oidc_user is not allowing bearer token authenticated REST/WebDAV requests pass

ℹ️ Support
, , , , , ,
1

The Basics

  • Nextcloud Server version (e.g., 29.x.x):
    • 30.0.5
  • Operating system and version (e.g., Ubuntu 24.04):
    • Ubuntu 24.04.1 LTS (Noble Numbat)
  • Web server and version (e.g, Apache 2.4.25):
    • Apache 2.4.58
  • Reverse proxy and version _(e.g. nginx 1.27.2)
    • None apart from anything done by Apache
  • PHP version (e.g, 8.3):
    • PHP 8.3
  • Is this the first time you’ve seen this error? (Yes / No):
    • yes
  • When did this problem seem to first start?
    • When OpenID Connect user backend (oidc_user) was updated to 7.3.2
  • Installation method (e.g. AlO, NCP, Bare Metal/Archive, etc.)
    • Hetzner App image based on https://github.com/hetznercloud/apps/tree/main/apps/hetzner/nextcloud
  • Are you using CloudfIare, mod_security, or similar? (Yes / No)
    • No

Summary of the issue you are facing:

Summary of the issue you are facing:

I am unable to make requests via REST or WebDAV with the bearer tokens from keycloak.

I configured oidc_user to use my keycloak instance as the authentication provider.
It is able to handle logins using the normal flow using that provider.
The client that is used for nextcloud login is also the same client used to generate the tokens via PKCE

Postman requests do not work for REST ,same as curl for webdav.

I ruled out CORS by installing WebAppPassword and configuring it for my frontend.
Requests via Basic tokens and username/password work fine, which tells me I am hitting the right endpoints.

Keycloak token validity was confirmed by calling the realms/{REALM}/protocol/openid-connect/userinfo

There is no difference between a user that was autoprovisioned by oidc login and
provisioned via manual call.

I get 401s or the below:

https://MY_NEXTCLOUD_INSTANCE/ocs/v2.php/apps/user_status/api/v1/statuses

<?xml version="1.0"?>
<ocs>
    <meta>
        <status>failure</status>
        <statuscode>997</statuscode>
        <message>Current user is not logged in</message>
    </meta>
    <data/>
</ocs>

Steps to replicate it (hint: details matter!):

I disabled “use unique user ID”, “user provider identifier as prefix for IDs”, and “user group provisioning”, and restrict login for users that are not in any whitelisted group".

I enabled “Check Bearer token on API and WebDAV requests”, “Auto provision user when accessing API and WebDAV with Bearer token”, “Send ID token hint on logout”.

The PKCE flow used to obtain the tokens use the same client used in oidc_user

Manual provisioning uses the confirmed providerId as detailed here


https://github.com/nextcloud/user_oidc



curl -H "ocs-apirequest: true" -u admin:admin -X POST -H "content-type: application/json" \

-d '{"providerId":2,"userId":"new_user","displayName":"New User","email":"new@user.org","quota":"5GB"}' \

https://my.nextcloud.org/ocs/v2.php/apps/user_oidc/api/v1/user

REST calls contain the headers OCS-APIRequest:true alongside the authorization.

The non-unique ID options are off by necessity as they ensure the user ID is the same as the keycloak UID.

  1. Set up keycloak as an authentication method via oidc_user
  2. Obtain a bearer token via keycloak authentication
  3. Make a request towards NextCloud instance using Bearer authentication

Log entries

Nextcloud

Please provide the log entries from your Nextcloud log that are generated during the time of problem (via the Copy raw option from Administration settings->Logging screen or from your nextcloud.log located in your data directory). Feel free to use a pastebin/gist service if necessary.

