Cloudron makes it easy to run web apps like WordPress, Nextcloud, GitLab on your server. Find out more or install now.


Skip to content
  • Categories
  • Recent
  • Tags
  • Popular
  • Bookmarks
  • Search
Skins
  • Light
  • Cerulean
  • Cosmo
  • Flatly
  • Journal
  • Litera
  • Lumen
  • Lux
  • Materia
  • Minty
  • Morph
  • Pulse
  • Sandstone
  • Simplex
  • Sketchy
  • Spacelab
  • United
  • Yeti
  • Zephyr
  • Dark
  • Cyborg
  • Darkly
  • Quartz
  • Slate
  • Solar
  • Superhero
  • Vapor

  • Default (No Skin)
  • No Skin
Collapse
Brand Logo

Cloudron Forum

Apps | Demo | Docs | Install
  1. Cloudron Forum
  2. Nextcloud
  3. Nextcloud OIDC integration

Nextcloud OIDC integration

Scheduled Pinned Locked Moved Nextcloud
111 Posts 10 Posters 10.4k Views 10 Watching
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • girishG girish

    Also, are you using Cloudron with OIDC integration to start with? Does a fresh install of NC (for testing) have the button?

    firmansiF Offline
    firmansiF Offline
    firmansi
    wrote on last edited by firmansi
    #9

    @girish No, this is not a fresh install, it's been with LDAP from the beginning since 1.5 years ago

    girishG 1 Reply Last reply
    0
    • firmansiF firmansi

      @girish No, this is not a fresh install, it's been with LDAP from the beginning since 1.5 years ago

      girishG Offline
      girishG Offline
      girish
      Staff
      wrote on last edited by
      #10

      @firmansi are you able to login as nextcloud admin? If so, if you go to App -> OIDC , is it configured and enabled?

      firmansiF 1 Reply Last reply
      0
      • girishG girish

        @firmansi are you able to login as nextcloud admin? If so, if you go to App -> OIDC , is it configured and enabled?

        firmansiF Offline
        firmansiF Offline
        firmansi
        wrote on last edited by
        #11

        @girish Yes, I can login as Administrator, but have not configure the OIDC, should I activate the OpenID Connect Login App first in Nextcloud App Store?

        girishG 1 Reply Last reply
        0
        • firmansiF firmansi

          @girish Yes, I can login as Administrator, but have not configure the OIDC, should I activate the OpenID Connect Login App first in Nextcloud App Store?

          girishG Offline
          girishG Offline
          girish
          Staff
          wrote on last edited by
          #12

          @firmansi OIDC should be automatically automatic configured. Can you restart the app and check the logs? In the log you should see ==> Disabling LDAP and then ==> Ensure OIDC settings . Do you see these messages?

          Can you also open a web terminal and run env | grep CLOUDRON_OIDC ? Do you see a bunch of variables?

          firmansiF 1 Reply Last reply
          0
          • jdaviescoatesJ Online
            jdaviescoatesJ Online
            jdaviescoates
            wrote on last edited by jdaviescoates
            #13

            OK, I've just installed fresh instance of Nextcloud to test this.

            I was able to login fine, but I don't seem able to make my user an admin. I can add them to the admin group, but they don't actually get any admin rights.

            It is kinda sorta nice that it sucks in all my Cloudron groups, but it's also not appropriate in my case. And none of those groups have access to this Cloudron, so the current set-up would seem to me to be generally inappropriate to me too. I also host a Nextcloud for a small volunteer group and them seeing a list of groups that have nothing whatsoever to do with them would, I imagine, be very confusing. I can imagine it could potentially be useful for some people's set-up though - so perhaps it could/ should only suck in/ create groups that actually have access to the app? (either way, I think the way it currently works needs to change).

            I use Cloudron with Gandi & Hetzner

            jdaviescoatesJ 1 Reply Last reply
            1
            • jdaviescoatesJ jdaviescoates

              OK, I've just installed fresh instance of Nextcloud to test this.

