Some Experience with NextCloud / Passport Integration

DerFrie

I finally managed do make the passport extension work with nextcloud (recent version=21). IMO the handling is somewhat unusual: after authentication on a nextcloud page I am guided to a registration window where I have to enter my user name (for flarum). Anyhow, authentication works and creates a flarum account if necessary.
I wonder if the plugin has been built for nextcloud (not only laravel)?
I am not experienced enough with OAuth to decide if the data structures nextcloud provides do not conform to the standard, or if the flarum extension is not flexible enough. To make it work I had to replace some code in ...vendor/league/oauth2-client/src/Provider/AbstractProvider.php (protected function fetchResourceOwnerDetails line 792):
change return $response into return $response["ocs"]["data"].
This seems to reflect internal data structures of nextcloud (ocs). Maybe there are further mismatches which cause flarum to ask for a user id (which I have to enter for nextcloud authentication if there is no session yet active).
On the nextcloud side I integrated flarum using the builtin iframe mechanism (external page). When opening the forum using the respective nextcloud button I have to login again. Passport authentication works, but I have to open flarum in another tab or window to see the opened session - the window displayed in the iframe does not change. Maybe this is a nextcloud issue as well. I also tried the Embed extension without effect.
Anyhow, this kind of integration looks to me like 90% of a feature other peopla already have been looking for. Closing the gap would provide a nice integration of flarum into nextcloud.

DerFrie

DerFrie A quick and dirty fix for the iframe problem: in ...vendor/flarum/core/src/Http/CookieFactory.php
changed lax into none (just this one occurrence). Now flarum looks wonderful in my nextcloud window, and nextcloud passes the session to flarum (once the user already has been created there). Exactly what I wished.
I only wonder about the consequences of changing the cookie policy.

askvortsov

DerFrie in response to your main issue. I'm not familiar with Nextcloud's API, but if they comply with the oauth2 protocol, that should include a valid format of requests. If they don't, I don't think fof passport should put in edge cases like that. However, iirc there might be a way to add drivers to the fof oauth extension. That might be worth looking into.

askvortsov

DerFrie You should be able to configure this by setting the 'cookie.samesite' property in config.php

DerFrie

askvortsov this worked - thanks a lot!

luceos

Actually I had an edge case recently which required me to parse the resource owner details differently too. You can do so by listening on the event ParsingResourceOwner. See: https://github.com/FriendsOfFlarum/passport/blob/7c91fe5a36882efbde91c7abda10b7eecc3a5457/src/Providers/PassportProvider.php#L94-L99

DerFrie

I am not at all experienced with development for Flarum, but this gives me some more motivation to start. Probably will need some more time until I can mark this issue "resolved".
Just to repeat my other question from above: is the query for a user id in the registration window (after A+A in Nextcloud) intended "regular" behaviour, or should there be an immediate login on Flarum, when the OAuth implementation is fully functional? I could not yet figure out if the parsing needs more corrections.

askvortsov

DerFrie user id in the registration window

Do you mean the step where the user has to select a username? It's intended, as usernames aren't generally returned by oauth.

DerFrie

ok, then my "fix" covers the mismatch completely, and I will try to get to a "cleaner" implementation.
In the data provided by NC there is an id field, populated by the NC username, so I expected this could be used to populate the Flarum table, but then NC provides more data than specified in the standard.

DerFrie

Checked somewhat further about the state of the league oauth2-client implementation. There is a bunch of official and third-party oauth providers, which could be provided in addition. The generic provider simply does not cover Nextcloud - there is another provider implementation which has not yet made its way into the official list.
Maybe the passport implementers should consider to go beyond laravel only and support more providers, but this should be directly addressed in a github issue.

DerFrie

My questions are answered so far, but it seems that I cannot mark this "solved" myself.
There is quite a jungle of extensions - found out that I can achieve NC integration with the passport extension with some tweaks, but the oauth extension is the better choice as a starting point. There is a still unofficial "Nextcloud Provider for OAuth 2.0 Client" intended to supplement the PHP League's OAuth 2.0 Client, which the Flarum oauth extension uses (already bundled with the official providers). It is quite straightforward to add this provider, so my suggestion is to extend the extension somewhat further. Once this is up and running I try to launch it on Guthub.