From 860ed531ce21a48a351ff8080d618c8240bdd6bd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Thomas=20M=C3=BCller?=
 <1005065+DeepDiver1975@users.noreply.github.com>
Date: Thu, 9 Jul 2026 15:33:03 +0200
Subject: [PATCH] feat(config): expose openid-connect via
 OWNCLOUD_OPENID_CONNECT
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The openidconnect app's 'openid-connect' config key had no corresponding
env var, so OIDC could not be configured through the image's env-based
config mechanism (only the unrelated OWNCLOUD_ENABLE_OIDC_REWRITE_URL
Apache toggle existed).

Add OWNCLOUD_OPENID_CONNECT, a JSON-encoded object decoded into
$config['openid-connect']. The key is a deeply nested associative array
(provider-url, client-id/secret, scopes, provider-params, auto-provision,
...) that the flat env-var idioms cannot represent, so it reuses the
json_decode pattern already used for OWNCLOUD_LOG_CONDITIONS and
OWNCLOUD_USER_BACKENDS. Invalid JSON is ignored, leaving the key unset.
Added to v24.04 only, matching the convention that v20.04/v22.04 are frozen.

Closes #492

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com>
---
 CHANGELOG.md                            |  6 ++++++
 ENVIRONMENT.md                          |  2 ++
 v24.04/overlay/etc/templates/config.php | 13 +++++++++++++
 3 files changed, 21 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index abc270e..0292276 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,11 @@
 # Changelog
 
+## 2026-07-09
+
+* Added
+  * Env variable `OWNCLOUD_OPENID_CONNECT` for the `openid-connect` app config key
+    [#492](https://github.com/owncloud-docker/base/issues/492)
+
 ## 2026-07-08
 
 * Added
diff --git a/ENVIRONMENT.md b/ENVIRONMENT.md
index d4fc7ff..5f53986 100644
--- a/ENVIRONMENT.md
+++ b/ENVIRONMENT.md
@@ -274,6 +274,8 @@
   Maximum number of concurrent UploadPart operations allowed during the multipart upload (see [documentation](https://doc.owncloud.com/server/latest/admin_manual/configuration/files/external_storage/s3_compatible_object_storage_as_primary.html)).
 - `OWNCLOUD_OBJECTSTORE_AVAILABLE_STORAGE=` \
   Indicates available storage size in the objectstore in bytes (see [documentation](https://doc.owncloud.com/server/latest/admin_manual/configuration/files/external_storage/s3_compatible_object_storage_as_primary.html)).
+- `OWNCLOUD_OPENID_CONNECT=` \
+  OpenID Connect (`openid-connect`) app configuration as a JSON-encoded object, e.g. `{"provider-url":"https://idp.example.net","client-id":"...","client-secret":"...","loginButtonName":"OpenID Connect"}`. Supports the full nested structure (`provider-params`, `auto-provision`, ...) (see [documentation](https://doc.owncloud.com/server/latest/admin_manual/configuration/server/config_apps_sample_php_parameters.html#app-openid-connect-oidc)).
 - `OWNCLOUD_OPENSSL_CONFIG=` \
   Path to a custom `openssl.cnf` file, e.g. when using a custom PKI or CA in the container (see [documentation](https://doc.owncloud.com/server/latest/admin_manual/configuration/server/config_sample_php_parameters.html#define-the-default-cipher-for-encrypting-files)).
 - `OWNCLOUD_OPERATION_MODE=` \
diff --git a/v24.04/overlay/etc/templates/config.php b/v24.04/overlay/etc/templates/config.php
index 11a2259..3611032 100644
--- a/v24.04/overlay/etc/templates/config.php
+++ b/v24.04/overlay/etc/templates/config.php
@@ -676,6 +676,19 @@ function getConfigFromEnv() {
     $config['customclient_ios'] = getenv('OWNCLOUD_CUSTOMCLIENT_IOS');
   }
 
+  // app: openidconnect
+  // 'openid-connect' is a deeply nested associative array (provider-url,
+  // client-id/secret, scopes, provider-params, auto-provision, ...) that the
+  // flat env-var idioms cannot represent, so it is passed as a JSON-encoded
+  // object, e.g.:
+  //   OWNCLOUD_OPENID_CONNECT='{"provider-url":"https://idp.example.net","client-id":"...","client-secret":"...","loginButtonName":"OpenID Connect"}'
+  if (getenv('OWNCLOUD_OPENID_CONNECT') != '') {
+    $openIdConnect = json_decode(getenv('OWNCLOUD_OPENID_CONNECT'), true);
+    if (is_array($openIdConnect)) {
+      $config['openid-connect'] = $openIdConnect;
+    }
+  }
+
   // app: user_ldap
   if (getenv('OWNCLOUD_LDAP_IGNORE_NAMING_RULES') != '') {
     $config['ldapIgnoreNamingRules'] = getenv('OWNCLOUD_LDAP_IGNORE_NAMING_RULES') === 'true';