Chris Coutinho
849c67c32a
This commit completes the Keycloak external IdP integration for the MCP
server, implementing ADR-002 Tier 2 (External Identity Provider) with
full Bearer token authentication support.
Key Changes:
1. **Keycloak backchannel-dynamic configuration**
- Added --hostname-strict=false and --hostname-backchannel-dynamic=true
- Allows external issuer (localhost:8888) with internal endpoints (keycloak:8080)
- Solves Docker networking issue where containers can't reach localhost
2. **CORSMiddleware Bearer token patch**
- Created app-hooks/patches/cors-bearer-token.patch from upstream commit 8fb5e77db82
- Allows Bearer tokens to bypass CORS/CSRF checks (stateless authentication)
- Applied via post-installation hook 20-apply-cors-bearer-token-patch.sh
- Enables app-specific APIs (Notes, Calendar, etc.) to work with Bearer tokens
3. **Patch organization**
- Moved patches to app-hooks/patches/ directory
- Updated docker-compose.yml to mount entire app-hooks directory
- Consolidated patch management for better maintainability
4. **Test improvements**
- All 11 Keycloak integration tests passing
- Tests validate OAuth token acquisition, MCP connectivity, token validation,
tool execution, token persistence, user provisioning, scope filtering,
and error handling
Architecture:
- Keycloak acts as external OAuth/OIDC identity provider
- MCP server uses Keycloak tokens to access Nextcloud APIs
- Nextcloud user_oidc app validates Bearer tokens from Keycloak
- No admin credentials needed - all API access uses user's OAuth tokens
Cache Note:
- Discovery and JWKS caches must be cleared when switching Keycloak configurations
- Use: docker compose exec redis redis-cli DEL "<cache-key>"
- Or: docker compose exec app php occ user_oidc:provider keycloak --clientid nextcloud
Related:
- ADR-002: Vector sync background jobs authentication
- Validates external IdP integration pattern
- Demonstrates offline_access with refresh tokens (Tier 1 & 2)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
105 lines
3.8 KiB
Plaintext
105 lines
3.8 KiB
Plaintext
# Nextcloud Instance
|
|
NEXTCLOUD_HOST=
|
|
|
|
# ===== AUTHENTICATION MODE =====
|
|
# Choose ONE of the following:
|
|
|
|
# Option 1: OAuth2/OIDC (RECOMMENDED - More Secure)
|
|
# - Requires Nextcloud OIDC app installed and configured
|
|
# - Admin must enable "Dynamic Client Registration" in OIDC app settings
|
|
# - Leave NEXTCLOUD_USERNAME and NEXTCLOUD_PASSWORD empty to use OAuth mode
|
|
# - OAuth client credentials are stored encrypted in SQLite (TOKEN_STORAGE_DB)
|
|
# - Optional: Pre-register client and provide credentials (otherwise auto-registers)
|
|
NEXTCLOUD_OIDC_CLIENT_ID=
|
|
NEXTCLOUD_OIDC_CLIENT_SECRET=
|
|
NEXTCLOUD_MCP_SERVER_URL=http://localhost:8000
|
|
|
|
# OAuth Storage Configuration (SQLite storage for OAuth clients and refresh tokens)
|
|
# TOKEN_ENCRYPTION_KEY: Required for encrypting OAuth client secrets and refresh tokens
|
|
# Generate with: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
|
|
#TOKEN_ENCRYPTION_KEY=
|
|
# TOKEN_STORAGE_DB: Path to SQLite database (default: /app/data/tokens.db)
|
|
#TOKEN_STORAGE_DB=/app/data/tokens.db
|
|
|
|
# Option 2: Basic Authentication (LEGACY - Less Secure)
|
|
# - Requires username and password
|
|
# - Credentials stored in environment variables
|
|
# - Use only for backward compatibility or if OAuth unavailable
|
|
# - If these are set, OAuth mode is disabled
|
|
NEXTCLOUD_USERNAME=
|
|
NEXTCLOUD_PASSWORD=
|
|
|
|
# ============================================
|
|
# Document Processing Configuration
|
|
# ============================================
|
|
# Enable document processing (PDF, DOCX, images, etc.)
|
|
# Set to false to disable all document processing
|
|
ENABLE_DOCUMENT_PROCESSING=false
|
|
|
|
# Default processor to use when multiple are available
|
|
# Options: unstructured, tesseract, custom
|
|
DOCUMENT_PROCESSOR=unstructured
|
|
|
|
# ============================================
|
|
# Unstructured.io Processor
|
|
# ============================================
|
|
# Enable Unstructured processor (requires unstructured service in docker-compose)
|
|
# This is a cloud-based/API processor supporting many document types
|
|
ENABLE_UNSTRUCTURED=false
|
|
|
|
# Unstructured API endpoint
|
|
UNSTRUCTURED_API_URL=http://unstructured:8000
|
|
|
|
# Request timeout in seconds (default: 120)
|
|
# OCR operations can take 30-120 seconds for large documents
|
|
UNSTRUCTURED_TIMEOUT=120
|
|
|
|
# Parsing strategy: auto, fast, hi_res
|
|
# - auto: Automatically choose based on document type
|
|
# - fast: Fast parsing without OCR
|
|
# - hi_res: High-resolution with OCR (slowest, most accurate)
|
|
UNSTRUCTURED_STRATEGY=auto
|
|
|
|
# OCR languages (comma-separated ISO 639-3 codes)
|
|
# Common: eng=English, deu=German, fra=French, spa=Spanish
|
|
UNSTRUCTURED_LANGUAGES=eng,deu
|
|
|
|
# Progress reporting interval in seconds (default: 10)
|
|
# During long-running OCR operations, progress notifications are sent to the MCP client
|
|
# at this interval to prevent timeouts and provide status updates
|
|
PROGRESS_INTERVAL=10
|
|
|
|
# ============================================
|
|
# Tesseract Processor (Local OCR)
|
|
# ============================================
|
|
# Enable Tesseract processor (requires tesseract binary installed)
|
|
# This is a local, lightweight OCR solution for images only
|
|
ENABLE_TESSERACT=false
|
|
|
|
# Path to tesseract executable (optional, auto-detected if in PATH)
|
|
#TESSERACT_CMD=/usr/bin/tesseract
|
|
|
|
# OCR language (e.g., eng, deu, eng+deu for multiple)
|
|
TESSERACT_LANG=eng
|
|
|
|
# ============================================
|
|
# Custom Processor (Your own API)
|
|
# ============================================
|
|
# Enable custom document processor via HTTP API
|
|
ENABLE_CUSTOM_PROCESSOR=false
|
|
|
|
# Unique name for your processor
|
|
#CUSTOM_PROCESSOR_NAME=my_ocr
|
|
|
|
# Your custom processor API endpoint
|
|
#CUSTOM_PROCESSOR_URL=http://localhost:9000/process
|
|
|
|
# Optional API key for authentication
|
|
#CUSTOM_PROCESSOR_API_KEY=your-api-key-here
|
|
|
|
# Request timeout in seconds
|
|
#CUSTOM_PROCESSOR_TIMEOUT=60
|
|
|
|
# Comma-separated MIME types your processor supports
|
|
#CUSTOM_PROCESSOR_TYPES=application/pdf,image/jpeg,image/png
|