From c1515fc0fa4dc54bc07b935036a69a7fdbe31213 Mon Sep 17 00:00:00 2001 From: whoalin1 Date: Wed, 7 Oct 2026 04:50:45 +0300 Subject: [PATCH] docs(admin): clarify OAuth2 tokens stay full-access behind proxies Assisted-by: Cursor:grok-4.7 Signed-off-by: whoalin1 --- admin_manual/configuration_server/oauth2.rst | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/admin_manual/configuration_server/oauth2.rst b/admin_manual/configuration_server/oauth2.rst index ad4928a576d..912cca068d9 100644 --- a/admin_manual/configuration_server/oauth2.rst +++ b/admin_manual/configuration_server/oauth2.rst @@ -42,6 +42,13 @@ Nextcloud ``OAuth2`` implementation currently does not support scoped access. Th Without scopes and restrictable access it is not recommended to use a Nextcloud instance as a user authentication service. +Putting an authenticating reverse proxy (for example ``oauth2_proxy``) in front +of an application does **not** reduce that scope. Nextcloud still issues a +Bearer token with full account access; the proxy only controls who can start the +login. Treat every issued token as highly privileged, and do not reuse Nextcloud +as a generic identity provider for third-party apps that should receive limited +permissions. + Skipping pre-login warning --------------------------