Nextcloud Integration through SAML

Overview

This document explains how to integrate Nextcloud (SP) with the RCDevs OpenOTP Identity Provider (IdP) using the User SAML application.
The integration enables Single Sign-On (SSO) for Nextcloud users, allowing authentication through the OpenOTP Authentication Server.

1. User is accessing SP for authentication
   https://nextcloud.rcdevsdocs.com/index.php
2. SP sends AuthnRequest to IdP published on the following URL (the URL and application path may change according your setup):
   https://sso.rcdevsdocs.com/openid/login_uid.php
3. IdP authenticates user
4. IdP sends SAML Response
5. SP (Nextcloud):
   Verifies signature
   Checks timestamps
   Confirms audience & recipient
   Extracts NameID & attributes
   Creates user if not exist (default yes)
6. User is logged in (using its WebADM admin credentials)

Prerequisites

• A functional RCDevs WebADM/OpenOTP setup with SAML service enabled.
• Administrative access to RCDevs WebADM/OpenOTP.
• Nextcloud Server to be installed
• Administrative access to Nextcloud Server.
• Installed and enabled User SAML app:
  https://apps.nextcloud.com/apps/user_saml

Note: To Install SSO & SAML Authentication mechanism in Nextcloud, log in as Nextcloud administrator, navigate to:
Settings → Apps → Integration → SAML authentication
and click Enable to activate the User SAML plugin.
If asked, choose Use built-in SAML authentication, click next and follow instructions displayed on screen
It will be enough to get SSO & SAML authentication support in Nextcloud

Configure SSO & SAML authentication in Nextcloud Server (SP configuration)

In Nextcloud, login as administrator and go to
Administration Settings → Security → SSO & SAML authentication
Ensure the User SAML app is enabled.
Use this direct link to access your Nextcloud Server instance.
https://nextcloud.rcdevsdocs.com/index.php/login?direct=1
Now we can start the proper configuration.
Go to SSO & SAML authentication and configure the following:

Global settings

Leave all settings unchecked

General

Note: Attribute to map the UID field value can be customized and refer to UserID Mapping setting in RCDevs IdP and it must match the configured value.

Use POST method for SAML request by default is unchecked but if needed, you can enable it.

Service Provider Data

• Click on Show Service provider Settings to expand the menu.
• Choose Name ID format to be Unspecified
• X.509 certificate of the Service Provider and Private key of the Service Provider are not mandatory. See hardening section for more information.
• Set Service Provider Entity ID (optional)
  https://nextcloud.rcdevsdocs.com
  Note: This value is sent in the SAML AuthnRequest in the saml:Issuer attribute. This value will be used later to match a Client Policy which will be created later in this documentation. It must be an URL! It cannot be just a hostname!

Identity Provider Data

Click on Show optional Identity Provider settings to expand the menu

Attribute Mapping

Click on Show attribute mapping settings to expand the menu

Security Settings

Click on Show security settings to expand the menu.
By default, all fields are not checked. Default settings:

The following settings are working without encryption:

User Filtering

No customization is required in this section.

Nextcloud configuration on the IdP (Client Policy)

Configure Client Policy

Add a specific policy that will be applied particularly to Nextcloud.
Go to Admin → Client Policies → Add Client.
Name the policy Nextcloud and click Proceed → Create Object.

Configure Policy Settings

In the client policy page which was created now, configure the following:

Scroll down to Default Application Settings, enable Application Settings, then click Edit.

A new page will be displayed. Here you have to alter settings in the two main sections:

MFA Authentication Server
and
OpenID & SAML Provider

In MFA Authentication Server → Authentication Policy define the authentication policies you want to apply for Nextcloud logins.

In OpenID & SAML Provider → SAML Settings →

In OpenID & SAML Provider → SAML & OpenID-Connect →

Click on Apply → and Apply again when redirected to the parent page, to save your settings and save your client policy.

