nextcloud/server

nextcloud as an single-sign-on (SSO) Backend

inos-github opened this issue · 9 comments

inos-github commented

What I am looking for is a way to use nextcloud as a SSO-Backend (little bit like github SSO) to authenticate users for another web-app. There are a lot of installations on hosted servers without the opportunity to install ldap or a similar service for SSO - authentication.

First of all, I am NOT a programmer so I might be totally wrong with my thoughts...

  • there should be Settings for admins (optionally group-admins) containing:
    • appURL (the URL to be called after authentication)
    • appKey
    • appSecret
    • option for setting a cookie if user is logged in already
  • there should be a nextcloud URL to be called with the hashed appKey as parameter
    • eg: https://my.cloud.com/auth?<hashed appKey salted with appSecret>
    • then the app should verify the calling domain and the appKey against the settings
    • a login screen should be provided
    • after successful login, the app sends back all information available for the user, loging in:
      • eg: ID, DisplayName, all Groups user is member, Mail, Language, TimeZone, ...
      • the answer should be hashed again using appSecret as salt
  • optionally: if the user is logged-in to nextcloud already, a cookie should be set and all the information passed without another authentication.

If all this (or a similar solution) exists already and I did not found it, please give me some hints how I can proceed.

Thank you for your great work!
Martin

coderkun commented

For OpenID Connect this would be an identity provider, right? Having an app in Nextcloud for this would be great!

  • 👍2
  • 🎉1
poVoq commented

A bit of a workaround, but this this you can use your Nextcloud db as a auth backend for SimpleSAMLphp (not really tested and experimental):
https://github.com/poVoq/simplesamlphp-module-sqlauthphppassword

hex-m commented

OpenID Connect (OIDC) is being worked on.

  • 👍3
  • 🎉1
  • 😕1
inos-github commented

OpenID Connect (OIDC) is being worked on.

sounds great - Thanks!

yrammos commented

OpenID Connect (OIDC) is being worked on.

Is it really? Am afraid not.

WoodpeckerBaby commented

keep alive

  • 👍3
tekhnee commented

Apparently it is being worked on indeed: https://apps.nextcloud.com/apps/user_oidc

LorbusChris commented

user_oidc is to use an OIDC server as user backend for nextcloud, not to use nextcloud as an OIDC backend.

However, as @Thesola10 mentioned in #8846 (comment),
https://apps.nextcloud.com/apps/solid looks like it could serve as an OIDC provider

fschrempf commented

I think this is out-of-scope for the Nextcloud server core, but it's already available as third-party app (https://github.com/H2CK/oidc).

  • 👍1