OpenID Connect Backend no token with 30.0.6

Support intro

Sorry to hear you’re facing problems. :slightly_frowning_face:

The community help forum (help.nextcloud.com) is for home and non-enterprise users. Support is provided by other community members on a best effort / “as available” basis. All of those responding are volunteering their time to help you.

If you’re using Nextcloud in a business/critical setting, paid and SLA-based support services can be accessed via portal.nextcloud.com where Nextcloud engineers can help ensure your business keeps running smoothly.

Getting help

In order to help you as efficiently (and quickly!) as possible, please fill in as much of the below requested information as you can.

Before clicking submit: Please check if your query is already addressed via the following resources:

(Utilizing these existing resources is typically faster. It also helps reduce the load on our generous volunteers while elevating the signal to noise ratio of the forums otherwise arising from the same queries being posted repeatedly).

Some or all of the below information will be requested if it isn’t supplied; for fastest response please provide as much as you can. :heart:

The Basics

  • Nextcloud Server version (e.g., 29.x.x):
    • 30.0.6.2
  • Operating system and version (e.g., Ubuntu 24.04):
    • Debian 6.1.119-1
  • Web server and version (e.g, Apache 2.4.25):
    • apache (docker image)
  • Reverse proxy and version _(e.g. nginx 1.27.2)
    • nginx
  • PHP version (e.g, 8.3):
    • docker image version
  • Is this the first time you’ve seen this error? (Yes / No):
    • yes
  • When did this problem seem to first start?
    • after logout -> when trying to get a new token from keycloak
  • Installation method (e.g. AlO, NCP, Bare Metal/Archive, etc.)
    • Docker Community
  • Are you using CloudfIare, mod_security, or similar? (Yes / No)
    • no

Summary of the issue you are facing:

After I updated my Docker containers to the latest version 30.0.6, it seems the bearer tokens are not passed to nextcloud. I tested with curl, and the tokens appear to be generated correctly (they validate).

I use the OpenID Connect user backend to get user information from a keycloak instance.

The failure only appears once you logged out (it did work for a while because i was already logged in) from nextcloud.

Steps to replicate it (hint: details matter!):

  1. Install new Nextcloud version 3.0.6.2 via docker
  2. Logout from any running explorer window
  3. Try to Login

Log entries

Nextcloud

Please provide the log entries from your Nextcloud log that are generated during the time of problem (via the Copy raw option from Administration settings->Logging screen or from your nextcloud.log located in your data directory). Feel free to use a pastebin/gist service if necessary.


  Debug    no app in context  RuntimeException: ignorable exception at lib/private/AppConfig.php line 1194                                                             2025-02-14T18:21:19+00:00

                               0. lib/private/AppConfig.php line 1180
                                  OC\AppConfig->loadConfig(null)
                               1. lib/private/AppConfig.php line 100
                                  OC\AppConfig->loadConfigAll(

                                  )
                               2. lib/private/AllConfig.php line 169
                                  OC\AppConfig->getKeys("bruteForce")
                               3. lib/private/Security/Bruteforce/Throttler.php line 95
                                  OC\AllConfig->getAppKeys("bruteForce")
                               4. lib/private/Security/Bruteforce/Throttler.php line 175
                                  OC\Security\Bruteforce\Throttler->isBypassListed("83.219.182.70")
                               5. lib/private/Security/Bruteforce/Throttler.php line 192
                                  OC\Security\Bruteforce\Throttler->getAttempts("83.219.182.70", "userOidcCode")
                               6. lib/private/Security/Bruteforce/Throttler.php line 265
                                  OC\Security\Bruteforce\Throttler->getDelay("83.219.182.70", "userOidcCode")
                               7. .../AppFramework/Middleware/Security/BruteForceMiddleware.php line 52
                                  OC\Security\Bruteforce\Throttler->sleepDelayOrThrowOnMax("83.219.182.70", "userOidcCode")
                               8. .../Middleware/MiddlewareDispatcher.php line 73
                                  OC\AppFramework\Middleware\Security\BruteForceMiddleware->beforeController(OCA\UserOIDC\Controller\LoginController {}, "code")
                               9. lib/private/AppFramework/Http/Dispatcher.php line 106
                                  OC\AppFramework\Middleware\MiddlewareDispatcher->beforeController(OCA\UserOIDC\Controller\LoginController {}, "code")
                              10. lib/private/AppFramework/App.php line 161
                                  OC\AppFramework\Http\Dispatcher->dispatch(OCA\UserOIDC\Controller\LoginController {}, "code")
                              11. lib/private/Route/Router.php line 302
                                  OC\AppFramework\App::main(
                                    "OCA\\UserOIDC\\Controller\\LoginController",
                                    "code",
                                    OC\AppFramework\DependencyInjection\DIContainer {},
                                    {_route:"user_oidc.login.code"}
                                  )
                              12. lib/base.php line 1003
                                  OC\Route\Router->match("\/apps\/user_oidc\/code")
                              13. index.php line 24
                                  OC::handleRequest(

