Seeking suggestions for managing user Authentication between Nextcloud and other services

[just]

What would be the best practice here?

Goal
To allow Nextcloud users to access other local services such as Moodle, DokuWiki, Kanboard, etc.

• Somehow protect oauth keys across services with full r+w access?
  • Issue filed for adding scoped access to oauth
• Setup and manage an LDAP server.
• Authenticate users via User SQL app

Would appreciate input from someone who has experience managing account credentials in a successful + secure manner that allows existing Nextcloud accounts to connect with other selfhosted services such as DokuWiki and Kanboard.

Continuing the discussion from Anyone got DokuWiki integrated with Nextcloud?:

@just

Security Warning!
Nextcloud OAuth2 implementation currently does not support scoped access. This means that every token has full access to the complete account including read and write permission to the stored files. It is essential to store the OAuth2 tokens in a safe way!

Without scopes and restrictable access it is not recommended to use a Nextcloud instance as a user authentication service.

Scoped Access for Oauth Tokens