Nextcloud SSO with Keycloak: Complete Setup Guide
Keycloak holds the accounts and checks every password; Nextcloud stops asking and trusts it. Four steps — a realm and a client in Keycloak, the OpenID Connect user backend app in Nextcloud, a user, and the first login.
Out of the box, Nextcloud keeps its own list of usernames and passwords. This guide takes that job away from it and gives it to Keycloak, so people sign in once, in one place, and Nextcloud simply trusts the answer.
The mental model worth holding on to: Keycloak is the security desk in a lobby. It is the only thing that ever checks anyone's ID. The applications upstairs stop asking for passwords and take the desk's word for it. Nextcloud is the first tenant; the same pattern points anything else you host at the same desk.
Verified against Keycloak 26, Nextcloud 30, and the OpenID Connect user backend app (user_oidc) 8.11. Keycloak's admin console was rewritten in version 19 and again in 26, so older guides describing an "Access Type" dropdown or a /auth path in the server URL no longer match what you will see.
What do you need before you start?
A running Keycloak server and a running Nextcloud, each reachable at its own address, and administrator access to both. Both should be served over HTTPS — user_oidc refuses to begin a login over plain HTTP and will show you "You must access Nextcloud with HTTPS to use OpenID Connect" instead of redirecting.
Throughout, replace https://id.example.com with your Keycloak address and https://cloud.example.com with your Nextcloud address.
Step 1: Create a realm and a client in Keycloak
A realm is a self-contained set of users, logins and applications. Keycloak can run several at once, completely separate from each other. There is one already, called master, and it holds the administrator account you log in with — your users do not belong in it. Open the realm selector at the top of the sidebar, choose Create realm, name it nextcloud, and create it.
Inside the new realm, open Clients and choose Create client. A client is an application allowed to ask Keycloak to log someone in. The Client ID is the name Nextcloud will give when it calls, so keep it simple and lowercase — nextcloud. You will type this exact word into Nextcloud later.
On the second page of the wizard, Capability config, turn on Client authentication. This is the setting people miss. Left off, Keycloak assumes anyone could be running the application — a phone app, a page of JavaScript — and never issues it a password of its own. Turned on, Keycloak treats Nextcloud as a real server it can hand a private secret to, and Nextcloud needs that secret. Standard flow is already enabled and should stay that way.
Why does the redirect URI break so many setups?
On the third page, Login settings, you fill in Valid redirect URIs. Here is what happens at login: Nextcloud sends the person over to Keycloak, they type their password there, and Keycloak sends them back. This field is the list of addresses Keycloak is permitted to send them back to, and anything not on the list it refuses.
It is not your Nextcloud home page. It is the specific page inside Nextcloud that catches people on the way in:
https://cloud.example.com/apps/user_oidc/codeGet one character wrong and the login fails at the very last moment — after the password has already been accepted — which makes it look like a password problem when it is not. If you are unsure, Nextcloud prints the exact URI it expects at the top of the provider form in Step 2; copy it from there.
Save the client, then open the Credentials tab. That tab only exists because you turned client authentication on. Copy the Client secret — it is Nextcloud's own password, proving to Keycloak that a request really came from Nextcloud and not from something that guessed the name. Treat it like any other password.
Step 2: Install the right Nextcloud app
Sign in to Nextcloud as an administrator and go to Apps → Integration. Seven apps in that list have "OpenID" or "OIDC" in the name and they do different jobs. The one you want is OpenID Connect user backend (user_oidc), maintained by Nextcloud itself.
Be careful here. OIDC Identity Provider does the opposite job — it turns Nextcloud into the thing that checks IDs, which is what Keycloak is for. "OpenID Connect Login", "OIDC connector" and "Social Login" are third-party alternatives that work differently. Older guides sometimes point at user_external with HTTP Basic Auth; that is not single sign-on at all — there is no redirect and no shared session, only a password being checked somewhere else.