                                  )

  Debug    no app in context  OCA\UserOIDC\Controller\LoginController::code uses the @NoCSRFRequired annotation and should use the                                     2025-02-14T18:21:19+00:00
                              #[OCP\AppFramework\Http\Attribute\NoCSRFRequired] attribute instead

  Debug    no app in context  OCA\UserOIDC\Controller\LoginController::code uses the @NoCSRFRequired annotation and should use the                                     2025-02-14T18:21:19+00:00
                              #[OCP\AppFramework\Http\Attribute\NoCSRFRequired] attribute instead

  Debug    no app in context  OCA\UserOIDC\Controller\LoginController::code uses the @PublicPage annotation and should use the                                         2025-02-14T18:21:19+00:00
                              #[OCP\AppFramework\Http\Attribute\PublicPage] attribute instead

  **Debug    user_oidc          No Bearer token**                                                                                                                          2025-02-14T18:21:19+00:00

  Debug    no app in context  OC_App::registerLogIn() is deprecated, please register your alternative login option using the registerAlternativeLogin() on the         2025-02-14T18:21:19+00:00
                              RegistrationContext in your Application class implementing the OCP\Authentication\IAlternativeLogin interface

Web Browser

If the problem is related to the Web interface, open your browser inspector Console and Network tabs while refreshing (reloading) and reproducing the problem. Provide any relevant output/errors here that appear.

Interner Serverfehler
Der Server konnte die Anfrage nicht fertig stellen.

Sollte dies erneut auftreten, sende bitte die nachfolgenden technischen Einzelheiten an deinen Server-Administrator.

Weitere Details können im Server-Protokoll gefunden werden.

Weitere Informationen finden Sie in der Dokumentation ↗.

Technische Details
Entfernte Adresse: 83.....
Anfragekennung: UDBs....

Web server / Reverse Proxy

The output of your Apache/nginx/system log in /var/log/____:

PASTE HERE

Configuration

Nextcloud

The output of occ config:list system or similar is best, but, if not possible, the contents of your config.php file from /path/to/nextcloud is fine (make sure to remove any identifiable information!):

