Authentication issue - verifying password endless loop. Nexcloud in docker with reverse proxy

ℹ️ Support 📦 Appliances (Docker, Snappy, VM, NCP, AIO)
, , , , , ,
1
Support intro

Sorry to hear you’re facing problems. :slightly_frowning_face:

The community help forum (help.nextcloud.com) is for home and non-enterprise users. Support is provided by other community members on a best effort / “as available” basis. All of those responding are volunteering their time to help you.

If you’re using Nextcloud in a business/critical setting, paid and SLA-based support services can be accessed via portal.nextcloud.com where Nextcloud engineers can help ensure your business keeps running smoothly.

Getting help

In order to help you as efficiently (and quickly!) as possible, please fill in as much of the below requested information as you can.

Before clicking submit: Please check if your query is already addressed via the following resources:

(Utilizing these existing resources is typically faster. It also helps reduce the load on our generous volunteers while elevating the signal to noise ratio of the forums otherwise arising from the same queries being posted repeatedly).

Some or all of the below information will be requested if it isn’t supplied; for fastest response please provide as much as you can. :heart:

The Basics

Hi guys

Good morning to all.

I did a fresh install of Nexcloud in Rpi5.

The Nextcloud server (FPM Alpine) is installed on a Raspberry Pi 5 running DietPi, with an NVMe drive and Docker.

The internal web server is Nginx, and the database is MariaDB. The Raspberry Pi 5 (192.168.2.100) is located on the Green network, behind an IPFire firewall (192.168.1.200) connected to a Fritz!Box router (192.168.1.1).

The DMZ network managed by IPFire also contains a Raspberry Pi 4 (172.5.0.5), running DietPi, Docker, and Nginx Proxy Manager (NPM) reverse proxy, configured with the usual Let’s Encrypt certificate.

the issue you are facing:

when I try to install an app or connect the Nextcloud client on an Android smartphone or a Windows PC, the authentication pop-up for password verification appears after I grant authorization, and the process enters an endless loop.

Steps to replicate it (hint: details matter!):

  1. fresh install of Nexcloud in docker and NPM as reverse proxy in a separate server under DMZ (ipfire firewall)

  2. configuration done and working fine in wui

  3. installation of Nextcloud app in smartphone Android or desktop. Once the permission is granted, authentication popup in endless loop

Log entries

Nextcloud

Please provide the log entries from your Nextcloud log that are generated during the time of problem (via the Copy raw option from Administration settings->Logging screen or from your nextcloud.log located in your data directory). Feel free to use a pastebin/gist service if necessary.

PASTE HERE

Web Browser

If the problem is related to the Web interface, open your browser inspector Console and Network tabs while refreshing (reloading) and reproducing the problem. Provide any relevant output/errors here that appear.

PASTE

Web server / Reverse Proxy

The output of your Apache/nginx/system log in /var/log/____:

PASTE HERE

Configuration

Nextcloud

The output of occ config:list system or similar is best, but, if not possible, the contents of your config.php file from /path/to/nextcloud is fine (make sure to remove any identifiable information!):

RPI5 - Docker configuration of Nextcloud stack: docker-compose.yaml

services:
  nextcloud-web:
    image: nginx:alpine
    container_name: nextcloud-nginx
    restart: unless-stopped
    ports:
      - "8085:80"
    volumes:
      - /mnt/nvme/docker/nextcloud/app:/var/www/html:ro
      - /mnt/nvme/docker/nextcloud/nginx/nginx.conf:/etc/nginx/conf.d/default.conf:ro
      - /var/log/nginx_internal:/var/log/nginx
    networks:
      - nextcloud-net
    depends_on:
      - nextcloud-app

  nextcloud-app:
    image: nextcloud:fpm-alpine
    container_name: nextcloud-app
    restart: unless-stopped
    extra_hosts:
      - "host.docker.internal:host-gateway"
    volumes:
      - /mnt/nvme/docker/nextcloud/app:/var/www/html
      - /var/log/nextcloud:/var/log/nextcloud
      - /mnt/ncUSB/data:/var/www/html/data
    environment:
      - MYSQL_HOST= db
      - MYSQL_DATABASE=nc
      - MYSQL_USER=nc
      - MYSQL_PASSWORD= nc
      - REDIS_HOST=nextcloud-redis
    networks:
      - nextcloud-net
    depends_on:
      - db
      - nextcloud-redis

