Connect to ownCloud Infinite Scale & OpenCloud with OpenID Connect

Important

  • Cyberduck 9.6.0 or later required
  • Mountain Duck 5.4.0 or later required

Authenticate with the OpenID Connect (OIDC) identity provider configured for your ownCloud Infinite Scale (oCIS) or OpenCloud deployment using a custom connection profile.

Both ownCloud Infinite Scale and OpenCloud disable Basic Authentication by default and require OAuth 2.0 tokens issued by the identity provider (IdP) in use such as the built-in IdP, Keycloak or Microsoft Entra ID. This tutorial explains how to obtain the OAuth endpoints and client configuration from the public configuration published by your server and how to write a connection profile for use with Cyberduck and Mountain Duck.

Note

Cyberduck 9.3.0 and Mountain Duck 5.1.0 or later set the username from the ID token after login to connect to the user home at /remote.php/dav/files/<username>. Previous versions connect to /remote.php/webdav.

The examples below use the OpenCloud deployment at cloud.example.net which is configured with Microsoft Entra ID as the identity provider. Replace the hostname with your own server, the tenant ID 00000000-0000-0000-0000-000000000000 with your Microsoft Entra tenant ID and the client ID 11111111-1111-1111-1111-111111111111 with the OAuth Client ID of your application registration.

Discover the OAuth Configuration

OpenID Connect Discovery Document

The server publishes the OpenID Connect discovery document at /.well-known/openid-configuration. Open the URL in a web browser or fetch it using curl.

curl -s https://cloud.example.net/.well-known/openid-configuration | jq '{issuer, authorization_endpoint, token_endpoint, scopes_supported}'

{
  "issuer": "https://login.microsoftonline.com/00000000-0000-0000-0000-000000000000/v2.0",
  "authorization_endpoint": "https://login.microsoftonline.com/00000000-0000-0000-0000-000000000000/oauth2/v2.0/authorize",
  "token_endpoint": "https://login.microsoftonline.com/00000000-0000-0000-0000-000000000000/oauth2/v2.0/token",
  "scopes_supported": [
    "openid",
    "profile",
    "email",
    "offline_access"
  ]
}

Tip

If the document is not available on the server hostname, look up the issuer using WebFinger and append /.well-known/openid-configuration to the href returned.

curl -s "https://cloud.example.net/.well-known/webfinger?resource=https%3A%2F%2Fcloud.example.net"

Web Client Configuration

The OAuth Client ID and scopes requested by the web interface are published in /config.json.

curl -s https://cloud.example.net/config.json | jq '.openIdConnect'

{
  "metadata_url": "https://login.microsoftonline.com/00000000-0000-0000-0000-000000000000/v2.0/.well-known/openid-configuration",
  "authority": "https://login.microsoftonline.com/00000000-0000-0000-0000-000000000000/v2.0",
  "client_id": "11111111-1111-1111-1111-111111111111",
  "response_type": "code",
  "scope": "openid profile email offline_access api://11111111-1111-1111-1111-111111111111/opencloud"
}

Note

Access tokens must be issued for an audience accepted by the server. Request the same scopes as the web client, including any API scope such as api://…/opencloud required with Microsoft Entra ID.

Map to Connection Profile Keys

Source Value Connection Profile Key
/.well-known/openid-configuration authorization_endpoint OAuth Authorization Url
/.well-known/openid-configuration token_endpoint OAuth Token Url
/config.json openIdConnect.client_id OAuth Client ID
/config.json openIdConnect.scope Scopes

Register Redirect URIs in Identity Provider

After login in the web browser, the identity provider redirects back to the application. Register the redirect URIs matching the OAuth Redirect Url in the connection profile with the OAuth client in your identity provider.

Custom URL SchemeLoopback Address

  • x-cyberduck-action:oauth for Cyberduck

  • x-mountainduck-action:oauth for Mountain Duck

  • http://localhost/ for both Cyberduck and Mountain Duck

The application listens on a random port on the loopback interface to receive the authorization code. This option requires the identity provider to accept redirect URIs to the loopback interface with any port as recommended for native apps in RFC 8252. Both Microsoft Entra ID and Keycloak support registering http://localhost without a port.

Requirements

  • Cyberduck 9.5.0 or later required
  • Mountain Duck 5.3.0 or later required

Microsoft Entra IDKeycloakOpenCloud Built-in Identity ProviderownCloud Infinite Scale Built-in Identity Provider

  1. Open the application registration for the OAuth Client ID in the Microsoft Entra admin center in Identity → Applications → App registrations.
  2. Navigate to Authentication and choose Add a platform → Mobile and desktop applications.
  3. Enter x-cyberduck-action:oauth in Custom redirect URIs and choose Configure. Repeat for x-mountainduck-action:oauth. When using the loopback address, enter http://localhost instead.

Note

Microsoft Entra ID ignores the port number for redirect URIs with localhost.

Important

Redirect URIs registered for the Single-page application platform used by the web interface cannot be used by Cyberduck and Mountain Duck.

