I'm playing around with NextCloud and the first thing I would like to do is make it use my in-house, bespoke authentication system. It seems like the user_saml plugin might be the thing to mess with, since it uses the words "Authentication via Environment Variable" but I have no idea what it means by that. Ideally I'd have it just run a shell command for authentication, the way Qmail / Dovecot "passdb driver = checkpassword" works, since I already have that working for IMAP... But if instead I have to write some stupid XML endpoint, that's not out of the question.

Any clue where to start? When I mess around on the /settings/admin/saml page it does not seem to be even attempting to load the URLs I entered.

Update: I got it working! It was... a lot.

1. First activate the "External user authentication" app.
2. Note that it seems to be unmaintained and does not work, and apply this patch.
3. Create a "run a shell command" plugin for it. There's this thing which showed me how to do it, but that one passes passwords on the command line which is a WTF level of nope. So I wrote one that uses the Qmail / Dovecot "passdb checkpassword" protocol. It looks like this: ``` [ "pipe", "r" ]]; $env = [ 'SERVICE' => 'nextcloud', 'AUTH\_SERVICE' => 'nextcloud', 'REMOTE\_IP' => $\_SERVER['REMOTE\_ADDR'] ?? '', ]; $proc = proc\_open ($this->command, $desc, $pipes, null, $env); if (is\_resource ($proc)) { fwrite ($pipes[$fd], "$uid\000$password"); fclose ($pipes[$fd]); $ret = proc\_close ($proc); if ($ret === 0) { $this->storeUser ($uid); return $uid; } } return false; } } ``` 4. Then enable it by adding this to config/config.php: ``` 'user\_backends' => [ [ 'class' => '\OCA\UserExternal\Shell', 'arguments' => [ '/where/it/is/checkpassword true' ]]], ``` Super easy! Barely an inconvenience! Previously. ?>