Using multiple user backends¶

It is possible to use multiple user backends (or user directories or identity providers) in Nextcloud.

For example, LDAP (via the user_ldap app) can be used with SAML (via the user_saml app) and with OpenID connect (via the user_oidc app).

LDAP¶

If user_ldap is configured to use an LDAP/AD directory, the related users can login via the direct login form. This user backend takes care of synchronizing the users so they will exist even before their first login.

SAML¶

user_saml can be used with other user backends as long as the "Allow the use of multiple user back-ends (e.g. LDAP)" checkbox is ticked in the SAML admin settings. In that case, Nextcloud will still lead unauthenticated users to the classic login page in which there will be an extra button to sign in through SAML.

This user backend can take care of the user provisioning or rely on the existing users in Nextcloud (those provisioned by user_ldap for example).

Oidc¶

user_oidc can also be used with other user backends. You need to make sure the "allow_multiple_user_backends" user_oidc app config is enabled (it is enabled by default).

You can check the state of this config value with:

php occ config:app:get user_oidc allow_multiple_user_backends

If this command returns an empty value or 1, this setting is enabled. If 0 is returned, it is disabled.

You can set this config value with:

php occ config:app:set --value=0 user_oidc allow_multiple_user_backends

This user backend is flexible in terms of user provisioning. It can be set to provision the users when they first log in. It can be set to only rely on users already existing in Nextcloud. More details in https://github.com/nextcloud/user_oidc/#4-provisioning-scenarios

There also is a pre-provisioning API to create users in the user_oidc backend before their first login. https://github.com/nextcloud/user_oidc/#pre-provisioning