Nextcloud OIDC Provider App - 2.2.0

Nextcloud OpenID Connect Provider App - 2.2.0

This is the an OIDC App for Nextcloud. This application allows to use your Nextcloud Login at other services supporting OpenID Connect.

Attention - Potential Breaking Change

Version 2.x tightens several behaviours to better match the OpenID Connect conformance suite. OIDC-compliant clients should continue to work, but clients that depend on legacy 1.x behaviour should be reviewed before upgrading. For further details consult the documentation.

Version 2.2.0 adds OpenID Connect Front-Channel Logout 1.0, Back-Channel Logout 1.0 and OpenID Connect Session Management 1.0. Existing clients remain valid and Front-Channel Logout is disabled for a client until a frontchannel_logout_uri is configured. For Back-Channel Logout the same applies. Session Management is a browser feature: HTTP(S) authorization responses include session_state when the OP itself is served over HTTPS. Native/custom-scheme redirect URIs keep their existing behavior and intentionally do not receive session_state, because they have no browser web origin that can host the Session Management RP iframe.

The 2.2.0 upgrade migration deliberately invalidates persisted OIDC authorization codes and access/refresh grant state. Existing relying parties therefore cannot continue with pre-upgrade refresh tokens and must start a new OIDC authorization/login flow after the upgrade. This one-time reauthentication is intentional so that newly issued ID Tokens and RP sessions are correlated with the sid state.

Provided features

• Support for OpenID Connect Code (response_type = code) and Implicit (response_type = id_token) Flow - Implicite Flow must be activated per client
• Support for PKCE
• Public and confidential types of clients are supported
• Creation of ID Tokens and UserInfo responses with claims based on requested scopes and the OpenID Connect claims parameter (currently supported scopes: openid, profile, email, roles, groups, and offline_access)
• Supported signing algorithms RS256 (default) and HS256
• Group memberships can be passed as roles or groups claims
• Clients can be assigned to dedicated user groups - Only users in the configured group are allowed to retrieve an access token to fetch the ID token
• Support for RFC9068 JWT Access Tokens (must be activated per client)
• Support for OAuth 2.0 Token Exchange (RFC 8693) using a constrained access-token-to-access-token profile
• Discovery & WebFinger endpoint provided
• RP-Initiated Logout, OpenID Connect Front-Channel Logout 1.0, Back-Channel Logout 1.0, and Session Management 1.0
• Dynamic Client Registration
• Client Configuration Management (RFC 7592)
• Token Introspection (RFC 7662)
• Support for resource url (RFC 9728) at introspection
• User Consent Management
• Support for custom claims
• Administration of clients via CLI
• Generation and validation of access tokens using events
• User specific settings to define which data is passed to clients in ID token and via userinfo endpoint

Full documentation can be found at:

User Documentation
Developer Documentation

What's Changed

• Add support for OpenID Connect Back-Channel Logout by @H2CK in #697
• Build(deps): Bump fast-uri from 3.1.5 to 3.1.7 in the npm_and_yarn group across 1 directory by @dependabot[bot] in #699
• Add OpenID Connect Front-Channel Logout 1.0 and OpenID Connect Session Management 1.0 by @H2CK in #701
• Build(deps): Bump @nextcloud/axios from 2.5.2 to 2.6.0 by @dependabot[bot] in #702
• Build(deps): Bump @jridgewell/sourcemap-codec from 1.5.5 to 1.6.0 by @dependabot[bot] in #706
• Build(deps): Bump webpack from 5.109.2 to 5.110.3 by @dependabot[bot] in #703
• Build(deps-dev): Bump @vue/compiler-sfc from 3.5.29 to 3.5.42 by @dependabot[bot] in #705

Full Changelog: 2.1.1...2.2.0