Cloudron makes it easy to run web apps like WordPress, Nextcloud, GitLab on your server. Find out more or install now.


Skip to content
  • Categories
  • Recent
  • Tags
  • Popular
  • Bookmarks
  • Search
Skins
  • Light
  • Cerulean
  • Cosmo
  • Flatly
  • Journal
  • Litera
  • Lumen
  • Lux
  • Materia
  • Minty
  • Morph
  • Pulse
  • Sandstone
  • Simplex
  • Sketchy
  • Spacelab
  • United
  • Yeti
  • Zephyr
  • Dark
  • Cyborg
  • Darkly
  • Quartz
  • Slate
  • Solar
  • Superhero
  • Vapor

  • Default (No Skin)
  • No Skin
Collapse
Brand Logo

Cloudron Forum

Apps | Demo | Docs | Install
  1. Cloudron Forum
  2. Nextcloud
  3. Nextcloud OIDC integration

Nextcloud OIDC integration

Scheduled Pinned Locked Moved Nextcloud
118 Posts 12 Posters 12.2k Views 11 Watching
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • avatar1024A avatar1024

    @jdaviescoates Thanks! Have you activated group mapping / syncing though? For me it's not working. I cannot add myself to the admin group (and I have definitely logged in - in fact that's how I know I'm not an admin 🙂 ). I can login with the "admin" user via the Nextcloud form but cannot add anyone else to the admin group, including myself.

    jdaviescoatesJ Offline
    jdaviescoatesJ Offline
    jdaviescoates
    wrote on last edited by
    #96

    @avatar1024 said in Nextcloud OIDC integration:

    Have you activated group mapping / syncing though?

    No.

    I use Cloudron with Gandi & Hetzner

    avatar1024A 1 Reply Last reply
    0
    • jdaviescoatesJ jdaviescoates

      @avatar1024 said in Nextcloud OIDC integration:

      Have you activated group mapping / syncing though?

      No.

      avatar1024A Offline
      avatar1024A Offline
      avatar1024
      wrote on last edited by avatar1024
      #97

      @jdaviescoates Yeah so it also works for me if I don't activate group mapping / syncing but I was asking if there is a solution to add admins users with that enabled.

      On one instance we used LDAP groups syncing and so switching to OIDC we need to also sync groups...but then we also needs admins 😅

      Anyone got a clue?

      PS: I've tried with my user who is a cloudron superadmin and with another user who is a Cloudron admin. None of them appear in the NC admin group or can be added to it.

      1 Reply Last reply
      1
      • J Offline
        J Offline
        joseph
        Staff
        wrote on last edited by
        #98

        @avatar1024 can nextcloud admin group have an arbitrary name or should it be admin(s) ? Since group sync is turned on, you have to create a such a group on Cloudron. The admins group is reserved in Cloudron, but this can be changed I think.

        avatar1024A 1 Reply Last reply
        0
        • J joseph

          @avatar1024 can nextcloud admin group have an arbitrary name or should it be admin(s) ? Since group sync is turned on, you have to create a such a group on Cloudron. The admins group is reserved in Cloudron, but this can be changed I think.

          avatar1024A Offline
          avatar1024A Offline
          avatar1024
          wrote on last edited by
          #99

          @joseph said in Nextcloud OIDC integration:

          can nextcloud admin group have an arbitrary name or should it be admin(s) ?

          In NC the group name for Admins is "admin". You can't change that and you can't create another group with admin rights. And in Cloudron one cannot create a group called "admin" (as you say the name is reserved). It feels like either:

          • Cloudron admins and Super admins should be mapped with the NC admin group
          • OIDC group syncing should exclude syncing the NC admin group
          1 Reply Last reply
          1
          • J Offline
            J Offline
            joseph
            Staff
            wrote on last edited by
            #100

            @avatar1024 there is a "Group whitelist regex" field in the OIDC UI. Have you tried setting it to only the groups you care about? It says it supports regexp, but not sure if it supports lookahead regexps (ask chatgpt) . i.e match all groups that are not admin.

            avatar1024A 1 Reply Last reply
            2
            • J joseph

              @avatar1024 there is a "Group whitelist regex" field in the OIDC UI. Have you tried setting it to only the groups you care about? It says it supports regexp, but not sure if it supports lookahead regexps (ask chatgpt) . i.e match all groups that are not admin.

              avatar1024A Offline
              avatar1024A Offline
              avatar1024
              wrote on last edited by
              #101

              @joseph Thanks, that worked!

