1

I've noticed that in some of the current versions of NextCloud that there is an admin menu option for adding Oauth 2.0 clients. Doing so gives you a Client ID and a Client Secret as you would expect as well as taking in a redirect URL. Now the question is, how do I use this. I have only found one single mention of it being used online, and that is this.

I currently am using the Oauth2 proxy from Bitly off of github which can be found here. My web server is Nginx and I am running NextCloud 12. I have another internal application that I host as well, this is run along side of an empty GitLab install and that GitLab install is being used as an Oauth 2 reverse proxy to authenticate through before getting to our internal software.

Any help or pointers would be great, this seems like a very powerful feature of NextCloud that has seemly zero support/docs.

To be a bit more specific I will try to better explain my current setup and what I would like it to look like.

Current:

I have 3 "subsites" if you will:

  • GitLab: www.site.com/subsiteA/
  • NextCloud: www.site.com/subsiteB/
  • InternalSite: www.site.com/subsiteC/

User goes to www.site.com/subsiteC and is bounced to the login of GitLab at www.site.com/subsiteA/. Upon successful login they are bounced back to www.site.com/subsiteC/.

Similarly if you go to www.site.com/subsiteB/ you are proxied through www.site.com/subsiteA/, however, the user will still have to sign in through NextCloud.

(Going to subsiteA takes you straight to GtiLab)

Ideal Setup:

  • NextCloud: www.site.com/subsiteA/
  • InternalSite: www.site.com/subsiteB/

If you go to www.site.com/subsiteB/ you are bounced through subsiteA but that is it. In this setup there is no need to login to GitLab before logging in to NextCloud.

Jake Hewitt
  • 31
  • 1
  • 5

1 Answers1

1

Nextcloud has added a section about OAuth2 to its documentation.

You will need various bits of information both about your client applications and about Nextcloud. Here are the most important bits about nextcloud:

  • Authorization endpoint: SERVER/apps/oauth2/authorize
  • Token endpoint: SERVER/apps/oauth2/api/v1/token
  • Profile URL can be accessed as JSON: SERVER/ocs/v2.php/cloud/user?format=json (example output)
  • Profile information is then stored in ocs.data.id, ocs.data.display-name, ocs.data.email and a few others.

I wrote two howtos:

Perhaps those are a good start for your configuration needs. If you encounter any other good tutorials, make sure to mention them in the comments!

amenthes
  • 115
  • 7