File manager

File manager - Edit - /home/jardides/www/Cloud/core/doc/admin/configuration_server/sso_configuration.html

Back
<!DOCTYPE html> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>Configuring Single-Sign-On — Nextcloud 12 Server Administration Manual 12 documentation</title> <link rel="stylesheet" href="../_static/" type="text/css" /> <link rel="stylesheet" href="../_static/pygments.css" type="text/css" /> <link rel="stylesheet" href="../_static/main.min.css" type="text/css" /> <link rel="stylesheet" href="../_static/styles.css" type="text/css" /> <script type="text/javascript"> var DOCUMENTATION_OPTIONS = { URL_ROOT: '../', VERSION: '12', COLLAPSE_INDEX: false, FILE_SUFFIX: '.html', HAS_SOURCE: true }; </script> <script type="text/javascript" src="../_static/jquery.js"></script> <script type="text/javascript" src="../_static/underscore.js"></script> <script type="text/javascript" src="../_static/doctools.js"></script> <script type="text/javascript" src="../_static/js/jquery-1.11.0.min.js"></script> <script type="text/javascript" src="../_static/js/jquery-fix.js"></script> <script type="text/javascript" src="../_static/bootstrap-3.1.0/js/bootstrap.min.js"></script> <script type="text/javascript" src="../_static/bootstrap-sphinx.js"></script> <link rel="top" title="Nextcloud 12 Server Administration Manual 12 documentation" href="../contents.html" /> <link rel="up" title="Server Configuration" href="index.html" /> <link rel="next" title="Configuring Memory Caching" href="caching_configuration.html" /> <link rel="prev" title="Configuring the Activity App" href="activity_configuration.html" /> <meta charset='utf-8'> <meta http-equiv='X-UA-Compatible' content='IE=edge,chrome=1'> <meta name='viewport' content='width=device-width, initial-scale=1.0, maximum-scale=1'> <meta name="apple-mobile-web-app-capable" content="yes"> <meta name="theme-color" content="#1d2d44"> </head> <body role="document"> <div class="wrap container not-front"> <div class="content row"> <main class="main"> <div class="row page-content-header"> <div class="col-md-5 col-md-offset-7"> <form class="headersearch" style="margin-bottom:-3px;" action="../search.html" method="get"> <input type="text" value="" name="q" id="q" class="form-control" /> <button class="btn btn-default" type="submit" id="searchsubmit">Search</button> </form> </div> </div> <div class="row"> <div class="col-md-3"> <div class="sidebar"> <div class="menu-support-container"> <ul id="menu-support" class="menu"> <ul> <li><a href="../contents.html">Table of Contents</a></li> </ul> <ul class="current"> <li class="toctree-l1"><a class="reference internal" href="../index.html">Introduction</a></li> <li class="toctree-l1"><a class="reference internal" href="../release_notes.html">Release Notes</a></li> <li class="toctree-l1"><a class="reference internal" href="../installation/index.html">Installation</a></li> <li class="toctree-l1 current"><a class="reference internal" href="index.html">Server Configuration</a><ul class="current"> <li class="toctree-l2"><a class="reference internal" href="security_setup_warnings.html">Warnings on Admin Page</a></li> <li class="toctree-l2"><a class="reference internal" href="occ_command.html">Using the occ Command</a></li> <li class="toctree-l2"><a class="reference internal" href="activity_configuration.html">Configuring the Activity App</a></li> <li class="toctree-l2 current"><a class="current reference internal" href="">Configuring Single-Sign-On</a><ul> <li class="toctree-l3"><a class="reference internal" href="#enabling-the-sso-saml-app">Enabling the SSO & SAML app</a></li> <li class="toctree-l3"><a class="reference internal" href="#configuring-saml-2-0">Configuring SAML 2.0</a></li> <li class="toctree-l3"><a class="reference internal" href="#configuring-environment-based-authentication">Configuring environment based authentication</a></li> </ul> </li> <li class="toctree-l2"><a class="reference internal" href="caching_configuration.html">Configuring Memory Caching</a></li> <li class="toctree-l2"><a class="reference internal" href="background_jobs_configuration.html">Defining