# Keycloak SSO - how to map only existing Keycloak users to Nextcloud users without creating new **URL:** \ **Category:** ℹ️ Support\ **Tags:** sso, openidconnect, sociallogin\ **Created:** [June 28, 2020, 2:09pm UTC](https://help.nextcloud.com/t/keycloak-sso-how-to-map-only-existing-keycloak-users-to-nextcloud-users-without-creating-new/85981 "2020-06-28T14:09:31Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![tuxmartin](https://help.nextcloud.com/user_avatar/help.nextcloud.com/tuxmartin/32/21877_2.png) [@tuxmartin](https://help.nextcloud.com/u/tuxmartin)\ **Post date:** [June 28, 2020, 2:09pm UTC](https://help.nextcloud.com/t/keycloak-sso-how-to-map-only-existing-keycloak-users-to-nextcloud-users-without-creating-new/85981/1 "2020-06-28T14:09:31Z")
Hi, I would like to use Keycloak as SSO provider fo Nextcloud 18. I followed the instructions: [https://devopstales.github.io/sso/nextcloud-sso/](https://devopstales.github.io/sso/nextcloud-sso/) I have installed Social Login app [https://apps.nextcloud.com/apps/sociallogin](https://apps.nextcloud.com/apps/sociallogin) I do not want to auto-create users in nextcloud after they login using SSO. I just want to allow existing Nextcloud users to login via SSO using OpenID connect protocol. Users in Keycloak and Nextcloud have the same login name and email. I also want to solve permissions and user groups in Nextcloud, not map it from Keycloak. In social login app I have checked “Disable auto create new users”. After I try to login using keycloak, I got following error: _“Auto creating new users is disabled”_ and login fails. But user with the same login name exists in Nextcloud and Keycloak. I need to keep the possibility of logging in with the local Nexcloud account without using SSO. What I do bad? Is it necessary to set Mappers in Keycloak client? But how? I tried everything possible, but still without success. I think I need to set up login and email mapping. Thanks for help. ---
**Author:** ![wwe](https://help.nextcloud.com/user_avatar/help.nextcloud.com/wwe/32/72963_2.png) [@wwe](https://help.nextcloud.com/u/wwe)\ **Post date:** [June 19, 2022, 8:24pm UTC](https://help.nextcloud.com/t/keycloak-sso-how-to-map-only-existing-keycloak-users-to-nextcloud-users-without-creating-new/85981/2 "2022-06-19T20:24:53Z")
the author of sociallogin app refuses to “auto-link” existing users to oidc providers (with reasons - I don’t agree but the reasons are reasonable) > > > This adds a feature to trust the \`preferred\_username\` claim from OpenID Connect …providers. Keycloak, at least, supports this. > > This is useful for environments where we provision nextcloud users using the OIDC provider, and want the usernames to be legible/meaningful. So my user id can be "steve" instead of e.g. "keycloak-de25e39c-0981-43aa-b572-a351aaa012e2". > > I didn't add any logic to auto-connect social accounts with oc\_sociallogin\_connect, or try to resolve existing users or duplicate emails. ---
**Author:** ![Dawsmonkee](https://help.nextcloud.com/letter_avatar/dawsmonkee/32/5_5575768a8748004e209b776fc1b2916d.png) [@Dawsmonkee](https://help.nextcloud.com/u/Dawsmonkee)\ **Post date:** [July 12, 2022, 8:20am UTC](https://help.nextcloud.com/t/keycloak-sso-how-to-map-only-existing-keycloak-users-to-nextcloud-users-without-creating-new/85981/3 "2022-07-12T08:20:46Z")
Is it possible to manually link existing users to the keycloak instance? ---
**Author:** ![wwe](https://help.nextcloud.com/user_avatar/help.nextcloud.com/wwe/32/72963_2.png) [@wwe](https://help.nextcloud.com/u/wwe)\ **Post date:** [July 12, 2022, 6:36pm UTC](https://help.nextcloud.com/t/keycloak-sso-how-to-map-only-existing-keycloak-users-to-nextcloud-users-without-creating-new/85981/4 "2022-07-12T18:36:16Z")
yes. each user can login into Nextcloud and link his account to different providers from sociallogin ---
**Author:** ![shroudcloud](https://help.nextcloud.com/letter_avatar/shroudcloud/32/5_5575768a8748004e209b776fc1b2916d.png) [@shroudcloud](https://help.nextcloud.com/u/shroudcloud)\ **Post date:** [January 24, 2023, 10:01am UTC](https://help.nextcloud.com/t/keycloak-sso-how-to-map-only-existing-keycloak-users-to-nextcloud-users-without-creating-new/85981/5 "2023-01-24T10:01:40Z")
That (linking keycloak users to existing NC users - manually, if necessary) is something I was looking for and came across this thread. And I am very happy to find that this works. But how? I have an existing NC user account. And I have created a new user by logging in via Keycloak. When I am in my existing NC account and go to Social Login settings, I only see the option to “Disable password confirmation on settings change” but I don’t see any option to link the Keycloak created account. Where do I find this or how do I do that? Thanks! ---
**Author:** ![wwe](https://help.nextcloud.com/user_avatar/help.nextcloud.com/wwe/32/72963_2.png) [@wwe](https://help.nextcloud.com/u/wwe)\ **Post date:** [January 24, 2023, 10:26am UTC](https://help.nextcloud.com/t/keycloak-sso-how-to-map-only-existing-keycloak-users-to-nextcloud-users-without-creating-new/85981/6 "2023-01-24T10:26:04Z")
I don’t use sociallogin app because of this restriction - so can’t explain you how it works… But there is no way to merge an existing NC user with another user auto-created by OIDC. You need to remove the KC user, disable user auto-creation and link you OIDC login after logging in as NC user… ---
**Author:** ![shroudcloud](https://help.nextcloud.com/letter_avatar/shroudcloud/32/5_5575768a8748004e209b776fc1b2916d.png) [@shroudcloud](https://help.nextcloud.com/u/shroudcloud)\ **Post date:** [January 26, 2023, 10:36am UTC](https://help.nextcloud.com/t/keycloak-sso-how-to-map-only-existing-keycloak-users-to-nextcloud-users-without-creating-new/85981/7 "2023-01-26T10:36:33Z")
Okay, so there is this check box in admin settings of sociallogin to “allow users to link social accounts” (or something to that effect). After checking this box, I started seeing the option to link to an external account in the user’s settings. Linking was no problem at all and external authentication is now working (for the users that have linked out). Thanks for your help! ---
**Author:** ![wwe](https://help.nextcloud.com/user_avatar/help.nextcloud.com/wwe/32/72963_2.png) [@wwe](https://help.nextcloud.com/u/wwe)\ **Post date:** [February 6, 2023, 7:12am UTC](https://help.nextcloud.com/t/keycloak-sso-how-to-map-only-existing-keycloak-users-to-nextcloud-users-without-creating-new/85981/8 "2023-02-06T07:12:24Z")
This topic was automatically closed after 12 days. New replies are no longer allowed.