Chris Coutinho
849c67c32a
This commit completes the Keycloak external IdP integration for the MCP
server, implementing ADR-002 Tier 2 (External Identity Provider) with
full Bearer token authentication support.
Key Changes:
1. **Keycloak backchannel-dynamic configuration**
- Added --hostname-strict=false and --hostname-backchannel-dynamic=true
- Allows external issuer (localhost:8888) with internal endpoints (keycloak:8080)
- Solves Docker networking issue where containers can't reach localhost
2. **CORSMiddleware Bearer token patch**
- Created app-hooks/patches/cors-bearer-token.patch from upstream commit 8fb5e77db82
- Allows Bearer tokens to bypass CORS/CSRF checks (stateless authentication)
- Applied via post-installation hook 20-apply-cors-bearer-token-patch.sh
- Enables app-specific APIs (Notes, Calendar, etc.) to work with Bearer tokens
3. **Patch organization**
- Moved patches to app-hooks/patches/ directory
- Updated docker-compose.yml to mount entire app-hooks directory
- Consolidated patch management for better maintainability
4. **Test improvements**
- All 11 Keycloak integration tests passing
- Tests validate OAuth token acquisition, MCP connectivity, token validation,
tool execution, token persistence, user provisioning, scope filtering,
and error handling
Architecture:
- Keycloak acts as external OAuth/OIDC identity provider
- MCP server uses Keycloak tokens to access Nextcloud APIs
- Nextcloud user_oidc app validates Bearer tokens from Keycloak
- No admin credentials needed - all API access uses user's OAuth tokens
Cache Note:
- Discovery and JWKS caches must be cleared when switching Keycloak configurations
- Use: docker compose exec redis redis-cli DEL "<cache-key>"
- Or: docker compose exec app php occ user_oidc:provider keycloak --clientid nextcloud
Related:
- ADR-002: Vector sync background jobs authentication
- Validates external IdP integration pattern
- Demonstrates offline_access with refresh tokens (Tier 1 & 2)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude <noreply@anthropic.com>
35 lines
907 B
Python
35 lines
907 B
Python
"""OAuth authentication components for Nextcloud MCP server."""
|
|
|
|
from .bearer_auth import BearerAuth
|
|
from .client_registration import ensure_oauth_client, register_client
|
|
from .context_helper import get_client_from_context
|
|
from .scope_authorization import (
|
|
InsufficientScopeError,
|
|
ScopeAuthorizationError,
|
|
check_scopes,
|
|
discover_all_scopes,
|
|
get_access_token_scopes,
|
|
get_required_scopes,
|
|
has_required_scopes,
|
|
is_jwt_token,
|
|
require_scopes,
|
|
)
|
|
from .token_verifier import NextcloudTokenVerifier
|
|
|
|
__all__ = [
|
|
"BearerAuth",
|
|
"NextcloudTokenVerifier",
|
|
"register_client",
|
|
"ensure_oauth_client",
|
|
"get_client_from_context",
|
|
"require_scopes",
|
|
"ScopeAuthorizationError",
|
|
"InsufficientScopeError",
|
|
"check_scopes",
|
|
"discover_all_scopes",
|
|
"get_access_token_scopes",
|
|
"get_required_scopes",
|
|
"has_required_scopes",
|
|
"is_jwt_token",
|
|
]
|