Choose Download and enable. When it finishes, the button reads "Disable".
Step 3: Point Nextcloud at Keycloak
Go to Administration settings → OpenID Connect and choose Register new provider. Four fields matter:
- Identifier — a label only, but it becomes the wording on the login button, so use something people will recognise.
Keycloakis fine. - Client ID —
nextcloud. It must match Keycloak exactly. - Client secret — the value you copied from the Credentials tab.
- Discovery endpoint — one link that saves you typing six others. Nextcloud fetches it and reads the rest of Keycloak's addresses from it:
https://id.example.com/realms/nextcloud/.well-known/openid-configuration
Note there is no /auth in that URL. Keycloak dropped that prefix in version 17.
Why should you fix the usernames before anyone logs in?
Before you submit, open Extra attributes mapping. Two settings in here cannot be corrected afterwards, and this is the only moment you get them for free.
By default, Nextcloud names accounts with a 64-character hash — something like 0ee1dbc07129212b34ec50ef78719e07e62b88cf2c579b5ed3e7f2de403ab858 — while showing a normal display name. That string is what Nextcloud uses for the home folder on disk, in every share, and in every mention. It happens because Keycloak identifies people by a permanent random id rather than by their username, and Nextcloud then scrambles it again so two different providers can never collide. Two safe defaults, one unusable result.
- Turn off "Use unique user ID". The scrambling only earns its keep if you point Nextcloud at two login servers at once.
- Set User ID mapping to
preferred_username, so the account takes the name the person actually logs in with.
Then Submit. Nextcloud checks the discovery endpoint before it will save, so a wrong address or a Keycloak that is not running is caught here rather than at the first login.
This matters on day one because changing it later does not rename the accounts you already have — it orphans them. The old account keeps its old name, a new one is created alongside, and the files stay in the old one where the person cannot reach them.
Step 4: Create a user and sign in
Back in Keycloak, in the nextcloud realm, open Users and add one. Fill in the username, email and name — Nextcloud reads all three when it creates the account, and skipping them gives you an account with no name and no email on the other side.
Open the new user's Credentials tab and choose Set password. Turn Temporary off. Left on — which is the default — Keycloak will demand a password change the first time they sign in, in the middle of the Nextcloud login, on a page they were not expecting.
Now sign out of Nextcloud. The username and password boxes are still there, and they still work for local accounts, but underneath them is a new button: Log in with Keycloak. Click it and the page changes — you have left Nextcloud, and you are on Keycloak, at a different address. That is the only place a password is ever typed now.
Sign in, and you land back in Nextcloud, logged in. There was no Nextcloud account for that person a moment ago; it was created the instant Keycloak vouched for them. Check Administration settings → Users and you will see the account, with the display name and email carried across, the backend column showing it came from OpenID Connect — and a readable account name, because you set that in Step 3.
How do you get back in if Keycloak goes down?
The local password form stays on the login page, and your original Nextcloud admin account still works there. Keep that account: it is how you reach the settings when the login server is unavailable. If you later hide the password form, https://cloud.example.com/login?direct=1 brings it back.
Common problems
- "Invalid parameter: redirect_uri" — the address in Keycloak does not match. It must end in
/apps/user_oidc/code, and the scheme, host, port and path all have to match exactly. - "You must access Nextcloud with HTTPS to use OpenID Connect" —
user_oidcwill not start a login over plain HTTP. Put Nextcloud behind TLS. For a local test rig only, the app has its own escape hatch:occ config:app:set user_oidc allow_insecure_http --value=1 --type=boolean --lazy. - "The discovery endpoint is not reachable" on save — Nextcloud can usually reach it, but it refuses server-to-server requests into private address ranges by default. If Keycloak is on a private IP, set
allow_local_remote_serversto true inconfig.php. - Accounts named with a long hash — the two settings in "Why should you fix the usernames before anyone logs in?" were not set before the first login. Fixing them now only affects accounts created afterwards.
