Nextcloud MCP Server

#!/bin/bash
#
# Configure user_oidc to accept bearer tokens from Keycloak
#
# This script sets up Keycloak as an external OIDC provider for Nextcloud.
# It enables bearer token validation, allowing the MCP server to use Keycloak
# tokens to access Nextcloud APIs without admin credentials.
#

set -e

echo "===================================================================="
echo "Configuring user_oidc provider for Keycloak..."
echo "===================================================================="

# Wait for Keycloak to be ready and realm to be available
echo "Waiting for Keycloak realm to be available..."
MAX_RETRIES=30
RETRY_COUNT=0

while [ $RETRY_COUNT -lt $MAX_RETRIES ]; do
    if curl -sf http://keycloak:8080/realms/nextcloud-mcp/.well-known/openid-configuration > /dev/null 2>&1; then
        echo "✓ Keycloak realm is ready"
        break
    fi
    echo "  Waiting for Keycloak... (attempt $((RETRY_COUNT + 1))/$MAX_RETRIES)"
    sleep 5
    RETRY_COUNT=$((RETRY_COUNT + 1))
done

if [ $RETRY_COUNT -eq $MAX_RETRIES ]; then
    echo "⚠ Warning: Keycloak not available after $MAX_RETRIES attempts"
    echo "  Keycloak provider will not be configured"
    echo "  You can configure it manually using:"
    echo "  docker compose exec app php occ user_oidc:provider keycloak \\"
    echo "    --clientid='nextcloud' \\"
    echo "    --clientsecret='nextcloud-secret-change-in-production' \\"
    echo "    --discoveryuri='http://keycloak:8080/realms/nextcloud-mcp/.well-known/openid-configuration' \\"
    echo "    --check-bearer=1 \\"
    echo "    --bearer-provisioning=1 \\"
    echo "    --unique-uid=1"
    exit 0
fi

# Check if provider already exists
if php /var/www/html/occ user_oidc:provider keycloak 2>/dev/null | grep -q "Identifier"; then
    echo "  Keycloak provider already exists, updating configuration..."

    # Update existing provider
    php /var/www/html/occ user_oidc:provider keycloak \
        --clientid="nextcloud" \
        --clientsecret="nextcloud-secret-change-in-production" \
        --discoveryuri="http://keycloak:8080/realms/nextcloud-mcp/.well-known/openid-configuration" \
        --check-bearer=1 \
        --bearer-provisioning=1 \
        --unique-uid=1 \
        --mapping-uid="sub" \
        --mapping-display-name="name" \
        --mapping-email="email" \
        --scope="openid profile email offline_access"

    echo "✓ Updated Keycloak provider configuration"
else
    echo "  Creating new Keycloak provider..."

    # Create new provider
    php /var/www/html/occ user_oidc:provider keycloak \
        --clientid="nextcloud" \
        --clientsecret="nextcloud-secret-change-in-production" \
        --discoveryuri="http://keycloak:8080/realms/nextcloud-mcp/.well-known/openid-configuration" \
        --check-bearer=1 \
        --bearer-provisioning=1 \
        --unique-uid=1 \
        --mapping-uid="sub" \
        --mapping-display-name="name" \
        --mapping-email="email" \
        --scope="openid profile email offline_access"

    echo "✓ Created Keycloak provider"
fi

# Display provider details
echo ""
echo "Keycloak provider configuration:"
php /var/www/html/occ user_oidc:provider keycloak

echo ""
echo "===================================================================="
echo "✓ Keycloak provider configured successfully"
echo "===================================================================="
echo ""
echo "Key features enabled:"
echo "  • Bearer token validation (--check-bearer=1)"
echo "  • Automatic user provisioning (--bearer-provisioning=1)"
echo "  • Unique user IDs (--unique-uid=1)"
echo "  • Offline access scope (for refresh tokens)"
echo ""
echo "MCP server can now use Keycloak tokens to access Nextcloud APIs"
echo "without admin credentials (ADR-002 architecture)."
echo ""