| Both sides previous revision Previous revision | |
| en:2.0:single_sign_on:oidc_nextcloud [2026/09/10 14:21] – [Configuring the Service Provider (Nextcloud)] kainhofer | en:2.0:single_sign_on:oidc_nextcloud [2026/09/10 18:30] (current) – [Setting up the Client (SP) in Admidio] kainhofer |
|---|
| {{ :en:2.0:sso:sso_oidc_01-07_clientadmin.png?direct&400 |}} | {{ :en:2.0:sso:sso_oidc_01-07_clientadmin.png?direct&400 |}} |
| |
| | |
| | * Nextcloud's user_oidc plugin uses the Discovery URL (of the form ''https://[YOUR_ADMIDIO]/modules/sso/index.php/oidc/.well-known/openid-configuration'') from Admidio to configure most of the general OpenID Connect settings automatically. Copy the Discovery URL from the top of the OIDC client page in Admitio into NextCloud's "Discovery endoint" field. All other endpoints shown in Admidio's preferences screen are provided in the discovery document and don't need to be copied manually. |
| | {{ :en:2.0:sso:sso_nc_user_oidc_04a_pluginpage_discovery.png?direct&950 |}} |
| |
| * The **Client Name** is the label of the client in Admidio's client list, it can be anything you like. | * The **Client Name** is the label of the client in Admidio's client list, it can be anything you like. |
| * The **"Client ID"** and **"Client Secret"** in Admidio and Nextcloud have to match exactly. The ID is typically the client's URL, although some clients allow any unique identifier. The Client Secret should a random string and will serve like a password. Admidio will create one and allow it to be copied to the client. Afterwards it is only stored as a hash in the database and not be recovered any more. However, one can create a new Client Secret in Admidio and copy that to the client's configuration. | * The **"Client ID"** and **"Client Secret"** in Admidio and Nextcloud have to match exactly. The ID is typically the client's URL, although some clients allow any unique identifier. The Client Secret should be a random string and will serve like a password. Admidio will create one and allow it to be copied to the client. Afterwards it is only stored as a hash in the database and can not be recovered any more. However, one can always create a new Client Secret in Admidio and copy that to the client's configuration. |
| * Enter the **scopes** you desire in the Nextcloud config and make sure that Admidio's config matches it. At least **openid must be included** (Admidio will implicitly add it). If group support is desired, the "groups" scope must be included (and the corresponding groups claim mapped, and group support selected in the Nextcloud config). | |
| * In Admidio, choose which field should be sent to and used by the Nextcloud Plugin to uniquely identify users. This would typically be the login name, although the user ID or UUID area also possible. | |
| * Nextcloud will display its **Redirect URL** at the very top of the form, which needs to be copied to Admidio's OpenID client configuration. | * Nextcloud will display its **Redirect URL** at the very top of the form, which needs to be copied to Admidio's OpenID client configuration. |
| {{ :en:2.0:sso:sso_nc_user_oidc_05_configuration.png?direct&900 |}} | {{ :en:2.0:sso:sso_nc_user_oidc_05_configuration.png?direct&900 |}} |
| | |
| | * Enter the **scopes** you desire in the Nextcloud config and make sure that Admidio's config matches it. At least **openid must be included** (Admidio will implicitly add it). If group support is desired, the "groups" scope must be included (and the corresponding groups claim mapped, and group support selected in the Nextcloud config). |
| |
| * In addition, Nextcloud also provides settings to map OpenID claims (defined profile fields with a fixed name, defined in the OpenID standard) to the Nextcloud user's profile data. None of them are required, but they can be mapped, if profile information should be transferred from Admidio to Nextcloud: | * In addition, Nextcloud also provides settings to map OpenID claims (defined profile fields with a fixed name, defined in the OpenID standard) to the Nextcloud user's profile data. None of them are required, but they can be mapped, if profile information should be transferred from Admidio to Nextcloud: |
