oauth2/OpenID discovery endpoint, nextcloud omits to connect via https and uses port 80

The Basics

  • Nextcloud Server version (e.g., 29.x.x):
    • [Nextcloud Hub 9] (30.0.5)
  • Operating system and version (e.g., Ubuntu 24.04):
    • Ubuntu 24.04
  • Web server and version (e.g, Apache 2.4.25):
    • Apache 2.4.58
  • Reverse proxy and version _(e.g. nginx 1.27.2)
    • traefik 3.2
  • PHP version (e.g, 8.3):
    • *8.3.6*
  • Is this the first time you’ve seen this error? (Yes / No):
    • initial setup
  • When did this problem seem to first start?
    • initial setup wizard of openid
  • Installation method (e.g. AlO, NCP, Bare Metal/Archive, etc.)
    • nextcloud-vm with script from github/.hanssonit
  • Are you using CloudfIare, mod_security, or similar? (Yes / No)
    • no

Summary of the issue you are facing:

I setup oidc with the OpenID Connect user backend app (from store) and authentik.

For the discovery endpoint there is a https url provided, that has a valid certificate (Lets encrypt), I get the error: Could not register provider: The discovery endpoint is not reachable.

As can be seen in the logs, nextcloud tries to call the provided https url on port 80??

“Message”: “Host "192.168.100.103" (authentik.mydomain.de:80) violates local access rules”,

To me, this seems the beginning of the problem to me.

unless I set:

‘allow_local_remote_servers’ => true,

If I do so, it works.

Steps to replicate it (hint: details matter!):

I have set the discovery endpoint to: https://authentik.mydomain.de/application/o/nextcloud/.well-known/openid-configuration

I have a valid certificate, can call the url in browser and from the nextcloud instance with curl without errors (see below).

I tried to set

‘overwritehost’ => ‘nextcloud.mydomain.de’,
‘overwriteprotocol’ => ‘https’,

but to no avail.

I have as custom configuration in addition

‘allowed_admin_ranges’ => [‘192.168.100.0/24’],
‘trusted_domains’ =>
array (
0 => ‘nextcloud.mydomain.de’,
1 => ‘192.168.100.110’,
),
‘trusted_proxies’ => [‘192.168.100.103/32’],

moreover i have a permanent router redirect in traefik for authentik mydomain de from 80 to 443.

The authentic. Mydomain . de subdomain is rebound locally with technitium dns to the reverse proxy (192.168.103). Currently it cannot be resolved externally to my instance at all (neither on http/nor https). I wonder if this could be of importance.


Displayed fqdn/Message of the day

I do not know if this is related in anyway, but weirdly on the cli the fqdn is just shown as ‘nextcloud’. It looks like this:

Application, launch url


| \| |_____ _| |_ __| |___ _  _ __| |
| .` / -_) \ /  _/ _| / _ \ || / _` |
|_|\_\___/_\_\\__\__|_\___/\_,_\__,_|

https://www.hanssonit.se/nextcloud-vm

FQDN: nextcloud
WAN IPv4: 217.95.109.41
WAN IPv6:
LAN IPv4: 192.168.100.110

Log entries

Nextcloud (raw)

{"reqId":"8YoTrTHSXwG1mZoUDKbj","level":3,"time":"2025-01-28T22:11:02+01:00","remoteAddr":"192.168.100.50","user":"zib","app":"user_oidc","method":"POST","url":"/apps/user_oidc/provider","message":"Discovery endpoint validation error","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36","version":"30.0.5.1","exception":{"Exception":"OCP\\Http\\Client\\LocalServerException","Message":"Host \"192.168.100.103\" (authentik.mydomain.de:80) violates local access rules","Code":0,"Trace":[{"file":"/var/www/nextcloud/3rdparty/guzzlehttp/guzzle/src/PrepareBodyMiddleware.php","line":35,"function":"OC\\Http\\Client\\{closure}","class":"OC\\Http\\Client\\DnsPinMiddleware","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/nextcloud/3rdparty/guzzlehttp/guzzle/src/Middleware.php","line":31,"function":"__invoke","class":"GuzzleHttp\\PrepareBodyMiddleware","type":"->"},{"file":"/var/www/nextcloud/3rdparty/guzzlehttp/guzzle/src/RedirectMiddleware.php","line":71,"function":"GuzzleHttp\\{closure}","class":"GuzzleHttp\\Middleware","type":"::","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/nextcloud/3rdparty/guzzlehttp/guzzle/src/Middleware.php","line":66,"function":"__invoke","class":"GuzzleHttp\\RedirectMiddleware","type":"->"},{"file":"/var/www/nextcloud/3rdparty/guzzlehttp/guzzle/src/HandlerStack.php","line":75,"function":"GuzzleHttp\\{closure}","class":"GuzzleHttp\\Middleware","type":"::","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/nextcloud/3rdparty/guzzlehttp/guzzle/src/Client.php","line":333,"function":"__invoke","class":"GuzzleHttp\\HandlerStack","type":"->"},{"file":"/var/www/nextcloud/3rdparty/guzzlehttp/guzzle/src/Client.php","line":169,"function":"transfer","class":"GuzzleHttp\\Client","type":"->"},{"file":"/var/www/nextcloud/3rdparty/guzzlehttp/guzzle/src/Client.php","line":189,"function":"requestAsync","class":"GuzzleHttp\\Client","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/nextcloud/lib/private/Http/Client/Client.php","line":205,"function":"request","class":"GuzzleHttp\\Client","type":"->"},{"file":"/var/www/nextcloud/apps/user_oidc/lib/Controller/SettingsController.php","line":48,"function":"get","class":"OC\\Http\\Client\\Client","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/nextcloud/apps/user_oidc/lib/Controller/SettingsController.php","line":85,"function":"isDiscoveryEndpointValid","class":"OCA\\UserOIDC\\Controller\\SettingsController","type":"->"},{"file":"/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php","line":208,"function":"createProvider","class":"OCA\\UserOIDC\\Controller\\SettingsController","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php","line":114,"function":"executeController","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/var/www/nextcloud/lib/private/AppFramework/App.php","line":161,"function":"dispatch","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/var/www/nextcloud/lib/private/Route/Router.php","line":302,"function":"main","class":"OC\\AppFramework\\App","type":"::"},{"file":"/var/www/nextcloud/lib/base.php","line":1003,"function":"match","class":"OC\\Route\\Router","type":"->"},{"file":"/var/www/nextcloud/index.php","line":24,"function":"handleRequest","class":"OC","type":"::"}],"File":"/var/www/nextcloud/lib/private/Http/Client/DnsPinMiddleware.php","Line":138,"message":"Discovery endpoint validation error","exception":[],"CustomMessage":"Discovery endpoint validation error"},"id":"6799491d70e8b"}

Nextcloud (formatted) (same log as raw)