- Asked to change password during login — the Temporary switch was left on when the password was set.
What have you actually built?
Accounts live in Keycloak and only in Keycloak. Nextcloud never sees a password; it asks Keycloak and takes the answer. Someone added to the realm can sign in immediately, with no second account to create, and their username is readable everywhere it appears. The same client-and-secret pattern points anything else you host at the same desk — which is the real payoff, because the second application is far less work than the first.
Full video transcript
1
00:00:00,000 --> 00:00:03,523
Nextcloud keeps its own list
of usernames and passwords.
2
00:00:03,563 --> 00:00:08,740
We are going to take that job away from it
and give it to Keycloak, which is free,
3
00:00:08,780 --> 00:00:13,448
runs on your own server, and can do
the same for everything else you host.
4
00:00:13,488 --> 00:00:16,566
Picture Keycloak as the
security desk in a lobby:
5
00:00:16,606 --> 00:00:19,747
it is the only thing that
ever checks anyone's ID,
6
00:00:19,787 --> 00:00:21,910
and the apps upstairs stop asking.
7
00:00:21,950 --> 00:00:26,237
By the end of this, a new person
exists in one place, signs in once,
8
00:00:26,277 --> 00:00:28,250
and Nextcloud simply trusts it.
9
00:00:28,650 --> 00:00:33,781
Two things have to happen on the Keycloak
side. First, somewhere to keep your users.
10
00:00:33,821 --> 00:00:36,037
Then, an entry for Nextcloud itself.
11
00:00:36,337 --> 00:00:38,514
This is the Keycloak admin console.
12
00:00:38,554 --> 00:00:42,759
Keycloak can run several completely
separate sets of users at once,
13
00:00:42,799 --> 00:00:44,660
and it calls each one a realm.
14
00:00:44,700 --> 00:00:47,384
There is only one right
now, called master,
15
00:00:47,424 --> 00:00:51,249
and that one holds the admin
account you just logged in with.
16
00:00:51,289 --> 00:00:53,443
Your own users do not go in there.
17
00:00:53,830 --> 00:00:57,174
So make a second realm,
and name it nextcloud.
18
00:00:57,214 --> 00:01:02,103
This one is its own separate world
— its own users, its own logins,
19
00:01:02,143 --> 00:01:04,866
nothing shared with the master realm.
20
00:01:05,171 --> 00:01:11,322
There it is, and it is empty. No users,
no applications, nothing in it at all.
21
00:01:11,362 --> 00:01:16,679
Everything from here happens inside
this realm, not the master one.
22
00:01:17,047 --> 00:01:21,448
Now open Clients. That is
Keycloak's list of applications.
23
00:01:21,758 --> 00:01:23,698
The list is empty, so add one.
24
00:01:23,738 --> 00:01:29,044
This is where you write Nextcloud into
the book, so the desk recognises it later.
25
00:01:29,084 --> 00:01:34,258
The client ID is simply the name Nextcloud
gives when it calls. Type nextcloud.
26
00:01:34,298 --> 00:01:37,624
You will type this exact
word into Nextcloud later,
27
00:01:37,664 --> 00:01:40,304
so keep it simple and keep it lowercase.
28
00:01:40,608 --> 00:01:43,634
That is page one of three. Next.
29
00:01:43,941 --> 00:01:48,159
One switch on this page matters,
and it is client authentication.
30
00:01:48,199 --> 00:01:52,089
Off means Keycloak assumes anyone
could be running this app,
31
00:01:52,129 --> 00:01:54,971
so it never issues it
a password of its own.
32
00:01:55,011 --> 00:01:58,377
On means Keycloak treats
Nextcloud as a real server,
33
00:01:58,417 --> 00:02:00,473
and hands it a private password.
34
00:02:00,513 --> 00:02:03,593
Nextcloud needs that
password, so turn this on.
35
00:02:03,896 --> 00:02:05,963
Page two done. Next.