Verification

1. Log out of Nextcloud.
2. Access your instance (e.g., https://nextcloud.rcdevsdocs.com).
3. You should be redirected to YOUR IdP login page RCDevs OpenOTP login.
4. Authenticate with your OpenOTP credentials or MFA.
5. Upon success, you are redirected back to Nextcloud as the authenticated user.

Hardening

In order to secure the access to Nextcloud server, we have to generate one pair of private/public key for Nexcloud service.
Note: You can generate a pair of certificates for your server by using WebAdm and accesing Admin → Create Server or Client Certificate section
Adjust depending your needs.

These certificates must be pasted in Identity Provider Data section in Nextcloud which was mentioned above.

Also, the Nextcloud X.509 Certificate of the Service Provider must be pasted in WebAdm

To do that, follow this path in WebAdm: Admin → Client Policies → Nextcloud
Click on Default application settings → Application Settings → Edit
click on OpenID & SAML Provider scroll down, check Peer Certificate and paste here the certificate from Nextcloud → Service Provider Data – X.509 certificate of the Service Provider

Now, we are ready to explore which WebAdm and Nextcloud security options are available.

for WebAdm settings, all are located in: Admin → Client Policies → Nextcloud
Click on Default application settings → Application Settings → Edit
click on OpenID & SAML Provider section
and
for Nextcloud settings, all are located in: Administration Settings → Security → SSO & SAML authentication → Security settings section

The following options have been tested and are supported by WebAdm:

Note: If Require Signed Request is set to No in WebAdm (default), by enforncing signed AuthnRequest on Nextcloud side, it will not break or reject anything! This confirms just that Nextcloud AuthnRequests are always signed, even if WebAdm does not enforce it, do not require it!

Note: Nextcloud (as SP) enforce that IdP (WebAdm) to sign entire SAML Response. This is not enabled by default in WebAdm, so set it as explained above.

Note: Nextcloud (as SP) enforce that IdP (WebAdm) to sign the saml:Assertion in SAML Response. This is default behavior in WebAdm, no action required.

Note: Nextcloud (acting as the SP) requires the IdP (WebADM) to sign the <saml:Assertion> element in the SAML Response. This is not the default behavior in WebADM, so make sure to enable it as described above.

Also, ensure that the public certificate is configured in the X.509 Certificate of the Service Provider section above and in WebADM. If this option is enabled but the Nextcloud public certificate is not configured on both sides, or if the certificate is missing, the SAML authentication will fail.

In fact, all options in Nextcloud - Security Settings - works with above settings in WebAdm, with two exceptions which are not supported:

• Indicates that the namelD of the samlp:logoutRequest sent by this SP will be encrypted.
• Indicates a requirement for the NamelD received by this SP to be encrypted.

Troubleshooting

• Invalid certificate: Ensure both SP and IdP certificates match and are valid.
• Looping redirect: Check Entity ID consistency between Nextcloud and WebADM.
• Attribute mismatch: Verify that NameID and user attributes correspond to those provided by the IdP.
• Turn on Debugging level in Nextclound by editing its config file config.php:
  For example, edit /var/www/html/nextcloud/config/config.php and set

'debug' => true,
'loglevel' => 0,

Review logs in data/nextcloud.log.

[root@nextcloud ~]# tail -f /var/www/html/nextcloud/data/nextcloud.log

• Advanced troubleshooting: Install SAML-tracer and inspect https dialog between SP and IdP
  https://addons.mozilla.org/en-US/firefox/addon/saml-tracer/
  https://chromewebstore.google.com/detail/saml-tracer/mpdajninpobndbfcldcmbpnnbhibjmch?hl=en
  https://support.esri.com/en-us/knowledge-base/user-a-saml-tracer-browser-extension-in-microsoft-edge--000033778

References

• Nextcloud SAML Plugin: https://apps.nextcloud.com/apps/user_saml
• SAML 2.0 Standard: https://docs.oasis-open.org/security/saml/v2.0/