{"reqId":"hTSzsEqJFfCYusmhH3Nk","level":3,"time":"2025-08-29T07:23:17+00:00","remoteAddr":"[REDACTED_IP]","user":"--","app":"files","method":"GET","url":"/cron.php","message":"Backends provided no user object for 63366739-599a-4b56-80f1-de0e7751cfb9","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:142.0) Gecko/20100101 Firefox/142.0","version":"30.0.5.1","exception":{"Exception":"OC\\User\\NoUserException","Message":"Backends provided no user object","Code":0,"Trace":[{"function":"getUserFolder","class":"OC\\Files\\Node\\Root","type":"->"},{"file":"/var/www/html/lib/private/Files/Node/LazyFolder.php","line":64,"function":"call_user_func_array"},{"file":"/var/www/html/lib/private/Files/Node/LazyRoot.php","line":38,"function":"__call","class":"OC\\Files\\Node\\LazyFolder","type":"->"},{"file":"/var/www/html/lib/private/FilesMetadata/Job/UpdateSingleMetadata.php","line":41,"function":"getUserFolder","class":"OC\\Files\\Node\\LazyRoot","type":"->"},{"file":"/var/www/html/lib/public/BackgroundJob/Job.php","line":61,"function":"run","class":"OC\\FilesMetadata\\Job\\UpdateSingleMetadata","type":"->"},{"file":"/var/www/html/lib/public/BackgroundJob/QueuedJob.php","line":43,"function":"start","class":"OCP\\BackgroundJob\\Job","type":"->"},{"file":"/var/www/html/lib/public/BackgroundJob/QueuedJob.php","line":29,"function":"start","class":"OCP\\BackgroundJob\\QueuedJob","type":"->"},{"file":"/var/www/html/cron.php","line":216,"function":"execute","class":"OCP\\BackgroundJob\\QueuedJob","type":"->"}],"File":"/var/www/html/lib/private/Files/Node/Root.php","Line":345,"message":"Backends provided no user object for 63366739-599a-4b56-80f1-de0e7751cfb9","exception":{},"CustomMessage":"Backends provided no user object for 63366739-599a-4b56-80f1-de0e7751cfb9"}}
{"reqId":"hTSzsEqJFfCYusmhH3Nk","level":2,"time":"2025-08-29T07:23:17+00:00","remoteAddr":"[REDACTED_IP]","user":"--","app":"no app in context","method":"GET","url":"/cron.php","message":"issue while running UpdateSingleMetadata","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:142.0) Gecko/20100101 Firefox/142.0","version":"30.0.5.1","exception":{"Exception":"OC\\User\\NoUserException","Message":"Backends provided no user object","Code":0,"Trace":[{"function":"getUserFolder","class":"OC\\Files\\Node\\Root","type":"->"},{"file":"/var/www/html/lib/private/Files/Node/LazyFolder.php","line":64,"function":"call_user_func_array"},{"file":"/var/www/html/lib/private/Files/Node/LazyRoot.php","line":38,"function":"__call","class":"OC\\Files\\Node\\LazyFolder","type":"->"},{"file":"/var/www/html/lib/private/FilesMetadata/Job/UpdateSingleMetadata.php","line":41,"function":"getUserFolder","class":"OC\\Files\\Node\\LazyRoot","type":"->"},{"file":"/var/www/html/lib/public/BackgroundJob/Job.php","line":61,"function":"run","class":"OC\\FilesMetadata\\Job\\UpdateSingleMetadata","type":"->"},{"file":"/var/www/html/lib/public/BackgroundJob/QueuedJob.php","line":43,"function":"start","class":"OCP\\BackgroundJob\\Job","type":"->"},{"file":"/var/www/html/lib/public/BackgroundJob/QueuedJob.php","line":29,"function":"start","class":"OCP\\BackgroundJob\\QueuedJob","type":"->"},{"file":"/var/www/html/cron.php","line":216,"function":"execute","class":"OCP\\BackgroundJob\\QueuedJob","type":"->"}],"File":"/var/www/html/lib/private/Files/Node/Root.php","Line":345,"message":"issue while running UpdateSingleMetadata","exception":{},"userId":"63366739-599a-4b56-80f1-de0e7751cfb9","fileId":59446,"CustomMessage":"issue while running UpdateSingleMetadata"}}
{"reqId":"6RDtGqFjiGkg6TK6LxT2","level":0,"time":"2025-08-29T07:23:17+00:00","remoteAddr":"[REDACTED_IP]","user":"--","app":"no app in context","method":"PROPFIND","url":"/remote.php/webdav","message":"OC_App::registerLogIn() is deprecated, please register your alternative login option using the registerAlternativeLogin() on the RegistrationContext in your Application class implementing the OCP\\Authentication\\IAlternativeLogin interface","userAgent":"Nextcloud Server Crawler","version":"30.0.5.1","data":[]}
{"reqId":"hx0ETAu2z1MpyNAXC6qM","level":0,"time":"2025-08-29T07:23:17+00:00","remoteAddr":"[REDACTED_IP]","user":"--","app":"no app in context","method":"GET","url":"/data/.ncdata","message":"OC_App::registerLogIn() is deprecated, please register your alternative login option using the registerAlternativeLogin() on the RegistrationContext in your Application class implementing the OCP\\Authentication\\IAlternativeLogin interface","userAgent":"Nextcloud Server Crawler","version":"30.0.5.1","data":[]}
