Seafile Client with Self-signed OIDC

Seafile Client
1

I have seafile deployed, using OIDC for the users. The OIDC is using self-signed certificates.

While this only gives a warning on the browser (like any other self-signed certificate), the seafile-applet fails. When clicking on “Single Sign-On”, the browser that opens fails to open the OIDC page, because the cert_authority is invalid.

Is this configurable in the options of the seafile client ?

2

The Seafile client does not appear to have a setting to simply ignore OIDC certificate validation. The desktop SSO flow uses the same TLS trust rules as the underlying OAuth/OIDC requests, so if your IdP uses a self-signed or private CA certificate, the fix is to make that certificate trusted by Seafile’s OAuth/TLS trust store rather than trying to bypass validation.

What to do instead:

  • Use a certificate issued by a publicly trusted CA for the OIDC endpoint, or
  • Add your IdP’s root CA to the trust store used by Seafile for OAuth requests.

The admin manual documents OAuth configuration on the server side, but it does not describe a client-side option to disable certificate validation: OAuth Authentication - Seafile Admin Manual

A related forum case also resolved the same class of issue by adding the root certificate to Seafile’s bundled CA file: Problem with access Keycloak