              So far I haven't been able to allow all groups but exclude "admin", but when I only allow only a specific group then the admin group is not provisioned and works as expected.

              1 Reply Last reply
              1
              • avatar1024A Offline
                avatar1024A Offline
                avatar1024
                wrote on last edited by
                #102

                Ok this regex to whitelist all groups except "admin" seems to work well 🙂 : ^(?!admin$).+$

                image.png

                1 Reply Last reply
                3
                • J joseph referenced this topic on
                • whitespaceW Offline
                  whitespaceW Offline
                  whitespace
                  wrote on last edited by
                  #103

                  Is there a way to lead logged-in Nextcloud OICD users from Logout back to the Cloudron login form in logged-out state?

                  Expected behaviour

                  1. User is logged-in in Nextcloud
                  2. User presses "Logout" in Nextcloud.
                  3. User is logged out of the Nextcloud and from Cloudron.
                  4. User sees the Cloudron login form.

                  What happens with ˋallow_user_multiple_backendsˋ set to value=0:

                  1. User presses "Logout" in Nextcloud
                  2. User is invisibly getting redirected to Cloudron login form that reports to the Nextcloud instance that user is logged-in.
                  3. User ends up logged-in in Nextcloud.

                  This would be useful for instances where Nextcloud is the primarily hosted app. We have a server with Nextcloud and Collabora Office backend. There is usually no necessity for users to ever see the dashboard other than editing their profile.

                  1 Reply Last reply
                  0
                  • nebulonN Offline
                    nebulonN Offline
                    nebulon
                    Staff
                    wrote on last edited by
                    #104

                    I guess Nextcloud initiates the OpenID login redirection automatically in that case then. Since the user still has a login session with the OpenID provider (the Cloudron) it will auto-login.

                    Since the logout of Nextcloud itself is from the Nextcloud session, the OpenID provider has no clue about a logout event, so I don't think this is currently possible.

                    1 Reply Last reply
                    1
                    • R Offline
                      R Offline
                      RaV001
                      wrote on last edited by
                      #105

                      Is this known that the encryption keys are not initialized anymore after login in with OIDC? I am currently unable to access any of my files via web after the login and the message "Encryption app is enabled, but your keys are not initialized. Please log-out and log-in again." appears but logging out and in again does not help

                      R 1 Reply Last reply
                      1
                      • R RaV001

                        Is this known that the encryption keys are not initialized anymore after login in with OIDC? I am currently unable to access any of my files via web after the login and the message "Encryption app is enabled, but your keys are not initialized. Please log-out and log-in again." appears but logging out and in again does not help

                        R Offline
                        R Offline
                        RaV001
                        wrote on last edited by
                        #106

                        @RaV001 said in Nextcloud OIDC integration:

                        Is this known that the encryption keys are not initialized anymore after login in with OIDC? I am currently unable to access any of my files via web after the login and the message "Encryption app is enabled, but your keys are not initialized. Please log-out and log-in again." appears but logging out and in again does not help

                        Okay I updated to the latest version of Nextcloud in Cloudron and now this has changed to telling me that "Invalid private key for encryption app. Please update your private key password in your personal settings to recover access to your encrypted files" but not sure what the old password should be as I am still using the same account but now logged in via OIDC. No files are readable currently

                        jdaviescoatesJ nebulonN 2 Replies Last reply
                        1
                        • R RaV001

                          @RaV001 said in Nextcloud OIDC integration:

                          Is this known that the encryption keys are not initialized anymore after login in with OIDC? I am currently unable to access any of my files via web after the login and the message "Encryption app is enabled, but your keys are not initialized. Please log-out and log-in again." appears but logging out and in again does not help