Import client configuration for Keycloak

Import a sample client configuration with Import client in Clients of the Keycloak admin console to allow OAuth authentication from Cyberduck & Mountain Duck. Both register the redirect URIs x-cyberduck-action:oauth and x-mountainduck-action:oauth.

  • . Registers a public client with the Client ID Cyberduck requiring no client secret. Set an empty OAuth Client Secret in the connection profile.
  • . Registers a confidential client with Client authentication enabled.

Important

For a confidential client, set the client secret from the Credentials tab of the client in OAuth Client Secret of the connection profile or disable Client authentication to register a public client.

Configure existing client

  1. Open the client for the OAuth Client ID in the Keycloak admin console in Clients.
  2. Add x-cyberduck-action:oauth and x-mountainduck-action:oauth to Valid redirect URIs and choose Save. When using the loopback address, add http://localhost/ instead.

Note

Keycloak ignores the port number for redirect URIs with localhost, 127.0.0.1 and [::1].

No client registration is required when using the built-in identity provider of OpenCloud. The public client with the Client ID OpenCloudDesktop registered by default for the OpenCloud Desktop Client accepts redirect URIs to the loopback interface with any port.

  1. Open Preferences… → Profiles in Cyberduck or Mountain Duck.
  2. Enable the OpenCloud (OpenID Connect) connection profile.
  3. Add a new bookmark and choose OpenCloud (OpenID Connect) in the protocol dropdown. Enter the hostname of your OpenCloud server in Server.

Note

On first login you are asked to allow access for OpenCloud Desktop Client. Consent is required to obtain a refresh token with the offline_access scope.

Attention

The client registration is part of the default configuration of the built-in identity provider and may have been changed by the server administrator.

No client registration is required when using the built-in identity provider of ownCloud Infinite Scale. The client registered by default for the ownCloud desktop app accepts redirect URIs to the loopback interface with any port.

  1. Open Preferences… → Profiles in Cyberduck or Mountain Duck.
  2. Enable the ownCloud Infinite Scale (OpenID Connect) connection profile.
  3. Add a new bookmark and choose ownCloud Infinite Scale (OpenID Connect) in the protocol dropdown. Enter the hostname of your ownCloud Infinite Scale server in Server.

Note

On first login you are asked to allow access for ownCloud desktop app. Consent is required to obtain a refresh token with the offline_access scope.

Important

Unlike the client registered in OpenCloud, the client is confidential and requires the client secret validated by the token endpoint. The connection profile includes the default client secret published in the .

Attention

The client registration is part of the default configuration of the built-in identity provider and may have been changed by the server administrator.

Note

Alternatively register a dedicated OAuth client for Cyberduck and Mountain Duck with the identity provider as long as the access token issued is accepted by the server.

Write Connection Profile

Create a file with the extension .cyberduckprofile using a text editor.

BlueprintExample (Microsoft Entra ID)Example (Keycloak)

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
    <dict>
        <key>Protocol</key>
        <string>owncloud</string>
        <key>Vendor</key>
        <string>…</string>
        <key>Description</key>
        <string>…</string>
        <key>Default Hostname</key>
        <string>…</string>
        <key>Hostname Configurable</key>
        <false/>
        <key>OAuth Authorization Url</key>
        <string>…</string>
        <key>OAuth Token Url</key>
        <string>…</string>
        <key>OAuth Client ID</key>
        <string>…</string>
        <key>OAuth Client Secret</key>
        <string></string>
        <key>OAuth Redirect Url</key>
        <string>${oauth.handler.scheme}:oauth</string>
        <key>OAuth PKCE</key>
        <true/>
        <key>Scopes</key>
        <array>
            <string>openid</string>
            <string>profile</string>
            <string>email</string>
            <string>offline_access</string>
        </array>
        <key>Username Configurable</key>
        <false/>
        <key>Password Configurable</key>
        <false/>
    </dict>
</plist>
  • Protocol Must be owncloud to connect using WebDAV with ownCloud extensions such as resumable uploads, versioning and sharing.
  • Vendor Unique identifier for the connection profile.
  • Default Hostname Hostname of the server. Set Hostname Configurable to false to prevent editing.
  • OAuth Authorization Url The authorization_endpoint from the discovery document.
  • OAuth Token Url The token_endpoint from the discovery document.
  • OAuth Client ID The client_id from config.json or of a dedicated client registered with the identity provider. Use OpenCloudDesktop with the built-in identity provider of OpenCloud.
  • OAuth Client Secret Set an empty value for public clients to not send a client secret. Omit the key to prompt for input when connecting. Set the client secret when the client registered is confidential such as the sample client configuration for Keycloak from ownCloud.
  • OAuth Redirect Url Resolves to x-cyberduck-action:oauth in Cyberduck and x-mountainduck-action:oauth in Mountain Duck allowing the same profile to be used in both applications. Alternatively set to http://localhost/ with Cyberduck 9.5.0 and Mountain Duck 5.3.0 or later when the identity provider accepts redirect URIs to the loopback interface with any port.
  • OAuth PKCE Use Proof Key for Code Exchange (PKCE). Enabled by default.
  • Scopes The scopes requested. Include offline_access to obtain a refresh token and not require to login again when the access token expires. Add openid to obtain an ID token used to determine the username.
  • Username Configurable and Password Configurable Set to false as no credentials are required. The username is set from the preferred_username claim in the ID token after login with Cyberduck 9.3.0 and Mountain Duck 5.1.0 or later.