Background Jobs</a></li> <li class="toctree-l2"><a class="reference internal" href="config_sample_php_parameters.html">Config.php Parameters</a></li> <li class="toctree-l2"><a class="reference internal" href="email_configuration.html">Email Configuration</a></li> <li class="toctree-l2"><a class="reference internal" href="external_sites.html">Linking External Sites</a></li> <li class="toctree-l2"><a class="reference internal" href="custom_client_repos.html">Custom Client Download Repositories</a></li> <li class="toctree-l2"><a class="reference internal" href="knowledgebase_configuration.html">Knowledge Base Configuration</a></li> <li class="toctree-l2"><a class="reference internal" href="language_configuration.html">Language Configuration</a></li> <li class="toctree-l2"><a class="reference internal" href="logging_configuration.html">Logging Configuration</a></li> <li class="toctree-l2"><a class="reference internal" href="harden_server.html">Hardening and Security Guidance</a></li> <li class="toctree-l2"><a class="reference internal" href="reverse_proxy_configuration.html">Reverse Proxy Configuration</a></li> <li class="toctree-l2"><a class="reference internal" href="thirdparty_php_configuration.html">Using Third Party PHP Components</a></li> <li class="toctree-l2"><a class="reference internal" href="automatic_configuration.html">Automatic Configuration Setup</a></li> <li class="toctree-l2"><a class="reference internal" href="server_tuning.html">Server Tuning</a></li> <li class="toctree-l2"><a class="reference internal" href="theming.html">Theming</a></li> </ul> </li> <li class="toctree-l1"><a class="reference internal" href="../configuration_user/index.html">User Management</a></li> <li class="toctree-l1"><a class="reference internal" href="../configuration_files/index.html">File Sharing and Management</a></li> <li class="toctree-l1"><a class="reference internal" href="../file_workflows/index.html">File Workflows</a></li> <li class="toctree-l1"><a class="reference internal" href="../configuration_database/index.html">Database Configuration</a></li> <li class="toctree-l1"><a class="reference internal" href="../configuration_mimetypes/index.html">Mimetypes Management</a></li> <li class="toctree-l1"><a class="reference internal" href="../maintenance/index.html">Maintenance</a></li> <li class="toctree-l1"><a class="reference internal" href="../operations/index.html">Operations</a></li> <li class="toctree-l1"><a class="reference internal" href="../issues/index.html">Issues and Troubleshooting</a></li> </ul> </ul> </div> </div> </div> <div class="col-md-9"> <div class="page-content"> <ul class="prevnext-title list-unstyled list-inline"> <li class="prev"> <a href="activity_configuration.html" title="Previous Chapter: Configuring the Activity App"><span class="glyphicon glyphicon-chevron-left visible-sm"></span><span class="hidden-sm">« Configuring t...</span> </a> </li> <li class="next"> <a href="caching_configuration.html" title="Next Chapter: Configuring Memory Caching"><span class="glyphicon glyphicon-chevron-right visible-sm"></span><span class="hidden-sm">Configuring M... »</span> </a> </li> </ul> <div class="section" id="configuring-single-sign-on"> <h1>Configuring Single-Sign-On<a class="headerlink" href="#configuring-single-sign-on" title="Permalink to this headline">¶</a></h1> <p>Using the SSO & SAML app of your Nextcloud you can make it easily possible to integrate your existing Single-Sign-On solution with Nextcloud. In addition, you can use the Nextcloud LDAP user provider to keep the convenience for users. (e.g. when sharing)</p> <p>The following providers are supported and tested at the moment:</p> <ul> <li><dl class="first docutils"> <dt>SAML 2.0</dt> <dd><ul class="first last simple"> <li>OneLogin</li> <li>Shibboleth</li> <li>Active Directory Federation Services (ADFS)</li> </ul> </dd> </dl> </li> <li><dl class="first docutils"> <dt>Authentication via Environment Variable</dt> <dd><ul class="first last simple"> <li>Kerberos (mod_auth_kerb)</li> <li>Any other provider that authenticates using the environment variable</li> </ul> </dd> </dl> </li> </ul> <p>While theoretically any other authentication provider implementing either one of those standards is compatible, we like to note that they are not part of any internal test matrix.