36
00:02:06,513 --> 00:02:09,073
This is the field that breaks most setups.
37
00:02:09,113 --> 00:02:12,230
Here is what actually
happens when someone logs in.
38
00:02:12,270 --> 00:02:16,563
Nextcloud sends them over to Keycloak,
they type their password there,
39
00:02:16,603 --> 00:02:18,358
and Keycloak sends them back.
40
00:02:18,398 --> 00:02:23,000
This box is the list of addresses
Keycloak is allowed to send them back to,
41
00:02:23,040 --> 00:02:25,476
and anything not on the list it refuses.
42
00:02:25,516 --> 00:02:27,147
So: your Nextcloud address,
43
00:02:27,187 --> 00:02:31,170
then the page inside Nextcloud
that catches people on the way in.
44
00:02:31,210 --> 00:02:35,379
Get one character wrong and the
login fails at the very last moment,
45
00:02:35,419 --> 00:02:37,522
after the password already worked.
46
00:02:37,859 --> 00:02:40,489
That is all three pages. Save.
47
00:02:42,110 --> 00:02:43,530
The client exists now.
48
00:02:43,570 --> 00:02:48,441
Open the Credentials tab — and notice
that tab was not there a moment ago.
49
00:02:48,481 --> 00:02:52,529
It only appeared because you
turned client authentication on.
50
00:02:52,832 --> 00:02:54,418
That is the client secret.
51
00:02:54,458 --> 00:02:56,357
It is Nextcloud's own password,
52
00:02:56,397 --> 00:03:01,486
how it proves to Keycloak that it really
is Nextcloud and not something pretending
53
00:03:01,526 --> 00:03:01,861
to be.
54
00:03:01,901 --> 00:03:03,300
Copy it somewhere safe.
55
00:03:03,340 --> 00:03:08,054
You will paste it into Nextcloud in the
next part, along with the client ID,
56
00:03:08,094 --> 00:03:11,347
and you treat it like a
password, because it is one.
57
00:03:12,334 --> 00:03:13,765
That is the desk set up.
58
00:03:13,805 --> 00:03:15,972
Keycloak now knows Nextcloud's name,
59
00:03:16,012 --> 00:03:19,221
the one address it is allowed
to send people back to,
60
00:03:19,261 --> 00:03:21,305
and the password it should expect.
61
00:03:21,345 --> 00:03:22,654
Next, the other half —
62
00:03:22,694 --> 00:03:27,291
telling Nextcloud to stop asking for
passwords and start trusting Keycloak.
63
00:03:27,891 --> 00:03:29,872
Keycloak is ready and waiting.
64
00:03:29,912 --> 00:03:32,635
Nextcloud does not know any of this yet —
65
00:03:32,675 --> 00:03:36,543
out of the box it has no idea
what OpenID Connect even is.
66
00:03:36,583 --> 00:03:38,133
That comes from an app.
67
00:03:38,433 --> 00:03:42,240
In Nextcloud, this is Apps, and
this is the Integration category.
68
00:03:42,280 --> 00:03:46,483
What you want is in here, and this
is where the first thing goes wrong.
69
00:03:46,797 --> 00:03:51,365
There are seven apps in this list
with OpenID or OIDC in the name,
70
00:03:51,405 --> 00:03:53,250
and they do different jobs.
71
00:03:53,290 --> 00:03:58,696
One of them, OIDC Identity Provider, does
the exact opposite of what we want —
72
00:03:58,736 --> 00:04:02,187
it turns Nextcloud into
the thing that checks IDs.
73
00:04:02,227 --> 00:04:04,631
We already have something for that.
74
00:04:04,671 --> 00:04:08,722
The one you want is this one:
OpenID Connect user backend.
75
00:04:09,027 --> 00:04:10,187
Download and enable.
76
00:04:10,227 --> 00:04:14,565
It is fetching it from the Nextcloud
app store, so give it a few seconds.