{
  "reqId": "BQn8ONVjSWugc2qqhcUm",
  "level": 3,
  "time": "2025-01-28T22:47:51+01:00",
  "remoteAddr": "192.168.100.50",
  "user": "zib",
  "app": "user_oidc",
  "method": "PUT",
  "url": "/apps/user_oidc/provider/1",
  "message": "Discovery endpoint validation error",
  "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36",
  "version": "30.0.5.1",
  "exception": {
    "Exception": "OCP\\Http\\Client\\LocalServerException",
    "Message": "Host \"192.168.100.103\" (authentik.mydomain.de:80) violates local access rules",
    "Code": 0,
    "Trace": [
      {
        "file": "/var/www/nextcloud/3rdparty/guzzlehttp/guzzle/src/PrepareBodyMiddleware.php",
        "line": 35,
        "function": "OC\\Http\\Client\\{closure}",
        "class": "OC\\Http\\Client\\DnsPinMiddleware",
        "type": "->",
        "args": [
          "*** sensitive parameters replaced ***"
        ]
      },
      {
        "file": "/var/www/nextcloud/3rdparty/guzzlehttp/guzzle/src/Middleware.php",
        "line": 31,
        "function": "__invoke",
        "class": "GuzzleHttp\\PrepareBodyMiddleware",
        "type": "->"
      },
      {
        "file": "/var/www/nextcloud/3rdparty/guzzlehttp/guzzle/src/RedirectMiddleware.php",
        "line": 71,
        "function": "GuzzleHttp\\{closure}",
        "class": "GuzzleHttp\\Middleware",
        "type": "::",
        "args": [
          "*** sensitive parameters replaced ***"
        ]
      },
      {
        "file": "/var/www/nextcloud/3rdparty/guzzlehttp/guzzle/src/Middleware.php",
        "line": 66,
        "function": "__invoke",
        "class": "GuzzleHttp\\RedirectMiddleware",
        "type": "->"
      },
      {
        "file": "/var/www/nextcloud/3rdparty/guzzlehttp/guzzle/src/HandlerStack.php",
        "line": 75,
        "function": "GuzzleHttp\\{closure}",
        "class": "GuzzleHttp\\Middleware",
        "type": "::",
        "args": [
          "*** sensitive parameters replaced ***"
        ]
      },
      {
        "file": "/var/www/nextcloud/3rdparty/guzzlehttp/guzzle/src/Client.php",
        "line": 333,
        "function": "__invoke",
        "class": "GuzzleHttp\\HandlerStack",
        "type": "->"
      },
      {
        "file": "/var/www/nextcloud/3rdparty/guzzlehttp/guzzle/src/Client.php",
        "line": 169,
        "function": "transfer",
        "class": "GuzzleHttp\\Client",
        "type": "->"
      },
      {
        "file": "/var/www/nextcloud/3rdparty/guzzlehttp/guzzle/src/Client.php",
        "line": 189,
        "function": "requestAsync",
        "class": "GuzzleHttp\\Client",
        "type": "->",
        "args": [
          "*** sensitive parameters replaced ***"
        ]
      },
      {
        "file": "/var/www/nextcloud/lib/private/Http/Client/Client.php",
        "line": 205,
        "function": "request",
        "class": "GuzzleHttp\\Client",
        "type": "->"
      },
      {
        "file": "/var/www/nextcloud/apps/user_oidc/lib/Controller/SettingsController.php",
        "line": 48,
        "function": "get",
        "class": "OC\\Http\\Client\\Client",
        "type": "->",
        "args": [
          "*** sensitive parameters replaced ***"
        ]
      },
      {
        "file": "/var/www/nextcloud/apps/user_oidc/lib/Controller/SettingsController.php",
        "line": 120,
        "function": "isDiscoveryEndpointValid",
        "class": "OCA\\UserOIDC\\Controller\\SettingsController",
        "type": "->"
      },
      {
        "file": "/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php",
        "line": 208,
        "function": "updateProvider",
        "class": "OCA\\UserOIDC\\Controller\\SettingsController",
        "type": "->",
        "args": [
          "*** sensitive parameters replaced ***"
        ]
      },
      {
        "file": "/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php",
        "line": 114,
        "function": "executeController",
        "class": "OC\\AppFramework\\Http\\Dispatcher",
        "type": "->"
      },
      {
        "file": "/var/www/nextcloud/lib/private/AppFramework/App.php",
        "line": 161,
        "function": "dispatch",
        "class": "OC\\AppFramework\\Http\\Dispatcher",
        "type": "->"
      },
      {
        "file": "/var/www/nextcloud/lib/private/Route/Router.php",
        "line": 302,
        "function": "main",
        "class": "OC\\AppFramework\\App",
        "type": "::"
      },
      {
        "file": "/var/www/nextcloud/lib/base.php",
        "line": 1003,
        "function": "match",
        "class": "OC\\Route\\Router",
        "type": "->"
      },
      {
        "file": "/var/www/nextcloud/index.php",
        "line": 24,
        "function": "handleRequest",
        "class": "OC",
        "type": "::"
      }
    ],
    "File": "/var/www/nextcloud/lib/private/Http/Client/DnsPinMiddleware.php",
    "Line": 138,
    "message": "Discovery endpoint validation error",
    "exception": [],
    "CustomMessage": "Discovery endpoint validation error"
  },
  "id": "6799719d7e575"
}