Connection profile for the OpenCloud deployment at cloud.example.net with Microsoft Entra ID as identity provider:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
    <dict>
        <key>Protocol</key>
        <string>owncloud</string>
        <key>Vendor</key>
        <string>cloud.example.net-entra</string>
        <key>Description</key>
        <string>OpenCloud Entra ID (cloud.example.net)</string>
        <key>Default Nickname</key>
        <string>OpenCloud</string>
        <key>Default Hostname</key>
        <string>cloud.example.net</string>
        <key>Hostname Configurable</key>
        <false/>
        <key>OAuth Authorization Url</key>
        <string>https://login.microsoftonline.com/00000000-0000-0000-0000-000000000000/oauth2/v2.0/authorize</string>
        <key>OAuth Token Url</key>
        <string>https://login.microsoftonline.com/00000000-0000-0000-0000-000000000000/oauth2/v2.0/token</string>
        <key>OAuth Client ID</key>
        <string>11111111-1111-1111-1111-111111111111</string>
        <key>OAuth Client Secret</key>
        <string></string>
        <key>OAuth Redirect Url</key>
        <string>${oauth.handler.scheme}:oauth</string>
        <key>OAuth PKCE</key>
        <true/>
        <key>Scopes</key>
        <array>
            <string>openid</string>
            <string>profile</string>
            <string>email</string>
            <string>offline_access</string>
            <string>api://11111111-1111-1111-1111-111111111111/opencloud</string>
        </array>
        <key>Username Configurable</key>
        <false/>
        <key>Password Configurable</key>
        <false/>
    </dict>
</plist>

Connection profile for an OpenCloud deployment at cloud.example.net with Keycloak at keycloak.example.net as identity provider using the realm openCloud and the public client Cyberduck imported from the :

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
    <dict>
        <key>Protocol</key>
        <string>owncloud</string>
        <key>Vendor</key>
        <string>cloud.example.net-keycloak</string>
        <key>Description</key>
        <string>OpenCloud Keycloak (cloud.example.net)</string>
        <key>Default Nickname</key>
        <string>OpenCloud</string>
        <key>Default Hostname</key>
        <string>cloud.example.net</string>
        <key>Hostname Configurable</key>
        <false/>
        <key>OAuth Authorization Url</key>
        <string>https://keycloak.example.net/realms/openCloud/protocol/openid-connect/auth</string>
        <key>OAuth Token Url</key>
        <string>https://keycloak.example.net/realms/openCloud/protocol/openid-connect/token</string>
        <key>OAuth Client ID</key>
        <string>Cyberduck</string>
        <key>OAuth Client Secret</key>
        <string></string>
        <key>OAuth Redirect Url</key>
        <string>${oauth.handler.scheme}:oauth</string>
        <key>OAuth PKCE</key>
        <true/>
        <key>Scopes</key>
        <array>
            <string>openid</string>
            <string>profile</string>
            <string>email</string>
            <string>offline_access</string>
        </array>
        <key>Username Configurable</key>
        <false/>
        <key>Password Configurable</key>
        <false/>
    </dict>
</plist>

Install Connection Profile

Double-click the .cyberduckprofile file to install it or copy it to the Profiles folder in the application support folder.

Create Bookmark

  1. Add a new bookmark in Cyberduck or Mountain Duck and choose the connection profile in the Protocol dropdown.
  2. Connect to the bookmark. The login page of the identity provider opens in your default web browser.
  3. After successful login, you are redirected back to Cyberduck or Mountain Duck. The OAuth tokens are saved in the Keychain on macOS or Credential Manager on Windows.

Troubleshooting

AADSTS50011: The redirect URI specified in the request does not match

The redirect URI x-cyberduck-action:oauth, x-mountainduck-action:oauth or http://localhost is not registered for the application in Microsoft Entra ID. Register the redirect URI for the Mobile and desktop applications platform.

AADSTS9002327: Tokens issued for the 'Single-Page Application' client-type may only be redeemed via cross-origin requests

The redirect URI is registered for the Single-page application platform. Register the redirect URI for the Mobile and desktop applications platform instead.

AADSTS7000218: The request body must contain the following parameter: 'client_assertion' or 'client_secret'

The application registration requires a client secret. Enable Allow public client flows in Authentication of the application registration or set OAuth Client Secret in the connection profile.

Invalid redirect_uri with Keycloak

Add x-cyberduck-action:oauth and x-mountainduck-action:oauth or the loopback address set in OAuth Redirect Url to Valid redirect URIs of the client.

Login Failure with 401 Unauthorized after successful login in web browser

The access token is not accepted by the server. Make sure to request the same scopes as the web client from config.json in Scopes of the connection profile.

References

Back to top