77
00:04:14,605 --> 00:04:19,423
This app is the piece that teaches Nextcloud
how to hand a login over to somebody
78
00:04:19,463 --> 00:04:23,801
else — without it, none of the settings
we are about to use exist at all.
79
00:04:23,841 --> 00:04:28,820
When it finishes, the button changes to
Disable, and that is how you know it is on.
80
00:04:29,186 --> 00:04:34,115
That adds a new page under Administration
settings, called OpenID Connect.
81
00:04:34,155 --> 00:04:35,901
Nothing is registered yet.
82
00:04:36,220 --> 00:04:37,422
Register a provider.
83
00:04:37,462 --> 00:04:41,584
A provider is just Nextcloud's word
for the thing that checks IDs —
84
00:04:41,624 --> 00:04:44,007
so this is where you describe Keycloak.
85
00:04:44,047 --> 00:04:47,091
Four boxes matter, and
you already have all four.
86
00:04:47,396 --> 00:04:49,196
The identifier is only a label.
87
00:04:49,236 --> 00:04:52,936
It is the wording on the button
people click on the login page,
88
00:04:52,976 --> 00:04:55,370
so make it something they will recognise.
89
00:04:55,410 --> 00:04:55,945
Keycloak.
90
00:04:56,251 --> 00:04:58,780
The discovery endpoint is the clever part.
91
00:04:58,820 --> 00:05:02,144
Rather than typing in six
different Keycloak addresses,
92
00:05:02,184 --> 00:05:05,752
you give Nextcloud one link
and it goes and reads the rest.
93
00:05:05,792 --> 00:05:09,911
It is your Keycloak address, then
slash realms, then the realm name,
94
00:05:09,951 --> 00:05:14,904
then a standard path that every one of
these servers publishes at the same place.
95
00:05:15,234 --> 00:05:19,129
The client ID is that word you
typed in Keycloak. Nextcloud.
96
00:05:19,169 --> 00:05:20,703
It has to match exactly,
97
00:05:20,743 --> 00:05:24,810
because it is how Keycloak knows
which of its entries this is.
98
00:05:25,115 --> 00:05:28,264
And the client secret, from the
Credentials tab a moment ago.
99
00:05:28,304 --> 00:05:32,656
This is the half of the pair that proves
the request is really coming from Nextcloud
100
00:05:32,696 --> 00:05:35,206
and not from somebody who
just guessed the name.
101
00:05:35,510 --> 00:05:38,504
Before you submit, open
Extra attributes mapping.
102
00:05:38,544 --> 00:05:42,343
There are two settings in here
that you want to get right now,
103
00:05:42,383 --> 00:05:47,090
while nobody has logged in yet, because
they cannot be corrected afterwards.
104
00:05:47,394 --> 00:05:50,401
The first is Use unique
user ID, and it is on.
105
00:05:50,441 --> 00:05:55,105
It scrambles every account name into
sixty-four characters of nonsense.
106
00:05:55,145 --> 00:06:00,471
It exists in case you ever point Nextcloud
at two different login servers at once
107
00:06:00,511 --> 00:06:02,988
and they hand you the same name twice.
108
00:06:03,028 --> 00:06:05,373
With one server it buys you nothing,
109
00:06:05,413 --> 00:06:10,607
and that name is what Nextcloud uses for
the folder on disk and in every share.
110
00:06:10,647 --> 00:06:11,442
Turn it off.
111
00:06:11,746 --> 00:06:13,593
The second is User ID mapping —
112
00:06:13,633 --> 00:06:17,733
which piece of information Nextcloud
should use as the account name.
113
00:06:17,773 --> 00:06:21,873
Left empty it uses the permanent
random id Keycloak gives everybody.
114
00:06:21,913 --> 00:06:26,804
Set it to preferred underscore username
and it uses the name they actually log in
115
00:06:26,844 --> 00:06:27,108
with.
116
00:06:27,148 --> 00:06:29,158
So Dana becomes dana, not a hash.