Curl

root@nextcloud:/home/zib# curl -v https://authentik.mydomain.de/application/o/nextcloud/.well-known/openid-configuration
* Host authentik.mydomain.de:443 was resolved.
* IPv6: (none)
* IPv4: 192.168.100.103
*   Trying 192.168.100.103:443...
* Connected to authentik.mydomain.de (192.168.100.103) port 443
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
*  CAfile: /etc/ssl/certs/ca-certificates.crt
*  CApath: /etc/ssl/certs
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_CHACHA20_POLY1305_SHA256 / X25519 / RSASSA-PSS
* ALPN: server accepted h2
* Server certificate:
*  subject: CN=mydomain.de
*  start date: Dec  7 18:10:28 2024 GMT
*  expire date: Mar  7 18:10:27 2025 GMT
*  subjectAltName: host "authentik.mydomain.de" matched cert's "*.mydomain.de"
*  issuer: C=US; O=Let's Encrypt; CN=R10
*  SSL certificate verify ok.
*   Certificate level 0: Public key type RSA (4096/152 Bits/secBits), signed using sha256WithRSAEncryption
*   Certificate level 1: Public key type RSA (2048/112 Bits/secBits), signed using sha256WithRSAEncryption
*   Certificate level 2: Public key type RSA (4096/152 Bits/secBits), signed using sha256WithRSAEncryption
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* using HTTP/2
* [HTTP/2] [1] OPENED stream for https://authentik.mydomain.de/application/o/nextcloud/.well-known/openid-configuration
* [HTTP/2] [1] [:method: GET]
* [HTTP/2] [1] [:scheme: https]
* [HTTP/2] [1] [:authority: authentik.mydomain.de]
* [HTTP/2] [1] [:path: /application/o/nextcloud/.well-known/openid-configuration]
* [HTTP/2] [1] [user-agent: curl/8.5.0]
* [HTTP/2] [1] [accept: */*]
> GET /application/o/nextcloud/.well-known/openid-configuration HTTP/2
> Host: authentik.mydomain.de
> User-Agent: curl/8.5.0
> Accept: */*
>
< HTTP/2 200
< content-type: application/json
< date: Tue, 28 Jan 2025 21:26:56 GMT
< referrer-policy: same-origin
< vary: Accept-Encoding
< vary: Cookie
< x-authentik-id: 1ecec8756f964194a18bd110402cdee8
< x-content-type-options: nosniff
< x-frame-options: DENY
< x-powered-by: authentik
<
{
  "issuer": "https://authentik.mydomain.de/application/o/nextcloud/",
  "authorization_endpoint": "https://authentik.mydomain.de/application/o/authorize/",
  "token_endpoint": "https://authentik.mydomain.de/application/o/token/",
  "userinfo_endpoint": "https://authentik.mydomain.de/application/o/userinfo/",
  "end_session_endpoint": "https://authentik.mydomain.de/application/o/nextcloud/end-session/",
  "introspection_endpoint": "https://authentik.mydomain.de/application/o/introspect/",
  "revocation_endpoint": "https://authentik.mydomain.de/application/o/revoke/",
  "device_authorization_endpoint": "https://authentik.mydomain.de/application/o/device/",
  "response_types_supported": [
    "code",
    "id_token",
    "id_token token",
    "code token",
    "code id_token",
    "code id_token token"
  ],
  "response_modes_supported": [
    "query",
    "fragment",
    "form_post"
  ],
  "jwks_uri": "https://authentik.mydomain.de/application/o/nextcloud/jwks/",
  "grant_types_supported": [
    "authorization_code",
    "refresh_token",
    "implicit",
    "client_credentials",
    "password",
    "urn:ietf:params:oauth:grant-type:device_code"
  ],
  "id_token_signing_alg_values_supported": [
    "RS256"
  ],
  "subject_types_supported": [
    "public"
  ],
  "token_endpoint_auth_methods_supported": [
    "client_secret_post",
    "client_secret_basic"
  ],
  "acr_values_supported": [
    "goauthentik.io/providers/oauth2/default"
  ],
  "scopes_supported": [
    "profile",
    "email",
    "profile",
    "openid"
  ],
  "request_parameter_supported": false,
  "claims_supported": [
    "sub",
    "iss",
    "aud",
    "exp",
    "iat",
    "auth_time",
    "acr",
    "amr",
    "nonce",
    "email",
    "email_verified",
    "name",
    "groups",
    "quota",
    "user_id",
    "name",
    "given_name",
    "preferred_username",
    "nickname",
    "groups"
  ],
  "claims_parameter_supported": false,
  "code_challenge_methods_supported": [
    "plain",
    "S256"
  ]
* Connection #0 to host authentik.mydomain.de left intact
}root@nextcloud:/home/zib#openssl s_client -connect authentik.mydomain.de:443 -CAfile /etc/ssl/certs/ca-certificates.crtt
CONNECTED(00000003)
depth=2 C = US, O = Internet Security Research Group, CN = ISRG Root X1
verify return:1
depth=1 C = US, O = Let's Encrypt, CN = R10
verify return:1
depth=0 CN = mydomain.de
verify return:1
---
Certificate chain
 0 s:CN = mydomain.de
   i:C = US, O = Let's Encrypt, CN = R10
   a:PKEY: rsaEncryption, 4096 (bit); sigalg: RSA-SHA256
   v:NotBefore: Dec  7 18:10:28 2024 GMT; NotAfter: Mar  7 18:10:27 2025 GMT
 1 s:C = US, O = Let's Encrypt, CN = R10
   i:C = US, O = Internet Security Research Group, CN = ISRG Root X1
   a:PKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
   v:NotBefore: Mar 13 00:00:00 2024 GMT; NotAfter: Mar 12 23:59:59 2027 GMT
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIF8DCCBNigAwIBAgISBOPIWM0aG5JKYF0CiJ0TyznbMA0GCSqGSIb3DQEBCwUA
MDMxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQwwCgYDVQQD
EwNSMTAwHhcNMjQxMjA3MTgxMDI4WhcNMjUwMzA3MTgxMDI3WjAUMRIwEAYDVQQD
Ewl6ZWViMjQuZGUwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCllGst
LqENMWA58I5KbNAZZGwmwU2KUpdoidsHj1ntSwzPzh5ciekVOJq0HPDNbWIieZSb
XAfPZgy5GEOSh2yHtkNVB/EbVALZsfWrRP58hFB14KwW2SMK1QzRhLTTLIbQ0erx
lfsMF+pKJ7HU4f0d1uDp7JAqy6cGrsatLhnspbULf2p6qtDVKvKI7F96Q8Fux9gu
ixaJ3ZpUpcqvD4RpqOcFAJRk7LbwTXqBSuMwLU8m0l5snDH9U1hu32Nv0jv2+Ppm
98Ds+uRhBphUs1WoqMjguw8KLJ7W5WqcW27laCziaEgK+HKbDBjo4DnlHJ2hhDc1
E2jagDp8ofdMEHLz0a8nsBoRrMCMUckX9njZv2SZdGN0SaIFLgGhAsPBG3LMlRNY
sasgOmzUEBzYi187aAOw9Exz0ZVagIrm0veHwOuafkYYY2PRgFWuGztaxZGfxGmG
VFHK0cgVtV+pMVv590o8InpFnpp/s65T5DeAC473w1fyJk//YrllvcAzDD+E6jJV
DSZ3RhcL40IIKf7L0aNqKAoWgaPjYgY3EOiLGeZeNkgpJFyIfmMtRgQpRTk9jbtg
fgIt3FIqvw2FRbNavdgvqOBjHRSEXQ9JJ/7V8/hSejzDGhPBRJb7gNZxD1KDrv8P
Lg5fLBbkKArxxtvfgLAcojdVSLhbnv4eJOlcOQIDAQABo4ICGzCCAhcwDgYDVR0P
AQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjAMBgNVHRMB
Af8EAjAAMB0GA1UdDgQWBBT7dpE2+cc15WUWOVT7WMQDVGV/sDAfBgNVHSMEGDAW
gBS7vMNHpeS8qcbDpHIMEI2iNeHI6DBXBggrBgEFBQcBAQRLMEkwIgYIKwYBBQUH
MAGGFmh0dHA6Ly9yMTAuby5sZW5jci5vcmcwIwYIKwYBBQUHMAKGF2h0dHA6Ly9y
MTAuaS5sZW5jci5vcmcvMCEGA1UdEQQaMBiCCyouemVlYjI0LmRlggl6ZWViMjQu
ZGUwEwYDVR0gBAwwCjAIBgZngQwBAgEwggEFBgorBgEEAdZ5AgQCBIH2BIHzAPEA
dwCi4wrkRe+9rZt+OO1HZ3dT14JbhJTXK14bLMS5UKRH5wAAAZOihmqAAAAEAwBI
MEYCIQCg686KGGVfABMEOeFcifjzCT9+xAdZ8beokKsV2xxRDwIhAPLMHyNm3KCd
T51LaJu1ZUNd8xgkQ+Hqtr76CzPQNRQAAHYAE0rfGrWYQgl4DG/vTHqRpBa3I0nO
WFdq367ap8Kr4CIAAAGTooZrRgAABAMARzBFAiEAxTJj1w4RZJkhCVN8VlraiONY
ijF15kgGVh5WmnRR6YgCIH2k0O3dDEEKr9vysPCx2+trAmfDgy8Hc3q2bDtvI9yX
MA0GCSqGSIb3DQEBCwUAA4IBAQAMovbHHVVoSvR7Z3yiSd7J5eqTr8GzGzFfICH/
Ahn1c7+bn1AosolvnmVrcl6h6ryimz6B20Sk4NuaOMvrwB1CpBZQldwQSFEuSJR/
omsnh8yRIr4I0JhnIG7mb+bOZkAUAHQiQHl0KRWSlLaHGcF+I4xrzeIxRwQj9o76
+qoOU5FmFw9ZtDeZvwNoaTdtw9O/kFLg/VYrZA3ZR2IBZjimSlWQHBnkha7gWij3
XwFCQ6sASokyj9WJjyR0k3xIKPsFMAwmMC4aph92Apf/MhoVmKEyxdYi06DrZnae
Ika+z5hvXgKpu26TQveL/Zl/HwKFiqfyz+mH8MCwqjx3/eVg
-----END CERTIFICATE-----
subject=CN = mydomain.de
issuer=C = US, O = Let's Encrypt, CN = R10
---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 3614 bytes and written 385 bytes
Verification: OK
---
New, TLSv1.3, Cipher is TLS_CHACHA20_POLY1305_SHA256
Server public key is 4096 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
---
---
Post-Handshake New Session Ticket arrived:
SSL-Session:
    Protocol  : TLSv1.3
    Cipher    : TLS_CHACHA20_POLY1305_SHA256
    Session-ID: AA1B447AA3373E54455901C161EE4BD7338B32BDF66D188BC5708EEE69D2B006
    Session-ID-ctx:
    Resumption PSK: 2E438557F21F3E48F436F611035CFA6F92754CA22DBD539FCA5E1ADF773095F7
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 604800 (seconds)
    TLS session ticket:
    0000 - 51 91 8b 52 79 60 cf 86-4d 62 49 6a e2 9e eb e9   Q..Ry`..MbIj....
    0010 - f8 97 f7 2f 74 a0 9a 39-4e 26 01 d9 d5 be 5d b4   .../t..9N&....].
    0020 - 60 ea 49 81 1e f4 7d 18-0d cd 7b 63 ef 83 12 7a   `.I...}...{c...z
    0030 - 74 f4 4d 83 bf ed 93 80-b8 4c bd ec 4a 17 dc 25   t.M......L..J..%
    0040 - 7a 08 69 20 b9 1a c1 f0-1b 72 a2 ef 82 a9 26 cb   z.i .....r....&.
    0050 - 0b 57 6a df f8 14 cb a3-ab fa 2b a1 75 da 28 50   .Wj.......+.u.(P
    0060 - 3e ea 17 9f 6d 98 7b 0d-25                        >...m.{.%

