Andrew Hofmans

Nextcloud SSO with Keycloak

This documents how I configured Nextcloud to use Single Sign-on leveraging Keycloak as the identity provider. There is official documentation for a Nextcloud-Keycloak integration, but it is behind Nextcloud's paywall.... I found several other guides, some directly conflicting with each other, but piecing them together has produced a working solution.

On to getting things working:

Nextcloud configuration

Global Settings

First, ensure that you do not lock yourself out of your Nextcloud instance while configuring SSO! Set the "Global Settings" to allow multiple back-ends.

Global

Service Provider Data

Provide a certificate for request signing. This is not publicly seen; it is only used between Nextcloud and Keycloak. I opted for a self-signed x.509 certificate. It will be imported to Keycloak as part of the metadata XML so trust will not be an issue. Fill in the certificate request using whatever information you wish.

openssl req  -nodes -new -x509  -keyout private.key -out public.cert

In the Service Provider Data section enter the public certificate and the private key in the corresponding text blocks. It should look like this:

Service

Identity Provider Data

In the Identity Provider section enter in your Keycloak settings. The format is

https://<your domain name here>/auth/realms/<your realm name here>

The last text entry is the RSA public key from your Keycloak server. This is found in the Master realm --> Realm Settings --> Keys https:///auth/admin/master/console/#/realms/master/keys

Identity

Attribute mapping

I did not do any special Attribute mapping.

Security settings

Check the boxes to make it look like this:

Security

Export XML

With the Nextcloud configuration complete you should have a gray indication "Metadata valid" next to the "Download metadata XML" button. Download the XML file so that you can import it into Keycloak.

Keycloak configuration

In Keycloak create a new client and choose to import a file. Upload the previously downloaded medata.xml and click ok.

Then go to the Mappers tab. If you do not need the role mapping, just delete it. I don't use it yet but I might look at this again in the future.

Then create a new Mappers:

Username
name: username
mapper type: user property
property: username
SAML attribute name: username
SAML attribute NameFormat: basic

Email
name: email
mapper type: user property
property: email
SAML attribute name: email
SAML attribute NameFormat: basic

Roles
name: Roles
mapper type: Role List
Role attribute name: Roles
Friendly name: roles
SAML Attribute NameFormat: Basic
Single Role Attribute: On

After the mappers are created and the client is saved, all Keycloak configuration is done. Open a new browser/Private Window and try to login to your Nextcloud account. If it doesn't work, check out the Nextcloud log file and the Keycloak log to determine where the breakdown is happening.

Other articles

Mirrored Ports with Open vSwitch

Published: Wed 15 April 2020
By Andrew Hofmans

In How-To.

tags: bash server proxmox

After adding some new SSD storage to my home server I had purged a lot of the older VMs that I didn't use frequently in my previous 'Spring Cleaning' effort to make space. One of the VMs that I had purged but now wanted to get back online and running …
read more
Access Git repo over SSH behind jumpbox

Published: Mon 13 January 2020
By Andrew Hofmans

In How-To.

tags: bash git server ssh

I recently ran accross the situation where I wanted to push changes to a repo that was stored on my personal Gitlab server. The issue was that I had recently restructured my homelab and the only way to get to the gitlab server via SSH was through a jumpbox. These …
read more
Install RDP on Debian 10 (Buster)
Published: Thu 09 January 2020
By Andrew Hofmans

In How-To.

tags: bash debian server

Start off with a freshly updated system and install the requirements:
```
apt update
apt upgrade
apt install -y xrdp xfce4 xfce4-terminal gnome-icon-theme-full tango-icon-theme
```
Make xfce4 our default xsession:
```
echo xfce4-session >~/.xsession
```
Make xfce4 the default for by editting the following file: :::bash nano /etc/xrdp/startwm.sh

Replace what is …
read more
Mesowx Real Time Weather Graphing

Published: Sun 23 April 2017
By Andrew Hofmans

In How-To.

tags: bash mysql server weewx mesowx

To start off this tutorial it is assumed that you have Weewx completely set up on another server with the weather station properly connected and reporting. This tutorial will be using a Master / Slave MYSQL database that is configured like my previous blog entry.

The purpose adding Mesowx into the …
read more
MYSQL Master Slave Replication over SSH tunnel
Published: Sat 22 April 2017
By Andrew Hofmans

In How-To.

tags: bash mysql server

The purpose of running having a master / slave relationship between your databases is that the slave database will be an exact replica of the specified master database. The purpose of running the connection through a SSH tunnel is to ensure:
1. Connection is encrypted
2. MYSQL server will only connect to the …
read more
Repair MYSQL Master Slave Replication

Published: Sat 21 January 2017
By Andrew Hofmans

In How-To.

tags: bash mysql server

One of the interesting parts of living on a boat is probably something that most people never think of dealing with. Power Management! Since we only have 30 amps of power available to draw at any one time we have to be quite careful on what is running. On those …
read more
Raspberry Pi WS-2080 Weather Station

Published: Mon 25 April 2016
By Andrew Hofmans

In How-To.

tags: raspberry pi bash server linux Weewx

After surviving a windstorm that produced 40-60 mph winds on the boat I decided that I wanted a weather station to capture that data! The closest anemometer was very far away and definitely was not subjected to the same winds that I had in my marina. The following post is …
read more