Nextcloud version: 27.1.3
Passwords version: 2023.11.30
I am attempting to install and run the Passwords app for the first time on my Nextcloud instance. For context, I’m using the lscr.io/linuxserver/nextcloud docker container image in a docker-compose setup together with a postgres database backend (I’ll include the specific config files after describing the problem I’m seeing), and it’s sitting behind a Traefik 2.10 reverse-proxy. The Passwords app downloads and installs fine through the Apps menu. When I booted up the app, it flagged some misconfiguration with regards to https behind the reverse proxy (I had to add ‘overwriteprotocol’ => ‘https’ as well as a ‘trusted_proxies’ array into my config.php file); those error messages are no longer showing up.
I’m stuck now, though, at the login screen:
I can’t figure out what password it’s wanting in this password box. I’ve tried my user password (logged in as the admin on the instance). I’ve tried the postgres database password. Hitting the login button sends a POST to /index.php/apps/passwords/api/1.0/session/open, but they return a 403 back and show “Password Invalid” as an error message.
I’ve unfortunately retried this too many times and the error message has now shifted to "Password invalid. Session revoked for too many failed login attempts. "
Breaking out the server logs, each failure is showing two separate logs: an error level, and a fatal level.
Here are the logs for when the error was just “Password Invalid”
{"reqId":"0iM5TuSCmJjzS1dpgeS8","level":3,"time":"2023-11-16T01:56:38+00:00","remoteAddr":"192.168.1.3","user":"jeff","app":"passwords","method":"POST","url":"/index.php/apps/passwords/api/1.0/session/open","message":"Error \"Password invalid\" in OCA\\Passwords\\Controller\\Api\\SessionApiController::open","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/119.0","version":"27.1.3.2","data":{"app":"passwords"},"id":"65569fcab0dd9"}
{"reqId":"0iM5TuSCmJjzS1dpgeS8","level":4,"time":"2023-11-16T01:56:38+00:00","remoteAddr":"192.168.1.3","user":"jeff","app":"passwords","method":"POST","url":"/index.php/apps/passwords/api/1.0/session/open","message":"Password invalid","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/119.0","version":"27.1.3.2","exception":{"Exception":"OCA\\Passwords\\Exception\\ApiException","Message":"Password invalid","Code":256,"Trace":[{"file":"/config/www/nextcloud/apps/passwords/lib/Services/UserChallengeService.php","line":134,"function":"solveChallenge","class":"OCA\\Passwords\\Helper\\Challenge\\ChallengeV1Helper","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/config/www/nextcloud/apps/passwords/lib/Controller/Api/SessionApiController.php","line":219,"function":"validateChallenge","class":"OCA\\Passwords\\Services\\UserChallengeService","type":"->"},{"file":"/config/www/nextcloud/apps/passwords/lib/Controller/Api/SessionApiController.php","line":138,"function":"verifyChallenge","class":"OCA\\Passwords\\Controller\\Api\\SessionApiController","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/app/www/public/lib/private/AppFramework/Http/Dispatcher.php","line":230,"function":"open","class":"OCA\\Passwords\\Controller\\Api\\SessionApiController","type":"->"},{"file":"/app/www/public/lib/private/AppFramework/Http/Dispatcher.php","line":137,"function":"executeController","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/app/www/public/lib/private/AppFramework/App.php","line":183,"function":"dispatch","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/app/www/public/lib/private/Route/Router.php","line":315,"function":"main","class":"OC\\AppFramework\\App","type":"::"},{"file":"/app/www/public/lib/base.php","line":1068,"function":"match","class":"OC\\Route\\Router","type":"->"},{"file":"/app/www/public/index.php","line":36,"function":"handleRequest","class":"OC","type":"::"}],"File":"/config/www/nextcloud/apps/passwords/lib/Helper/Challenge/ChallengeV1Helper.php","Line":61,"message":"Password invalid","exception":[],"CustomMessage":"Password invalid"},"id":"65569fcab0da5"}
Here are the logs for the “too many attempts” error:
{"reqId":"BikEI9PrrCtLawzmR3Qn","level":3,"time":"2023-11-16T23:02:25+00:00","remoteAddr":"192.168.1.3","user":"jeff","app":"passwords","method":"POST","url":"/index.php/apps/passwords/api/1.0/session/open","message":"Error \"Too many failed login attempts\" in OCA\\Passwords\\Controller\\Api\\SessionApiController::open","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/119.0","version":"27.1.3.2","data":{"app":"passwords"},"id":"65569f9599496"}
