| Both sides previous revision Previous revision Next revision | Previous revision |
| en:2.0:single_sign_on:saml_nextcloud [2026/09/03 23:20] – [TL;DR; - Quick Overview] kainhofer | en:2.0:single_sign_on:saml_nextcloud [2026/09/05 00:29] (current) – [Prerequisites] kainhofer |
|---|
| Throughout the document we will assume you have both Admidio and Nextcloud already set up properly at https://admidio.local/ and https://nextcloud.local/. Please modify these URLs to your actual installation. | Throughout the document we will assume you have both Admidio and Nextcloud already set up properly at https://admidio.local/ and https://nextcloud.local/. Please modify these URLs to your actual installation. |
| | |
| As a first step, one needs to **configure Admidio to act as an SAML 2.0 Identity Provider** (IdP). This has to be done once and is not specific to Nextcloud. Please follow this guide: [[en:2.0:single_sign_on|#a_basic_setup_for_admidio_as_a_saml_id_provider]] | |
| | As a first step, one needs to **configure Admidio to act as an SAML 2.0 Identity Provider** (IdP). This has to be done once and is not specific to Nextcloud. Please [[en:2.0:single_sign_on#a_basic_setup_for_admidio_as_a_saml_id_provider|follow this guide]]. |
| {{ :en:2.0:sso:sso_saml_01-05_setup_admidio_preferences.png?direct&600 |}} | {{ :en:2.0:sso:sso_saml_01-05_setup_admidio_preferences.png?direct&600 |}} |
| |
| Basically, one (1) needs to enable SAML 2.0 and **choose a unique EntityID**. | Basically, one needs to enable SAML 2.0 and **choose a unique EntityID**. |
| The page https://admidio.local/adm_program/modules/preferences.php?panel=sso provides the link to the metadata xml, and the individual settings in case a client does not support auto-configuration via metadata. | The page https://admidio.local/adm_program/modules/preferences.php?panel=sso provides the link to the metadata xml, and the individual settings in case a client does not support auto-configuration via metadata. |
| |
| ===== Quick Overview ===== | ===== Quick Overview ===== |
| |
| Setting up a client (SAML "Service Provider" = "SP") to use Admidio's user accounts for log-in consists of two steps. If both the IdP (Admidio in our case) and the SP (Nextcloud in this document) support metadata loading, the setup is very straightforward and easy. Otherwise, one has to copy URLs manually to the client, but Admidio already provides these in a single place, so this situation is not as bad, either. | Setting up a client (SAML "Service Provider" = "SP") to use Admidio's user accounts for log-in consists of two steps. If both the IdP (Admidio in our case) and the SP (Nextcloud in this document) support metadata loading, the setup is very straightforward and easy. Otherwise, one has to copy URLs manually to the client, but Admidio already provides these in a single place, so this case is also straightforward. |
| |
| * At the **Service Provider (SP)** - Nextcloud in our case - **install the extension** to support SAML login. | * At the **Service Provider (SP)** - Nextcloud in our case - **install the extension** to support SAML login. |
| |
| Paste the metadata URL copied from Nextcloud into the corresponding input field at the top and click "Load Client Metadata". This should load all settings from Nextcloud and pre-fill the following fields correctly. Only the Client Name needs to be entered. Choose any name to clearly identify the client in the list of SAML clients. There is no functionality depending on the name. | Paste the metadata URL copied from Nextcloud into the corresponding input field at the top and click "Load Client Metadata". This should load all settings from Nextcloud and pre-fill the following fields correctly. Only the Client Name needs to be entered. Choose any name to clearly identify the client in the list of SAML clients. There is no functionality depending on the name. |
| {{ :en:2.0:sso:sso_saml_02-05_nc_admidio_clientsetup1.png?direct&600 |}} | |
| | {{:en:2.0:sso:sso_saml_02-05_nc_admidio_clientsetup1.png?direct&600|}} {{:en:2.0:sso:sso_saml_02-05_nc_admidio_clientsetup1b.png?direct&600|}} |
| |
| |
| In addition to the Entity ID and URLs to connect SP and IdP and the certificate, which are configured automatically, one also needs to define the attribute and role mapping. The username is the most relevant. To use Admidio's group memberships as Nextcloud groups, make sure to include the "Roles" field and provide the correct field name in Nextcloud. Internally, Nextcloud will add a prefix to the role names, which makes it impossible to assign admin rights to SAML groups (Nextcloud uses the group with internal name "admin" for administrators). If you want to assign admin rights through SAML, too, then you must enter a single space into the prefix field. This causes Nextcloud to take the role names verbatim as Nextcloud group names, including "admin". | In addition to the Entity ID and URLs to connect SP and IdP and the certificate, which are configured automatically, one also needs to define the attribute and role mapping. The username is the most relevant. To use Admidio's group memberships as Nextcloud groups, make sure to include the "Roles" field and provide the correct field name in Nextcloud. Internally, Nextcloud will add a prefix to the role names, which makes it impossible to assign admin rights to SAML groups (Nextcloud uses the group with internal name "admin" for administrators). If you want to assign admin rights through SAML, too, then you must enter a single space into the prefix field. This causes Nextcloud to take the role names verbatim as Nextcloud group names, including "admin". |
| |
| {{ :en:2.0:sso:sso_saml_02-06_nc_admidio_clientsetup1.png?direct&900 |}} | {{ :en:2.0:sso:sso_saml_02-06_nc_admidio_clientsetup1.png?direct&1100 |}} |
| |
| |
| The Nextclout SAML configuration also provides settings to choose whether its requests sent to admidio should be signed (a crypto key needs to be set as described above!), and whether all received responses and asserts are expected to be signed or encrypted. You can choose the security level that you desire, but you need to make sure that the settings in Admidio and Nextcloud are consistent, otherwise login will not be possible (e.g. if Wordpress is configured to require signatures on all asserts and responses received, while Admidio is configured not to sign them). | The Nextclout SAML configuration also provides settings to choose whether its requests sent to admidio should be signed (a crypto key needs to be set as described above!), and whether all received responses and asserts are expected to be signed or encrypted. You can choose the security level that you desire, but you need to make sure that the settings in Admidio and Nextcloud are consistent, otherwise login will not be possible (e.g. if Wordpress is configured to require signatures on all asserts and responses received, while Admidio is configured not to sign them). |
| |
| {{ :en:2.0:sso:sso_saml_02-07_nc_admidio_clientsetup3.png?direct&900 |}} | {{ :en:2.0:sso:sso_saml_02-07_nc_admidio_clientsetup3.png?direct&1100 |}} |
| |
| |