{"reqId":"1FJmxjNDVhZpgiEpK2tl","level":0,"time":"2025-08-29T07:23:17+00:00","remoteAddr":"[REDACTED_IP]","user":"--","app":"no app in context","method":"GET","url":"/data/.ncdata","message":"OC_App::registerLogIn() is deprecated, please register your alternative login option using the registerAlternativeLogin() on the RegistrationContext in your Application class implementing the OCP\\Authentication\\IAlternativeLogin interface","userAgent":"Nextcloud Server Crawler","version":"30.0.5.1","data":[]}
{"reqId":"L2lpZssurVJNx6lJxBh3","level":0,"time":"2025-08-29T07:23:17+00:00","remoteAddr":"[REDACTED_IP]","user":"--","app":"no app in context","method":"GET","url":"/data/.ncdata","message":"OC_App::registerLogIn() is deprecated, please register your alternative login option using the registerAlternativeLogin() on the RegistrationContext in your Application class implementing the OCP\\Authentication\\IAlternativeLogin interface","userAgent":"Nextcloud Server Crawler","version":"30.0.5.1","data":[]}
{"reqId":"NXhNRE3meLXJYp3mDnLe","level":0,"time":"2025-08-29T07:23:17+00:00","remoteAddr":"[REDACTED_IP]","user":"--","app":"no app in context","method":"GET","url":"/data/.ncdata","message":"OC_App::registerLogIn() is deprecated, please register your alternative login option using the registerAlternativeLogin() on the RegistrationContext in your Application class implementing the OCP\\Authentication\\IAlternativeLogin interface","userAgent":"Nextcloud Server Crawler","version":"30.0.5.1","data":[]}
{"reqId":"P2AeSfL6tYKN8UoLmEzX","level":0,"time":"2025-08-29T07:23:17+00:00","remoteAddr":"[REDACTED_IP]","user":"--","app":"no app in context","method":"GET","url":"/data/.ncdata","message":"OC_App::registerLogIn() is deprecated, please register your alternative login option using the registerAlternativeLogin() on the RegistrationContext in your Application class implementing the OCP\\Authentication\\IAlternativeLogin interface","userAgent":"Nextcloud Server Crawler","version":"30.0.5.1","data":[]}
{"reqId":"sxMc1HnytC0L059N0C7g","level":0,"time":"2025-08-29T07:23:17+00:00","remoteAddr":"[REDACTED_IP]","user":"--","app":"no app in context","method":"GET","url":"/data/.ncdata","message":"OC_App::registerLogIn() is deprecated, please register your alternative login option using the registerAlternativeLogin() on the RegistrationContext in your Application class implementing the OCP\\Authentication\\IAlternativeLogin interface","userAgent":"Nextcloud Server Crawler","version":"30.0.5.1","data":[]}
{"reqId":"gs0JAuWeSMbYQkuXTy77","level":0,"time":"2025-08-29T07:23:18+00:00","remoteAddr":"[REDACTED_IP]","user":"--","app":"no app in context","method":"HEAD","url":"/ocm-provider/","message":"OC_App::registerLogIn() is deprecated, please register your alternative login option using the registerAlternativeLogin() on the RegistrationContext in your Application class implementing the OCP\\Authentication\\IAlternativeLogin interface","userAgent":"Nextcloud Server Crawler","version":"30.0.5.1","data":[]}
{"reqId":"a2LVMtQh2mit8RWw8FQo","level":0,"time":"2025-08-29T07:23:18+00:00","remoteAddr":"[REDACTED_IP]","user":"--","app":"no app in context","method":"GET","url":"/.well-known/webfinger","message":"OC_App::registerLogIn() is deprecated, please register your alternative login option using the registerAlternativeLogin() on the RegistrationContext in your Application class implementing the OCP\\Authentication\\IAlternativeLogin interface","userAgent":"Nextcloud Server Crawler","version":"30.0.5.1","data":[]}
{"reqId":"9CByjXBLkZ8QwOOTlKEz","level":0,"time":"2025-08-29T07:23:18+00:00","remoteAddr":"[REDACTED_IP]","user":"--","app":"no app in context","method":"GET","url":"/.well-known/nodeinfo","message":"OC_App::registerLogIn() is deprecated, please register your alternative login option using the registerAlternativeLogin() on the RegistrationContext in your Application class implementing the OCP\\Authentication\\IAlternativeLogin interface","userAgent":"Nextcloud Server Crawler","version":"30.0.5.1","data":[]}
{"reqId":"CGi6pXYEX2n7CRJ6onx9","level":0,"time":"2025-08-29T07:23:18+00:00","remoteAddr":"[REDACTED_IP]","user":"--","app":"no app in context","method":"GET","url":"/remote.php/dav/","message":"OC_App::registerLogIn() is deprecated, please register your alternative login option using the registerAlternativeLogin() on the RegistrationContext in your Application class implementing the OCP\\Authentication\\IAlternativeLogin interface","userAgent":"Nextcloud Server Crawler","version":"30.0.5.1","data":[]}