117
00:06:29,461 --> 00:06:31,613
That is everything. Submit.
118
00:06:34,255 --> 00:06:38,013
Registered, and Nextcloud
checked it before it would save —
119
00:06:38,053 --> 00:06:40,588
it went and fetched that discovery link.
120
00:06:40,628 --> 00:06:44,193
If the address were wrong, or
Keycloak were not running,
121
00:06:44,233 --> 00:06:49,215
you would have been told right here
instead of finding out at the first login.
122
00:06:49,255 --> 00:06:52,668
The Nextcloud side is done,
and it is done correctly.
123
00:06:53,672 --> 00:06:55,862
Both halves know about each other now,
124
00:06:55,902 --> 00:06:59,207
and the account names will
come out right the first time.
125
00:06:59,247 --> 00:07:01,653
What is missing is somebody to log in as.
126
00:07:02,253 --> 00:07:08,218
Everything so far has been plumbing between
two servers. Now for an actual person.
127
00:07:08,258 --> 00:07:12,579
From here on, accounts live in
Keycloak — not in Nextcloud.
128
00:07:12,879 --> 00:07:16,723
Back in Keycloak, in the
nextcloud realm, this is Users.
129
00:07:16,763 --> 00:07:21,827
Empty, because this realm is brand
new. This list is your staff list now.
130
00:07:22,165 --> 00:07:22,868
Add a user.
131
00:07:22,908 --> 00:07:26,581
The username is what they
will actually type to log in,
132
00:07:26,621 --> 00:07:29,214
so keep it short and keep it lowercase.
133
00:07:29,254 --> 00:07:29,591
Dana.
134
00:07:29,894 --> 00:07:32,231
Email and real name are worth filling in,
135
00:07:32,271 --> 00:07:36,231
because Nextcloud reads all three
of these when it makes the account.
136
00:07:36,271 --> 00:07:40,735
Skip them and you get an account with
no name and no email on the other side.
137
00:07:41,039 --> 00:07:42,076
Create.
138
00:07:45,323 --> 00:07:48,527
The user exists, but
there is no password yet.
139
00:07:48,567 --> 00:07:52,446
That is the Credentials tab,
and right now it is empty.
140
00:07:52,770 --> 00:07:54,098
Set password.
141
00:07:54,403 --> 00:07:55,259
Type it twice.
142
00:07:55,299 --> 00:07:58,266
This is the only password
Dana will ever need —
143
00:07:58,306 --> 00:08:03,360
the whole point of the exercise is that
she never has a separate Nextcloud one.
144
00:08:03,666 --> 00:08:04,612
Now this switch.
145
00:08:04,652 --> 00:08:08,803
Temporary is on by default, and it
is the thing that catches people.
146
00:08:08,843 --> 00:08:13,980
Leave it on and Keycloak will demand a new
password the very first time she signs in
147
00:08:14,020 --> 00:08:17,370
— which happens halfway
through logging into Nextcloud,
148
00:08:17,410 --> 00:08:19,342
on a page she was not expecting.
149
00:08:19,382 --> 00:08:20,121
Turn it off.
150
00:08:20,424 --> 00:08:25,773
Save, and Keycloak asks once
more to be sure. Save password.
151
00:08:26,740 --> 00:08:30,063
Dana exists, in Keycloak,
with a password that works.
152
00:08:30,103 --> 00:08:32,157
Nextcloud has never heard of her.
153
00:08:32,197 --> 00:08:35,940
Let us see what happens the
first time she tries to log in.
154
00:08:36,540 --> 00:08:39,810
This is the moment it either
works or it does not.
155
00:08:39,850 --> 00:08:44,351
Watch where the password gets typed,
because that is the whole idea.
156
00:08:44,651 --> 00:08:47,388
Here is the Nextcloud
login page, signed out.
157
00:08:47,428 --> 00:08:50,351
The username and password
boxes are still there,
158
00:08:50,391 --> 00:08:54,094
and they still work for local
accounts — that matters later.
