OpenID Client on Cloudron:

https://lampoidc.mydomain.com/secure/redirect_uri
<clientId>
<secret>

/app/data/apache/app.conf:

ServerName localhost

<VirtualHost *:80>
    ServerName localhost
    UseCanonicalName Off
    DocumentRoot /app/data/public

    LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" proxy
    CustomLog "|/bin/cat" proxy
    ErrorLog "|/bin/cat"

    <Directory /app/data/public>
        Options +FollowSymLinks
        AllowOverride All
        Require all granted
    </Directory>

    # Do not remove this include. It's required for your app to see the Real IP
    Include "/app/code/apache/rpaf.conf"
    # This line can be commented out, if you do no require PHPMyAdmin Access
    Include "/app/code/apache/phpmyadmin.conf"

</VirtualHost>

# OIDCRedirectURI is a vanity URL that must point to a path protected by this module but must NOT point to any content
OIDCRedirectURI https://lampoidc.mydomain.com/secure/redirect_uri
OIDCCryptoPassphrase somethingsecret

OIDCProviderMetadataURL https://my.mydomain.com/.well-known/openid-configuration
OIDCClientID <clientId>
OIDCClientSecret <secret>

/app/data/public/.htaccess:

AuthType openid-connect
Require valid-user

Any ideas?

would you be able to do that, so I can pull the branch again like I managed to do before?

authentication works (nice!) but the redirect url appends port 80 (https://lampoidc.mydomain.com:80/) which results in an ssl error (SSL_ERROR_RX_RECORD_TOO_LONG)

manualy removing the port then loads the page.

ai suggested adding this to the app.conf virtual host:

UseCanonicalName Off
UseCanonicalPhysicalPort Off

which did not help...

any ideas?

You can test the branch from https://git.cloudron.io/packages/lamp-app/-/tree/oidc-support?ref_type=heads if you know your way around building a custom app.

Once installed you have to create an OpenID client in your Cloudron dashboard with /secure/redirect_uri and put the following in /app/data/apache/app.conf:

   # OIDCRedirectURI is a vanity URL that must point to a path protected by this module but must NOT point to any content
OIDCRedirectURI https://<your.lampapp.domain>/secure/redirect_uri
OIDCCryptoPassphrase somethingsecret

OIDCProviderMetadataURL https://<my.example.com>/.well-known/openid-configuration
OIDCClientID <clientId>
OIDCClientSecret <secret>

Then restart the app and then you may put those two lines in any .htaccess within your public/ folder which you want to protect from public access:

AuthType openid-connect
Require valid-user

Please do not pre-provision the client data. My use case would be with keycloak, so users are able to login there and access a members only website, as well as further services.

I would like to have the possibility of users self registering - which is impossible with cloudron (atm).

is there no way to auto-provision it with the cloudron data, but allow admins to edit the config? That way it would work "out-of-the-box" but could still be used with other IAMs.

If we do not pre-provision it, the Cloudron access controls won't be applied

Any input here might help to decide on how to go about this.

I would like to try https://github.com/OpenIDC/mod_auth_openidc in it

I would separate this into:

• Activating already installed mods
• Installing and activating new monds

Maybe you can symlink the apache2 folder to a writable folder inside /app

Currently, there is no way to enable modules on the fly. It has to be part of the package. Since expires is fairly standard, I added it to the package itself. Otherwise, we have to investigate what's the best approach for this.