OpenCloud Android OIDC Login: No Refresh Token Returned by VoidAuth Despite offline_access

[v1rusnl]

For gods sake I am not able to make VoidAuth work with Opencloud Android App. Web is working perfect. And redirect back and forth in the Android App to VoidAuth is working to.

Problem

The OpenCloud Android app correctly requests the OIDC scope offline_access (seems to be hardcoded in the App regardless of Server Config), but VoidAuth does not return a refresh token. As a result, token renewal fails later with an error such as: Invalid Refresh Token and I am not able to log into Opencloud App.

Webfinger Response:

{
  "subject": "https://opencloud.mydomain.com",
  "properties": {
    "http://opencloud.eu/ns/oidc/client_id": "OpenCloudAndroid",
    "http://opencloud.eu/ns/oidc/scopes": [
      "openid",
      "profile",
      "email",
      "offline_access"
    ]
  },
  "links": [
    {
      "rel": "http://openid.net/specs/connect/1.0/issuer",
      "href": "https://auth.mydomain.com/oidc"
    }
  ]
}

VoidAuth advertises offline_access as a supported scope:

{
  "scopes_supported": [
    "openid",
    "offline_access",
    "email",
    "profile",
    "groups"
  ],
  "grant_types_supported": [
    "authorization_code",
    "implicit",
    "refresh_token"
  ]
}

The OpenCloud Android app sends the expected request:

GET https://auth.mydomain.com/oidc/auth

client_id=OpenCloudAndroid
response_type=code
redirect_uri=oc://android.opencloud.eu
scope=openid profile email offline_access
code_challenge_method=S256

After successful authentication, the app exchanges the authorization code:

POST https://auth.mydomain.com/oidc/token

grant_type=authorization_code
client_id=OpenCloudAndroid
code=<authorization_code>
code_verifier=<pkce_verifier>
redirect_uri=oc://android.opencloud.eu
scope=openid offline_access email profile

VoidAuth returns:

{
  "access_token": "<token>",
  "expires_in": 3600,
  "id_token": "<token>",
  "scope": "openid profile email",
  "token_type": "Bearer"
}

The response does not contain:

{
  "refresh_token": "<refresh_token>"
}

Additionally, VoidAuth removes the requested scope.

Expected behaviour: A successful offline_access flow should return something like:

{
  "access_token": "<token>",
  "refresh_token": "<refresh_token>",
  "expires_in": 3600,
  "scope": "openid profile email offline_access",
  "token_type": "Bearer"
}

The same flow was tested using an OIDC debugger:
Authorization Code Flow ✅
PKCE with SHA-256 ✅
Client ID: OpenCloudAndroid ✅
Scope: openid profile email offline_access ✅

Result:

access_token=<token>
expires_in=3600
id_token=<token>
scope=openid profile email
token_type=Bearer

Again, no refresh_token was returned.

Anybody got the Android or iOS Client working with Opencloud? If yes, what's the setting in VoidAuth OIDC config?

[v1rusnl]

Windows Client seems to have the same issue.

[notquitenothing]

I believe that in order to get a refresh_token the /oidc/auth request needs to include the prompt=consent parameter. Otherwise the scope request for offline_access is stripped. The relevant code in the node-oidc-provider library is here. You do get a refresh_token automatically if your OIDC Client App is not using native redirect-uris and is using the None (Public) auth method.

[v1rusnl]

I'm not very talented in this OIDC background stuff. So is this more of an Opencloud issue than VoidAuth? I've see #198 but I'm still none the wiser. 😄

[v1rusnl]

It seems to work now with the following config (let's see for how long 😃 ):

Added to Opencloud .env:

# =============================================================================
# OIDC / VoidAuth
# =============================================================================

# Internen OpenCloud-IDP deaktivieren
OC_EXCLUDE_RUN_SERVICES=idp

# Externer OIDC-Issuer
OC_OIDC_ISSUER=https://auth.mydomain.com/oidc
PROXY_OIDC_ISSUER=https://auth.mydomain.com/oidc
WEBFINGER_OIDC_ISSUER=https://auth.mydomain.com/oidc

# TLS-Zertifikate des externen IdP prüfen
PROXY_OIDC_INSECURE=false
WEBFINGER_INSECURE=false


# =============================================================================
# OIDC: Webclient
# =============================================================================

