[How To] Pocket ID integration (SSO oidc) - web + desktop + mobile (ios and android)

[C8opmBM]

Ok, so I got it going with pocketID.

Docker compose:

  opencloud:
    image: opencloudeu/opencloud-rolling:latest
    container_name: opencloud
    profiles:
      - apps
    networks:
      - apps
    entrypoint:
      - /bin/sh
    command: ['-c', 'opencloud init || true; opencloud server']
    environment:
      OC_URL: https://open.cloud.domain
      OC_LOG_LEVEL: warn
      OC_LOG_COLOR: true
      OC_LOG_PRETTY: true
      OC_LOG_TIMEZONE: ${TZ}
      OC_EXCLUDE_RUN_SERVICES: idp
      GATEWAY_GRPC_ADDR: 0.0.0.0:9142 ##
      OC_INSECURE: false
      PROXY_ENABLE_BASIC_AUTH: false
      IDM_CREATE_DEMO_USERS: false
      # denial shares
      FRONTEND_OCS_ENABLE_DENIALS: false ##
      # make the registry available to the app provider containers
      MICRO_REGISTRY_ADDRESS: 127.0.0.1:9233
      # make the registry available to the app provider containers
      NATS_NATS_HOST: 0.0.0.0
      NATS_NATS_PORT: 9233
      # CSP configs
      PROXY_CSP_CONFIG_FILE_LOCATION: /etc/opencloud/csp.yaml
      OC_GRPC_MAX_RECEIVED_MESSAGE_SIZE: 102400000
      # Allow public shares default without password
      OC_SHARING_PUBLIC_SHARE_MUST_HAVE_PASSWORD: false
      OC_PASSWORD_POLICY_MIN_CHARACTERS: '5'
      OC_PASSWORD_POLICY_MIN_LOWERCASE_CHARACTERS: '0'
      OC_PASSWORD_POLICY_MIN_UPPERCASE_CHARACTERS: '0'
      OC_PASSWORD_POLICY_MIN_DIGITS: '0'
      OC_PASSWORD_POLICY_MIN_SPECIAL_CHARACTERS: '0'
      # Email
      OC_ADD_RUN_SERVICES: 'notifications'
      NOTIFICATIONS_SMTP_HOST: ${NOTIFICATIONS_SMTP_HOST}
      NOTIFICATIONS_SMTP_PORT: ${NOTIFICATIONS_SMTP_PORT} 
      NOTIFICATIONS_SMTP_SENDER: ${NOTIFICATIONS_SMTP_SENDER} 
      NOTIFICATIONS_SMTP_USERNAME: ${NOTIFICATIONS_SMTP_USERNAME}
      NOTIFICATIONS_SMTP_PASSWORD: ${NOTIFICATIONS_SMTP_PASSWORD}
      NOTIFICATIONS_SMTP_INSECURE: "false"
      NOTIFICATIONS_SMTP_AUTHENTICATION: login
      NOTIFICATIONS_SMTP_ENCRYPTION: starttls
      NOTIFICATIONS_EMAIL_TEMPLATE_PATH: ${OC_NOTIFICATIONS_EMAIL_TEMPLATE_PATH}
      # OIDC
      OC_OIDC_ISSUER: https://id.pocket.auth
      ## Proxy
      PROXY_OIDC_REWRITE_WELLKNOWN: true
      PROXY_USER_OIDC_CLAIM: preferred_username
      PROXY_USER_CS3_CLAIM: username
      PROXY_AUTOPROVISION_ACCOUNTS: true
      PROXY_OIDC_ACCESS_TOKEN_VERIFY_METHOD: none
      PROXY_ROLE_ASSIGNMENT_DRIVER: oidc
      PROXY_TLS: false 
      GRAPH_ASSIGN_DEFAULT_USER_ROLE: false
      WEB_OIDC_CLIENT_ID: 6544440d-2a0b-492b-ba98-xxxxxxx  #Pocket ID autogenerated ID
      WEB_OIDC_METADATA_URL: https://id.pocket.auth/.well-known/openid-configuration
    volumes:
      - ${CONFIGDIR}/opencloud/config:/etc/opencloud
      - ${CONFIGDIR}/opencloud/config/csp.yaml:/etc/opencloud/csp.yaml
      - ${STUFF}/opencloud:/var/lib/opencloud
    restart: unless-stopped

networks:
  apps:
    driver: bridge
    enable_ipv6: false
    ipam:
      driver: default
      config:
        - subnet: 172.20.230.0/24
          gateway: 172.20.230.1

Then csp.yaml file in config>csp.yaml modify rows 7 and 8 with your pocketID

directives:
  child-src:
    - '''self'''
  connect-src:
    - '''self'''
    - 'https://raw.githubusercontent.com/opencloud-eu/awesome-apps/'
    - 'https://id.pocket.auth/'
    - 'wss://id.pocket.auth/'
  default-src:
    - '''none'''
  font-src:
    - '''self'''
  frame-ancestors:
    - '''self'''
  frame-src:
    - '''self'''
    - 'https://embed.diagrams.net/'
    # In contrary to bash and docker the default is given after the | character
    - 'https://${COLLABORA_DOMAIN|collabora.opencloud.test}/'
  img-src:
    - '''self'''
    - 'data:'
    - 'blob:'
    - 'https://raw.githubusercontent.com/opencloud-eu/awesome-apps/'
    # In contrary to bash and docker the default is given after the | character
    - 'https://${COLLABORA_DOMAIN|collabora.opencloud.test}/'
  manifest-src:
    - '''self'''
  media-src:
    - '''self'''
  object-src:
    - '''self'''
    - 'blob:'
  script-src:
    - '''self'''
    - '''unsafe-inline'''
  style-src:
    - '''self'''
    - '''unsafe-inline'''

Then add in pocket ID the following groups and roles as needed:

Everything should work now.
If you need tika search and collabora, you can add them later.

[michaelalbertshofer]

Actually you can manually modify the client id in pocket-id as pointed out by the developer of pocket-id here

[C8opmBM]

Thanks for the link, I did manage to change client ids, but unfortunately we still cannot make other clients work.
See this issue

[C8opmBM]

Update - desktop app also can be configured with pocketID.
We need to update the clientID inside pocketid database and use the given client ID names shown in the documentation

A bit that was missing but was filled in by @savely-krasovsky is that the redirect uri for desktop app need to end with :*
So, below some screens:

Some more details here

Update 2 - android also released and working from Google Play

[FrankelJb]

Does this work for mobile?

[savely-krasovsky]

Yes, I have working iOS app.

[C8opmBM]

Also android (from GooglePlay) works.

[savely-krasovsky]

Oh, I missed Android release! It also works, just checked, yeah.