              I was able to login fine, but I don't seem able to make my user an admin. I can add them to the admin group, but they don't actually get any admin rights.

              It is kinda sorta nice that it sucks in all my Cloudron groups, but it's also not appropriate in my case. And none of those groups have access to this Cloudron, so the current set-up would seem to me to be generally inappropriate to me too. I also host a Nextcloud for a small volunteer group and them seeing a list of groups that have nothing whatsoever to do with them would, I imagine, be very confusing. I can imagine it could potentially be useful for some people's set-up though - so perhaps it could/ should only suck in/ create groups that actually have access to the app? (either way, I think the way it currently works needs to change).

              jdaviescoatesJ Online
              jdaviescoatesJ Online
              jdaviescoates
              wrote on last edited by jdaviescoates
              #14

              @jdaviescoates said in Nextcloud OIDC integration:

              I was able to login fine, but I don't seem able to make my user an admin. I can add them to the admin group, but they don't actually get any admin rights.

              I think something about the way it's syncing to Cloudron groups is what is breaking this.

              When I login as admin and edit my user to add them to the admin group, my user does get added as an admin, and then appears in the list of admins.

              But once I logout as admin and then back in again as my user, I'm no longer in the admin group. Which is exactly what I see confirmed again when I log back in as the admin. The user is no longer in the admin group (but is in a bunch of Cloudron groups that have been pulled in but don't have anything to do with, nor access to, this app)

              Another reason to change the way it's currently working with Cloudron groups.

              If possible I think the way forward would be to

              1. only pull in/ sync Cloudron groups that have access to the app (i.e. don't pull in nor do anything with Cloudron groups unless those groups have specifically been given access to the app under the Cloudron App Access Control settings)

              2. Make sure the group syncing thing doesn't ever touch the admin group.

              Or, possibly: just don't sync with Cloudron groups at all (certainly this if you can't get that to work with the existing admin group)

              I use Cloudron with Gandi & Hetzner

              1 Reply Last reply
              3
              • girishG Offline
                girishG Offline
                girish
                Staff
                wrote on last edited by
                #15

                @jdaviescoates thanks for the detailed investigation! Right, this is a bug that the package is enabling OIDC groups. New package coming with it disabled.

                1 Reply Last reply
                2
                • avatar1024A Offline
                  avatar1024A Offline
                  avatar1024
                  wrote on last edited by
                  #16

                  @girish But syncing Cloudron group might be super useful in other cases, at least that is certainly the case with the organisation I work with and it was a relief when it started to work with LDAP.

                  How it should be implemented I'm not sure. I understand the concerns of @jdaviescoates when the way app access work is that, apps have access to everything unless you restrict it and give access to only specific users/groups. So following that logic it seems like the behaviour of all groups being synced (as described by @jdaviescoates) is normal (as it does for users) and that if an app should only see some groups/users, then the Cloudron admin should make sure only those groups are granted access (and then the OIDC plugin should only sync those groups and not others).

                  The Nextcloud admin group however should be independent of OIDC syncing and Nextcloud admins should be able to manage it independently.

                  1 Reply Last reply
                  2
                  • firmansiF Offline
                    firmansiF Offline
                    firmansi
                    wrote on last edited by
                    #17

                    @girish I am quite hesitate to do this in my production server as it is now, and actually with current LDAP scenario, I am satisfied. If I may suggest, will it be doable in next update, the Cloudron team can make the OIDC as optional instead of seemingly compulsory configuration? Or at least until this scenario is already proven to work seamless without any hassle.

                    1 Reply Last reply
                    2
                    • girishG Offline
                      girishG Offline
                      girish
                      Staff
                      wrote on last edited by girish
                      #18

                      @jdaviescoates I have published a new package with groups disabled. Can you please check?

                      @avatar1024 OIDC Group Sync has to be configured by the package installer just like LDAP Group Sync. Cloudron only exposes groups but does not provision the app (it's not possible for Cloudron to know what group should be what).

