Skip to main content
server.camp Docs
Toggle Dark/Light/Auto mode Toggle Dark/Light/Auto mode Toggle Dark/Light/Auto mode Back to homepage
  1. Documentation
  2. /
  3. Services
  4. /
  5. Nextcloud
  6. /
  7. SSO with Authentik

SSO with Authentik

Connect your managed Nextcloud at server.camp to Authentik so your team can sign in with their central Authentik account.

Prerequisites:

  • Managed Authentik at server.camp
  • Managed Nextcloud at server.camp
  • Admin access to both services

Step 1: Create a provider in Authentik

  1. In Authentik, open Applications → Providers
  2. Click “Create” → Type: OAuth2/OpenID Connect
  3. Fill in the fields:
    • Name: Nextcloud
    • Client Type: Confidential
    • Redirect URIs: https://your-nextcloud.srv.camp/apps/user_oidc/code
    • Signing Key: Select the default key (already available)
  4. Save — Authentik automatically generates a Client ID and Client Secret. You’ll need both in the next step.
Copy Client ID and Secret now
Open the provider you just created and copy Client ID and Client Secret into a text editor. You’ll need them shortly in Nextcloud.

Step 2: Create an application in Authentik

  1. Go to Applications → Applications → “Create”
  2. Fill in the fields:
    • Name: Nextcloud
    • Slug: nextcloud
    • Provider: select the Nextcloud provider you just created
  3. Optional: Under UI Settings, upload a Nextcloud logo and set the launch URL to https://your-nextcloud.srv.camp
  4. Save

Restrict access by group (recommended): Open the application → Policy / Group / User Bindings tab → “Create” → Group → select the group that should have access to Nextcloud (e.g. all-employees). Only members of that group will be able to sign in via Authentik.

Step 3: Find the Discovery URL

You’ll need this URL in Nextcloud:

https://your-authentik.srv.camp/application/o/nextcloud/.well-known/openid-configuration

Replace your-authentik.srv.camp with your actual Authentik address and nextcloud with the slug you set in Step 2.

Open the URL in a browser — if a JSON response appears, the URL is correct.

Step 4: Configure OpenID Connect in Nextcloud

  1. Sign in to Nextcloud as an admin
  2. Open Apps (the grid icon in the top right)
  3. Search for “OpenID Connect user backend” and install the app
  4. Navigate to Settings → Administration → OpenID Connect
  5. Click “Add provider” and fill in:
    • Identifier: authentik (any name, for display only)
    • Client ID: from Step 1
    • Client Secret: from Step 1
    • Discovery URL: from Step 3
  6. Save
User attribute mapping
Nextcloud uses the sub claim as the unique user ID by default. For a readable username, enable mapping to preferred_username in the provider settings. Authentik sends this value automatically.

Step 5: Test the login

  1. Sign out of Nextcloud
  2. The login page now shows a “Sign in with Authentik” button (or similar)
  3. Click it — you’ll be redirected to Authentik
  4. After authentication (and 2FA if enabled), the user lands back in Nextcloud
Test before switching over
Keep the standard Nextcloud login active while testing SSO. This lets you sign in with your admin account if the SSO configuration needs adjusting. Once everything works, disable local login under Settings → Administration → OpenID Connect.

Troubleshooting

“Redirect URI mismatch” — The redirect URI in Authentik doesn’t match what Nextcloud sends. Verify the URL matches exactly (including https:// and path): https://your-nextcloud.srv.camp/apps/user_oidc/code.

User signs in but lands in an empty account — This is expected on first login: Nextcloud creates a new account. Existing Nextcloud accounts are not automatically linked to Authentik accounts. Use the account migration feature in the user_oidc app under Settings → Administration → OpenID Connect → Link users to connect existing accounts.

SSO button not appearing — Check that the user_oidc app is enabled and that the Discovery URL is reachable in a browser.

Questions?

If you run into issues with SSO, reach out at support@server.camp.

gdoc_arrow_left_alt Getting Started Node-RED gdoc_arrow_right_alt