Nextcloud external auth

These notes are designed to help with LDAP authentication for various packages, and were developed around the use of samba for the LDAP provider.

Nextcloud (without LDAP SSL)

Create service user in Samba (make sure it has a long password and never expires). These docs assume you name the user next.cloud Go to Nextcloud Admin -> LDAP/Ad integration Enter server IP of Samba server Enter the port as 389 Enter User DN as follows. Assumes your domain is something like yourdomain.local and that your primary user container is the default "users"

cn=next.cloud,cn=users,dc=yourdomain,dc=local

Enter the password for the next.cloud user Enter the Base DN(s) as needed. The basic one is

dc=yourdomain,dc=local

Click Test Base DN then Configuration OK should go green. If not check for typos and that your target Samba server has the workaround in its smb.conf as per Samba#Secure_LDAP_quick_workaround

Once it's gone green, move to the Users tab and select the groups that should be allowed to login to Nextcloud. The default catch-all for this is Domain Users

In the Login Attributes tab select appropriate attributes. LDAP/AD Username is a good default unless you need the differentiator of the email address (or something else that you'd build in Other Attributes).

The above should result in a working system where any active Samba user (in the right group) will be able to log in to Nextcloud without further intervention.

To do

• to check - how Nextcloud can retrieve the email address as part of the user attribute so that it's available for Nextcloud notifications
• to check - how to use Samba groups in Nextcloud

Nextcloud (with LDAP SSL)

If using LDAPS the configuration is similar with the above, only changes are:

• Put ldaps:// before the samba server ip.

• Use port 636.

• You have to copy the samba certificate to the Nextcloud server and specify the location of it in /etc/ldap/ldap.conf

Errors

If you get Could not detect user display name attribute. Please specify it yourself in advanced ldap settings. when using "Verify settings and count users" in the Users tab, or get something like LDAP Login: Could not get user object for DN cn=test-user,cn=users,dc=copajv,dc=local. Maybe the LDAP entry has no set display name attribute? in the logs, go to "Advanced" tab in "Directory Settings" section and change "User Display Name Field" from displayName to cn.