--- title: OAuth login via ChurchTools on Nextcloud description: This tutorial explains how to configure your own Nextcloud so that you can log in to Nextcloud with your ChurchTools login as an OAuth server. Group and, if desired, group role information will be transferred. You can use the rights… url: "https://staging.churchtools.academy/en/help/system-settings/oauth-login-systemsettings/oauth-login-via-churchtools-with-nextcloud/" updated: "2026-03-31" category: Login / OAuth --- # OAuth login via ChurchTools on Nextcloud This tutorial explains how to configure your own Nextcloud so that you can log in to Nextcloud with your ChurchTools login as an OAuth server. Group and, if desired, group role information will be transferred. You can use the rights management feature in ChurchTools to define who is allowed to log in to Nextcloud. You can find more details about the configuration of OAuth on our help page [OAuth between two ChurchTools systems](https://staging.churchtools.academy/en/help/system-settings/oauth-login-systemsettings/oauth-between-two-churchtools-systems/) and the pages linked there. **Warning** We are happy to provide you with this help page as support and maintain it to the best of our knowledge. However, please understand that when it comes to functions, settings or changes in **third-party systems** such as NextCloud, we **cannot guarantee** that all information is always **up-to-date, complete or correct** - we simply have no direct influence on this. The official information and documentation of the respective provider is therefore always decisive. If you get stuck somewhere during implementation or if something seems contradictory to you: Feel free to contact us - we will help you find the right next steps, but cannot make any promises regarding availability, behavior or support from third-party providers. ## 1. Register Nextcloud as an OAuth client The first step is to add Nextcloud as an OAuth client in the System settings. To do this, open the *System settings* (2) via the *administration menu* (1). In the *General* section of the sidebar, you will find the *Login* entry (3). Here you can add a new *OAuth client* (4). [![System settings - Login - OAuth](https://staging.churchtools.academy/wp-content/uploads/2025/12/System-settings_Login_OAuth.png)](https://staging.churchtools.academy/wp-content/uploads/2025/12/System-settings_Login_OAuth.png) It is best to choose the name of the third-party system, in this case "Nextcloud". This name will also be displayed to users later to make it clear which system they are trying to sign up to. [![System settings - Login - OAuth - Add OAuth-Client](https://staging.churchtools.academy/wp-content/uploads/2025/12/System-settings_Login_OAuth_Add-OAuth-Client.png)](https://staging.churchtools.academy/wp-content/uploads/2025/12/System-settings_Login_OAuth_Add-OAuth-Client.png) ChurchTools now creates the necessary connection data for connecting the NextCloud client. In our screenshot you can see the URL of our ChurchTools system https://testengland.church.tools. In your system, the URL of your ChurchTools is displayed accordingly. [![System settings - Login - OAuth - Edit OAuth-Client](https://staging.churchtools.academy/wp-content/uploads/2025/12/System-settings_Login_OAuth_Edit-OAuth-Client.png)](https://staging.churchtools.academy/wp-content/uploads/2025/12/System-settings_Login_OAuth_Edit-OAuth-Client.png) You must *add the redirect URI using the Redirect URI* button. It looks like this: `https://nextcloud.example.com/apps/sociallogin/custom_oauth2/ChurchTools` Exchange `nextcloud.example.com` with your own URL under which the Nextcloud runs. The last part `ChurchTools` is the provider name, which we can choose ourselves directly in Nextcloud. If you follow these instructions, you only need to change the domain and can leave the name "ChurchTools". **Redirect UR**I The redirect URI is normally communicated to you by the third-party system, but unfortunately Nextcloud or the app that we are about to activate does not do this. The OAuth server (your ChurchTools) needs this URI to redirect users to the third-party system (Nextcloud) after Login. **Important** Depending on how Nextcloud is configured, the path `index.php` may need to be appended to the URL. The redirect from the screenshot above looks like this: `https://nextcloud.example.com/index.php/apps/sociallogin/custom_oauth2/ChurchTools` Try this if necessary if the Login is not successful later. ## 2. Activate the Social Login app For the OAuth login we need the Nextcloud app "[Social Login](https://apps.nextcloud.com/apps/sociallogin)". As an admin, you can find and add new apps via the app menu. [![Social Login App](https://staging.churchtools.academy/wp-content/uploads/2024/12/CleanShot-2024-12-10-at-11.09.28.png)](https://staging.churchtools.academy/wp-content/uploads/2024/12/CleanShot-2024-12-10-at-11.09.28.png) ## 3. Enter custom OAuth2 profile Now we can configure and set up the Social Login as an admin under "Administration". To do this, we create a *custom OAuth2 profile* (1) and fill in the values with the links that ChurchTools provided in step 1. [![Create custom OAuth2 profile in Social Login