Configure Rocket.chat for OIDC SSO with Kopano Konnect

In my last blog I explained how the Kopano Meet app on Cloudron can be used as an oidc/oauth provider for Nextcloud. This time I wanted to show how to achieve the same with Rocket.chat.

The following configuration needs to be added to the identifier registration of Kopano Konnect:

- id: rocketchat.9wd.eu
  name: Rocketchat
  trusted: true
  application_type: web
  redirect_uris:
  - https://rocketchat.9wd.eu/_oauth/konnect

Remember to restart Konnect after modifying the registry. If you want to verify that the configuration was properly loaded you have to modify log_level in /app/data/konnectd.cfg to read /app/data/konnectd.cfg. With another restart Konnect will then print a message like the following at startup:

Apr 20 20:21:30 time="2020-04-20T18:21:30Z" level=debug msg="registered client" application_type=web client_id=rocketchat.9wd.eu insecure=false origins="[https://rocketchat.9wd.eu]" redirect_uris="[https://rocketchat.9wd.eu/_oauth/konnect]" trusted=true with_client_secret=false

In Rocket.chat the following configuration needs to be added. For this go into the admin backend, select “OAuth” and there “Add custom oauth”. I am using the following settings:

• URL: https://meet.9wd.eu
• Token Path: /konnect/v1/token
• Token Sent Via: Header
• Identity Token Sent Via: Same as "Token Sent Via"
• Identity Path: /konnect/v1/userinfo
• Authorize Path: /signin/v1/identifier/_/authorize
• Scope: openid profile email
• Id: rocketchat.9wd.eu
• Secret: rocketchat
• Login Style: Default
• Button Text: Kopano Konnect (needs to be something the user can relate to)
• Button Text Color: #FFFFFF
• Button Color: #13679A
• Username field: preferred_username
• Merge users: false

After storing these log out of Rocket.chat and you will see a new button on your login page titled “Kopano Konnect”, which will then use the new login method.