    Start Time: 1738100386
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
    Extended master secret: no
    Max Early Data: 0
---
read R BLOCK
closed
root@nextcloud:/home/zib#

Web server / Reverse Proxy

The output of your Apache/nginx/system log in /var/log/____:

reverse proxy does not log an error

Configuration

Nextcloud

The output of occ config:list system

{
    "system": {
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "nextcloud.mydomain.de",
            "192.168.100.110"
        ],
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "allow_local_remote_servers": true,
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "pgsql",
        "version": "30.0.5.1",
        "overwrite.cli.url": "https:\/\/nextcloud",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": "0",
            "dbindex": "0",
            "timeout": "0.5",
            "password": "***REMOVED SENSITIVE VALUE***"
        },
        "memcache.local": "\\OC\\Memcache\\Redis",
        "filelocking.enabled": "true",
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "upgrade.disable-web": true,
        "log_type": "file",
        "logfile": "\/var\/log\/nextcloud\/nextcloud.log",
        "loglevel": "2",
        "log.condition": {
            "apps": [
                "admin_audit"
            ]
        },
        "maintenance_window_start": 2,
        "mail_smtpmode": "smtp",
        "remember_login_cookie_lifetime": "1800",
        "log_rotate_size": "10485760",
        "trashbin_retention_obligation": "auto, 60",
        "versions_retention_obligation": "auto, 180",
        "activity_expire_days": "120",
        "simpleSignUpLink.shown": false,
        "default_phone_region": "de",
        "logtimezone": "Europe\/Berlin",
        "htaccess.RewriteBase": "\/",
        "preview_concurrency_new": "8",
        "preview_concurrency_all": "16",
        "enabledPreviewProviders": [
            "OC\\Preview\\Imaginary",
            "OC\\Preview\\Image",
            "OC\\Preview\\MarkDown",
            "OC\\Preview\\MP3",
            "OC\\Preview\\TXT",
            "OC\\Preview\\OpenDocument",
            "OC\\Preview\\Movie",
            "OC\\Preview\\Krita",
            "OC\\Preview\\ImaginaryPDF"
        ],
        "preview_imaginary_url": "***REMOVED SENSITIVE VALUE***",
        "preview_max_x": "2048",
        "preview_max_y": "2048",
        "preview_max_memory": "256",
        "preview_format": "webp",
        "maintenance": false,
        "allowed_admin_ranges": [
            "192.168.100.0\/24"
        ],
        "app_install_overwrite": [
            "extract"
        ]
    },
    "apps": {
        "activity": {
            "installed_version": "3.0.0",
            "types": "filesystem",
            "enabled": "yes"
        },
        "admin_audit": {
            "installed_version": "1.20.0",
            "types": "logging",
            "enabled": "yes",
            "logfile": "\/var\/log\/nextcloud\/audit.log"
        },
        "app_api": {
            "installed_version": "4.0.5",
            "types": "",
            "enabled": "yes"
        },
        "backgroundjob": {
            "lastjob": "110"
        },
        "bruteforcesettings": {
            "installed_version": "3.0.0",
            "types": "",
            "enabled": "yes"
        },
        "calendar": {
            "installed_version": "5.0.9",
            "types": "",
            "enabled": "yes"
        },
        "circles": {
            "installed_version": "30.0.0",
            "types": "filesystem,dav",
            "enabled": "yes",
            "loopback_tmp_path": "\/",
            "migration_22": "1",
            "migration_run": "0",
            "loopback_tmp_scheme": "https",
            "maintenance_run": "0",
            "maintenance_update": "{\"3\":1738125309,\"2\":1738127102,\"1\":1738127102}"
        },
        "cloud_federation_api": {
            "installed_version": "1.13.0",
            "types": "filesystem",
            "enabled": "yes"
        },
        "collectives": {
            "types": "filesystem",
            "enabled": "yes",
            "installed_version": "2.16.0"
        },
        "comments": {
            "installed_version": "1.20.1",
            "types": "logging",
            "enabled": "yes"
        },
        "contacts": {
            "installed_version": "6.1.3",
            "types": "dav",
            "enabled": "yes"
        },
        "contactsinteraction": {
            "installed_version": "1.11.0",
            "types": "dav",
            "enabled": "yes"
        },
        "core": {
            "installedat": "1737837505.6529",
            "vendor": "nextcloud",
            "public_files": "files_sharing\/public.php",
            "lastupdatedat": 1738116642,
            "backgroundjobs_mode": "cron",
            "metadataGenerationDone": true,
            "moveavatarsdone": "yes",
            "previewsCleanedUp": "1",
            "lastcron": 1738127102,
            "lastupdateResult": "[]",
            "files_metadata": {
                "photos-original_date_time": {
                    "value": null,
                    "type": "int",
                    "etag": "",
                    "indexed": true,
                    "editPermission": 0
                },
                "photos-size": {
                    "value": null,
                    "type": "array",
                    "etag": "",
                    "indexed": false,
                    "editPermission": 0
                },
                "photos-exif": {
                    "value": null,
                    "type": "array",
                    "etag": "",
                    "indexed": false,
                    "editPermission": 0
                },
                "photos-ifd0": {
                    "value": null,
                    "type": "array",
                    "etag": "",
                    "indexed": false,
                    "editPermission": 0
                },
                "blurhash": {
                    "value": null,
                    "type": "string",
                    "etag": "317236e8d81f8b0dafb53d4474bce891",
                    "indexed": false,
                    "editPermission": 0
                },
                "photos-gps": {
                    "value": null,
                    "type": "array",
                    "etag": "",
                    "indexed": false,
                    "editPermission": 0
                },
                "photos-place": {
                    "value": null,
                    "type": "string",
                    "etag": "",
                    "indexed": true,
                    "editPermission": 0
                }
            },
            "oc.integritycheck.checker": []
        },
        "dashboard": {
            "installed_version": "7.10.0",
            "types": "",
            "enabled": "yes"
        },
        "dav": {
            "installed_version": "1.31.1",
            "types": "filesystem",
            "enabled": "yes",
            "regeneratedBirthdayCalendarsForYearFix": "yes",
            "buildCalendarSearchIndex": "yes",
            "buildCalendarReminderIndex": "yes"
        },
