...
NextCloud is a PHP application and performs the role of , user interface, document store and WOPI authentication server. Collabora Online compatibility is now available via a bundled plugin and the only configuration needed is the URL for the Collabora service. When users open a file in NextCloud control is passed to Collabora Online, and the office application interface appears.
[IMAGE]
A single Collabora Online service can be used by more than one NextCloud front-end.
...
NextCloud's SAML implementation is currently rather limited, and only supports one IdP. This means that a proxy IdP would be needed to provide fully federated access to users.
[IMAGE]
More advanced SAML features are planned and development seems to be active.
...
The second SSO option is to rely on the web server (such as Apache or NGINX) and use basic user information passed as environment variables such as REMOTE_USER.
[IMAGE]
This means that the Shibboleth SP software, OpenID Connect or even Kerberos can be used, but integration is weak - only the username is available.
...
This would hinder usage across a federation (since users would not exist in the LDAP directory) but may help research organisations, as group membership and access control can be handled by a community LDAP server.
Pilot Implementations
Three different demonstrations were set up, so that different features and integration combinations could be explored.
...
Demonstration 2: External authentication (SAML) plus LDAP
Demonstration 3: Integrated SAML with a federated IdP Proxy
...
The External Storage plugin allows remote data storage to be used, including other NextCloud or OwnCloud services.
Caveats
Speed
The display of Collabora is generated by sending many tile-like images over the web as individual files, and is rather slow. Over a normal broadband internet connection the display is not quite fast enough to keep up with typing.
...
However, there is an unofficial project to help with installing an alternative open source version of the Collabora Online software without these limitations, and without Docker.
Admin accounts must be created before switching to SSO
...