Configure Rocket.chat for OIDC SSO with Kopano Konnect

In my last blog I explained how the Kopano Meet app on Cloudron can be used as an oidc/oauth provider for Nextcloud. This time I wanted to show how to achieve the same with Rocket.chat.

The following configuration needs to be added to the identifier registration of Kopano Konnect:

- id: rocketchat.9wd.eu
  name: Rocketchat
  trusted: true
  application_type: web
  redirect_uris:
  - https://rocketchat.9wd.eu/_oauth/konnect

Remember to restart Konnect after modifying the registry. If you want to verify that the configuration was properly loaded you have to modify log_level in /app/data/konnectd.cfg to read /app/data/konnectd.cfg. With another restart Konnect will then print a message like the following at startup:

Apr 20 20:21:30 time="2020-04-20T18:21:30Z" level=debug msg="registered client" application_type=web client_id=rocketchat.9wd.eu insecure=false origins="[https://rocketchat.9wd.eu]" redirect_uris="[https://rocketchat.9wd.eu/_oauth/konnect]" trusted=true with_client_secret=false

In Rocket.chat the following configuration needs to be added. For this go into the admin backend, select “OAuth” and there “Add custom oauth”. I am using the following settings:

  • URL: https://meet.9wd.eu
  • Token Path: /konnect/v1/token
  • Token Sent Via: Header
  • Identity Token Sent Via: Same as "Token Sent Via"
  • Identity Path: /konnect/v1/userinfo
  • Authorize Path: /signin/v1/identifier/_/authorize
  • Scope: openid profile email
  • Id: rocketchat.9wd.eu
  • Secret: rocketchat
  • Login Style: Default
  • Button Text: Kopano Konnect (needs to be something the user can relate to)
  • Button Text Color: #FFFFFF
  • Button Color: #13679A
  • Username field: preferred_username
  • Merge users: false

After storing these log out of Rocket.chat and you will see a new button on your login page titled “Kopano Konnect”, which will then use the new login method.