                          Okay I updated to the latest version of Nextcloud in Cloudron and now this has changed to telling me that "Invalid private key for encryption app. Please update your private key password in your personal settings to recover access to your encrypted files" but not sure what the old password should be as I am still using the same account but now logged in via OIDC. No files are readable currently

                          jdaviescoatesJ Offline
                          jdaviescoatesJ Offline
                          jdaviescoates
                          wrote on last edited by
                          #107

                          @RaV001 said in Nextcloud OIDC integration:

                          not sure what the old password should be

                          I'm not sure as I don't use this, but presumably it'll be whatever "your private key password" (not your Cloudron pw) was before whenever you set it up.

                          Hopefully you made a note of it or remember it?!

                          If not you could well be stuck.

                          As an "doesn't help you right now" aside, this is precisely why I personally don't use encryption much myself - I figure the risk of me somehow losing access to my own files by something going wrong or me losing or forgetting my keys is actually quite a lot higher (in that it's actually happened before) than someone nefarious gaining access to my files (which as far as I know has never actually happened)

                          I use Cloudron with Gandi & Hetzner

                          R 1 Reply Last reply
                          0
                          • R RaV001

                            @RaV001 said in Nextcloud OIDC integration:

                            Is this known that the encryption keys are not initialized anymore after login in with OIDC? I am currently unable to access any of my files via web after the login and the message "Encryption app is enabled, but your keys are not initialized. Please log-out and log-in again." appears but logging out and in again does not help

                            Okay I updated to the latest version of Nextcloud in Cloudron and now this has changed to telling me that "Invalid private key for encryption app. Please update your private key password in your personal settings to recover access to your encrypted files" but not sure what the old password should be as I am still using the same account but now logged in via OIDC. No files are readable currently

                            nebulonN Offline
                            nebulonN Offline
                            nebulon
                            Staff
                            wrote on last edited by
                            #108

                            @RaV001 never used Nextclouds encryption, but maybe it used the password which was also used by the user account/LDAP before to open the encryption key. Have you tried to use the same password as your Cloudron user has?

                            R 1 Reply Last reply
                            2
                            • nebulonN nebulon

                              @RaV001 never used Nextclouds encryption, but maybe it used the password which was also used by the user account/LDAP before to open the encryption key. Have you tried to use the same password as your Cloudron user has?

                              R Offline
                              R Offline
                              RaV001
                              wrote on last edited by
                              #109

                              @nebulon yes used the same password as for my user twice but it says the new password is wrong... restoring the backup from last week currently before the update of the Nextcloud app to check if this solves the issue for now

                              1 Reply Last reply
                              1
                              • jdaviescoatesJ jdaviescoates

                                @RaV001 said in Nextcloud OIDC integration:

                                not sure what the old password should be

                                I'm not sure as I don't use this, but presumably it'll be whatever "your private key password" (not your Cloudron pw) was before whenever you set it up.

                                Hopefully you made a note of it or remember it?!

                                If not you could well be stuck.

                                As an "doesn't help you right now" aside, this is precisely why I personally don't use encryption much myself - I figure the risk of me somehow losing access to my own files by something going wrong or me losing or forgetting my keys is actually quite a lot higher (in that it's actually happened before) than someone nefarious gaining access to my files (which as far as I know has never actually happened)

                                R Offline
                                R Offline
                                RaV001
                                wrote on last edited by
                                #110

                                @jdaviescoates I am pretty sure I never have used a special password for this. As far as I can tell this was always the users password but somehow I am not seeing where I could have backed up any recovery stuff but Nextcloud seems to do encryption in different ways and some things have changed a lot over time

                                jdaviescoatesJ 1 Reply Last reply
                                1
                                • R RaV001

                                  @jdaviescoates I am pretty sure I never have used a special password for this. As far as I can tell this was always the users password but somehow I am not seeing where I could have backed up any recovery stuff but Nextcloud seems to do encryption in different ways and some things have changed a lot over time

                                  jdaviescoatesJ Offline
                                  jdaviescoatesJ Offline
                                  jdaviescoates
                                  wrote on last edited by
                                  #111

                                  @RaV001 well, good luck! I hope the backup works and you manage to regain access to your files! 🤞

                                  I use Cloudron with Gandi & Hetzner

                                  1 Reply Last reply
                                  0
                                  • girishG girish

                                    @jdaviescoates I have published a new package with groups disabled. Can you please check?

