How to organise nextclud for many users and groups with different permissions

I am setting up a site for about 200 users with different groups, different calendersand different permissions. It is very difficult to find practical information on how such a site can be organised. I would propose two things:

  1. An administration manual which can be used by admins with no specific computerknowledge. How to organise a site with many different users.
  2. A catgory in the forum for tips about how to organise things. I am not talking about the installation, but about the next step - how to organise the site, from adding users, groups, assigning permissions etc. How to use external websites etc.
1 Like

Hello @rollanders

There is an Administration Manual, and its very useful. Do you expect Nextcloud to provide a way to administer Servers without any technical knowledge whatsoever?

Its like me wanting to change the gearing ratio in my VW Passat without knowing anything about cars or the tools necessary.

Everything in core is in the Admin manual. External Sites for example is a 3rd party app, and thefore you should search help at their end. Well, in fact thats as straightforward as: Enabling the App -> enter URL in Admin Panel. Finished.

The settings in the Admin Panel in your Web UI should be pretty selfexplainatory, and if the are not, don´t hestiate to ask specific questions about it on this board.

There are categories for a lot of stuff under Apps. For example if you have problems with the calendar: https://help.nextcloud.com/c/apps/calendar

If you come want to write a howto here, nobody will stop you, but one cannot make the one universial documentation, because you can deploy Nextcloud server in a great variety of ways, so catching everyone with one document is not likley to happen. A minimum of technical insight is expected and required, and as an personal opinion: I you managed to set up the server itself, the webadministration should not pose unresolvable problems to you.

Playing around already shows you some options. You can manage shares based on users and groups. If you use dedicated shares, you can do most things directly with Nextcloud. However, if you want to use an existing folder structure and for example have a large shared folder but different permissions within sub-folders, that is a bit difficult. Therefore, you can use a different storage and add it via the external storage app. With samba, Linux-ACL on file system (accessed via NFS or SFTP), … you can realize much more detailed permission settings.

Other thing is, I don’t know up to how many users the user management is best suited and at what point you should think about external storage backends. Larger organisations often have existing authentication structures they can reuse (e.g. LDAP).

You can find most things in the manual, however it is not always presented in the best way, especially for starters. The huge flexibility (many different OS, webservers, authentication back-ends, external storage, …) does not make it easier. If you have a good idea, feel free to share your ideas (https://github.com/nextcloud/documentation/issues).

@Ascendancer

I am only installing and setting up Nextcloud. I will then hand it over to other admins. These admins are not interested in the details of how the installation was done. They need a manual that explains the functions of the web UI, how to add users, groups and how to assign permissions. A manual that informs them how to link to external sites. They would be completely lost if I told them to read the Adminstration Manual.

In fact even after reading this manual I myself have very vague ideas about how to create users with permission only to read certain files in certain folders and not allowing them to upload or delete files or use Nextcloud to sync folders from their personal computors. It ends with a lot of trial and errors for me.
I understand that I can get small pieces here and there from the manual and from this forum, but this information is spread out all over.

OK. I can start posing my elementary questions but I do not know where?

For the moment I need to know how I can add users that are only allowed to read certain folders but are not allowed to edit, delete or add new files. How can I avoid the default files and maps that are included every time I add a user?

As an example - I need a calender for booking locals. A number of persons should be able to edit this calender. In my logic I created a fake user (Localbooker) just to make a calender (Localbooking) and shared this calender with the people who need it. I now try to find out how I can use Google calender to sync with this calender, so that these people do not need to open Nextcloud each time they should edit it.

I think it would be good to have one place for questions like this.

Roland

@tflidd

Thanks for your answer. I try to set-up this thing for a church with about 250 members. Most of them will probably not use Nextcloud at all. About half of these members are involved in probably 40 different groups, some in many. Calenders and storing files are the most important functions currently. We do not need a complex structure of folders. There are lots of such organisations…

Maybe I need LDAP? I have contacted our webb-host for LDAP but am waiting for the answer. But I think it would be an overkill for our needs. 250 users and 40 groupes may seem a lot, but in reality there may be only 50 regular users and 10 groups. I think I just need some very simple guidelines.

For the moment e-mail and texting are used for most of the communication between members, and I think it may continue like that. It is too complicated to open Nextcloud for this communication, but Files from Mailes is a good function there. I need to look that up.

Some years ago I tried to use Open Atrium for this need, and they had a Wiki with some fundamental but easy understanded instructions. But then they came with a new version which I think ruined the whole thing.

I think your link to the calendar app just shows how difficlt this would be. The majority of the postings in that thread are about problems. I need answerts to other kind of questions. As an example I want to create maybe 4 calendars and share them with selected people. Some of these people should only be allowed to read. Others to edit. In my previous post I explained one way I tried to solve this. But it may get very complicated when I add new users and have to share these calenders with them individually. OK maybe I can create different groups with different permissions to this calender (those who can only see the local bookings, and those who can edit them)? Can calenders be created by a group? I guess others have already found out tricks like this.

I would like to have a simple wiki for dummies. I can give some ideas about the content, but my problem is I have still to do a lot of trial and errors. But if you have the patience I can ask a lot of questions which may give you an idea how a dummy thinks.

You will find most answers somewhere spread in the forum. You can create users with a 0 quota, so they can only use shared folders. You would typically use a admin user to create a folder an share it with the users or a group. There is a new app groupfolder which should allow to do this, but I think there were still a few bugs.

I’m not sure for calendar, you can’t create a group-calendar as a group, it must be a person (or dummy-user) that then shares the calendar with a group.

There have been a few requests in the past to integrate a wiki into Nextcloud. I think finally someone managed to do it, search a bit on the forum.

I wouldn’t setup LDAP only for that. Perhaps you have already mail addresses (of your own domain), then you could authenticate against a IMAP server as well.

For me it looks like you could use Nextcloud for what you want to do. I’d suggest you make a small test setup and play around with 5 users or so if you can manage everything like you want to.

Many thanks @tflidd. I will look around and use trial and error testing. I have also found information on the oC forum that gives usable hints.

One reason for my post was to propose that there should be a category in the forum for questions like mine and for tips on setting up NC. According to the description the Support category should be the closest, but that category is filled with reports on errors or assumed bug reports and technical issues rather than simple questions on functionality.

A second reason was to suggest a manual or a wiki for the non-technically oriented admin on how to use the inbuilt functions and the apps to set up a site after it is up and running. Something that is between the current Administrator and the User manuals. Your answer on setting the quota to 0 to allow users to only use shared folders is one such simple answer that helps. I have not found that anywhere. The oC manual defines different user roles which gave me a hint that users could have no personal webb space. I assumed that corresponded to setting the quota to 0. However the smallest quota I have succeeded to assign is 1 KB.

Thank you also for the advice not to go with an LDAP solution and the tips on using our domains IMAP server for authentification. I need to figure out what that means in reality though. We have an IMAP server and e-mail adresses for the organisation but only a few use that.

And thanks for the reassurance that you think NC can fit our needs.

We have a howto section, but treats things on a lower level. So it is just a very specific problem -> answer.

Aha. I missed that one.
Remaining the Admin Manual for Dummies :wink: But I realise that Nextcloud is kind of a swissknife and can be used in many different situations - from the user who wants to sync his computers, to the big company that use it for their intranet. So there is probably a need for a range of Admin Manuals for Dummies. I found the How-to/FAQ WIKI Thanks!