Storage Health Check: Check for presence of an OIDC IdP

modules/storages/app/common/storages/peripherals/nextcloud_connection_validator.rb

@@ -54,10 +54,26 @@ def validate
 
       private
 
+      def sso_misconfigured
+        return None() unless @storage.authenticate_via_idp?
+
+        openid_connect_idp_absent
+      end
+
+      def openid_connect_idp_absent
+        return None() if OpenIDConnect::Provider.any?
+
+        Some(ConnectionValidation.new(type: :error,
+                                      error_code: :oidc_provider_missing,
+                                      timestamp: Time.current,
+                                      description: I18n.t("storages.health.connection_validation.oidc_provider_missing")))
+      end
+
       def has_base_configuration_error?
         host_url_not_found
           .or { missing_dependencies }
           .or { version_mismatch }
+          .or { sso_misconfigured }
           .or { with_unexpected_content }
           .or { capabilities_request_failed_with_unknown_error }
       end

modules/storages/config/locales/en.yml

@@ -223,6 +223,7 @@ en:
         host_not_found: No Nextcloud server found at the configured host url. Please check the configuration.
         missing_dependencies: 'A required dependency is missing on the file storage. Please add the following dependency: %{dependency}.'
         not_configured: The connection could not be validated. Please finish configuration first.
+        oidc_provider_missing: There is no OpenID Connect Identity Provider configured.
         placeholder: Check your connection against the server.
         subtitle: Connection validation
         tenant_id_wrong: The configured directory (tenant) id is invalid. Please check the configuration.

modules/storages/spec/common/storages/peripherals/nextcloud_connection_validator_spec.rb

@@ -230,6 +230,31 @@
     end
   end
 
+  context "when OpenID Connect is enabled" do
+    let(:storage) { create(:nextcloud_storage_configured, :oidc_enabled) }
+    let(:app_version) { Storages::SemanticVersion.parse("2.6.3") }
+    let(:capabilities_response) do
+      ServiceResult.success(result: Storages::NextcloudCapabilities.new(
+        app_enabled?: true,
+        app_version:,
+        group_folder_enabled?: false,
+        group_folder_version: nil
+      ))
+    end
+
+    it "succeeds when a provider is available" do
+      create(:oidc_provider)
+
+      expect(subject.type).to eq(:healthy)
+    end
+
+    it "errors if no Provider is available" do
+      expect(subject.type).to eq(:error)
+      expect(subject.error_code).to eq(:oidc_provider_missing)
+      expect(subject.description).to eq(I18n.t("storages.health.connection_validation.oidc_provider_missing"))
+    end
+  end
+
   private
 
   def build_failure(code:, payload:)

modules/storages/spec/contracts/storages/storages/nextcloud_contract_spec.rb

@@ -156,6 +156,8 @@
     context "when the authentication method is oauth2_sso" do
       let(:authentication_method) { "oauth2_sso" }
 
+      before { storage.nextcloud_audience = "valid_audience" }
+
       it { is_expected.to be_valid }
     end
 

modules/storages/spec/factories/storage_factory.rb

@@ -92,7 +92,12 @@
     provider_type { Storages::Storage::PROVIDER_TYPE_NEXTCLOUD }
     sequence(:host) { |n| "https://host#{n}.example.com/" }
     authentication_method { "two_way_oauth2" }
-    nextcloud_audience { "nextcloud" }
+    nextcloud_audience { nil }
+
+    trait :oidc_enabled do
+      nextcloud_audience { "nextcloud" }
+      authentication_method { "oauth2_sso" }
+    end
 
     trait :as_automatically_managed do
       automatic_management_enabled { true }