simplify oCIS deployment with external IDP

[wkloucek]

Is your feature request related to a problem? Please describe.

When you are using oCIS with an external IDP, you need to make sure, that oC Desktop / iOS / Android clients can find the .well-known/openid-configuration endpoint on the same domain / port, in general address as oCIS.

This endpoint is provided by an external IDP in our case. Redirects to this proxy are not allowed (OIDC spec), therefore we need to proxy requests to the IDP. The current capabilities of the proxy are not sufficient for common usecases. An example for that is our Keycloak deployment example:

ocis/deployments/examples/ocis_keycloak/docker-compose.yml

Lines 130 to 138 in 38d670f

	# let /.well-known/openid-configuration be served by Keycloak
	- "traefik.http.middlewares.idp-headers.headers.customrequestheaders.X-Forwarded-Host=${KEYCLOAK_DOMAIN:-keycloak.owncloud.test}"
	- "traefik.http.middlewares.idp-prefix.addprefix.prefix=/auth/realms/${KEYCLOAK_REALM:-oCIS}"
	- "traefik.http.middlewares.idp-override.chain.middlewares=idp-headers,idp-prefix"
	- "traefik.http.routers.idp-wellknown.entrypoints=https"
	- "traefik.http.routers.idp-wellknown.tls.certresolver=http"
	- "traefik.http.routers.idp-wellknown.rule=Host(`${OCIS_DOMAIN:-ocis.owncloud.test}`) && Path(`/.well-known/openid-configuration`)"
	- "traefik.http.routers.idp-wellknown.middlewares=idp-override"
	- "traefik.http.routers.idp-wellknown.service=keycloak"

In that example this mapping is done in the proxy:

• https://ocis.owncloud.test/.well-known/openid-configuration => https://keycloak.owncloud.test/auth/realms/ocis-realm/.well-known/openid-configuration
• Set the X-Forwarded-Host to keycloak.owncloud.test since the request originally was to https://ocis.owncloud.test/.well-known/openid-configuration and would have resulted in ocis.owncloud.test

Describe the solution you'd like

Have a simple way to make the .well-known/openid-configuration endpoint available without using an external proxy.

Describe alternatives you've considered

Providing different way to discover the OIDC provider to the clients (eg. like Web with a config) but that would break existing clients.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 10 days if no further activity occurs. Thank you for your contributions.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 10 days if no further activity occurs. Thank you for your contributions.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 10 days if no further activity occurs. Thank you for your contributions.