{"reqId":"rp3HThGvpfDpRtXnB9DO","level":0,"time":"2025-08-29T07:23:18+00:00","remoteAddr":"[REDACTED_IP]","user":"--","app":"no app in context","method":"GET","url":"/remote.php/dav/","message":"OC_App::registerLogIn() is deprecated, please register your alternative login option using the registerAlternativeLogin() on the RegistrationContext in your Application class implementing the OCP\\Authentication\\IAlternativeLogin interface","userAgent":"Nextcloud Server Crawler","version":"30.0.5.1","data":[]}
{"reqId":"nzPYrqorBBLGIRO9IK7l","level":0,"time":"2025-08-29T07:23:21+00:00","remoteAddr":"[REDACTED_IP]","user":"--","app":"cron","method":"GET","url":"/cron.php","message":"WebCron call has selected job with ID 1973","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:142.0) Gecko/20100101 Firefox/142.0","version":"30.0.5.1","data":{"app":"cron"}}
{"reqId":"jZ1074bOwWsaNfAywAEl","level":0,"time":"2025-08-29T07:23:27+00:00","remoteAddr":"[REDACTED_IP]","user":"--","app":"no app in context","method":"PUT","url":"/ocs/v2.php/apps/user_status/api/v1/user_status/status","message":"OC_App::registerLogIn() is deprecated, please register your alternative login option using the registerAlternativeLogin() on the RegistrationContext in your Application class implementing the OCP\\Authentication\\IAlternativeLogin interface","userAgent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36","version":"30.0.5.1","data":[]}
{"reqId":"jZ1074bOwWsaNfAywAEl","level":3,"time":"2025-08-29T07:23:27+00:00","remoteAddr":"[REDACTED_IP]","user":"--","app":"PHP","method":"PUT","url":"/ocs/v2.php/apps/user_status/api/v1/user_status/status","message":"TypeError: OCA\\UserStatus\\Controller\\UserStatusController::__construct(): Argument #3 ($userId) must be of type string, null given at /var/www/html/apps/user_status/lib/Controller/UserStatusController.php#36","userAgent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36","version":"30.0.5.1","data":{"app":"PHP"}}
{"reqId":"F3ABVL1KL3dGHdhZPGbc","level":0,"time":"2025-08-29T07:23:52+00:00","remoteAddr":"[REDACTED_IP]","user":"--","app":"no app in context","method":"GET","url":"/","message":"OC_App::registerLogIn() is deprecated, please register your alternative login option using the registerAlternativeLogin() on the RegistrationContext in your Application class implementing the OCP\\Authentication\\IAlternativeLogin interface","userAgent":"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0) Gecko/20100101 Firefox/8.0","version":"30.0.5.1","data":[]}
{"reqId":"NlXXvdrorg9xntEVFawY","level":0,"time":"2025-08-29T07:23:52+00:00","remoteAddr":"[REDACTED_IP]","user":"--","app":"no app in context","method":"GET","url":"/login","message":"OC_App::registerLogIn() is deprecated, please register your alternative login option using the registerAlternativeLogin() on the RegistrationContext in your Application class implementing the OCP\\Authentication\\IAlternativeLogin interface","userAgent":"Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0) Gecko/20100101 Firefox/8.0","version":"30.0.5.1","data":[]}
{"reqId":"SLrzdtAZLW55oXihqAlf","level":0,"time":"2025-08-29T07:24:44+00:00","remoteAddr":"[REDACTED_IP]","user":"--","app":"no app in context","method":"PUT","url":"/ocs/v2.php/apps/user_status/api/v1/user_status/status","message":"OC_App::registerLogIn() is deprecated, please register your alternative login option using the registerAlternativeLogin() on the RegistrationContext in your Application class implementing the OCP\\Authentication\\IAlternativeLogin interface","userAgent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36","version":"30.0.5.1","data":[]}
{"reqId":"SLrzdtAZLW55oXihqAlf","level":3,"time":"2025-08-29T07:24:44+00:00","remoteAddr":"[REDACTED_IP]","user":"--","app":"PHP","method":"PUT","url":"/ocs/v2.php/apps/user_status/api/v1/user_status/status","message":"TypeError: OCA\\UserStatus\\Controller\\UserStatusController::__construct(): Argument #3 ($userId) must be of type string, null given at /var/www/html/apps/user_status/lib/Controller/UserStatusController.php#36","userAgent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36","version":"30.0.5.1","data":{"app":"PHP"}}

