Trying to sync groups via OpenID to Nextcloud without rolemappings

Getting advice
1

Hi there, after a longer journey in the internet, I am starting to wonder whether it’s even possible to achieve group syncing without doing rolemappings first. This extra step makes Keycloak impossible to use for organizations that rotate a ton of groups regularely.

Now, perhaps it is a limitation of the plugin i found after all. I am trying to use GitHub - pulsejet/nextcloud-oidc-login: Nextcloud login via a single OpenID Connect 1.0 provider i am also aware of the Social Login alternative but last time I checked, it had trouble with newer Keycloak versions. I read that the official SAML one has a problem where only a single group is synced.

If it isn’t possible

…then i wonder if there could be a workaround, perhaps with a script running via cron? That would create assigned roles to groups, even tho that wouldn’t be very pretty.

It would be amazing if somebody had a helpful pointer for me. :slight_smile:

2

A bit late to the party I suppose.
But using GitHub - pulsejet/nextcloud-oidc-login: Nextcloud login via a single OpenID Connect 1.0 provider it appears that as long as the nextcloud instance has a group that matches the name in KeyCloak, it will sync the memberships dynamically.

I haven’t found a way for nextcloud to create the groups on-demand via whatever the user has assigned in KeyCloak.

However this works:
Create a group with a role mapping for the client, lets call the group “xyz”.
Then on the nextcloud instance run ‘cd /var/www/html && php occ group:add xyz’

After the user logs in with SSO, ‘cd /var/www/html && php occ group:list’ should list the following:

  - admin:
    - admin
  - xyz:
    - usernameA

Not sure how spot on this is to everyone’s needs, but works pretty reliably for smaller instances and with “Group folders” which was my main concern.

I suspect that this is the two lines that are important for us in this case: nextcloud-oidc-login/lib/Service/AttributeMap.php at ee5563c88a799f36849fbe1393cf0ce95de873d8 · pulsejet/nextcloud-oidc-login · GitHub