</p> <div class="section" id="enabling-the-sso-saml-app"> <h2>Enabling the SSO & SAML app<a class="headerlink" href="#enabling-the-sso-saml-app" title="Permalink to this headline">¶</a></h2> <div class="admonition warning"> <p class="first admonition-title">Warning</p> <p class="last">Make sure to configure an administrative user that can access the instance via SSO. Logging-in with your regular Nextcloud account won’t be possible anymore.</p> </div> <p>The “SSO & SAML” App is shipped and disabled by default. To enable the app enabled simply go to your Nextcloud Apps page to enable it. It can then be found in the “SSO & SAML authentication” section of your Nextcloud.</p> </div> <div class="section" id="configuring-saml-2-0"> <h2>Configuring SAML 2.0<a class="headerlink" href="#configuring-saml-2-0" title="Permalink to this headline">¶</a></h2> <p>To configure using SAML choose the “SAML authentication” in the setup wizard of the application. Then configure the application as required by your Service Provider.</p> <blockquote> <div><div class="figure"> <img alt="../_images/saml_app_overview.png" src="../_images/saml_app_overview.png" /> </div> </div></blockquote> </div> <div class="section" id="configuring-environment-based-authentication"> <h2>Configuring environment based authentication<a class="headerlink" href="#configuring-environment-based-authentication" title="Permalink to this headline">¶</a></h2> <p>It is possible to authenticate against Nextcloud using an environment variable. This is for example relevant in case you use an service provider incompatible with SAML such as Kerberos or don’t want to configure SAML in the software yourself.</p> <p>To enable that choose the “Environment variable” authentication provider in the application and then specify the environment variable. (e.g. <cite>REMOTE_USER</cite> for Kerberos)</p> <p>Once done you also need to protect the login route properly. On an Apache server with mod_auth_kerb the following configuration would protect the login route:</p> <div class="highlight-apache"><div class="highlight"><pre><span class="nt"><Location</span> <span class="s">"/index.php/login"</span><span class="nt">></span> <span class="nb">AuthType</span> Kerberos <span class="nb">AuthName</span> <span class="s2">"Kerberos Login"</span> <span class="nb">KrbServiceName</span> HTTP <span class="nb">KrbMethodNegotiate</span> <span class="k">On</span> <span class="nb">KrbMethodK5Passwd</span> <span class="k">Off</span> <span class="nb">KrbSaveCredentials</span> <span class="k">Off</span> <span class="nb">KrbVerifyKDC</span> <span class="k">On</span> <span class="nb">KrbAuthRealms</span> NEXTCLOUD-AD.LOCAL <span class="nb">Krb5KeyTab</span> <span class="sx">/etc/apache2/webpage.HTTP.keytab</span> <span class="nb">Require</span> valid-user <span class="nt"></Location></span> </pre></div> </div> <div class="admonition warning"> <p class="first admonition-title">Warning</p> <p class="last">If this authentication approach is used clients do require an application specific password for authentication. A better integration into our desktop and mobile clients is considered for the future though.</p> </div> </div> </div> <ul class="prevnext-title list-unstyled list-inline"> <li class="prev"> <a href="activity_configuration.html" title="Previous Chapter: Configuring the Activity App"><span class="glyphicon glyphicon-chevron-left visible-sm"></span><span class="hidden-sm">« Configuring t...</span> </a> </li> <li class="next"> <a href="caching_configuration.html" title="Next Chapter: Configuring Memory Caching"><span class="glyphicon glyphicon-chevron-right visible-sm"></span><span class="hidden-sm">Configuring M... »</span> </a> </li> </ul> </div> </div> </div> </main> </div> </div> </body> </html>

| ver. 1.4 | Github | . | PHP 7.4.33 | Generation time: 0.01 | proxy | phpinfo | Settings