                                    @avatar1024 OIDC Group Sync has to be configured by the package installer just like LDAP Group Sync. Cloudron only exposes groups but does not provision the app (it's not possible for Cloudron to know what group should be what).

                                    @firmansi we can't support both LDAP and OIDC in the long run. But on platform level, we already decided to switch to OIDC for all apps. This is more secure and auditable. I think you can probably wait for the upgrade anyway till all the issues are ironed out. Most of the apps that support OIDC have already been switched to OIDC from LDAP.

                                    O Offline
                                    O Offline
                                    overholt
                                    wrote last edited by overholt
                                    #112

                                    @girish said in Nextcloud OIDC integration:

                                    we can't support both LDAP and OIDC in the long run. But on platform level, we already decided to switch to OIDC for all apps. This is more secure and auditable. I think you can probably wait for the upgrade anyway till all the issues are ironed out. Most of the apps that support OIDC have already been switched to OIDC from LDAP.

                                    This is a pretty big deal for companies with a lot of users who have set NextCloud up with LDAP (because we don't need OIDC). Did the Cloudron team consider that? It will require a lot of hand-holding and manual effort to re-establish new user accounts, reconnect mobile apps and manually reconfigure their files shares and group access. It would have been nice to provide a way to migrate NC users to Cloudron while maintaining files, shares and access.

                                    I get that it is better, it's just that now you are forcing your subscribers to jump through a very tall hoop. I just onboarded our entire company to NextCloud, which was a hard enough process. Now I will have to explain to everyone why they need to go through that process all over again. Not fun and not at all what I need right now. We probably won't upgrade until I can figure out what to do. I might migrate our install to a Docker VM. That way I can keep the users in tact and also get the HPBE with AIO. Either way it's a lot of work.

                                    jamesJ 1 Reply Last reply
                                    2
                                    • O overholt

                                      @girish said in Nextcloud OIDC integration:

                                      we can't support both LDAP and OIDC in the long run. But on platform level, we already decided to switch to OIDC for all apps. This is more secure and auditable. I think you can probably wait for the upgrade anyway till all the issues are ironed out. Most of the apps that support OIDC have already been switched to OIDC from LDAP.

                                      This is a pretty big deal for companies with a lot of users who have set NextCloud up with LDAP (because we don't need OIDC). Did the Cloudron team consider that? It will require a lot of hand-holding and manual effort to re-establish new user accounts, reconnect mobile apps and manually reconfigure their files shares and group access. It would have been nice to provide a way to migrate NC users to Cloudron while maintaining files, shares and access.

                                      I get that it is better, it's just that now you are forcing your subscribers to jump through a very tall hoop. I just onboarded our entire company to NextCloud, which was a hard enough process. Now I will have to explain to everyone why they need to go through that process all over again. Not fun and not at all what I need right now. We probably won't upgrade until I can figure out what to do. I might migrate our install to a Docker VM. That way I can keep the users in tact and also get the HPBE with AIO. Either way it's a lot of work.

                                      jamesJ Offline
                                      jamesJ Offline
                                      james
                                      Staff
                                      wrote last edited by
                                      #113

                                      Hello @overholt

                                      @overholt said in Nextcloud OIDC integration:

                                      It would have been nice to provide a way to migrate NC users to Cloudron while maintaining files, shares and access.

                                      All users that exist in LDAP are automatically migrated to OIDC when they log in for the first time with OIDC.
                                      They retain all files, shares, access, groups and so on.
                                      The reconfiguration part on the desktop client or mobile client part is only a login and everything else should stay the same.
                                      One exception for other clients explained further down.

                                      @overholt said in Nextcloud OIDC integration:

                                      Now I will have to explain to everyone why they need to go through that process all over again.

