From 40b1f0ec3c8e776459e4a2f85996248d72a07b13 Mon Sep 17 00:00:00 2001 From: Chris Coutinho Date: Sun, 14 Jun 2026 12:22:23 +0200 Subject: [PATCH] docs(login-flow): clarify re-auth + placeholders per review Round-1 review follow-ups: - Troubleshooting "Access forbidden": note that existing users must re-authorize once after switching to a static client (stored sessions were issued to the now-deleted DCR client). - Default IdP setup: explain that the `/mcp` resource identifier works because `_has_mcp_audience` accepts both the bare server URL and the `/mcp` form. - env.sample.oauth-multi-user: use angle-bracket placeholders (``) to match the template convention and fail loudly if copied verbatim. Co-Authored-By: Claude Opus 4.8 (1M context) --- docs/login-flow-v2.md | 6 ++++-- env.sample.oauth-multi-user | 4 ++-- 2 files changed, 6 insertions(+), 4 deletions(-) diff --git a/docs/login-flow-v2.md b/docs/login-flow-v2.md index f7957f1a..4babbfa8 100644 --- a/docs/login-flow-v2.md +++ b/docs/login-flow-v2.md @@ -87,7 +87,7 @@ DCR clients after ~1 hour (see [Troubleshooting](#access-forbidden-after-the-con - **Redirect URI:** `https:///oauth/callback` - **Flow / response type:** authorization **code** - **Type:** **confidential** (so it issues a client secret) - - **Resource identifier:** `https:///mcp` (so issued tokens carry the MCP server's audience) + - **Resource identifier:** `https:///mcp` (so issued tokens carry the MCP server's audience; the verifier's `_has_mcp_audience` accepts both this `/mcp` form and the bare server URL) - **Scopes:** leave empty to allow all, or list the per-app scopes you want plus `openid profile email offline_access` 3. Copy the generated client ID and secret into `NEXTCLOUD_OIDC_CLIENT_ID` / `NEXTCLOUD_OIDC_CLIENT_SECRET`. @@ -369,7 +369,9 @@ cached that now-deleted client in `tokens.db` and keeps reusing it. see [Default IdP setup](#default-idp-setup-nextclouds-built-in-oidc-app). Static clients are never auto-deleted. Set `NEXTCLOUD_OIDC_CLIENT_ID` / `NEXTCLOUD_OIDC_CLIENT_SECRET` (they take precedence over the cached DCR client) -and recreate the container. +and recreate the container. Existing users will need to re-authorize once after +this switch — their stored sessions were issued to the now-deleted DCR client, +so old refresh tokens no longer validate against the new static client. As a non-recommended stopgap you can extend the DCR client lifetime globally: `occ config:app:set oidc client_expire_time --value 31536000`. diff --git a/env.sample.oauth-multi-user b/env.sample.oauth-multi-user index 4368f307..61bf205f 100644 --- a/env.sample.oauth-multi-user +++ b/env.sample.oauth-multi-user @@ -27,8 +27,8 @@ MCP_DEPLOYMENT_MODE=login_flow # registers an ephemeral client that the app deletes after ~1h, which breaks # auth permanently ("Access forbidden" on reconnect — see issue #907). # Create one under Administration settings -> OpenID Connect provider. -NEXTCLOUD_OIDC_CLIENT_ID=your-client-id -NEXTCLOUD_OIDC_CLIENT_SECRET=your-client-secret +NEXTCLOUD_OIDC_CLIENT_ID= +NEXTCLOUD_OIDC_CLIENT_SECRET= # MCP Server URL (for OAuth redirects) NEXTCLOUD_MCP_SERVER_URL=http://localhost:8000