                      @firmansi we can't support both LDAP and OIDC in the long run. But on platform level, we already decided to switch to OIDC for all apps. This is more secure and auditable. I think you can probably wait for the upgrade anyway till all the issues are ironed out. Most of the apps that support OIDC have already been switched to OIDC from LDAP.

                      jdaviescoatesJ avatar1024A 3 Replies Last reply
                      3
                      • girishG girish

                        @firmansi OIDC should be automatically automatic configured. Can you restart the app and check the logs? In the log you should see ==> Disabling LDAP and then ==> Ensure OIDC settings . Do you see these messages?

                        Can you also open a web terminal and run env | grep CLOUDRON_OIDC ? Do you see a bunch of variables?

                        firmansiF Offline
                        firmansiF Offline
                        firmansi
                        wrote on last edited by firmansi
                        #19

                        @girish I have updated to the latest version and nothing appears in env | grep CLOUDRON_OIDC

                        Now, I install manually OpenID Connect Login, but I don;t know how and where to set

                        Do we have to install manually first then update the package maybe? I see in this forum the scenario works fine with fresh installation, but not the old one

                        girishG 1 Reply Last reply
                        0
                        • firmansiF firmansi

                          @girish I have updated to the latest version and nothing appears in env | grep CLOUDRON_OIDC

                          Now, I install manually OpenID Connect Login, but I don;t know how and where to set

                          Do we have to install manually first then update the package maybe? I see in this forum the scenario works fine with fresh installation, but not the old one

                          girishG Offline
                          girishG Offline
                          girish
                          Staff
                          wrote on last edited by
                          #20

                          @firmansi said in Nextcloud OIDC integration:

                          @girish I have updated to the latest version and nothing appears in env | grep CLOUDRON_OIDC

                          So, I think you have installed nextcloud without Cloudron user management to start with. In that case, this change won't affect you at all. Just to double check: If you go into the app configuration -> Access Control, I guess you see Dashboard Visibility instead of User Management, correct?

                          firmansiF 1 Reply Last reply
                          3
                          • girishG girish

                            @jdaviescoates I have published a new package with groups disabled. Can you please check?

                            @avatar1024 OIDC Group Sync has to be configured by the package installer just like LDAP Group Sync. Cloudron only exposes groups but does not provision the app (it's not possible for Cloudron to know what group should be what).

                            @firmansi we can't support both LDAP and OIDC in the long run. But on platform level, we already decided to switch to OIDC for all apps. This is more secure and auditable. I think you can probably wait for the upgrade anyway till all the issues are ironed out. Most of the apps that support OIDC have already been switched to OIDC from LDAP.

                            jdaviescoatesJ Online
                            jdaviescoatesJ Online
                            jdaviescoates
                            wrote on last edited by
                            #21

                            @girish said in Nextcloud OIDC integration:

                            @jdaviescoates I have published a new package with groups disabled. Can you please check?

                            The existing test install was still broken after the update, i.e. the groups were still there and it still removed my user from the admin group.

                            A new test install works! No groups and user stays in the admin group once added.

                            I use Cloudron with Gandi & Hetzner

                            1 Reply Last reply
                            2
                            • girishG girish

                              @jdaviescoates I have published a new package with groups disabled. Can you please check?

                              @avatar1024 OIDC Group Sync has to be configured by the package installer just like LDAP Group Sync. Cloudron only exposes groups but does not provision the app (it's not possible for Cloudron to know what group should be what).

                              @firmansi we can't support both LDAP and OIDC in the long run. But on platform level, we already decided to switch to OIDC for all apps. This is more secure and auditable. I think you can probably wait for the upgrade anyway till all the issues are ironed out. Most of the apps that support OIDC have already been switched to OIDC from LDAP.

                              jdaviescoatesJ Online
                              jdaviescoatesJ Online
                              jdaviescoates
                              wrote on last edited by
                              #22

                              @girish said in Nextcloud OIDC integration:

                              @avatar1024 OIDC Group Sync has to be configured by the package installer just like LDAP Group Sync.

                              Just out of interest, how is this done?