{"reqId":"BikEI9PrrCtLawzmR3Qn","level":4,"time":"2023-11-16T23:02:25+00:00","remoteAddr":"192.168.1.3","user":"jeff","app":"passwords","method":"POST","url":"/index.php/apps/passwords/api/1.0/session/open","message":"Too many failed login attempts","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/119.0","version":"27.1.3.2","exception":{"Exception":"OCA\\Passwords\\Exception\\ApiException","Message":"Too many failed login attempts","Code":256,"Trace":[{"file":"/config/www/nextcloud/apps/passwords/lib/Controller/Api/SessionApiController.php","line":223,"function":"registerFailedAttempt","class":"OCA\\Passwords\\Helper\\User\\UserLoginAttemptHelper","type":"->"},{"file":"/config/www/nextcloud/apps/passwords/lib/Controller/Api/SessionApiController.php","line":138,"function":"verifyChallenge","class":"OCA\\Passwords\\Controller\\Api\\SessionApiController","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/app/www/public/lib/private/AppFramework/Http/Dispatcher.php","line":230,"function":"open","class":"OCA\\Passwords\\Controller\\Api\\SessionApiController","type":"->"},{"file":"/app/www/public/lib/private/AppFramework/Http/Dispatcher.php","line":137,"function":"executeController","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/app/www/public/lib/private/AppFramework/App.php","line":183,"function":"dispatch","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/app/www/public/lib/private/Route/Router.php","line":315,"function":"main","class":"OC\\AppFramework\\App","type":"::"},{"file":"/app/www/public/lib/base.php","line":1068,"function":"match","class":"OC\\Route\\Router","type":"->"},{"file":"/app/www/public/index.php","line":36,"function":"handleRequest","class":"OC","type":"::"}],"File":"/config/www/nextcloud/apps/passwords/lib/Helper/User/UserLoginAttemptHelper.php","Line":114,"message":"Too many failed login attempts","exception":[],"CustomMessage":"Too many failed login attempts"},"id":"65569f9599460"}
And this is my docker-compose.yml file, in case that’s useful
---
version: "3.1"
services:
nextcloud:
image: lscr.io/linuxserver/nextcloud
container_name: nextcloud
environment:
- PUID=1000
- PGID=1000
- TZ=America/Boise
volumes:
- ./config:/config
- ./data:/data
networks:
- proxy
- nextcloud
restart: unless-stopped
labels:
- "traefik.enable=true"
- "traefik.docker.network=proxy"
# Web portal HTTP config
- "traefik.http.routers.nextcloud.entrypoints=http"
- "traefik.http.routers.nextcloud.rule=Host(`redacted`)"
- "traefik.http.middlewares.nextcloud-https-redirect.redirectscheme.scheme=https"
- "traefik.http.routers.nextcloud.middlewares=nextcloud-https-redirect"
# Web portal HTTPS config
- "traefik.http.middlewares.nextcloud-redirectregex-remote.redirectregex.permanent=true"
- "traefik.http.middlewares.nextcloud-redirectregex-remote.redirectregex.regex=https://(.*)/\\.well-known/(?:card|cal)dav"
- "traefik.http.middlewares.nextcloud-redirectregex-remote.redirectregex.replacement=https://$${1}/remote.php/dav"
- "traefik.http.middlewares.nextcloud-redirectregex-index.redirectregex.permanent=true"
- "traefik.http.middlewares.nextcloud-redirectregex-index.redirectregex.regex=https://(.*)/\\.well-known/(webfinger|nodeinfo)"
- "traefik.http.middlewares.nextcloud-redirectregex-index.redirectregex.replacement=https://$${1}/index.php/.well-known/$${2}"
- "traefik.http.middlewares.nextcloud-redirectchain.chain.middlewares=nextcloud-redirectregex-remote,nextcloud-redirectregex-index"
- "traefik.http.routers.nextcloud-secure.entrypoints=https"
- "traefik.http.routers.nextcloud-secure.rule=Host(`redacted`)"
- "traefik.http.routers.nextcloud-secure.tls=true"
- "traefik.http.routers.nextcloud-secure.service=nextcloud"
- "traefik.http.routers.nextcloud-secure.middlewares=nextcloud-redirectchain"
- "traefik.http.services.nextcloud.loadbalancer.server.port=80"
database:
container_name: nextcloud_postgres
image: postgres:14-alpine@sha256:28407a9961e76f2d285dc6991e8e48893503cc3836a4755bbc2d40bcc272a441
env_file:
- .env
environment:
POSTGRES_PASSWORD: ${DB_PASSWORD}
POSTGRES_USER: ${DB_USERNAME}
POSTGRES_DB: ${DB_DATABASE_NAME}
volumes:
- pgdata:/var/lib/postgresql/data
restart: always
networks:
- nextcloud
networks:
proxy:
external: true
nextcloud:
volumes:
pgdata:
