Skip to main content

Nextcloud

This guide explains how to set up single sign-on (SSO) between VaultysHub and Nextcloud using the Social Login plugin with OpenID Connect.

Prerequisites​

  • Nextcloud version 20 or higher
  • Administrator access to Nextcloud
  • Application configured in VaultysHub with OpenID Connect
  • Social Login plugin installed on Nextcloud

Installing the Social Login Plugin​

Via the Nextcloud Interface​

  1. Log in to Nextcloud as an administrator
  2. Go to Settings → Apps
  3. Search for "Social Login" in the Integration category
  4. Click on Download and enable

Via the Command Line​

cd /var/www/nextcloud
sudo -u www-data php occ app:install sociallogin
sudo -u www-data php occ app:enable sociallogin

Configuration in VaultysHub​

1. Create the Application​

  1. Log in to VaultysHub as an administrator
  2. Go to Applications → Add
  3. Search for "Nextcloud" or create a custom application
  4. Configure the basic information:
    • Name: Nextcloud
    • URL: https://your-nextcloud.example.com
    • Icon: Choose the Nextcloud icon

2. Configure OpenID Connect​

  1. In the Authentication tab of the application
  2. Select OpenID Connect as the authentication type
  3. Note the following information:
    • Client ID: nextcloud-xxxxxx
    • Client Secret: secret-xxxxxx
    • Issuer URL: https://your-vaultyshub.link.vaultys.org/api/oidc/[appid]
    • App ID: [appid] (unique identifier of the application in VaultysHub)

3. Configure the Redirect URLs​

In the Allowed Redirect URLs section, add:

https://your-nextcloud.example.com/apps/sociallogin/custom_oidc/vaultyshub

Note: The [appid] will be automatically generated when creating the application in VaultysHub.

4. Configure the Scopes​

Ensure that the following scopes are enabled:

  • openid
  • profile
  • email

Configuration in Nextcloud​

1. Access Social Login Settings​

  1. Log in to Nextcloud as an administrator
  2. Go to Settings → Administration → Social login

2. General Configuration​

In the General Settings section:

  • Allow self-registration: Enable if you want to automatically create accounts
  • Create a new account if it does not exist: Recommended
  • Update user profile on each login: To synchronize information
  • Disable Nextcloud authentication: Keep disabled to maintain local admin access
  • Allow login with email: To facilitate user access

Login Button: Log in with VaultysHub

3. Add a Custom OpenID Connect Provider​

Click on + Custom OpenID Connect and configure:

  • Internal Identifier: vaultyshub
  • Display Name: VaultysHub SSO
  • Authorization URL: https://your-vaultyshub.link.vaultys.org/api/oidc/[appid]/auth
  • Token URL: https://your-vaultyshub.link.vaultys.org/api/oidc/[appid]/token
  • User Info URL: https://your-vaultyshub.link.vaultys.org/api/oidc/[appid]/userinfo
  • Logout URL: https://your-vaultyshub.link.vaultys.org/api/oidc/[appid]/logout
  • Client ID: [Copy from VaultysHub]
  • Client Secret: [Copy from VaultysHub]
  • Scope: openid profile email

4. Attribute Mapping​

User field mapping configuration:

  • User Identifier: sub or email
  • Display Name: name
  • Email: email
  • Quota: Leave empty or configure according to your needs

5. Advanced Settings (Optional)​

  • Default Groups: Nextcloud groups assigned automatically
  • Button on the login page: Button style (0 = standard button)

Advanced Configuration​

Group Synchronization​

VaultysHub does not transmit user groups (no scope or claim groups). Nextcloud groups are managed directly in Nextcloud or assigned automatically via the Default Groups option of Social Login.

Automatic Provisioning with SCIM (Optional)​

For complete user and group provisioning, you can also configure SCIM:

  1. Install the User provisioning app on Nextcloud
  2. Configure SCIM in VaultysHub (see SCIM guide)
  3. SCIM URL Nextcloud: https://your-nextcloud.example.com/apps/scimserviceprovider

Configuration via Environment Variables​

For automated deployments, you can configure Social Login via config.php:

'sociallogin' => [
    'update_profile_on_login' => true,
    'providers' => [
        'vaultyshub' => [
            'displayName' => 'VaultysHub SSO',
            'apiBaseUrl' => 'https://your-vaultyshub.link.vaultys.org',
            'authorizeUrl' => 'https://your-vaultyshub.link.vaultys.org/api/oidc/[appid]/auth',
            'tokenUrl' => 'https://your-vaultyshub.link.vaultys.org/api/oidc/[appid]/token',
            'userInfoUrl' => 'https://your-vaultyshub.link.vaultys.org/api/oidc/[appid]/userinfo',
            'logoutUrl' => 'https://your-vaultyshub.link.vaultys.org/api/oidc/[appid]/logout',
            'clientId' => 'nextcloud-xxxxxx',
            'clientSecret' => 'secret-xxxxxx',
            'scope' => 'openid profile email',
            'userMapping' => [
                'id' => 'sub',
                'name' => 'name',
                'email' => 'email'
            ]
        ]
    ]
},

