OAuth possible with generic WebDAV configuration?

[fritzt0]

Is it possible to configure WebDAV access to a custom Web server that requires OAuth 2.0 authentication for access? This particular configuration consists of nginx + webdav-ext + dex. I tried to create a profile but the OAuth part seems to be ignored, it's also nowhere seen in the UI configuration. Client is on macOS.

Thanks for any help.

[dkocher]

Not out of the box but theoretically possible as we already support this for ownCloud Infinite Scale (oCIS).

[dkocher]

Previously implemented for ownCloud in #14876.

[fritzt0]

Thanks for the speedy response. Should I create a feature request or what would be the best way to move this forward (theoretically)?

[fritzt0]

The setup provides a simple PDF dokument server. It's an nginx + nginx-dav-ext-module WebDAV setup that has a Dex (very similar to KeyCloak) authentication behind a reverse proxy (Traefik) for https encryption. The whole setup runs in Docker.

The system checks for a valid Bearer token in the http header (Authorization), if none is available a dialog is presented to provide authentication. If successful, the system will add a Bearer token to the header. Refresh tokens are handled in accordance with the OAuth 2.0 specification.

My guess would be, this setup is very similar to oCIS as you mentioned and would provide a flexible solution for custom servers with OAuth or OpenID authentification.

[dkocher]

I have opened #16791 to look into possible options.

[fritzt0]

Nice, looking forward to it.

[dkocher]

With #16792 being merged you should be able to make this work using a custom connection profile like the following, filling in the required values as appropriate

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
    <dict>
        <key>Protocol</key>
        <string>dav</string>
        <key>Vendor</key>
        <string>fritzt0</string>
        <key>Description</key>
        <string>WebDAV (Dex)</string>
        <key>OAuth Configurable</key>
        <true/>
        <key>OAuth Authorization Url</key>
        <string>https://dex/openid-connect/auth</string>
        <key>OAuth Token Url</key>
        <string>https://dex/openid-connect/token</string>
        <key>Scopes</key>
        <array>
            <string>openid</string>
        </array>
        <key>OAuth Client ID</key>
        <string></string>
        <key>OAuth Client Secret</key>
        <string></string>
        <key>OAuth Redirect Url</key>
        <string>x-cyberduck-action:oauth</string>
        <key>Password Configurable</key>
        <false/>
        <key>Username Configurable</key>
        <false/>
    </dict>
</plist>

[fritzt0]

Many thanks, I'll test and provide feedback with the next update to Cyberduck.

[dkocher]

You can test with the current snapshot build.

[fritzt0]

Using Cyberduck 9.1.3, I tested the feature but could not access the WebDAV share. I don't get any dialog asking for the credentials nor do I get any feedback (also no error). It just flashes in the title bar for some fraction of a second and then nothing. Can I provide any error logs? I had a glimpse into the Console app for the Cyberduck process (with Info & Debug messages enabled), but there is nothing obviously wrong to my eyes...