{
    "system": {
        "htaccess.RewriteBase": "\/",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "apps_paths": [
            {
                "path": "\/var\/www\/html\/apps",
                "url": "\/apps",
                "writable": false
            },
            {
                "path": "\/var\/www\/html\/custom_apps",
                "url": "\/custom_apps",
                "writable": true
            }
        ],
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "upgrade.disable-web": true,
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "localhost",
            "cloud.flugsportzentrum.at"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "pgsql",
        "version": "30.0.6.2",
        "overwrite.cli.url": "https:\/\/cloud.flugsportzentrum.at\/",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "loglevel": 0,
        "log_type": "file",
        "logfile": "\/var\/www\/html\/data\/nextcloud.log",
        "log_rotate_size": 10485760,
        "log.condition": {
            "apps": [
                "admin_audit"
            ]
        },
        "skeletondirectory": "",
        "preview_max_x": 2048,
        "preview_max_y": 2048,
        "jpeg_quality": 70,
        "enabledPreviewProviders": {
            "1": "OC\\Preview\\Image",
            "2": "OC\\Preview\\MarkDown",
            "3": "OC\\Preview\\MP3",
            "4": "OC\\Preview\\TXT",
            "5": "OC\\Preview\\Movie",
            "6": "OC\\Preview\\Krita",
            "7": "OC\\Preview\\OpenDocument",
            "8": "OC\\Preview\\MSOffice2003",
            "9": "OC\\Preview\\MSOffice2007",
            "10": "OC\\Preview\\MSOfficeDoc",
            "0": "OC\\Preview\\Imaginary",
            "23": "OC\\Preview\\ImaginaryPDF"
        },
        "enable_previews": true,
        "maintenance": false,
        "mail_smtpmode": "smtp",
        "trashbin_retention_obligation": "auto",
        "versions_retention_obligation": "auto",
        "activity_expire_days": 30,
        "simpleSignUpLink.shown": false,
        "share_folder": "\/Shared",
        "maintenance_window_start": 1,
        "allow_local_remote_servers": true,
        "overwriteprotocol": "https",
        "documentation_url.server_logs": "https:\/\/github.com\/nextcloud\/all-in-one\/discussions\/5425",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 6379,
            "password": "***REMOVED SENSITIVE VALUE***"
        },
        "memcache.locking": "OC\\Memcache\\Redis",
        "memcache.distributed": "OC\\Memcache\\Redis",
        "auth.bruteforce.protection.enabled": true,
        "ratelimit.protection.enabled": true,
        "preview_imaginary_url": "***REMOVED SENSITIVE VALUE***",
        "preview_imaginary_key": "***REMOVED SENSITIVE VALUE***",
        "forbidden_filename_characters": [
            "<",
            ">",
            ":",
            "\"",
            "|",
            "?",
            "*",
            "\\",
            "\/"
        ],
        "forbidden_filename_extensions": [
            " ",
            ".",
            ".filepart",
            ".part"
        ],
        "forbidden_filename_basenames": [
            "con",
            "prn",
            "aux",
            "nul",
            "com0",
            "com1",
            "com2",
            "com3",
            "com4",
            "com5",
            "com6",
            "com7",
            "com8",
            "com9",
            "com\u00b9",
            "com\u00b2",
            "com\u00b3",
            "lpt0",
            "lpt1",
            "lpt2",
            "lpt3",
            "lpt4",
            "lpt5",
            "lpt6",
            "lpt7",
            "lpt8",
            "lpt9",
            "lpt\u00b9",
            "lpt\u00b2",
            "lpt\u00b3"
        ],
        "mail_smtpsecure": "ssl",
        "mail_sendmailmode": "smtp",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "465",
        "mail_smtpauth": 1,
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***"
    }
}

Apps

The output of occ app:list (if possible).

Enabled:
  - activity: 3.0.0
  - admin_audit: 1.20.0
  - announcementcenter: 7.1.0
  - app_api: 4.0.6
  - bruteforcesettings: 3.0.0
  - calendar: 5.0.10
  - cfg_share_links: 6.1.1
  - circles: 30.0.0
  - cloud_federation_api: 1.13.0
  - collectives: 2.16.1
  - comments: 1.20.1
  - contacts: 6.1.3
  - contactsinteraction: 1.11.0
  - dashboard: 7.10.0
  - dav: 1.31.1
  - external: 5.5.2
  - federatedfilesharing: 1.20.0
  - federation: 1.20.0
  - files: 2.2.0
  - files_downloadlimit: 3.0.0
  - files_external: 1.22.0
  - files_fulltextsearch: 30.0.0
  - files_pdfviewer: 3.0.0
  - files_reminders: 1.3.0
  - files_sharing: 1.22.0
  - files_trashbin: 1.20.1
  - files_versions: 1.23.0
  - firstrunwizard: 3.0.0
  - fulltextsearch: 30.0.0
  - fulltextsearch_elasticsearch: 30.0.0
  - groupfolders: 18.0.10
  - logreader: 3.0.0
  - lookup_server_connector: 1.18.0
  - mail: 4.1.2
  - nextcloud_announcements: 2.0.0
  - notifications: 3.0.0
  - notify_push: 1.0.0
  - oauth2: 1.18.1
  - password_policy: 2.0.0
  - polls: 7.2.9
  - privacy: 2.0.0
  - provisioning_api: 1.20.0
  - recommendations: 3.0.0
  - related_resources: 1.5.0
  - richdocuments: 8.5.3
  - serverinfo: 2.0.0
  - settings: 1.13.0
  - sharebymail: 1.20.0
  - spreed: 20.1.4
  - support: 2.0.0
  - survey_client: 2.0.0
  - systemtags: 1.20.0
  - text: 4.1.0
  - theming: 2.6.0
  - twofactor_backupcodes: 1.19.0
  - updatenotification: 1.20.0
  - user_oidc: 6.2.1
  - user_status: 1.10.0
  - viewer: 3.0.0
  - weather_status: 1.10.0
  - webhook_listeners: 1.1.0-dev
  - workflowengine: 2.12.0
Disabled:
  - encryption: 2.18.0
  - photos: 3.0.2 (installed 3.0.2)
  - side_menu: 4.0.1 (installed 4.0.1)
  - suspicious_login: 8.0.0
  - twofactor_nextcloud_notification: 4.0.0
  - twofactor_totp: 12.0.0-dev
  - user_ldap: 1.21.0