        "deck": {
            "installed_version": "1.14.3",
            "types": "dav",
            "enabled": "yes"
        },
        "extract": {
            "installed_version": "1.3.6",
            "types": "",
            "enabled": "yes"
        },
        "federatedfilesharing": {
            "installed_version": "1.20.0",
            "types": "",
            "enabled": "yes"
        },
        "federation": {
            "installed_version": "1.20.0",
            "types": "authentication",
            "enabled": "yes"
        },
        "files": {
            "installed_version": "2.2.0",
            "types": "filesystem",
            "enabled": "yes",
            "max_chunk_size": "104857600"
        },
        "files_downloadlimit": {
            "installed_version": "3.0.0",
            "types": "",
            "enabled": "yes"
        },
        "files_external": {
            "enabled": "yes",
            "installed_version": "1.22.0",
            "types": "filesystem"
        },
        "files_pdfviewer": {
            "installed_version": "3.0.0",
            "types": "",
            "enabled": "yes"
        },
        "files_reminders": {
            "installed_version": "1.3.0",
            "types": "",
            "enabled": "yes"
        },
        "files_sharing": {
            "installed_version": "1.22.0",
            "types": "filesystem",
            "enabled": "yes"
        },
        "files_trashbin": {
            "installed_version": "1.20.1",
            "types": "filesystem,dav",
            "enabled": "yes"
        },
        "files_versions": {
            "installed_version": "1.23.0",
            "types": "filesystem,dav",
            "enabled": "yes"
        },
        "firstrunwizard": {
            "installed_version": "3.0.0",
            "types": "logging",
            "enabled": "yes"
        },
        "logreader": {
            "installed_version": "3.0.0",
            "types": "logging",
            "enabled": "yes"
        },
        "lookup_server_connector": {
            "installed_version": "1.18.0",
            "types": "authentication",
            "enabled": "yes"
        },
        "mail": {
            "installed_version": "4.1.2",
            "types": "",
            "enabled": "yes"
        },
        "nextcloud_announcements": {
            "installed_version": "2.0.0",
            "types": "logging",
            "enabled": "yes",
            "pub_date": "Thu, 24 Oct 2019 00:00:00 +0200"
        },
        "notifications": {
            "installed_version": "3.0.0",
            "types": "logging",
            "enabled": "yes"
        },
        "oauth2": {
            "installed_version": "1.18.1",
            "types": "authentication",
            "enabled": "yes"
        },
        "password_policy": {
            "installed_version": "2.0.0",
            "types": "authentication",
            "enabled": "yes"
        },
        "photos": {
            "installed_version": "3.0.2",
            "types": "dav,authentication",
            "enabled": "yes",
            "lastPlaceMappedUser": "zib",
            "lastPlaceMappingDone": "true"
        },
        "preview": {
            "webp_quality": "65"
        },
        "privacy": {
            "installed_version": "2.0.0",
            "types": "",
            "enabled": "yes"
        },
        "provisioning_api": {
            "installed_version": "1.20.0",
            "types": "prevent_group_restriction",
            "enabled": "yes"
        },
        "recommendations": {
            "installed_version": "3.0.0",
            "types": "",
            "enabled": "yes"
        },
        "related_resources": {
            "installed_version": "1.5.0",
            "types": "",
            "enabled": "yes"
        },
        "serverinfo": {
            "installed_version": "2.0.0",
            "types": "",
            "enabled": "yes",
            "cached_count_filecache": "848",
            "cached_count_storages": "5"
        },
        "settings": {
            "installed_version": "1.13.0",
            "types": "",
            "enabled": "yes"
        },
        "sharebymail": {
            "installed_version": "1.20.0",
            "types": "filesystem",
            "enabled": "yes"
        },
        "support": {
            "installed_version": "2.0.0",
            "types": "session",
            "enabled": "yes",
            "SwitchUpdaterServerHasRun": "yes"
        },
        "survey_client": {
            "installed_version": "2.0.0",
            "types": "",
            "enabled": "yes",
            "last_sent": "1737845102",
            "last_report": "{\"id\":\"ocq6he1v4i0y\",\"items\":[[\"server\",\"version\",\"30.0.5.1\"],[\"server\",\"code\",\"other\"],[\"server\",\"enable_avatars\",\"yes\"],[\"server\",\"enable_previews\",\"yes\"],[\"server\",\"memcache.local\",\"\\\\OC\\\\Memcache\\\\Redis\"],[\"server\",\"memcache.distributed\",\"\\\\OC\\\\Memcache\\\\Redis\"],[\"server\",\"asset-pipeline.enabled\",\"no\"],[\"server\",\"filelocking.enabled\",\"yes\"],[\"server\",\"memcache.locking\",\"\\\\OC\\\\Memcache\\\\Redis\"],[\"server\",\"debug\",\"no\"],[\"server\",\"cron\",\"cron\"],[\"php\",\"version\",\"8.3.6\"],[\"php\",\"memory_limit\",-1],[\"php\",\"max_execution_time\",0],[\"php\",\"upload_max_filesize\",2097152],[\"database\",\"type\",\"pgsql\"],[\"database\",\"version\",\"PostgreSQL 16.6 (Ubuntu 16.6-0ubuntu0.24.04.1) on x86_64-pc-linux-gnu, compiled by gcc (Ubuntu 13.2.0-23ubuntu4) 13.2.0, 64-bit\"],[\"database\",\"size\",17994211],[\"apps\",\"logreader\",\"3.0.0\"],[\"apps\",\"federation\",\"1.20.0\"],[\"apps\",\"provisioning_api\",\"1.20.0\"],[\"apps\",\"support\",\"2.0.0\"],[\"apps\",\"password_policy\",\"2.0.0\"],[\"apps\",\"circles\",\"30.0.0\"],[\"apps\",\"updatenotification\",\"1.20.0\"],[\"apps\",\"bruteforcesettings\",\"3.0.0\"],[\"apps\",\"app_api\",\"4.0.5\"],[\"apps\",\"twofactor_backupcodes\",\"1.19.0\"],[\"apps\",\"files_versions\",\"1.23.0\"],[\"apps\",\"user_status\",\"1.10.0\"],[\"apps\",\"files_trashbin\",\"1.20.1\"],[\"apps\",\"text\",\"4.1.0\"],[\"apps\",\"webhook_listeners\",\"1.1.0-dev\"],[\"apps\",\"comments\",\"1.20.1\"],[\"apps\",\"lookup_server_connector\",\"1.18.0\"],[\"apps\",\"systemtags\",\"1.20.0\"],[\"apps\",\"nextcloud_announcements\",\"2.0.0\"],[\"apps\",\"theming\",\"2.5.0\"],[\"apps\",\"files_downloadlimit\",\"3.0.0\"],[\"apps\",\"oauth2\",\"1.18.1\"],[\"apps\",\"survey_client\",\"2.0.0\"],[\"apps\",\"files_sharing\",\"1.22.0\"],[\"apps\",\"viewer\",\"3.0.0\"],[\"apps\",\"related_resources\",\"1.5.0\"],[\"apps\",\"dav\",\"1.31.1\"],[\"apps\",\"cloud_federation_api\",\"1.13.0\"],[\"apps\",\"photos\",\"3.0.2\"],[\"apps\",\"weather_status\",\"1.10.0\"],[\"apps\",\"recommendations\",\"3.0.0\"],[\"apps\",\"files\",\"2.2.0\"],[\"apps\",\"serverinfo\",\"2.0.0\"],[\"apps\",\"files_reminders\",\"1.3.0\"],[\"apps\",\"privacy\",\"2.0.0\"],[\"apps\",\"dashboard\",\"7.10.0\"],[\"apps\",\"sharebymail\",\"1.20.0\"],[\"apps\",\"files_pdfviewer\",\"3.0.0\"],[\"apps\",\"settings\",\"1.13.0\"],[\"apps\",\"activity\",\"3.0.0\"],[\"apps\",\"federatedfilesharing\",\"1.20.0\"],[\"apps\",\"firstrunwizard\",\"3.0.0\"],[\"apps\",\"contactsinteraction\",\"1.11.0\"],[\"apps\",\"notifications\",\"3.0.0\"],[\"apps\",\"workflowengine\",\"2.12.0\"],[\"apps\",\"admin_audit\",\"1.20.0\"],[\"apps\",\"calendar\",\"5.0.9\"],[\"apps\",\"contacts\",\"6.1.3\"],[\"apps\",\"mail\",\"4.1.2\"],[\"apps\",\"deck\",\"1.14.3\"],[\"apps\",\"collectives\",\"2.15.2\"],[\"apps\",\"files_external\",\"1.22.0\"],[\"stats\",\"num_files\",253],[\"stats\",\"num_users\",1],[\"stats\",\"num_storages\",3],[\"stats\",\"num_storages_local\",2],[\"stats\",\"num_storages_home\",1],[\"stats\",\"num_storages_other\",0],[\"stats\",\"num_comments\",0],[\"stats\",\"num_comment_markers\",0],[\"stats\",\"num_systemtags\",0],[\"stats\",\"num_systemtags_mappings\",0],[\"files_sharing\",\"num_shares\",0],[\"files_sharing\",\"num_shares_user\",0],[\"files_sharing\",\"num_shares_groups\",0],[\"files_sharing\",\"num_shares_link\",0],[\"files_sharing\",\"num_shares_link_no_password\",0],[\"files_sharing\",\"num_fed_shares_sent\",0],[\"files_sharing\",\"num_fed_shares_received\",0],[\"encryption\",\"enabled\",\"no\"],[\"encryption\",\"default_module\",\"no\"]]}"
        },
        "systemtags": {
            "installed_version": "1.20.0",
            "types": "logging",
            "enabled": "yes"
        },
        "text": {
            "installed_version": "4.1.0",
            "types": "dav",
            "enabled": "yes"
        },
        "theming": {
            "installed_version": "2.5.0",
            "types": "logging",
            "enabled": "yes",
            "productName": "Nextcloud HanssonIT VM"
        },
        "twofactor_backupcodes": {
            "installed_version": "1.19.0",
            "types": "",
            "enabled": "yes"
        },
        "updatenotification": {
            "installed_version": "1.20.0",
            "types": "",
            "enabled": "yes",
            "notify_groups": "[]",
            "update_check_errors": 0,
            "collectives": "2.16.0"
        },
        "user_oidc": {
            "installed_version": "6.2.1",
            "types": "authentication",
            "enabled": "yes",
            "id4me_enabled": "1",
            "provider-1-uniqueUid": "1",
            "provider-1-checkBearer": "0",
            "provider-1-bearerProvisioning": "0",
            "provider-1-providerBasedId": "0",
            "provider-1-groupProvisioning": "1",
            "provider-1-sendIdTokenHint": "1",
            "provider-1-mappingUid": "user_id",
            "provider-1-mappingQuota": "quota",
            "provider-1-mappingGroups": "groups",
            "provider-1-mappingDisplayName": "name",
            "provider-1-mappingEmail": "email",
            "provider-1-mappingAddress": "",
            "provider-1-mappingStreetaddress": "",
            "provider-1-mappingPostalcode": "",
            "provider-1-mappingLocality": "",
            "provider-1-mappingRegion": "",
            "provider-1-mappingCountry": "",
            "provider-1-mappingWebsite": "",
            "provider-1-mappingAvatar": "",
            "provider-1-mappingTwitter": "",
            "provider-1-mappingFediverse": "",
            "provider-1-mappingOrganisation": "",
            "provider-1-mappingRole": "",
            "provider-1-mappingHeadline": "",
            "provider-1-mappingBiography": "",
            "provider-1-mappingPhonenumber": "",
            "provider-1-mappingGender": "",
            "provider-1-extraClaims": "",
            "provider-1-groupWhitelistRegex": "",
            "provider-1-restrictLoginToGroups": "0",
            "provider-1-jwksCache": "{\"keys\": [{\"alg\": \"RS256\", \"kid\": \"297cfca0b1aca9a1a5d9c3508a988577\", \"kty\": \"RSA\", \"use\": \"sig\", \"n\": \"l9TQITMv5Xb9s-xawHf6lCgeUs6UGqGfqndwnvFrRJVjL4Rp-5OjqituvoW2vfUlMpyl8e4D33KPK4ocmGcHOgMBM0i7riy8Bq65gp2GAfw0NCxeFYe9FPh_1KF80FJJxZe6XtVanCmHfkHx9v4nIEmbF6l1UlYrlSN7V-F3tcN1P5sNS9F5ulHf6Qh5aHrDAFO6ep0aGYMbAnAVoMfPQ7eMD_uJsIlB9DMWIZ1fSJHRneeeplg_-CX6jWqlwbDiINfQBHZyfORYDXmGzK-wm9WW4alovUPyd-brUb7BLiCB8Tft2gAZ3QqgO8X9m1yte0FNtdF5DTiVoSv9PU2nZv9YiJiji9tBHj8T4A7ZQAhYNlO1cctx21VUm4AhWAeexx06QWqXBuaUu1DTfrqujPumwwSpdPufNGrMxiWQVSMIOzEGv-NL0juCI-fh8In0NfIbao5pNsPfhphSEix5d4D-k4NgvPG0WuRpRXLBIAqWaCD52wGXb_L2CaFrs6pUYJQecP2jtPk3ywBiNZdNNpV1eiaYzUvexI5He7NI0J43bbsN1CT9tuYMvrO0kOthZSxRv2-_dUMtQhrjE-61lccc-9-tE4V1WCTxQHkMrpvd-6-CocdMr7Ws4zBouaNMXnEJVvqac1CC1WbGCOPxAX2Ol3DrosDXhifFWwV9yhU\", \"e\": \"AQAB\", \"x5c\": [\"MIIFUjCCAzqgAwIBAgIQZOSU8YrPSDuujCwFlPl1eDANBgkqhkiG9w0BAQsFADAdMRswGQYDVQQDDBJhdXRoZW50aWsgMjAyNC44LjMwHhcNMjQxMDA5MjIwMjA1WhcNMjUxMDEwMjIwMjA1WjBWMSowKAYDVQQDDCFhdXRoZW50aWsgU2VsZi1zaWduZWQgQ2VydGlmaWNhdGUxEjAQBgNVBAoMCWF1dGhlbnRpazEUMBIGA1UECwwLU2VsZi1zaWduZWQwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCX1NAhMy\/ldv2z7FrAd\/qUKB5SzpQaoZ+qd3Ce8WtElWMvhGn7k6OqK26+hba99SUynKXx7gPfco8rihyYZwc6AwEzSLuuLLwGrrmCnYYB\/DQ0LF4Vh70U+H\/UoXzQUknFl7pe1VqcKYd+QfH2\/icgSZsXqXVSViuVI3tX4Xe1w3U\/mw1L0Xm6Ud\/pCHloesMAU7p6nRoZgxsCcBWgx89Dt4wP+4mwiUH0MxYhnV9IkdGd556mWD\/4JfqNaqXBsOIg19AEdnJ85FgNeYbMr7Cb1ZbhqWi9Q\/J35utRvsEuIIHxN+3aABndCqA7xf2bXK17QU210XkNOJWhK\/09Tadm\/1iImKOL20EePxPgDtlACFg2U7Vxy3HbVVSbgCFYB57HHTpBapcG5pS7UNN+uq6M+6bDBKl0+580aszGJZBVIwg7MQa\/40vSO4Ij5+HwifQ18htqjmk2w9+GmFISLHl3gP6Tg2C88bRa5GlFcsEgCpZoIPnbAZdv8vYJoWuzqlRglB5w\/aO0+TfLAGI1l002lXV6JpjNS97Ejkd7s0jQnjdtuw3UJP225gy+s7SQ62FlLFG\/b791Qy1CGuMT7rWVxxz7360ThXVYJPFAeQyum937r4Khx0yvtazjMGi5o0xecQlW+ppzUILVZsYI4\/EBfY6XcOuiwNeGJ8VbBX3KFQIDAQABo1UwUzBRBgNVHREBAf8ERzBFgkNrUktPR2dlc0xDdkRMM2wyYkdFRHNpbzkxb1R5cmZIbGhTRDB6eEV2LnNlbGYtc2lnbmVkLmdvYXV0aGVudGlrLmlvMA0GCSqGSIb3DQEBCwUAA4ICAQBa3Zi27nzRiXXlUvqZXEiMlnj2t0R9qkcj1qJdS+N9\/B1ns\/\/BFjavYdMH8Wu4pRc2m98G+keHwt8zY2BC4DtwdJpiTut7seXvY3A1OK+jyoNrPQjAYMyXJTWKqF\/NLRy3BnZVKYVls3KOY75H9s3ZYJgHZ3llVl4L7Glob3VRABpxC0UQKUXMRpFKJ37FnWRTfwtp52PB64czCvE2PKkprCgsAbXp+q9vfL3XpKqnzVzHTXL1h+\/4\/JYvJ+Mkay0ytERx5qgJd9vUQNTnATyrN35WzbXecW9Z4JgADMO5zqO4RdlYoBwTXcT+kIqe0mlAshMoonyfSg2MKqXwd96\/NqCRqhhMq7jbB6UMr4XS7gFnkxoiX9\/+CozSZ0FvySfpmGv6CXYvQtqcX2RxDng+EhsKftt3N85r19vdWuLH18tPoFfecxMn6FVW\/U0QiLGyd1kD7gkG\/FgQkb+cVsuLmJOj9JM1eb8HogwTmSOn8vxcK3XXM31PCH\/AwZ2RjE2GBUqgU79vnlO++nUTRckyZg5Q+tGc51itr7m\/bbrZDk8edJpEQ2zMg5MlmNFicIDPhHJiFYwkuC9YcONJ+\/BGmnFT63podEVbCuzLePu54LVRzts429NIXY1R5vK0z9M6v7zmsa0xkOtUOO+RApExQX7ZuySXN86e6RLgx5HZoQ==\"], \"x5t\": \"ZW259KAPO8WPpdhqaVpMIRgxsYk\", \"x5t#S256\": \"tekqicXxF1BUrd_F4l9oWkCyEGu8uHYuxA9L2NqUqis\"}]}",
            "allow_multiple_user_backends": "0",
            "provider-1-jwksCacheTimestamp": "1738106745"
        },
        "user_status": {
            "installed_version": "1.10.0",
            "types": "",
            "enabled": "yes"
        },
        "viewer": {
            "installed_version": "3.0.0",
            "types": "",
            "enabled": "yes"
        },
        "weather_status": {
            "installed_version": "1.10.0",
            "types": "",
            "enabled": "yes"
        },
        "webhook_listeners": {
            "installed_version": "1.1.0-dev",
            "types": "filesystem",
            "enabled": "yes"
        },
        "workflowengine": {
            "installed_version": "2.12.0",
            "types": "filesystem",
            "enabled": "yes"
        }
    }
}

