Connect to ownCloud Infinite Scale & OpenCloud with OpenID Connect

Authenticate with the OpenID Connect (OIDC) identity provider configured for your ownCloud Infinite Scale (oCIS) or OpenCloud deployment using a custom connection profile.

Both ownCloud Infinite Scale and OpenCloud disable Basic Authentication by default and require OAuth 2.0 tokens issued by the identity provider (IdP) in use such as the built-in IdP, Keycloak or Microsoft Entra ID. This tutorial explains how to obtain the OAuth endpoints and client configuration from the public configuration published by your server and how to write a connection profile for use with Cyberduck and Mountain Duck.

Note

Cyberduck 9.3.0 and Mountain Duck 5.1.0 or later set the username from the ID token after login to connect to the user home at /remote.php/dav/files/<username>. Previous versions connect to /remote.php/webdav.

The examples below use the OpenCloud deployment at cloud.example.net which is configured with Microsoft Entra ID as the identity provider. Replace the hostname with your own server, the tenant ID 00000000-0000-0000-0000-000000000000 with your Microsoft Entra tenant ID and the client ID 11111111-1111-1111-1111-111111111111 with the OAuth Client ID of your application registration.

Discover the OAuth Configuration

OpenID Connect Discovery Document

The server publishes the OpenID Connect discovery document at /.well-known/openid-configuration. Open the URL in a web browser or fetch it using curl.

curl -s https://cloud.example.net/.well-known/openid-configuration | jq '{issuer, authorization_endpoint, token_endpoint, scopes_supported}'

{
  "issuer": "https://login.microsoftonline.com/00000000-0000-0000-0000-000000000000/v2.0",
  "authorization_endpoint": "https://login.microsoftonline.com/00000000-0000-0000-0000-000000000000/oauth2/v2.0/authorize",
  "token_endpoint": "https://login.microsoftonline.com/00000000-0000-0000-0000-000000000000/oauth2/v2.0/token",
  "scopes_supported": [
    "openid",
    "profile",
    "email",
    "offline_access"
  ]
}

Tip

If the document is not available on the server hostname, look up the issuer using WebFinger and append /.well-known/openid-configuration to the href returned.

curl -s "https://cloud.example.net/.well-known/webfinger?resource=https%3A%2F%2Fcloud.example.net"

Web Client Configuration

The OAuth Client ID and scopes requested by the web interface are published in /config.json.

curl -s https://cloud.example.net/config.json | jq '.openIdConnect'

{
  "metadata_url": "https://login.microsoftonline.com/00000000-0000-0000-0000-000000000000/v2.0/.well-known/openid-configuration",
  "authority": "https://login.microsoftonline.com/00000000-0000-0000-0000-000000000000/v2.0",
  "client_id": "11111111-1111-1111-1111-111111111111",
  "response_type": "code",
  "scope": "openid profile email offline_access api://11111111-1111-1111-1111-111111111111/opencloud"
}

Note

Access tokens must be issued for an audience accepted by the server. Request the same scopes as the web client, including any API scope such as api://…/opencloud required with Microsoft Entra ID.

Map to Connection Profile Keys

Source	Value	Connection Profile Key
/.well-known/openid-configuration	authorization_endpoint	OAuth Authorization Url
/.well-known/openid-configuration	token_endpoint	OAuth Token Url
/config.json	openIdConnect.client_id	OAuth Client ID
/config.json	openIdConnect.scope	Scopes

Register Redirect URIs in Identity Provider

After login in the web browser, the identity provider redirects back to the application. Register the redirect URIs matching the OAuth Redirect Url in the connection profile with the OAuth client in your identity provider.

Custom URL SchemeLoopback Address

• x-cyberduck-action:oauth for Cyberduck

• x-mountainduck-action:oauth for Mountain Duck

Microsoft Entra IDKeycloakOpenCloud Built-in Identity ProviderownCloud Infinite Scale Built-in Identity Provider

1. Open the application registration for the OAuth Client ID in the Microsoft Entra admin center in Identity → Applications → App registrations.

2. Navigate to Authentication and choose Add a platform → Mobile and desktop applications.

3. Enter x-cyberduck-action:oauth in Custom redirect URIs and choose Configure. Repeat for x-mountainduck-action:oauth. When using the loopback address, enter http://localhost instead.

Note

Microsoft Entra ID ignores the port number for redirect URIs with localhost.

Important

Redirect URIs registered for the Single-page application platform used by the web interface cannot be used by Cyberduck and Mountain Duck.

Note

Alternatively register a dedicated OAuth client for Cyberduck and Mountain Duck with the identity provider as long as the access token issued is accepted by the server.

