Technical Tip: How to configure Nextcloud and FortiAuthenticator for OpenID Connect (OIDC) authentication

[kiri]

Description	This article describes how to configure Nextcloud and FortiAuthenticator for OpenID Connect (OIDC) authentication
Scope	FortiTrust Identity and FortiAuthenticator v6.5, v6.6.
Solution	This has been tested with the following versions: FortiTrust Identity 6.6.1. Nextcloud Hub 8 (29.0.3). OpenID Connect user backend v5.0.3. FortiAuthenticator: See this section of the documentation for info about OIDC limitations with FortiAuthenticator. Create/import users, and add them to some group. Define a realm with the user base. Define a portal with the realm. Define a policy with the portal. Define scopes and claims. Start defining a relying party, copy Redirect URIs from step 8, and Save. https://<NEXTCLOUDFQDN>/apps/user_oidc/code Nextcloud: Install OpenID and connect to the user backend. Register a new provider: Copy Client ID and Client secret from step 6. Set the discovery endpoint to: https://<FACFQDN>/api/v1/oauth/.well-known/oauth-authorization-server/  See the documentation. Authentication and Access control Settings, disable Use unique user id, Enable Use group provisioning. Match the scopes and claims from step 5, Submit. Logout and test oidc login. Select the OIDC login button at the bottom of the page. Input credentials on the FortiAuthenticator login dialog box and select Authorize. The account was provisioned on Nextcloud, along with the groups the user is a member of, and logged in. FortiAuthenticator login event: Log Record Detail ID 7129 Timestamp Mon Jul 22 16:14:31 2024 Level information Action Status Source IP Message Successful OAuth login User testuser Log Type Type Id 20000 Name Authentication OK Sub Category Authentication Category Event Description Authentication successful (general)