Apps

The output of occ app:list:

Enabled:
  - activity: 3.0.0
  - admin_audit: 1.20.0
  - app_api: 4.0.5
  - bruteforcesettings: 3.0.0
  - calendar: 5.0.9
  - circles: 30.0.0
  - cloud_federation_api: 1.13.0
  - collectives: 2.16.0
  - comments: 1.20.1
  - contacts: 6.1.3
  - contactsinteraction: 1.11.0
  - dashboard: 7.10.0
  - dav: 1.31.1
  - deck: 1.14.3
  - extract: 1.3.6
  - federatedfilesharing: 1.20.0
  - federation: 1.20.0
  - files: 2.2.0
  - files_downloadlimit: 3.0.0
  - files_external: 1.22.0
  - files_pdfviewer: 3.0.0
  - files_reminders: 1.3.0
  - files_sharing: 1.22.0
  - files_trashbin: 1.20.1
  - files_versions: 1.23.0
  - firstrunwizard: 3.0.0
  - logreader: 3.0.0
  - lookup_server_connector: 1.18.0
  - mail: 4.1.2
  - nextcloud_announcements: 2.0.0
  - notifications: 3.0.0
  - oauth2: 1.18.1
  - password_policy: 2.0.0
  - photos: 3.0.2
  - privacy: 2.0.0
  - provisioning_api: 1.20.0
  - recommendations: 3.0.0
  - related_resources: 1.5.0
  - serverinfo: 2.0.0
  - settings: 1.13.0
  - sharebymail: 1.20.0
  - support: 2.0.0
  - survey_client: 2.0.0
  - systemtags: 1.20.0
  - text: 4.1.0
  - theming: 2.5.0
  - twofactor_backupcodes: 1.19.0
  - updatenotification: 1.20.0
  - user_oidc: 6.2.1
  - user_status: 1.10.0
  - viewer: 3.0.0
  - weather_status: 1.10.0
  - webhook_listeners: 1.1.0-dev
  - workflowengine: 2.12.0
Disabled:
  - encryption: 2.18.0
  - suspicious_login: 8.0.0
  - twofactor_nextcloud_notification: 4.0.0
  - twofactor_totp: 12.0.0-dev
  - user_ldap: 1.21.0

Please review your discovery document

the endpoints are defined there it is crucial you have right URLs there with the right https:// scheme

is only required if both system run on the same host… from your post it doesn’t look like this is the case…

I am not sure what is referenced by “discovery document.” Do you mean the setup itself? The URL is set to HTTPS; I did check that. :crazy_face:

Why do you think so? I run this on (virtually) separated hosts. But it just does not work without the setting. So it is needed in my setup… To me, “remote” sounds like being called via TCP or another external service.

However, I did further investigate the issue and think it might be a false alarm, triggered by the :80 in the error log of the initial probe and the community documentation of Nextcloud with Authentik:

Nextcloud Authentik Integration Documentation

(that states allow_local_remote_servers is only necessary if TLS is not present).

If I curl the Authentik endpoint with HTTP, I get a 301 Permanent Redirect (as expected). This is expected because I set it up with a redirect. Nevertheless, authentication succeeds, so no payload is sent over HTTP.