                                      I understand this is not optimal and the wish for a discussion first with the community is also very understandable.
                                      If you are looking for the argument for your company that just started using Nextcloud on Cloudron why this change is necessary?
                                      Answer with, Security and Usability.
                                      Usability might not be that obvious at first since the given task of migration at hand.

                                      OIDC Login enables 2FA authentication before the application.
                                      Plain vanilla LDAP has no concept of 2FA.
                                      So, with LDAP, users will have to maintain 2FA codes for every application.
                                      With OIDC, only one 2FA code is needed.

                                      Nextcloud specific security advancement with OIDC is that you need to create an app-password within Nextcloud for external clients like DAVx5 or other calendar apps.
                                      This reduces the risk of some random thrid party application leaking the user password.

                                      O 1 Reply Last reply
                                      4
                                      • jamesJ james

                                        Hello @overholt

                                        @overholt said in Nextcloud OIDC integration:

                                        It would have been nice to provide a way to migrate NC users to Cloudron while maintaining files, shares and access.

                                        All users that exist in LDAP are automatically migrated to OIDC when they log in for the first time with OIDC.
                                        They retain all files, shares, access, groups and so on.
                                        The reconfiguration part on the desktop client or mobile client part is only a login and everything else should stay the same.
                                        One exception for other clients explained further down.

                                        @overholt said in Nextcloud OIDC integration:

                                        Now I will have to explain to everyone why they need to go through that process all over again.

                                        I understand this is not optimal and the wish for a discussion first with the community is also very understandable.
                                        If you are looking for the argument for your company that just started using Nextcloud on Cloudron why this change is necessary?
                                        Answer with, Security and Usability.
                                        Usability might not be that obvious at first since the given task of migration at hand.

                                        OIDC Login enables 2FA authentication before the application.
                                        Plain vanilla LDAP has no concept of 2FA.
                                        So, with LDAP, users will have to maintain 2FA codes for every application.
                                        With OIDC, only one 2FA code is needed.

                                        Nextcloud specific security advancement with OIDC is that you need to create an app-password within Nextcloud for external clients like DAVx5 or other calendar apps.
                                        This reduces the risk of some random thrid party application leaking the user password.

                                        O Offline
                                        O Offline
                                        overholt
                                        wrote last edited by
                                        #114

                                        @james Thanks for the explanation. It does help. It sounds like the migration might be easier than I'm thinking. My worry is having to manually reconfigure shares, etc inside NextCloud for users.

                                        Just so I make sure I understand, is LDAP the default authentication protocol used when installing NextCloud on Cloudron and selecting "let application manage users?" I think I might be misunderstanding what LDAP is in relation to Cloudron and NextCloud. I might not even be using LDAP.

                                        jamesJ avatar1024A 2 Replies Last reply
                                        0
                                        • O overholt

                                          @james Thanks for the explanation. It does help. It sounds like the migration might be easier than I'm thinking. My worry is having to manually reconfigure shares, etc inside NextCloud for users.

                                          Just so I make sure I understand, is LDAP the default authentication protocol used when installing NextCloud on Cloudron and selecting "let application manage users?" I think I might be misunderstanding what LDAP is in relation to Cloudron and NextCloud. I might not even be using LDAP.

                                          jamesJ Offline
                                          jamesJ Offline
                                          james
                                          Staff
                                          wrote last edited by
                                          #115

                                          Hello @overholt
                                          No, when you choose "let application manage users" the app itself manages the users.
                                          If all your users truly only exist in Nextcloud and not in Cloudron this migration does not concern you at all.

                                          O 1 Reply Last reply
                                          2
                                          Reply
                                          • Reply as topic
                                          Log in to reply
                                          • Oldest to Newest
                                          • Newest to Oldest
                                          • Most Votes


                                          • Login

                                          • Don't have an account? Register

                                          • Login or register to search.
                                          • First post
                                            Last post
                                          0
                                          • Categories
                                          • Recent
                                          • Tags
                                          • Popular
                                          • Bookmarks
                                          • Search