I recently updated my Nextcloud-AIO instance to Nextcloud 35.
While SSO with Keycloak still works for login, I get the message that encryption keys could not be loaded and I should logout and login (when opening files)…
If I use the standard login or passkey, this doesn’t seem to happen.
If I login with password, logout, and login again with SSO, the message doesn’t show.
Do I have to setup some special fields for SSO to make encryption work?
I am using Keycloak with “OpenID Connect”…
You’ve posted a request in the support section. Unfortunately you have not completed the required support template. Please edit your post and add as much information as possible so that community supporters have the necessary technical information to help you resolve your issue! Especially describe the issue and provide logs. Don’t mix multiple topics.
In my installation SSO (OIDC with Keycloak) was working with nc34 which was “Hub 26 Spring” and still works with nc35 which is “Hub 26 Summer”.
Yes, you’re right, it’s server side encryption.
The german pop-up message in Nextcloud is “Verschlüsselungs-App ist aktiviert, aber die Schlüssel sind nicht initialisiert. Bitte ab- und wieder anmelden”
= Encryption-App is active, but no keys are initialized. Please log off and on
But apart from this message, there are no log entries.
Additionally, I attached to my docker instance and used “occ encryption:encrypt-all”.
But while there are gigabytes of data, the whole process took less than 10 secs for scanning all accounts.
So I am now wondering if the whole encryption implementation is really running, or if something got stuck somewhere. The nextcloud protocol doesn’t show a single line of message related to anything “occ” or “encryption” or “server” (sadly, the protocol is full of mail error messages, because some user haven’t configured their mail account integration)
Thanks for your help.
I am using Keycloak with “OpenID Connect” for about 2 years now. (Nextcloud and Keycloak are running on the same server, all in docker container behind reverse proxies)
Prior to nextcloud 35, the user key encryption simply was disabled.
With update to 35, nextcloud complained about an inactive default encryption module. I activated the corresponding app, and now I get the message anytime I log in with SSO.
When using:
nextcloud-aio-nextcloud:/var/www/html$ ./occ encryption:encrypt-all
You are about to encrypt all files stored in your Nextcloud installation.
Depending on the number of available files, and their size, this may take quite some time.
Please ensure that no user accesses their files during this time!
Note: The encryption module you use determines which files get encrypted.
Do you really wan to continue? (y/n) y
Encrypt all files with the Default encryption module
====================================================
Use master key to encrypt all files.
Start to encrypt users files
----------------------------
all files encrypted
[============================\]
The files in the Nextcloud AIO data container are encrypted (they start with HBEGIN:oc_encryption_module:OC_DEFAULT_MODULE:cipher:AES-256-CTR:signed:true:useLegacyFileKey:false:encoding:binary:HEND)
So the message in Nextcloud seems to be something like a false positive, but it really makes me nervous that someday the encryption breaks and all my files are garbage…
What was the precise message and where did you see it? There is nothing specific to v35 that I can think of, such as a setup check change, that has anything to do with SSE or the default encryption module nor suggesting it be activated.
If you weren’t using encryption previously, I would not suggest enabling it blindly. Both SSE and E2EE require careful planning and both have trade-offs.
