# Nextcloud

> Integrate Nextcloud with Ironchip through OIDC: install the OpenID Connect user backend app, create the application in Ironchip, grant access and link it.

URL: https://docs.ironchip.com/en/identidad/integraciones/saas/nextcloud/

Ironchip acts as the OIDC provider for Nextcloud. Users sign in to Nextcloud from a button that redirects them to Ironchip to authenticate.

## Requirements

- Administrator access to the Ironchip admin console.
- Administrator privileges on the Nextcloud instance.
- Access to the file system of the Nextcloud server.

## Prepare Nextcloud

### Install the OpenID Connect app

1. Sign in to your Nextcloud instance.
2. Click your profile icon (top right corner) and select **Apps**.

   [Image: Nextcloud profile menu with the Apps option]

3. In the left side menu, select the **Integration** category.

   [Image: Integration category in the Nextcloud apps list]

4. Use the search (magnifying glass icon) to find the **OpenID Connect user backend** app.
5. Click **Download and enable**.

   [Image: OpenID Connect user backend app with the Download and enable button]

### Adjust the configuration file

Before continuing in the web interface, adjust the security and network settings of Nextcloud:

1. Find and edit the `config/config.php` file on your server.
2. Add or change these lines inside the configuration array:

   ```php title="config/config.php"
   'allow_local_remote_servers' => true,
   'debug' => true,
   ```

## Configure Ironchip

### Create the OIDC application

1. Sign in to the Ironchip admin console and go to **Applications** > **New Application**.

   [Image: New Application button in the Applications section of the Ironchip admin console]

2. Select the **OIDC** protocol.

   [Image: OIDC protocol selection]

3. On the **General** tab, enter a descriptive name in **Name** (for example, `Nextcloud Access`) and click **Add**.

   [Image: General tab of the OIDC service configuration with the Name field]

4. In **Redirect URIs**, enter the return URL of your server:

   ```text
   http://<YOUR_SERVER_IP_OR_DOMAIN>/apps/user_oidc/code
   ```

   For example: `http://my-domain/apps/user_oidc/code`.

5. Click **Save**. Store the generated **Client ID** and **Client Secret** in a safe place; you can also download them with **Download credentials**.

   [Image: Service created successfully summary with the Client ID, Client Secret, and Metadata URL]

### Authorize the users

Authorize which users can use this access method.

1. Open the application you just created.

   [Image: Newly created application in the applications list]

2. Click **Add Access**.

   [Image: Add Access button of the application]

3. In **Select a group**, search for and select the user who will authenticate. Click **Next**.

   [Image: User selection for the access]

4. In **Select usernames**, define how the access username is built. In this example, with the `email` tag, that is, the user's email address. Click **Next**.

   [Image: Select usernames step with the email tag as the username]

5. In **Select authentication policies**, choose the policy the user will authenticate with. In this example, **Any user devices**. Click **Next**.

   [Image: Select authentication policies step with the Any user devices policy]

6. In **Review**, check the configuration and click **Add**. The user's access is created.

   [Image: Review summary of the access with the user, the %email% template, and the Any user devices policy]

## Configure Nextcloud

1. Go back to Nextcloud, open your profile and select **Administration settings**.

   [Image: Profile menu with Administration settings]

2. In the left menu, open the **OpenID Connect** section.

   [Image: OpenID Connect section in the administration settings]

3. Under **Registered Providers**, click **+** to create a new registration. The **Register a new provider** dialog shows the return URL of your server, which must match the one you entered in **Redirect URIs** in Ironchip.

   [Image: Registered Providers section with the + button to create a new registration]

4. Fill in the fields:
   - **Identifier**: a display name (for example, `Ironchip Login`).
   - **Client ID**: paste the Client ID provided by Ironchip.
   - **Client secret**: paste the Client Secret provided by Ironchip.
   - **Discovery endpoint**: `https://idp.ironchip.com/oidc/.well-known/openid-configuration`.

   [Image: Provider form with the identifier, client ID, client secret and discovery endpoint]

5. Click **Submit**. Ironchip is now integrated into Nextcloud.

## Verify the integration

1. Sign out of your current Nextcloud session.
2. A new button appears on the sign-in screen: **Login with** followed by the identifier you chose (for example, **Login with Ironchip Login**).

   [Image: Nextcloud sign-in screen with the Ironchip button]

3. Click the button. Nextcloud redirects you to the Ironchip gateway to authenticate.

   [Image: Ironchip authentication gateway]

4. Complete the process on your device. Nextcloud automatically redirects you to its main dashboard.

   [Image: Nextcloud main dashboard after signing in]