Chris Coutinho
529dc4616b
Implements proper OAuth 2.0 separation following RFC 8707 best practices with distinct resource server and OAuth client configurations. ## Architecture Changes - Create separate "nextcloud" bearer-only client (resource server) - Configure "nextcloud-mcp-server" OAuth client with audience mapper - Audience mapper targets "nextcloud" resource server - Token flow: aud="nextcloud", azp="nextcloud-mcp-server" ## Benefits - Proper OAuth client vs resource server separation - Support for future multi-resource tokens: aud=["nextcloud", "other-service"] - RFC 8707 Resource Indicators compliance - Clear requester identification via azp claim ## Documentation Updates - Correct OAuth flow: MCP Client initiates, handles redirect, shares tokens - Explain MCP Server as protected resource architecture - Document offline_access with refresh tokens (Tier 1, current) - Document token exchange with delegation (Tier 2, future when Keycloak adds support) - Reference Keycloak issue #38279 for delegation status ## Files - keycloak/realm-export.json: Add separate clients configuration - app-hooks/post-installation/15-setup-keycloak-provider.sh: Setup user_oidc with "nextcloud" client - docs/audience-validation-setup.md: Comprehensive documentation with corrected OAuth flow and delegation comparison - docker-compose.yml: Fix Keycloak healthcheck (bash TCP instead of curl) - scripts/test_separate_clients.sh: Verification script for architecture 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
101 lines
3.7 KiB
Bash
Executable File
101 lines
3.7 KiB
Bash
Executable File
#!/bin/bash
|
|
#
|
|
# Configure user_oidc to accept bearer tokens from Keycloak
|
|
#
|
|
# This script sets up Keycloak as an external OIDC provider for Nextcloud.
|
|
# It enables bearer token validation, allowing the MCP server to use Keycloak
|
|
# tokens to access Nextcloud APIs without admin credentials.
|
|
#
|
|
|
|
set -e
|
|
|
|
echo "===================================================================="
|
|
echo "Configuring user_oidc provider for Keycloak..."
|
|
echo "===================================================================="
|
|
|
|
# Wait for Keycloak to be ready and realm to be available
|
|
echo "Waiting for Keycloak realm to be available..."
|
|
MAX_RETRIES=30
|
|
RETRY_COUNT=0
|
|
|
|
while [ $RETRY_COUNT -lt $MAX_RETRIES ]; do
|
|
if curl -sf http://keycloak:8080/realms/nextcloud-mcp/.well-known/openid-configuration > /dev/null 2>&1; then
|
|
echo "✓ Keycloak realm is ready"
|
|
break
|
|
fi
|
|
echo " Waiting for Keycloak... (attempt $((RETRY_COUNT + 1))/$MAX_RETRIES)"
|
|
sleep 5
|
|
RETRY_COUNT=$((RETRY_COUNT + 1))
|
|
done
|
|
|
|
if [ $RETRY_COUNT -eq $MAX_RETRIES ]; then
|
|
echo "⚠ Warning: Keycloak not available after $MAX_RETRIES attempts"
|
|
echo " Keycloak provider will not be configured"
|
|
echo " You can configure it manually using:"
|
|
echo " docker compose exec app php occ user_oidc:provider keycloak \\"
|
|
echo " --clientid='nextcloud' \\"
|
|
echo " --clientsecret='nextcloud-secret-change-in-production' \\"
|
|
echo " --discoveryuri='http://keycloak:8080/realms/nextcloud-mcp/.well-known/openid-configuration' \\"
|
|
echo " --check-bearer=1 \\"
|
|
echo " --bearer-provisioning=1 \\"
|
|
echo " --unique-uid=1"
|
|
exit 0
|
|
fi
|
|
|
|
# Check if provider already exists
|
|
if php /var/www/html/occ user_oidc:provider keycloak 2>/dev/null | grep -q "Identifier"; then
|
|
echo " Keycloak provider already exists, updating configuration..."
|
|
|
|
# Update existing provider
|
|
php /var/www/html/occ user_oidc:provider keycloak \
|
|
--clientid="nextcloud" \
|
|
--clientsecret="nextcloud-secret-change-in-production" \
|
|
--discoveryuri="http://keycloak:8080/realms/nextcloud-mcp/.well-known/openid-configuration" \
|
|
--check-bearer=1 \
|
|
--bearer-provisioning=1 \
|
|
--unique-uid=1 \
|
|
--mapping-uid="sub" \
|
|
--mapping-display-name="name" \
|
|
--mapping-email="email" \
|
|
--scope="openid profile email offline_access"
|
|
|
|
echo "✓ Updated Keycloak provider configuration"
|
|
else
|
|
echo " Creating new Keycloak provider..."
|
|
|
|
# Create new provider
|
|
php /var/www/html/occ user_oidc:provider keycloak \
|
|
--clientid="nextcloud" \
|
|
--clientsecret="nextcloud-secret-change-in-production" \
|
|
--discoveryuri="http://keycloak:8080/realms/nextcloud-mcp/.well-known/openid-configuration" \
|
|
--check-bearer=1 \
|
|
--bearer-provisioning=1 \
|
|
--unique-uid=1 \
|
|
--mapping-uid="sub" \
|
|
--mapping-display-name="name" \
|
|
--mapping-email="email" \
|
|
--scope="openid profile email offline_access"
|
|
|
|
echo "✓ Created Keycloak provider"
|
|
fi
|
|
|
|
# Display provider details
|
|
echo ""
|
|
echo "Keycloak provider configuration:"
|
|
php /var/www/html/occ user_oidc:provider keycloak
|
|
|
|
echo ""
|
|
echo "===================================================================="
|
|
echo "✓ Keycloak provider configured successfully"
|
|
echo "===================================================================="
|
|
echo ""
|
|
echo "Key features enabled:"
|
|
echo " • Bearer token validation (--check-bearer=1)"
|
|
echo " • Automatic user provisioning (--bearer-provisioning=1)"
|
|
echo " • Unique user IDs (--unique-uid=1)"
|
|
echo " • Offline access scope (for refresh tokens)"
|
|
echo ""
|
|
echo "MCP server can now use Keycloak tokens to access Nextcloud APIs"
|
|
echo "without admin credentials (ADR-002 architecture)."
|
|
echo ""
|