Write Connection Profile

Create a file with the extension .cyberduckprofile using a text editor.

BlueprintExample (Microsoft Entra ID)Example (Keycloak)

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
    <dict>
        <key>Protocol</key>
        <string>owncloud</string>
        <key>Vendor</key>
        <string>…</string>
        <key>Description</key>
        <string>…</string>
        <key>Default Hostname</key>
        <string>…</string>
        <key>Hostname Configurable</key>
        <false/>
        <key>OAuth Authorization Url</key>
        <string>…</string>
        <key>OAuth Token Url</key>
        <string>…</string>
        <key>OAuth Client ID</key>
        <string>…</string>
        <key>OAuth Client Secret</key>
        <string></string>
        <key>OAuth Redirect Url</key>
        <string>${oauth.handler.scheme}:oauth</string>
        <key>OAuth PKCE</key>
        <true/>
        <key>Scopes</key>
        <array>
            <string>openid</string>
            <string>profile</string>
            <string>email</string>
            <string>offline_access</string>
        </array>
        <key>Username Configurable</key>
        <false/>
        <key>Password Configurable</key>
        <false/>
    </dict>
</plist>

• Protocol Must be owncloud to connect using WebDAV with ownCloud extensions such as resumable uploads, versioning and sharing.

• Vendor Unique identifier for the connection profile.

• Default Hostname Hostname of the server. Set Hostname Configurable to false to prevent editing.

• OAuth Authorization Url The authorization_endpoint from the discovery document.

• OAuth Token Url The token_endpoint from the discovery document.

• OAuth Client ID The client_id from config.json or of a dedicated client registered with the identity provider. Use OpenCloudDesktop with the built-in identity provider of OpenCloud.

• OAuth Client Secret Set an empty value for public clients to not send a client secret. Omit the key to prompt for input when connecting. Set the client secret when the client registered is confidential such as the sample client configuration for Keycloak from ownCloud.

• OAuth Redirect Url Resolves to x-cyberduck-action:oauth in Cyberduck and x-mountainduck-action:oauth in Mountain Duck allowing the same profile to be used in both applications. Alternatively set to http://localhost/ with Cyberduck 9.5.0 and Mountain Duck 5.3.0 or later when the identity provider accepts redirect URIs to the loopback interface with any port.

• OAuth PKCE Use Proof Key for Code Exchange (PKCE). Enabled by default.

• Scopes The scopes requested. Include offline_access to obtain a refresh token and not require to login again when the access token expires. Add openid to obtain an ID token used to determine the username.

• Username Configurable and Password Configurable Set to false as no credentials are required. The username is set from the preferred_username claim in the ID token after login with Cyberduck 9.3.0 and Mountain Duck 5.1.0 or later.

Install Connection Profile

Double-click the .cyberduckprofile file to install it or copy it to the Profiles folder in the application support folder.

Create Bookmark

1. Add a new bookmark in Cyberduck or Mountain Duck and choose the connection profile in the Protocol dropdown.

2. Connect to the bookmark. The login page of the identity provider opens in your default web browser.

3. After successful login, you are redirected back to Cyberduck or Mountain Duck. The OAuth tokens are saved in the Keychain on macOS or Credential Manager on Windows.

Troubleshooting

AADSTS50011: The redirect URI specified in the request does not match

The redirect URI x-cyberduck-action:oauth, x-mountainduck-action:oauth or http://localhost is not registered for the application in Microsoft Entra ID. Register the redirect URI for the Mobile and desktop applications platform.

AADSTS9002327: Tokens issued for the 'Single-Page Application' client-type may only be redeemed via cross-origin requests

The redirect URI is registered for the Single-page application platform. Register the redirect URI for the Mobile and desktop applications platform instead.

AADSTS7000218: The request body must contain the following parameter: 'client_assertion' or 'client_secret'

The application registration requires a client secret. Enable Allow public client flows in Authentication of the application registration or set OAuth Client Secret in the connection profile.

Invalid redirect_uri with Keycloak

Add x-cyberduck-action:oauth and x-mountainduck-action:oauth or the loopback address set in OAuth Redirect Url to Valid redirect URIs of the client.

Login Failure with 401 Unauthorized after successful login in web browser

The access token is not accepted by the server. Make sure to request the same scopes as the web client from config.json in Scopes of the connection profile.

References

• NextCloud & ownCloud

• Connection Profiles

• OpenID Connect Discovery 1.0

• OpenCloud Documentation

• ownCloud Infinite Scale → Authentication

• Microsoft identity platform → Redirect URI best practices