  db:
    image: mariadb:10.11
    container_name: db
    restart: unless-stopped
    command: --transaction-isolation=READ-COMMITTED --log-bin=binlog --binlog-format=ROW --log-error=/var/log/mysql/error.log
    volumes:
      - /mnt/nvme/docker/nextcloud/db:/var/lib/mysql
      - /var/log/mariadb:/var/log/mysql
    environment:
      - MYSQL_ROOT_PASSWORD=nc
      - MYSQL_DATABASE=nc
      - MYSQL_USER=nc
      - MYSQL_PASSWORD= nc
    networks:
      - nextcloud-net

  nextcloud-redis: 
    image: redis:alpine
    container_name: nextcloud-redis
    restart: unless-stopped
    volumes:
      - /mnt/nvme/docker/nextcloud/redis:/data
    networks:
      - nextcloud-net

networks:
  nextcloud-net:
    external: true


PI5 internal nginx configuration in docker stack: nginx.conf
server {
    listen 80;

    add_header Strict-Transport-Security "max-age=15552000; includeSubDomains; preload" always;

    server_name cl.xx.it;

    access_log /var/log/nginx/access.log;
    error_log /var/log/nginx/error.log warn;

set_real_ip_from 172.5.0.5;

real_ip_header X-Forwarded-For;
real_ip_recursive on;


    include mime.types;
    types {
        text/javascript mjs;
        application/javascript mjs;
    }

    location ^~ /.well-known {
        location = /.well-known/carddav { return 301 $scheme://$http_host/remote.php/dav/; }
        location = /.well-known/caldav  { return 301 $scheme://$http_host/remote.php/dav/; }

        try_files $uri $uri/ /index.php$request_uri;
    }

    root /var/www/html;
    index index.php index.html;

    client_max_body_size 512M;
    fastcgi_buffers 64 4K;

    location / {
        try_files $uri $uri/ /index.php$request_uri;
    }


location ~ \.php(?:$|/) {
    include fastcgi_params;

    fastcgi_split_path_info ^(.+?\.php)(/.*)$;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    fastcgi_param PATH_INFO $fastcgi_path_info;

    fastcgi_pass nextcloud-app:9000;
    fastcgi_index index.php;

    fastcgi_param HTTPS on;
    fastcgi_param HTTP_X_FORWARDED_PROTO https;

Sabre\DAV\Exception\NotAuthenticated)
    fastcgi_param HTTP_AUTHORIZATION $http_authorization;


    fastcgi_param SERVER_NAME cl.xx.it;
    fastcgi_param HTTP_HOST cl.xx.it;

    fastcgi_param SERVER_PORT $http_x_forwarded_port;

    fastcgi_param REMOTE_ADDR $remote_addr;

    fastcgi_read_timeout 180s;
    fastcgi_send_timeout 180s;
}

    location ~ \.(?:css|js|mjs|woff2?|svg|gif|png|jpg|jpeg|ico)$ {
        try_files $uri /index.php$request_uri;
        expires 6M;
        access_log off;
    }
}

RPI5 nextcloud configuration: config.php
<?php

$CONFIG = array (
  'instanceid' => 'mio',
  'passwordsalt' => 'mio',
  'secret' => 'mio',
  'version' => '34.0.3.2',
  'installed' => true,
  'dbtype' => 'mysql',
  'dbhost' => 'db',
  'dbname' => 'nc',
  'dbtableprefix' => 'oc_',
  'dbuser' => 'nc',
  'dbpassword' => 'nc',
  'mysql.utf8mb4' => true,
  'datadirectory' => '/var/www/html/data',
  'memcache.local' => '\\OC\\Memcache\\APCu',
  'memcache.distributed' => '\\OC\\Memcache\\Redis',
  'memcache.locking' => '\\OC\\Memcache\\Redis',
  'redis' =>
  array (
    'host' => 'nextcloud-redis',
    'password' => '',
    'port' => 6379,
  ),
  'apps_paths' =>
  array (
    0 =>
    array (
      'path' => '/var/www/html/apps',
      'url' => '/apps',
      'writable' => false,
    ),
    1 =>
    array (
      'path' => '/var/www/html/custom_apps',
      'url' => '/custom_apps',
      'writable' => true,
    ),
  ),
  'log_type' => 'file',
  'logfile' => '/var/log/nextcloud/VB_nextcloud.log',
  'loglevel' => 2,
  'logdateformat' => 'F d, Y H:i:s',
  'trusted_domains' =>
  array (
    0 => '192.168.2.100:8085',
    1 => 'aa.aa.aa.aa',
    2 => 'cl.xx.it',
    3 => '172.5.0.5',
  ),
  'trusted_proxies' =>
  array (
    0 => '172.5.0.5',
  ),
  'forwarded_for_headers' =>
  array (
    0 => 'HTTP_X_FORWARDED_FOR',
  ),
  'overwritehost' => 'cl.xx.it',
  'overwriteprotocol' => 'https',
  'overwrite.cli.url' => 'https://cl.xx.it',