Web Browser

If the problem is related to the Web interface, open your browser inspector Console and Network tabs while refreshing (reloading) and reproducing the problem. Provide any relevant output/errors here that appear.

Not applicable

Web server / Reverse Proxy

The output of your Apache/nginx/system log in /var/log/____:

Not accessible

Configuration

Nextcloud

The output of occ config:list system or similar is best, but, if not possible, the contents of your config.php file from /path/to/nextcloud is fine (make sure to remove any identifiable information!):

<?php
$CONFIG = array (
  'passwordsalt' => '**',
  'secret' => '**',
  'trusted_domains' => 
  array (
    0 => 'REDACTED',
    1 => 'REDACTED',
    2 => 'REDACTED',
  ),
  'datadirectory' => '/var/www/html/data',
  'dbtype' => 'mysql',
  'version' => '30.0.5.1',
  'overwrite.cli.url' => 'REDACTED',
  'dbname' => 'nextcloud',
  'dbhost' => 'localhost',
  'dbport' => '',
  'dbtableprefix' => 'oc_',
  'mysql.utf8mb4' => true,
  'dbuser' => 'nextcloud',
  'dbpassword' => '**',
  'installed' => true,
  'instanceid' => '**',
  'htaccess.RewriteBase' => '/',
  'maintenance' => false,
  'loglevel' => 0,
  'app_install_overwrite' => 
  array (
    0 => 'customproperties',
  ),
  'updater.secret' => '**',
  'debug' => true,
);

Apps

The output of occ app:list (if possible).

Enabled:
  - activity: 3.0.0
  - analytics: 5.8.0
  - app_api: 4.0.5
  - bruteforcesettings: 3.0.0
  - circles: 30.0.0
  - cloud_federation_api: 1.13.0
  - comments: 1.20.1
  - contactsinteraction: 1.11.0
  - customproperties: 2.0.4
  - dashboard: 7.10.0
  - dav: 1.31.1
  - federatedfilesharing: 1.20.0
  - federation: 1.20.0
  - files: 2.2.0
  - files_downloadlimit: 3.0.0
  - files_pdfviewer: 3.0.0
  - files_reminders: 1.3.0
  - files_sharing: 1.22.0
  - files_trashbin: 1.20.1
  - files_versions: 1.23.0
  - files_zip: 2.1.0
  - firstrunwizard: 3.0.0
  - groupfolders: 18.1.4
  - logreader: 3.0.0
  - lookup_server_connector: 1.18.0
  - nextcloud_announcements: 2.0.0
  - notifications: 3.0.0
  - oauth2: 1.18.1
  - ocs_api_viewer: 1.0.10
  - password_policy: 2.0.0
  - photos: 3.0.2
  - privacy: 2.0.0
  - provisioning_api: 1.20.0
  - recommendations: 3.0.0
  - related_resources: 1.5.0
  - richdocuments: 8.5.10
  - serverinfo: 2.0.0
  - settings: 1.13.0
  - sharebymail: 1.20.0
  - spreed: 20.1.9
  - support: 2.0.0
  - survey_client: 2.0.0
  - systemtags: 1.20.0
  - text: 4.1.0
  - theming: 2.5.0
  - twofactor_backupcodes: 1.19.0
  - updatenotification: 1.20.0
  - user_oidc: 7.3.2
  - user_status: 1.10.0
  - viewer: 3.0.0
  - weather_status: 1.10.0
  - webapppassword: 25.8.0
  - webhook_listeners: 1.1.0-dev
  - workflowengine: 2.12.0
Disabled:
  - admin_audit: 1.20.0
  - cookbook: 0.11.3
  - dataroom: 1.0.5 (installed 1.0.5)
  - encryption: 2.18.0
  - files_external: 1.22.0
  - suspicious_login: 8.0.0
  - twofactor_nextcloud_notification: 4.0.0
  - twofactor_totp: 12.0.0-dev
  - user_ldap: 1.21.0
2

May be this, which appears to be close to a resolution:

1 Like
3

After that issue and PR were merged in and version 7.4.0 was released and installed, the issue was resolved.

Tested on 30.0.5 and 31.0.8

1 Like