Alternative: Official Application user_oidc​

Nextcloud also publishes its own OpenID Connect application, user_oidc, configurable via the command line:

occ app:install user_oidc
occ user_oidc:provider VaultysHub \
  --clientid="[appid]" \
  --clientsecret="<secret client>" \
  --discoveryuri="https://your-vaultyshub.link.vaultys.org/api/oidc/[appid]/.well-known/openid-configuration" \
  --scope="openid email profile" \
  --mapping-uid=email --mapping-email=email --mapping-display-name=name \
  --unique-uid=0
  • Redirect URI to declare in VaultysHub: https://cloud.example.com/apps/user_oidc/code (or …/index.php/apps/user_oidc/code without URL rewriting).
  • user_oidc chooses client_secret_post when the provider offers it, which is the case with VaultysHub; it also sends a PKCE.
  • The login page displays Log in with VaultysHub.

Points of attention:

  • user_oidc refuses connections if Nextcloud is not served over HTTPS: “You must access Nextcloud with HTTPS to use OpenID Connect”. For testing in HTTP only: occ config:app:set --value=1 --type=boolean --lazy user_oidc allow_insecure_http.
  • “Could not reach the OpenID Connect provider” even though the server connects to VaultysHub: if VaultysHub has a private address, Nextcloud's HTTP client rejects it by default. Enable occ config:system:set allow_local_remote_servers --type=boolean --value=true.
  • With an internal certification authority: occ config:system:set user_oidc httpclient.allowselfsigned --type=boolean --value=true.

Testing the Configuration​

1. Login Test​

  1. Log out of Nextcloud
  2. On the login page, click on "Log in with VaultysHub"
  3. You should be redirected to VaultysHub
  4. Authenticate with your VaultysHub credentials
  5. You should be redirected back to Nextcloud and logged in automatically

2. User Information Verification​

  1. Go to Settings → Personal Information
  2. Check that the information is correctly synchronized:
    • Display name
    • Email address

3. Logout Test​

  1. Click on your profile → Logout
  2. Verify that you are also logged out of VaultysHub

Troubleshooting​

Error "Invalid redirect URI"​

Problem: The redirect URL is not correctly configured

Solution:

  1. Ensure that the URL in VaultysHub matches exactly: 
    https://your-nextcloud.example.com/apps/sociallogin/custom_oidc/vaultyshub
  2. Pay attention to the protocol (http vs https) and the trailing slash

Error "Invalid client credentials"​

Problem: The client credentials are incorrect

Solution:

  1. Check the Client ID and Client Secret in VaultysHub
  2. Ensure there are no extra spaces during copy-pasting
  3. Regenerate the secret if necessary

Groups are not synchronized​

Problem: VaultysHub groups do not appear in Nextcloud

Solution: this is the expected behavior. VaultysHub does not transmit groups: manage them directly in Nextcloud or use the Default Groups option of Social Login.

Error "Could not fetch user info"​

Problem: Nextcloud cannot retrieve user information

Solution:

  1. Check the UserInfo URL: https://your-vaultyshub.link.vaultys.org/api/oidc/[appid]/userinfo
  2. Test the endpoint with curl: 
    curl -H "Authorization: Bearer TOKEN" https://your-vaultyshub.link.vaultys.org/api/oidc/[appid]/userinfo
  3. Check VaultysHub logs for authorization errors

User created but unable to log in​

Problem: The account is created but the user cannot log back in

Solution:

  1. Check the user identifier mapping (using sub is recommended)
  2. Ensure that the identifier is unique and stable
  3. Check Nextcloud logs: 
    tail -f /var/www/nextcloud/data/nextcloud.log | grep sociallogin

Security​

Recommendations​

  1. HTTPS required: Always use HTTPS for Nextcloud and VaultysHub
  2. Secure secrets: Store the Client Secret securely
  3. IP restriction: If possible, limit access to OAuth endpoints by IP
  4. Secret rotation: Regularly change the Client Secret
  5. Audit logs: Enable and monitor authentication logs

Disable Local Authentication​

To enforce the use of SSO only:

  1. In Social Login, enable "Disable Nextcloud authentication"
  2. Caution: Always keep a local admin account for emergencies: 
    sudo -u www-data php occ user:add admin --password-from-env

Resources​