryptionKeyKey }} - name: NEXTCLOUD_OIDC_SCOPES value: {{ .Values.auth.multiUserBasic.scopes | quote }} - {{- if .Values.auth.multiUserBasic.clientId }} + {{- if or .Values.auth.multiUserBasic.clientId .Values.auth.multiUserBasic.existingSecret }} # Static OAuth credentials (optional - uses DCR if not provided) - name: NEXTCLOUD_OIDC_CLIENT_ID valueFrom: @@ -122,7 +122,7 @@ spec: value: {{ include "nextcloud-mcp-server.publicIssuerUrl" . | quote }} - name: NEXTCLOUD_OIDC_SCOPES value: {{ .Values.auth.oauth.scopes | quote }} - {{- if .Values.auth.oauth.clientId }} + {{- if or .Values.auth.oauth.clientId .Values.auth.oauth.existingSecret }} - name: NEXTCLOUD_OIDC_CLIENT_ID valueFrom: secretKeyRef: