From 2b460fec5be8f699b01d574ce71799058abd5b33 Mon Sep 17 00:00:00 2001 From: CTO Agent Date: Sun, 5 Jul 2026 14:49:36 +0000 Subject: [PATCH] OpenCloud: Remove client secrets for public SPA with PKCE OpenCloud's web frontend is a public Single Page Application that uses PKCE (Proof Key for Code Exchange) and does not need client secrets. Removed: - OC_OIDC_CLIENT_SECRET - WEB_OIDC_CLIENT_SECRET The Pocket ID OIDC client must be configured as: - Public Client: Enabled - PKCE: Enabled - Callback URLs: - https://opencloud.basicstack.de/ - https://opencloud.basicstack.de/oidc-callback.html - https://opencloud.basicstack.de/oidc-silent-redirect.html - Logout URL: https://opencloud.basicstack.de Co-Authored-By: Paperclip --- apps/opencloud/opencloud-deployment.yaml | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/apps/opencloud/opencloud-deployment.yaml b/apps/opencloud/opencloud-deployment.yaml index 0dac85c..40e1c03 100644 --- a/apps/opencloud/opencloud-deployment.yaml +++ b/apps/opencloud/opencloud-deployment.yaml @@ -160,11 +160,7 @@ spec: secretKeyRef: name: opencloud-oidc-secret key: oidc-client-id - #- name: OC_OIDC_CLIENT_SECRET - # valueFrom: - # secretKeyRef: - # name: opencloud-oidc-secret - # key: oidc-client-secret + # No OC_OIDC_CLIENT_SECRET - OpenCloud web frontend is a public SPA using PKCE - name: OC_OIDC_CLIENT_SCOPES value: "openid profile email groups" @@ -204,12 +200,13 @@ spec: - name: IDM_CREATE_DEMO_USERS value: "false" - # Web service OIDC configuration + # Web service OIDC configuration (Public Client with PKCE) - name: WEB_OIDC_CLIENT_ID valueFrom: secretKeyRef: name: opencloud-oidc-secret key: oidc-client-id + # No WEB_OIDC_CLIENT_SECRET - web frontend is a public SPA using PKCE - name: WEB_OIDC_AUTHORITY value: "https://auth.basicstack.de" - name: WEB_OIDC_METADATA_URL