159
00:08:54,439 --> 00:08:58,039
But there is something new
underneath. Login with Keycloak.
160
00:08:58,079 --> 00:09:01,741
That button appeared the moment
the provider was registered,
161
00:09:01,781 --> 00:09:04,743
and the wording is that
identifier you typed in.
162
00:09:05,048 --> 00:09:09,877
Click it, and look at what happens to
the page. You have left Nextcloud.
163
00:09:10,180 --> 00:09:14,371
This is Keycloak now, on a different
address and a different port.
164
00:09:14,411 --> 00:09:17,897
It says nextcloud at the top
because that is the realm,
165
00:09:17,937 --> 00:09:21,487
but the server asking for the
password is not Nextcloud.
166
00:09:21,527 --> 00:09:26,205
Nextcloud never sees it. This is the
only place a password is ever typed.
167
00:09:26,582 --> 00:09:30,975
So sign in as Dana, with the password
you set in Keycloak a moment ago.
168
00:09:31,015 --> 00:09:34,784
And watch what happens next,
because this is the whole trick.
169
00:09:34,824 --> 00:09:38,842
Keycloak checks the password,
decides she is who she says she is,
170
00:09:38,882 --> 00:09:43,088
and sends her back to Nextcloud
carrying a signed note that says so.
171
00:09:43,128 --> 00:09:45,648
Nextcloud reads the note and believes it.
172
00:09:45,688 --> 00:09:49,372
It never sees the password,
and it never gets a copy of it.
173
00:09:49,767 --> 00:09:53,060
And back to Nextcloud,
logged in, as Dana Reyes.
174
00:09:53,100 --> 00:09:55,560
That name came across from Keycloak.
175
00:09:55,600 --> 00:09:59,726
There was no Nextcloud account
for Dana thirty seconds ago —
176
00:09:59,766 --> 00:10:03,168
it made one the instant
Keycloak vouched for her.
177
00:10:03,530 --> 00:10:07,903
Now log back in as the administrator,
to see what that actually created.
178
00:10:10,064 --> 00:10:14,902
Here is the users list, and there is
the new account, alongside the admin.
179
00:10:15,509 --> 00:10:18,450
Display name Dana Reyes,
the email came across,
180
00:10:18,490 --> 00:10:23,334
the backend column says the account came
from OpenID Connect rather than from
181
00:10:23,374 --> 00:10:26,379
Nextcloud itself — and
the account name is dana.
182
00:10:26,419 --> 00:10:29,995
Readable, because you set that
before she ever logged in.
183
00:10:30,035 --> 00:10:32,065
That is the whole thing working.
184
00:10:32,972 --> 00:10:36,340
Dana is in, and she never
typed anything into Nextcloud.
185
00:10:36,380 --> 00:10:39,748
Her password went to Keycloak,
Keycloak vouched for her,
186
00:10:39,788 --> 00:10:43,400
and Nextcloud took its word for
it and built her an account.
187
00:10:43,440 --> 00:10:47,944
Everybody else you add from here gets
the same thing with no further work.
188
00:10:48,544 --> 00:10:51,589
Accounts live in Keycloak,
and only in Keycloak.
189
00:10:51,629 --> 00:10:56,216
Nextcloud never sees a password — it
asks Keycloak and takes the answer.
190
00:10:56,256 --> 00:10:59,943
A new person gets made once
and can sign in straight away,
191
00:10:59,983 --> 00:11:04,249
with no second account to create
and nothing to tidy up afterwards.
192
00:11:04,289 --> 00:11:09,558
The same client-and-secret pattern points
anything else you host at the same desk.
193
00:11:10,758 --> 00:11:14,641
The written version, with every
address and setting you can copy,
194
00:11:14,681 --> 00:11:16,391
is on securecloudstorage.com.
195
00:11:16,431 --> 00:11:18,060
Link is in the description.