Nextcloud version 25.0.7 Ubuntu 20.04.6 Apache v ersion2.4.41-4ubuntu3.14 PHP version 7.4 Good day! I am using LDAP and SAML apps in my nextcloud instance, and I faced the problem of bypass SAML authentication in browser. Steps to replicate it: Open https://<instance_name>/remote.php/dav/file…

Enter correct credentials Do you mean enter the app password? I believe this is expected as the app password isn’t scoped in any way except for filesystem access. You could always log in via the app password from https://<instance_name>/index.php/login?direct=1

Hey, thanks for your report! Can you please share your SAML configuration (remove any sensitive information) with us? Thank you!

Just noticed that all versions you’re using are heavily outdated and not supported anymore. Does the same happen on supported versions? See Maintenance and Release Schedule · nextcloud/server Wiki · GitHub

Also, [image] Vorchmaster: Enter correct credentials Do those match against a e.g. local user?

This must be a version thing. Just tested in both lab setup and production. I cannot replicate this. I could - however - bypass SAML if using an app password. Which is expected.

Is it correct? You open https://<instance_name>/remote.php/dav/files/<user_name>, and get redirect to SAML authentication?

I cannot login with browser to WebDav. This is expected. I am presented with a creds pop up. I enters my Creds, and is sent to an “internal server error”. Trying to browse to anything (deleting part of url) I am redirected to login page. You cannot use SAML with WebDAV. It is not support by the dev…

Sounds great, do you have “Enforce two-factor authentication” checkbox enabled?

In addition, I updated stand to 25.0.13, and I still have the same issue. Could you specify your version?

I meant normal password, I am trying to avoid using app passwords although my issue could be got over by forcing usage of app passwords.

Saml authentication bypass vulnerability

ℹ️ Support

SysKeeper November 28, 2023, 7:11am 20