Documize Export

The advanced settings are runtime settings that customize the way CoreID functions. These settings have functional defaults, so change them at your own risk.

The settings are managed by super-users in the Settings page. The key is a string specifying the setting, and the value is the JSON string encoding the value. This might be an array, object, or raw value.

These settings deal with various aspects of the user registration process.

auth.allow_registration (default true)

This is a true/false value. If true, users are allowed to self-register. If false, the registration button and form are disabled.

auth.default_roles (default ["base_user"])

This is an array of strings. The strings in the array are a list of roles that are given to newly registered users. The base_user setting should always be present, as it allows the user to sign into the CoreID dashboard and manage their password settings.

Additional roles that can be included:

• ldap_admin - gives access to all LDAP resources
• ldap_client - gives access to bind and search LDAP resources
• saml_admin - gives access to all SAML resources
• root - gives super-user permissions

These settings deal with the public-facing homepage.

home.allow_landing (default true)

If false, the home/landing page will not be shown. Instead, users will be redirected to the dashboard.

home.redirect_authenticated (default true)

If true, authenticated users who browse to the home/landing page will be redirected to the dashboard.

Nextcloud is a self-hosted private cloud solution that, throught first- and third-party extensions, can provide file sync, calendar, contacts, task tracking, photos sync, and more. Because of its rich plugin ecosystem, Nextcloud supports a wide variety of authentication backends.

For our purposes, we'll be configuring Nextcloud to authenticate using SAML2, and setting up LDAP. The LDAP is necessary because the SAML2 plugin for Nextcloud requires the user information to be looked up from a different backend source. So, users will sign-in with SAML2 (meaning they see the familiar CoreID login flow), but Nextcloud will look up their information using LDAP.

Part 1: LDAP Setup

The first thing we need to do is create an LDAP authentication client and an application for our Nextcloud install in the CoreID dashboard. To do this, sign-in to CoreID as a super-user and take the following steps:

1. Navigate to the Applications interface and click the Setup Wizard button.
2. Using the setup wizard, fill in the name and identifier of your Nextcloud app. These can be anything you want, but the name will be shown to users so it's best to make it something sensible.
3. For the authentication type, choose "LDAP (BindDN or Simple)." You'll now be prompted to enter LDAP credentials. These are the credentials Nextcloud will use to look up users from the LDAP server.
4. After doing that, you'll land on the success page of the setup wizard. Leave this page open, or note its contents, as we'll be using some of the values provided here to configure Nextcloud.

Now, log into your Nextcloud instance as a user with administrative permissions. Then, use the following steps to set up Nextcloud to use the CoreID LDAP backend:

1. Click on your user icon in the top right, then click the "Apps" menu item. This will load the extensions interface.
2. Using the search bar at the top of the page, locate the "LDAP user and group backend" extension and enable it.
   1. If the enable button is not available, make sure you have the php-ldap extension installed and enabled.
3. Then, click your user icon in the top right, then click the "Settings" menu item.
4. Navigate to the "LDAP / AD integration" settings page under the "Administration" section of the sidebar.
   
   
5. On the "Server" tab, fill in the address of your CoreID instance, as well as its LDAP port. Then, enter the LDAP credentials you just created. The bind DN corresponds to the "Bind User DN" shown on the final page of the application setup wizard.
   
   
6. Now, navigate to the "Expert" tab. Since CoreID provides only a basic LDAP server implementation, we need to fill in some values here.
7. First, set the "Internal Username" field to "uid". This is what CoreID provides.
8. Also, override the "UUID Attribute for Users" and "UUID Attribute for Groups" to "uid" and "cn" respectively.
   
   
9. Navigate to the "Advanced" tab and expand the "Directory Settings" section. We'll fill in a few of these fields:
   
   
   
   1. User Display Name Field: gecos
   2. Base User Tree: ou=people,dc=example,dc=domain
      1. This corresponds to the "User search base" value displayed on the last page of the CoreID application setup wizard.
   3. Group Display Name Field: cn
   4. Base Group Tree: ou=groups,dc=example,dc=domain
      1. This corresponds to the "Group search base" value displayed on the last page of the CoreID application set wizard.
   5. Paging chunksize: 0
      1. This disables paging, which is not supported by CoreID
10. Now, navigate to the "Users" tab. Click the "Edit LDAP Query" button and fill in the LDAP filter for the CoreID application.
    
    
    
    This query corresponds to the "Search filter" displayed on the last page of the CoreID application setup wizard, however you should remove the "(uid=username_substituted_here)" clause.
11. Navigate to the "Login Attributes" tab and click the "Edit LDAP Query" button. Fill in the LDAP filter for the CoreID application.