'overwritecondaddr' => '^.*$',
'force_cookies_secure' => true,
 'upgrade.disable-web' => true,
  'force_cookies_secure' => true,
  'maintenance_window_start' => 1,
  'enable_password_confirmation' => false,
  'session_relaxed_expiry' => true,
  'session_keepalive' => true,

  'remember_login_cookie_lifetime' => 0,

  'session_lifetime' => 86400,
  'remember_login_cookie_lifetime' => 1209600,
  'auth.bruteforce.protection.enabled' => false,
  'bruteforce.whitelist' =>
  array (
    0 => '172.5.0.5/24',
  ),
  'appstoreenabled' => false,
  'app_install_overwrite' =>
  array (
  ),
  'maintenance' => false,
);

RPI4 in DMZ: NPM reverse proxy configuration

Docker-compose.yaml

services:
  app:
    image: 'jc21/nginx-proxy-manager:latest'
    container_name: nginx-proxy-manager
    restart: unless-stopped
    ports:
      - '80:80'   
      - '81:81'   
      - '443:443' 
    dns:
      - 1.1.1.1
      - 8.8.8.8
    volumes:
      - /mnt/sd/docker/npm/data:/data
      - /mnt/sd/docker/npm/letsencrypt:/etc/letsencrypt

Proxy host

map $scheme $hsts_header {
    https   "max-age=63072000;includeSubDomains; preload";
}

server {
  set $forward_scheme http;
  set $server         "192.168.2.100";
  set $port           8085;

  listen 80;
listen [::]:80;

listen 443 ssl;
listen [::]:443 ssl;


  server_name cl.xx.it;

  http2 on;


  # Let's Encrypt SSL
  include conf.d/include/letsencrypt-acme-challenge.conf;
  include conf.d/include/ssl-cache.conf;
  include conf.d/include/ssl-ciphers.conf;
  ssl_certificate /etc/letsencrypt/live/npm-19/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/npm-19/privkey.pem;

# Asset Caching
  include conf.d/include/assets.conf;


  # HSTS (ngx_http_headers_module is required) (63072000 seconds = 2 years)
  add_header Strict-Transport-Security $hsts_header always;

    # Force SSL

    set $trust_forwarded_proto "F";

    include conf.d/include/force-ssl.conf;

proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection;
proxy_http_version 1.1;

  access_log /data/logs/proxy-host-3_access.log proxy;
  error_log /data/logs/proxy-host-3_error.log warn;

location / {
    proxy_pass http://192.168.2.100:8085;

    proxy_set_header Host $host;

    proxy_set_header Authorization $http_authorization;
    proxy_pass_header Authorization;

    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto https;

    proxy_buffering off;
    proxy_request_buffering off;

    proxy_read_timeout 1200s;
    proxy_connect_timeout 1200s;
    proxy_send_timeout 1200s;

    proxy_hide_header Upgrade;
}

location /.well-known/carddav {
    return 301 $scheme://$host/remote.php/dav;
}
location /.well-known/caldav {
    return 301 $scheme://$host/remote.php/dav;
}
location ^~ /.well-known {
    return 301 $scheme://$host/index.php$uri;
}

  # Custom
  include /data/nginx/custom/server_proxy[.]conf;
}

Apps

The output of occ app:list (if possible).

Tips for increasing the likelihood of a response

  • Use the preformatted text formatting option in the editor for all log entries and configuration output.
  • If screenshots are useful, feel free to include them.
    • If possible, also include key error output in text form so it can be searched for.
  • Try to edit log output only minimally (if at all) so that it can be ran through analyzers / formatters by those trying to help you.