Tips for increasing the likelihood of a response

  • Use the preformatted text formatting option in the editor for all log entries and configuration output.
  • If screenshots are useful, feel free to include them.
    • If possible, also include key error output in text form so it can be searched for.
  • Try to edit log output only minimally (if at all) so that it can be ran through analyzers / formatters by those trying to help you.

I can confirm the update of my NC apache docker image from 30.5 to 30.6 (user_oidc seems upgraded from 6.1.2 to 6.2.1) killed fresh login functionality - existing previously logged in session remain operational.

I see the same error in EN

Internal Server Error

The server was unable to complete your request.

If this happens again, please send the technical details below to the server administrator.

More details can be found in the server log.

but in opposite to your which looks little bruteforce related:

mine seems to fail with following message:

{
  "reqId": "6KqFvwygtU6vp9as0gjn",
  "level": 3,
  "time": "2025-02-14T20:32:25+00:00",
  "remoteAddr": "192.168.11.203",
  "user": "--",
  "app": "index",
  "method": "GET",
  "url": "/apps/user_oidc/code?state=037HQIQBHZGFJ...a496413-651a-4d23-b4a1-f6275d7ae89b",
  "message": "phone",
  "userAgent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Firefox/135.0",
  "version": "30.0.6.2",
  "exception": {
    "Exception": "InvalidArgumentException",
    "Message": "phone",
    "Code": 0,
    "Trace": [
      {
        "file": "/var/www/html/lib/private/Accounts/AccountManager.php",
        "line": 761,
        "function": "sanitizePropertyPhoneNumber",
        "class": "OC\\Accounts\\AccountManager",
        "type": "->",
        "args": [
          {
            "__class__": "OC\\Accounts\\AccountProperty"
          }
        ]
      },
...
<snip>
...
    "File": "/var/www/html/lib/private/Accounts/AccountManager.php",
    "Line": 675,
    "message": "phone",
    "exception": {},
    "CustomMessage": "phone"
  }

I found this issue https://github.com/nextcloud/user_oidc/issues/1023 which sounds similar.

so I tick “update provider” on the admin page but the login was still failing so I decided to double check the phone number. my test user had some fantasy value assigned

            "phone_number": "+155598745612",

so as first test I simply removed the phone number and login started working :muscle: added the number back and the login fails again :face_vomiting: test with valid Swiss and German number in international format works… the above number should formally pass the NANP (north america numbering plan) but seems there is some logic in the check I have to review…

The problem seems go down to the AccountManager.php option of the server

server/lib/private/Accounts/AccountManager.php at 228ac86fa2e9ca4d6388ddb7b2968412c8b68749 · nextcloud/server · GitHub which was introduced with this commit as this is a server function the problem occurs on the web interface <cloud>/settings/user as well:

entering a number manually shows the check result visually with a green frame and checkmark or red frame and “Invalid value” text. So they are running phone validation which accept Swiss and German numbers without issues (even invalid) but famous US 555 fake numbers fail the check!!

Update: opened Github issue [Bug]: login fails with user_oidc if phone number attribute is invalid · Issue #50819 · nextcloud/server · GitHub

@wwe thank you for your debugging work! This seems to be the correct answer and worked for me as well!

I use Keycloak as OpenID Provider and once I set the phoneNumber to “optional” it worked like a charm. I observed the same, simply deleting the phoneNumber (so an empty string “”) worked as well.

Thanks a lot!!
Hannes

This topic was automatically closed 8 days after the last reply. New replies are no longer allowed.