Moreover, if I use tcpdump and listen on port 80, there is no traffic at all, but there is traffic on 443 (although it could also be the reverse proxy, not Authentik, and it is encrypted).

To me, this might suggest that only the initial probe call fails because it is restricted by allow_local_remote_servers => false (which is blocked, although with tls inplace, there seems no real threat of man-in-the middle or spoofing) and is somehow logged on port 80, but in reality, this is not actually happening…?

1 Like

You’ll need to use allow_local_remote_servers since Authentik is running on a local private subnet.

The port 80 in the DNS pinning error is perhaps a bit misleading. The LocalServerException used to not log the port. It’s not, necessarily, the actual port being used for the request.

(I was initially confused by your port being 80 as well, so that’s why I took a closer look at the code).

The way the DNS pinning works it generates a list of potential port combinations that must be protected. That is generally { actual port + 80 + 443 }. The logged port is just the one that happens to be specified in the particular iteration of the foreach that the isLocalAddress() check returns true on.

Disclaimer: This just my reading of the code. I’ve been meaning to get more familiar with the DNS pinning implementation.

If you want to confirm with certainty what discovery endpoint URL/scheme is being used, you can set your loglevel to 0 briefly and re-run the discovery. The URL should be logged.

P.S. I’ll fix the port logging now.

my bad. I think jtr points to the right code - local refers not only to the same server but to all local ip subnets. and yes both ports seem to be affected :80 and :443 so there is no difference which of them is used. but I still see no reason why :80 is used if you define https: and discovery endpoint lists valid https:// URLs.

the contents of the JSON document shipped by authentik IdP on discovery endpoint - it describes the OpenID system and where to find different functionalities like authorization, UserInfo endpoints etc

this is expected as you seem to have hppt->https redirect in place. but definitely good you double check.

I tried to verify this, deleted the OIDC provider in nextcloud and redid the setup - But it does not log anything (besides unrelated): “url”:“–”

occ log

zib@nextcloud:~$ sudo -u www-data php /var/www/nextcloud/occ log:tail
 ------- ------------------- ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------
  Level   App                 Message                                                                                                                                                                                                                                          Time
 ------- ------------------- ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------
  Debug   user_oidc           no OIDC providers                                                                                                                                                                                                                                2025-01-31T08:03:22+01:00

  Debug   no app in context   OC_App::registerLogIn() is deprecated, please register your alternative login option using the registerAlternativeLogin() on the RegistrationContext in your Application class implementing the OCP\Authentication\IAlternativeLogin interface   2025-01-31T08:03:22+01:00

  Debug   user_oidc           no OIDC providers                                                                                                                                                                                                                                2025-01-31T08:03:26+01:00

  Debug   no app in context   OC_App::registerLogIn() is deprecated, please register your alternative login option using the registerAlternativeLogin() on the RegistrationContext in your Application class implementing the OCP\Authentication\IAlternativeLogin interface   2025-01-31T08:03:44+01:00

  Debug   user_oidc           Could not find unique token validation                                                                                                                                                                                                           2025-01-31T08:03:52+01:00

  Debug   no app in context   OC_App::registerLogIn() is deprecated, please register your alternative login option using the registerAlternativeLogin() on the RegistrationContext in your Application class implementing the OCP\Authentication\IAlternativeLogin interface   2025-01-31T08:03:54+01:00

  Debug   no app in context   OC_App::registerLogIn() is deprecated, please register your alternative login option using the registerAlternativeLogin() on the RegistrationContext in your Application class implementing the OCP\Authentication\IAlternativeLogin interface   2025-01-31T08:04:00+01:00

 ------- ------------------- ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ ---------------------------

raw log

zib@nextcloud:~$ sudo cat /var/log/nextcloud/nextcloud.log
{"reqId":"Iqwzh1naGNLbl3QFzQ5c","level":0,"time":"2025-01-31T08:03:22+01:00","remoteAddr":"192.168.100.50","user":"zib","app":"user_oidc","method":"PROPFIND","url":"/remote.php/dav/files/zib/","message":"no OIDC providers","userAgent":"Mozilla/5.0 (Windows) mirall/3.15.3 (build 20250107) (Nextcloud, windows-10.0.26100 ClientArchitecture: x86_64 OsArchitecture: x86_64)","version":"30.0.5.1","data":{"app":"user_oidc"}}
{"reqId":"kmFockDLyX4JUjFqYhik","level":0,"time":"2025-01-31T08:03:22+01:00","remoteAddr":"","user":"--","app":"no app in context","method":"","url":"--","message":"OC_App::registerLogIn() is deprecated, please register your alternative login option using the registerAlternativeLogin() on the RegistrationContext in your Application class implementing the OCP\\Authentication\\IAlternativeLogin interface","userAgent":"--","version":"30.0.5.1","data":[]}
{"reqId":"fsi5eNyk55q5SEppsnQv","level":0,"time":"2025-01-31T08:03:26+01:00","remoteAddr":"192.168.100.50","user":"zib","app":"user_oidc","method":"PROPFIND","url":"/remote.php/dav/files/zib/","message":"no OIDC providers","userAgent":"Mozilla/5.0 (Windows) mirall/3.15.3 (build 20250107) (Nextcloud, windows-10.0.26100 ClientArchitecture: x86_64 OsArchitecture: x86_64)","version":"30.0.5.1","data":{"app":"user_oidc"}}
{"reqId":"15iWELiKZ7hDXuKLQzd0","level":0,"time":"2025-01-31T08:03:44+01:00","remoteAddr":"","user":"--","app":"no app in context","method":"","url":"--","message":"OC_App::registerLogIn() is deprecated, please register your alternative login option using the registerAlternativeLogin() on the RegistrationContext in your Application class implementing the OCP\\Authentication\\IAlternativeLogin interface","userAgent":"--","version":"30.0.5.1","data":[]}
{"reqId":"LRazr6dqj82BtAn7U75P","level":0,"time":"2025-01-31T08:03:52+01:00","remoteAddr":"192.168.100.50","user":"zib","app":"user_oidc","method":"PROPFIND","url":"/remote.php/dav/files/zib/","message":"Could not find unique token validation","userAgent":"Mozilla/5.0 (Windows) mirall/3.15.3 (build 20250107) (Nextcloud, windows-10.0.26100 ClientArchitecture: x86_64 OsArchitecture: x86_64)","version":"30.0.5.1","data":{"app":"user_oidc"}}
{"reqId":"FoQtBhHDuESzlVk1PzMQ","level":0,"time":"2025-01-31T08:03:54+01:00","remoteAddr":"","user":"--","app":"no app in context","method":"","url":"--","message":"OC_App::registerLogIn() is deprecated, please register your alternative login option using the registerAlternativeLogin() on the RegistrationContext in your Application class implementing the OCP\\Authentication\\IAlternativeLogin interface","userAgent":"--","version":"30.0.5.1","data":[]}
{"reqId":"vH8LbQOmFUmJNrn1wtgJ","level":0,"time":"2025-01-31T08:04:00+01:00","remoteAddr":"","user":"--","app":"no app in context","method":"","url":"--","message":"OC_App::registerLogIn() is deprecated, please register your alternative login option using the registerAlternativeLogin() on the RegistrationContext in your Application class implementing the OCP\\Authentication\\IAlternativeLogin interface","userAgent":"--","version":"30.0.5.1","data":[]}
zib@nextcloud:~$

Did you mean I should rerun it with local_remote: false?

Much appreciated! :+1: