Help Needed: Disabling Dynamic Client Registration in Keycloak for OwnCloud Infinite Scale Mobile App Authentication
from mitexleo@buddyverse.one to selfhosted@lemmy.world on 24 Nov 08:40
https://buddyverse.one/post/174033

Hi,

I’m hoping someone can help me with an issue I’m facing with Keycloak and OCIS.

Background: I installed OCIS (ownCloud Infinite Scale) and configured it to use Keycloak as the OIDC provider. Everything works perfectly when logging in via the web interface. However, I’m encountering issues when trying to log in from the ownCloud mobile apps (iOS and Android).

Problem: Whenever I attempt to log in from the mobile apps, Keycloak reports a “client not found” error. According to various forum posts, Keycloak is creating a new client each time a login attempt is made from the mobile apps. Since these dynamically created clients are not configured properly, the login fails.

Suggested Solution: One developer suggested disabling dynamic client registration in Keycloak. This would prevent Keycloak from creating new clients automatically and ensure that the existing, properly configured client is used.

My Setup:

What I’ve Tried: I’ve looked through the Keycloak admin console and documentation but haven’t found a straightforward way to disable dynamic client registration. I’ve also tried configuring the clients manually, but the issue persists.

Questions:

  1. How can I disable dynamic client registration in Keycloak version 26?
  2. Are there any other settings or configurations I should be aware of to ensure smooth authentication for the ownCloud mobile apps?

Any guidance or insights would be greatly appreciated. Thanks in advance!

Edit: Found the solution: mitexleo.one/@ml/113542105595682701

#selfhosted

threaded - newest

just_another_person@lemmy.world on 24 Nov 08:59 next collapse

Dafuq?

mitexleo@buddyverse.one on 24 Nov 09:01 collapse

What does that mean?

mitexleo@buddyverse.one on 24 Nov 09:02 collapse

Got it …

sorter_plainview@lemmy.today on 24 Nov 10:36 collapse

Hi, I have some experience with Keycloak. So I assume you explicitly enabled you are using OIDC dynamic registration.

Can you share the config file after redacting sensitive contents?

mitexleo@buddyverse.one on 24 Nov 10:44 collapse

I didn’t enable dynamic registration. I used this docker compose to deploy keycloak: github.com/mitexleo/…/compose.yaml

sorter_plainview@lemmy.today on 24 Nov 11:03 collapse

Oh, so no separate config is used and only env variables I guess. Is it possible for you to get the URL your app is requesting? If yes, please share a sample.

Also double check the realm name. I assume you created a new realm for your use and not using master.

mitexleo@buddyverse.one on 24 Nov 11:16 collapse

This is the url owncloud android app requested: auth.mydomain.com/realms/R1/protocol/…/auth?redir…

Yeah, I’m using a dedicated realm for OCIS. It’s working without any issues on the web.

mitexleo@buddyverse.one on 24 Nov 11:25 collapse

You might want to check this out: github.com/owncloud/client/issues/11940

Apparently, the client_ID stays same in my case. I guess it’s not really creating new clients.

I also set oc://android.owncloud.com as valid redirect URI.

<img alt="" src="https://buddyverse.one/pictrs/image/f0ded4a7-2665-4857-a2cc-c7f741b65f5e.jpeg">

sorter_plainview@lemmy.today on 24 Nov 19:03 collapse

Sorry for the delay. I got busy. I’m not entirely sure this is a dynamic registration issue. Your screenshot points to something like a permission issue. This is a bit wild guess with very limited information.

Do you have any info saved when you attempted to register the client manually and use client id and secret?

I will try to do some tests when I get to my setup. Do ping me if you have any updates.

mitexleo@buddyverse.one on 25 Nov 05:51 next collapse

I just tried to login from the mobile app.

mitexleo@buddyverse.one on 25 Nov 07:48 collapse

Found the solution: mitexleo.one/@ml/113542105595682701

I just had to import client config the apps.