sevenhill/QSfera
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(webfinger): use webfinger properties instead new relations

Browse Source 
This works the previous commits so that clients can add an addtional
'platform' query parameter to the webfinger request that  can be used
to query the oidc client id and list of scopes that the clients need
to use when connecting to the IDP.

This also removes the non-standard issuer relatation introduced in a
previous commit as we can just introduce new relations in the
http://openid.net name space.

For IDP like Authentik that create a separate issuer url per Client
(Application in Authentik's terms) it is suggested to just configure
as single Client and use that id for all platforms (i.e. setting
'WEBFINGER_ANDROID_OIDC_CLIENT_ID', 'WEBFINGER_DESKTOP_OIDC_CLIENT_ID',
'WEBFINGER_IOS_OIDC_CLIENT_ID' and 'WEBFINGER_WEB_OIDC_CLIENT_ID' to
same value.

Related: #2088
Related: https://github.com/opencloud-eu/desktop/issues/246
This commit is contained in:
Ralf Haferkamp
2026-02-17 10:41:35 +01:00
committed by Ralf Haferkamp
parent 24aaeb46ba
commit 4f1aca6d90
13 changed files with 116 additions and 129 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/webfinger/pkg/command/server.go
+1 -28
View File
@@ -120,17 +120,7 @@ func getRelationProviders(cfg *config.Config) (map[string]service.RelationProvid
for _, relationURI := range cfg.Relations {
switch relationURI {
case relations.OpenIDConnectRel:
rels[relationURI] = relations.OpenIDDiscovery(cfg.IDP)
case relations.OpenIDConnectDesktopRel:
// Handled below - can also be auto-enabled via DesktopIDP config
if cfg.DesktopIDP != "" {
rels[relationURI] = relations.OpenIDDiscoveryDesktop(cfg.DesktopIDP, cfg.DesktopClientID)
}
case relations.OpenIDConnectMobileRel:
// Handled below - can also be auto-enabled via MobileIDP config
if cfg.MobileIDP != "" {
rels[relationURI] = relations.OpenIDDiscoveryMobile(cfg.MobileIDP, cfg.MobileClientID)
}
rels[relationURI] = relations.OpenIDDiscovery(cfg.IDP, cfg.OIDCClientConfigs)
case relations.OpenCloudInstanceRel:
var err error
rels[relationURI], err = relations.OpenCloudInstance(cfg.Instances, cfg.OpenCloudURL)
@@ -142,22 +132,5 @@ func getRelationProviders(cfg *config.Config) (map[string]service.RelationProvid
}
}
// Auto-enable desktop OIDC issuer when DesktopIDP is configured,
// even if not explicitly listed in Relations. This provides a simpler
// configuration experience - just set WEBFINGER_OIDC_ISSUER_DESKTOP.
// See: https://github.com/opencloud-eu/desktop/issues/246
if cfg.DesktopIDP != "" {
if _, exists := rels[relations.OpenIDConnectDesktopRel]; !exists {
rels[relations.OpenIDConnectDesktopRel] = relations.OpenIDDiscoveryDesktop(cfg.DesktopIDP, cfg.DesktopClientID)
}
}
// Auto-enable mobile OIDC issuer when MobileIDP is configured
if cfg.MobileIDP != "" {
if _, exists := rels[relations.OpenIDConnectMobileRel]; !exists {
rels[relations.OpenIDConnectMobileRel] = relations.OpenIDDiscoveryMobile(cfg.MobileIDP, cfg.MobileClientID)
}
}
return rels, nil
}