App](https://staging.churchtools.academy/wp-content/uploads/2024/12/CleanShot-2024-12-10-at-11.22.11.png)](https://staging.churchtools.academy/wp-content/uploads/2024/12/CleanShot-2024-12-10-at-11.22.11.png) Now fill in the fields: - Internal name: Name that is also used in the redirect URI - Title: Name of this profile. The text is also displayed during Nextcloud Login - API Base URL, Authorization URL, Token URL, Profile URL, Client ID: These fields are created by ChurchTools and displayed in the OAuth client's System settings (see screenshot above). - Client Secret: Select a random character string here. [![NextCloud - Custom OAuth2 parameter](https://staging.churchtools.academy/wp-content/uploads/2025/12/NextCloud_Custom-OAuth2-parameter-1.png)](https://staging.churchtools.academy/wp-content/uploads/2025/12/NextCloud_Custom-OAuth2-parameter-1.png) Now everything is set up and you can log in to Nextcloud. **Profile data** Upon successful Login, ChurchTools transfers the following profile data to Nextcloud: profile picture, first name, last name, e-mail, group memberships. At the top of the page you will find some checkboxes. You are free to select what makes sense for you. However, we recommend that you check two boxes: - Update the user profile with every registration - Create groups automatically if they do not exist (see last point of these instructions) [![NextClud - Social login parameter](https://staging.churchtools.academy/wp-content/uploads/2025/12/NextClud_Social-login-parameter.png)](https://staging.churchtools.academy/wp-content/uploads/2025/12/NextClud_Social-login-parameter.png) ## 4. Assign ChurchTools rights As a super admin, you will already be able to log in. However, it is not always intended that every ChurchTools user should also have a login to Nextcloud. Therefore, ChurchTools users need the global right to log in to the third-party system: `Log in to third-party system via ChurchTools user account (login to external system)`. [![Manage permissions - Administration - Log in to external systems](https://staging.churchtools.academy/wp-content/uploads/2025/12/Manager-permissions_Login-to-external-system.png)](https://staging.churchtools.academy/wp-content/uploads/2025/12/Manager-permissions_Login-to-external-system.png) **Rights group** So that you don't lose track, you can set up a new ChurchTools group and only allow these group participants access to Nextcloud. This way you can keep track of who can log in. Using [automatic memberships](https://staging.churchtools.academy/en/help/churchtools-modules/automatic-membership/), you could easily grant access to all leaders. New people can also be informed immediately that they have been granted Nextcloud access using an e-mail predefined in [routines](https://staging.churchtools.academy/en/help/churchtools-modules/routinen/understanding-routines/). ## 5. Synchronize groups or group roles It is possible to transfer and save the group memberships to Nextcloud. There are two ways to do this. Whichever way you choose, the groups or group roles are transferred from ChurchTools to the third-party system. Nextcloud takes this data and assigns the profile to these groups. If "Create groups automatically if they do not exist" is activated, a group will be created beforehand. If this option is not active, the groups can also be created manually in Nextcloud if not all ChurchTools groups are required. Only the name must be the same. ### Transfer groups In order for groups to be transferred (regardless of Role), `groups` must be entered in the OAuth2 profile under "groups claim". [![Social Login App groups claim groups](https://staging.churchtools.academy/wp-content/uploads/2024/12/CleanShot-2024-12-10-at-12.06.11.png)](https://staging.churchtools.academy/wp-content/uploads/2024/12/CleanShot-2024-12-10-at-12.06.11.png) Groups in Nextcloud have the following scheme: `-`. For example, "ChurchTools-church leadership". ### Transferring groups and roles In order for roles to be transferred, `roles` must be entered in the OAuth2 profile under "groups claim". [![Social Login App groups claim roles](https://staging.churchtools.academy/wp-content/uploads/2024/12/CleanShot-2024-12-10-at-12.08.19.png)](https://staging.churchtools.academy/wp-content/uploads/2024/12/CleanShot-2024-12-10-at-12.08.19.png) Group roles in Nextcloud have the following scheme:`-_`. For example, "ChurchTools-church leadership_leader". **One group per role** Nextcloud does not recognize roles for groups. To support different ChurchTools roles in Nextcloud, a separate Nextcloud group is created for each group role. If groups are created automatically, this can cause the group list in Nextcloud to grow quickly. ## Read more - [What is OAuth? (Login to third party systems)](https://staging.churchtools.academy/en/help/system-settings/oauth-login-systemsettings/what-is-oauth-login-to-third-party-systems/) - [What is the difference between LDAP and OAuth?](https://staging.churchtools.academy/en/help/system-settings/login-en/what-is-the-difference-between-ldap-and-oauth/) - [Connection of Nextcloud to the ChurchTools Login](https://staging.churchtools.academy/de/help/verwaltung/ldap/0-anbindung-von-nextcloud-an-den-churchtools-login/)