Nextcloud: sign in with ns8-idp #8262

Nextcloud users must type their password in the Nextcloud login page, even if they already signed in to other applications of the cluster. With single sign-on they can open Nextcloud without typing the password again.

Proposed solution

• In the Nextcloud application settings, select an OIDC provider among those available in the cluster (for example ns8-idp). The list is empty, and the option hidden, if no provider is installed.
• The administrator can decide not to use single sign-on, even if a provider is installed: the default is no provider, and users keep signing in with their password.
• When a provider is selected, the application registers its client with the register-client action and configures the Nextcloud user_oidc app with the returned client ID, secret and issuer.
• OIDC logins match existing Nextcloud users by user name (preferred_username claim): no duplicate accounts are created.
• Keep the configuration up to date when the provider changes its public host name (service-oidc-changed event), and remove it when the provider is removed.
• Desktop and mobile clients keep working: they use app passwords or the browser login flow.
• If the realm accepts only federated logins, send users straight to the provider, and document the emergency login path (/login?direct=1).

Alternative solutions

• Use the oidc_login community app instead of user_oidc: evaluate which one is better maintained and supports user matching by name.

Additional context

WebDAV, CalDAV and CardDAV keep using LDAP passwords or app passwords.

See also

• Parent: Single sign-on for applications with ns8-idp #8258
• Developer manual, Single sign-on: https://nethserver.github.io/ns8-core/core/user_domains/#single-sign-on
• https://github.com/NethServer/ns8-nextcloud