WEB_OIDC_CLIENT_ID=web
WEB_OIDC_AUTHORITY=https://auth.mydomain.com/oidc
WEB_OIDC_METADATA_URL=https://auth.mydomain.com/oidc/.well-known/openid-configuration
WEB_OIDC_RESPONSE_TYPE=code
WEB_OIDC_SCOPE=openid profile email groups

WEBFINGER_WEB_OIDC_CLIENT_ID=web
WEBFINGER_WEB_OIDC_CLIENT_SCOPES=openid profile email groups


# =============================================================================
# OIDC: Native Clients
# =============================================================================

WEBFINGER_DESKTOP_OIDC_CLIENT_ID=OpenCloudDesktop
WEBFINGER_DESKTOP_OIDC_CLIENT_SCOPES=openid profile email groups offline_access

WEBFINGER_ANDROID_OIDC_CLIENT_ID=OpenCloudAndroid
WEBFINGER_ANDROID_OIDC_CLIENT_SCOPES=openid profile email groups offline_access

WEBFINGER_IOS_OIDC_CLIENT_ID=OpenCloudIOS
WEBFINGER_IOS_OIDC_CLIENT_SCOPES=openid profile email groups offline_access


# =============================================================================
# OIDC: Token-Verarbeitung
# =============================================================================

# VoidAuth liefert opaque Access-Tokens.
# OpenCloud fragt die Claims über den UserInfo-Endpunkt ab.
PROXY_OIDC_ACCESS_TOKEN_VERIFY_METHOD=none
PROXY_OIDC_SKIP_USER_INFO=false

# Externe OIDC-Discovery über OpenCloud bereitstellen
PROXY_OIDC_REWRITE_WELLKNOWN=true


# =============================================================================
# OIDC: Benutzer-Auto-Provisioning
# =============================================================================

PROXY_AUTOPROVISION_ACCOUNTS=true

PROXY_AUTOPROVISION_CLAIM_USERNAME=preferred_username
PROXY_AUTOPROVISION_CLAIM_EMAIL=email
PROXY_AUTOPROVISION_CLAIM_DISPLAYNAME=name
PROXY_AUTOPROVISION_CLAIM_GROUPS=groups


# =============================================================================
# OIDC: Benutzeridentität
# =============================================================================

PROXY_USER_OIDC_CLAIM=preferred_username
PROXY_USER_CS3_CLAIM=username

GRAPH_USERNAME_MATCH=none


# =============================================================================
# OIDC: Automatische Rollenzuweisung
# =============================================================================

PROXY_ROLE_ASSIGNMENT_DRIVER=oidc
PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM=groups

# Rollen ausschließlich über OIDC vergeben
GRAPH_ASSIGN_DEFAULT_USER_ROLE=false

Added to Opencloud proxy.yaml

role_assignment:
  driver: oidc
  oidc_role_mapper:
    role_claim: groups
    role_mapping:
      - role_name: admin
        claim_value: admin
      - role_name: spaceadmin
        claim_value: spaceadmin
      - role_name: user
        claim_value: user
      - role_name: user-light
        claim_value: user-light

Groups in VoidAuth (need to be assigned to the user also -> if user-light is needed, then create it also):

Android, iOS and WebClient working with this config incl. Auto provisioning of the user to group in Opencloud.

Only culprit: Desktop Client does not work due to this statement by Opencloud:

Configure client discovery with WebFinger
The Desktop Client does not fully support this discovery mechanism yet. Configure the Desktop Client WebFinger variables anyway so the setup is ready for client support and stays consistent.

Guess we'll just have to wait for that. In meantime, WebDAV can be used with Token based login.

@notquitenothing Before I would make a PR for OIDC-Guides, I would want the vars be reviewed by some other users that run this setup. Quite possible that some values are wrong (with no workflow impact, but nevertheless) or this setup is overcomplicated like the crazy amount of work setting up Opencloud 😤Could you move this subject to discussions?

---

Alternative way to the above would be to use the Opencloud default driver instead of oidc driver.

Change:
PROXY_ROLE_ASSIGNMENT_DRIVER=default
GRAPH_ASSIGN_DEFAULT_USER_ROLE=true

Remove:
PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM=groups

Remove:
Block role-assignment block from proxy.yaml

This setup would also work with Desktop client, but with this setup, every new user would have the role user and IDM/user management would have to be made in Opencloud afterwards. So I went the 1st path described here.