                              I use Cloudron with Gandi & Hetzner

                              girishG 1 Reply Last reply
                              1
                              • jdaviescoatesJ jdaviescoates

                                @girish said in Nextcloud OIDC integration:

                                @avatar1024 OIDC Group Sync has to be configured by the package installer just like LDAP Group Sync.

                                Just out of interest, how is this done?

                                girishG Offline
                                girishG Offline
                                girish
                                Staff
                                wrote on last edited by
                                #23

                                @jdaviescoates there is a checkbox in the UI to enable it . I forget the exact text but it's inside the OIDC app settings.

                                jdaviescoatesJ 1 Reply Last reply
                                2
                                • girishG girish

                                  @firmansi said in Nextcloud OIDC integration:

                                  @girish I have updated to the latest version and nothing appears in env | grep CLOUDRON_OIDC

                                  So, I think you have installed nextcloud without Cloudron user management to start with. In that case, this change won't affect you at all. Just to double check: If you go into the app configuration -> Access Control, I guess you see Dashboard Visibility instead of User Management, correct?

                                  firmansiF Offline
                                  firmansiF Offline
                                  firmansi
                                  wrote on last edited by firmansi
                                  #24

                                  @girish I don't really get it, from the first time I set the Nextcloud, user management with Cloudron instead of the app, so when I add new user then it will have access to to Cloudron automatically.

                                  Well, it;s true, What I see when I click Access Control is Dashboard Visibility. Now I set the app visible only to several groups.

                                  nebulonN 1 Reply Last reply
                                  0
                                  • girishG girish

                                    @jdaviescoates there is a checkbox in the UI to enable it . I forget the exact text but it's inside the OIDC app settings.

                                    jdaviescoatesJ Online
                                    jdaviescoatesJ Online
                                    jdaviescoates
                                    wrote on last edited by
                                    #25

                                    @girish Ah yes, I found it in /settings/admin/user_oidc thanks

                                    08c9a9e6-b87d-4367-83e2-0787f48ab426-image.png

                                    I use Cloudron with Gandi & Hetzner

                                    1 Reply Last reply
                                    3
                                    • firmansiF firmansi

                                      @girish I don't really get it, from the first time I set the Nextcloud, user management with Cloudron instead of the app, so when I add new user then it will have access to to Cloudron automatically.

                                      Well, it;s true, What I see when I click Access Control is Dashboard Visibility. Now I set the app visible only to several groups.

                                      nebulonN Offline
                                      nebulonN Offline
                                      nebulon
                                      Staff
                                      wrote on last edited by
                                      #26

                                      @firmansi I don't think I understand what you are trying to tell us. Is the app installed with or without Cloudron usermanagement? Note that if it is installed without then the access controls become the dashboard visibility settings!

                                      1 Reply Last reply
                                      1
                                      • firmansiF Offline
                                        firmansiF Offline
                                        firmansi
                                        wrote on last edited by
                                        #27

                                        @nebulon I think it's without Cloudron User Management because What i see now is only Dashboard Visibility Setting, why I seem confused, because I have been using this Nextcloud in Cloudron for the last 1,5 years, and all this time I never create new user in Nextcloud directly, but always with Cloudron Users with LDAP

                                        1 Reply Last reply
                                        0
                                        • nebulonN Offline
                                          nebulonN Offline
                                          nebulon
                                          Staff
                                          wrote on last edited by
                                          #28

                                          Yeah something is inconsistent then. You can just verify the LDAP extension settings as an admin within Nextcloud to see what is happening.

                                          firmansiF 1 Reply Last reply
                                          0
                                          Reply
                                          • Reply as topic
                                          Log in to reply
                                          • Oldest to Newest
                                          • Newest to Oldest
                                          • Most Votes


                                          • Login

                                          • Don't have an account? Register

                                          • Login or register to search.
                                          • First post
                                            Last post
                                          0
                                          • Categories
                                          • Recent
                                          • Tags
                                          • Popular
                                          • Bookmarks
                                          • Search