Feature Request: Support configurable native OIDC redirect URIs and Microsoft Entra ID group claims

[laitco]

Support configurable native OIDC redirect URIs and Microsoft Entra ID group claims

Is your feature request related to a problem? Please describe.

OpenCloud works well with OpenID Connect providers, but Microsoft Entra ID integration is currently limited by two issues:

1. Native client authentication relies on a fixed redirect URI, which is not compatible with Microsoft Entra ID requirements.
2. There is no built-in support for consuming Microsoft Entra ID groups claims for authorization.

While testing the OpenCloud iOS app with Microsoft Entra ID, I also reported a related client-side issue:

opencloud-eu/ios#65

This feature request focuses on improving the server-side integration with Microsoft Entra ID.

Describe the solution you'd like

1. Configurable native application redirect URIs

Instead of requiring a fixed redirect URI for native clients, allow administrators to configure the redirect URI used by the OpenCloud clients.

This would allow deployments to use redirect URIs supported by Microsoft Entra ID, including:

• HTTPS redirect URIs
• MSAL redirect URIs (msauth.<bundle-id>://auth)

This keeps OpenCloud identity-provider agnostic while allowing compatibility with Microsoft Entra ID and other providers with different redirect URI requirements.

2. Support Microsoft Entra ID group claims

Support reading the standard groups claim from the ID Token or UserInfo endpoint.

Allow administrators to map Microsoft Entra ID Group Object IDs to OpenCloud groups for authorization and group membership synchronization.

Describe alternatives you've considered

• Managing users and groups manually inside OpenCloud.
• Using another identity provider.
• Introducing an additional identity broker only for claim transformation.
• Maintaining custom forks or client-specific workarounds.

These approaches add unnecessary complexity.

Additional context

Microsoft Entra ID is one of the most widely deployed enterprise identity providers. Supporting configurable native redirect URIs together with Entra ID group claims would make OpenCloud significantly easier to integrate into enterprise environments while remaining standards-based and identity-provider agnostic.

Related iOS issue:

opencloud-eu/ios#65

[micbar]

What impact does that have on our clients?

Does that mean, we should add the configurable redirects to all clients?

@laitco
One thing worth mentioning: OpenCloud always stores its users in LDAP.
Maybe it would make more sense to use keycloak as a broker and fill an OpenLDAP during the first broker login.

What do you have in mind? You wrote that you already connected opencloud and EntraID. How did you solve the LDAP requirement?

[laitco]

What impact does that have on our clients?

Does that mean, we should add the configurable redirects to all clients?

@laitco One thing worth mentioning: OpenCloud always stores its users in LDAP. Maybe it would make more sense to use keycloak as a broker and fill an OpenLDAP during the first broker login.

What do you have in mind? You wrote that you already connected opencloud and EntraID. How did you solve the LDAP requirement?

The impact for now with my configuration is that the client app on like iOS cannot be used with OIDC EntraID because the redirection parameter is not supported to add in EntraID.

I did some deep testing and troubleshooting and got it working that a user can login via EntraID with applying the default user role.

Here is my Docker-ENV from my test instance:

TZ=Europe/Berlin
OC_URL=<URL>
IDM_ADMIN_PASSWORD=<ADMINPASSWORD>
PROXY_HTTP_ADDR=0.0.0.0:9200
WEB_OIDC_AUTHORITY=https://login.microsoftonline.com/<TENANTID>/v2.0
WEB_OIDC_CLIENT_ID=<CLIENTID>
WEB_OIDC_CLIENT_SECRET=<CLIENTSECRET>
WEB_OIDC_SCOPE=openid profile email
PROXY_USER_OIDC_CLAIM=email
PROXY_USER_CS3_CLAIM=username
PROXY_AUTOPROVISION_ACCOUNTS=true
GRAPH_USERNAME_MATCH=none
PROXY_TLS=false
OC_INSECURE=false
PROXY_CONFIG_FILE_LOCATION=/etc/opencloud/proxy.yaml
PROXY_CSP_CONFIG_FILE_OVERRIDE_LOCATION=/etc/opencloud/csp.yaml
PROXY_OIDC_ISSUER=https://login.microsoftonline.com/<TENANTID>/v2.0
PROXY_OIDC_ACCESS_TOKEN_VERIFY_METHOD=none
WEB_OIDC_RESPONSE_TYPE=code
PROXY_AUTOPROVISION_CLAIM_USERNAME=email
PROXY_ROLE_ASSIGNMENT_DRIVER=default
OC_EXCLUDE_RUN_SERVICES=idp
OC_ADMIN_USER_ID=<ADMINUSERID>
OC_LOG_LEVEL=info
PROXY_OIDC_REWRITE_WELLKNOWN=true
OC_DEFAULT_LANGUAGE=de
OC_URL NOTIFICATIONS_WEB_UI_URL=<URL>
START_ADDITIONAL_SERVICES=\"notifications\"
OC_SHARING_PUBLIC_SHARE_MUST_HAVE_PASSWORD=true