opencloud-oidc-webfinger-proxy

A lightweight Go-based reverse proxy that dynamically rewrites href fields in WebFinger responses for OpenID Connect (OIDC) clients.

This service is primarily designed for OpenCloud environments but can be used with any OIDC implementation that requires dynamic issuer rewriting based on user agent or suffix mapping.

---

🚀 Features

• 🔄 Dynamically rewrites href values in WebFinger JSON responses
• ⚙️ Fully configurable via environment variables — no code changes required
• 🧩 Compatible with any OIDC-compliant identity provider (e.g. Authentik, Authelia, Dex, etc.)
• 🧠 Extremely lightweight and stateless — built with Go
• 🧱 Works seamlessly behind Nginx or any reverse proxy

---

🧠 How it works

1. The proxy listens for requests on /.well-known/webfinger.
2. It forwards the request to the configured upstream WebFinger service.
3. The JSON response is inspected and any href fields matching HREF_PATTERN are replaced with
   HREF_REPLACEMENT + <issuer-suffix> + "/".
4. The issuer suffix is provided via the HTTP header X-Issuer-Suffix,
   or falls back to the configured DEFAULT_SUFFIX.

Example:

Upstream response

{
  "href": "https://auth.domain.com/application/o/opencloud/"
}

Modified by proxy (Header: X-Issuer-Suffix=opencloud-android)

{
  "href": "https://auth.domain.com/application/o/opencloud-android/"
}

⚙️ Environment Variables

Variable	Description	Example
PORT	Port on which the proxy listens	9210
UPSTREAM_URL	Base URL of the real WebFinger endpoint (including schema)	https://cloud.domain.com
HREF_PATTERN	The part of the href URL to be matched and replaced	https://auth.domain.com/application/o/
HREF_REPLACEMENT	The base part to replace the matched pattern with	https://auth.domain.com/application/o/
DEFAULT_SUFFIX	Default issuer suffix when none is provided via header	opencloud

All variables are required — the service will exit with an error if any are missing.

🧩 Example usage

Run locally

export PORT=9210
export UPSTREAM_URL=https://cloud.domain.com
export HREF_PATTERN=https://auth.domain.com/application/o/
export HREF_REPLACEMENT=https://auth.domain.com/application/o/
export DEFAULT_SUFFIX=opencloud

go run main.go

Then test it:

curl -H "X-Issuer-Suffix: opencloud-android"   "http://localhost:9210/.well-known/webfinger?rel=http%3A%2F%2Fopenid.net%2Fspecs%2Fconnect%2F1.0%2Fissuer&resource=https%3A%2F%2Fcloud.domain.com"

Response:

{
  "links": [
    {
      "rel": "http://openid.net/specs/connect/1.0/issuer",
      "href": "https://auth.domain.com/application/o/opencloud-android/"
    }
  ],
  "subject": "https://cloud.domain.com"
}