Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Bug]: oauth clients fail since 30.0.6 #50917

Open
5 of 8 tasks
normen opened this issue Feb 20, 2025 · 9 comments
Open
5 of 8 tasks

[Bug]: oauth clients fail since 30.0.6 #50917

normen opened this issue Feb 20, 2025 · 9 comments
Labels
0. Needs triage Pending check for reproducibility or if it fits our roadmap 30-feedback bug feature: authentication

Comments

@normen
Copy link

normen commented Feb 20, 2025

⚠️ This issue respects the following points: ⚠️

Bug description

Since updating to Nextcloud 30.0.6 two of my WebApps that use my NextCloud as OAuth login ceased to work. These are Peertube and Gitea. Both worked fine in 30.0.5.

WordPress (with OIDC plugin) and OpenWebUI can still use the NextCloud OAuth login after the update, only Peertube and Gitea give errors when trying to log in.

Steps to reproduce

  1. Set up peertube and gitea with OAuth login through Nextcloud
  2. Update Nextcloud to 30.0.6
  3. See the login doesn't work anymore

Expected behavior

The OAuth login should work for all external apps.

Nextcloud Server version

30

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.4

Web server

Nginx

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Updated from a MINOR version (ex. 32.0.1 to 32.0.2)

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

  • Default user-backend (database)
  • LDAP/ Active Directory
  • SSO - SAML
  • Other

Configuration report

{
    "system": {
        "htaccess.RewriteBase": "\/",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "appstoreenabled": true,
        "apps_paths": [
            {
                "path": "\/var\/www\/html\/apps",
                "url": "\/apps",
                "writable": false
            },
            {
                "path": "\/var\/www\/html\/custom_apps",
                "url": "\/custom_apps",
                "writable": true
            }
        ],
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "simpleSignUpLink.shown": false,
        "trusted_domains": [
            "cloud.bitwaves.de",
            "localhost",
            "nextcloud-fpm",
            "127.0.0.",
            "172.21.0.42"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "skeletondirectory": "",
        "templatedirectory": "",
        "dbtype": "mysql",
        "version": "30.0.6.2",
        "overwrite.cli.url": "http:\/\/cloud.bitwaves.de",
        "overwriteprotocol": "https",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpmode": "smtp",
        "mail_sendmailmode": "smtp",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpauthtype": "LOGIN",
        "mail_smtpauth": 1,
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "maintenance": false,
        "loglevel": 2,
        "log.condition": {
            "apps": [
                "admin_audit"
            ]
        },
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "password": "***REMOVED SENSITIVE VALUE***",
            "port": 6379
        },
        "app_install_overwrite": [
            "social",
            "jsloader",
            "ocdownloader",
            "ncdownloader",
            "news",
            "jitsi",
            "talk_matterbridge"
        ],
        "theme": "",
        "ncd_admin_settings": {
            "disallow_aria2_settings": "1",
            "ncd_disable_bt": "1"
        },
        "defaultapp": "",
        "maintenance_window_start": 3,
        "updater.release.channel": "stable",
        "default_phone_region": "DE"
    }
}

List of activated Apps

Enabled:
  - activity: 3.0.0
  - admin_audit: 1.20.0
  - assistant: 2.3.0
  - calendar: 5.1.0
  - cloud_federation_api: 1.13.0
  - comments: 1.20.1
  - contacts: 7.0.0
  - cookbook: 0.11.2
  - cospend: 3.0.11
  - dav: 1.31.1
  - deck: 1.14.3
  - external: 5.5.2
  - federatedfilesharing: 1.20.0
  - federation: 1.20.0
  - files: 2.2.0
  - files_accesscontrol: 1.20.1
  - files_automatedtagging: 1.20.0
  - files_downloadlimit: 3.0.0
  - files_external: 1.22.0
  - files_pdfviewer: 3.0.0
  - files_reminders: 1.3.0
  - files_sharing: 1.22.0
  - files_trashbin: 1.20.1
  - files_versions: 1.23.0
  - files_zip: 2.1.0
  - flow_notifications: 1.10.1
  - forms: 4.3.7
  - gpxpod: 7.0.4
  - groupfolders: 18.1.0
  - impersonate: 1.17.1
  - integration_openai: 3.4.0
  - integration_peertube: 1.2.0
  - integration_youtube: 0.3.1
  - logreader: 3.0.0
  - lookup_server_connector: 1.18.0
  - mail: 4.2.0
  - ncdownloader: 1.0.21
  - news: 25.2.1
  - nextcloud_announcements: 2.0.0
  - notes: 4.11.0
  - notifications: 3.0.0
  - oauth2: 1.18.1
  - oidc: 1.4.0
  - password_policy: 2.0.0
  - passwords: 2024.12.21
  - polls: 7.3.1
  - privacy: 2.0.0
  - provisioning_api: 1.20.0
  - related_resources: 1.5.0
  - serverinfo: 2.0.0
  - settings: 1.13.0
  - sharebymail: 1.20.0
  - spreed: 20.1.4
  - talk_matterbridge: 1.31.1026000
  - tasks: 0.16.1
  - text: 4.1.0
  - theming: 2.6.0
  - twofactor_backupcodes: 1.19.0
  - unroundedcorners: 1.1.4
  - updatenotification: 1.20.0
  - viewer: 3.0.0
  - webhook_listeners: 1.1.0-dev
  - whiteboard: 1.0.5
  - workflow_ocr: 1.30.1
  - workflow_pdf_converter: 1.15.1
  - workflow_script: 1.15.0
  - workflowengine: 2.12.0
Disabled:
  - analytics: 5.2.4 (installed 5.2.4)
  - app_api: 4.0.6 (installed 3.2.1)
  - bruteforcesettings: 3.0.0 (installed 2.4.0)
  - circles: 30.0.0 (installed 24.0.1)
  - contactsinteraction: 1.11.0 (installed 1.5.0)
  - dashboard: 7.10.0 (installed 7.6.0)
  - encryption: 2.18.0
  - files_downloadactivity: 1.17.0 (installed 1.17.0)
  - files_scripts: 4.1.0 (installed 4.1.0)
  - firstrunwizard: 3.0.0 (installed 2.9.0)
  - integration_dropbox: 3.0.3 (installed 3.0.3)
  - integration_giphy: 2.0.1 (installed 2.0.1)
  - jitsi: 0.19.0 (installed 0.19.0)
  - jsloader: 1.5.0 (installed 1.5.0)
  - maps: 1.5.0 (installed 1.5.0)
  - photos: 3.0.2 (installed 1.0.0)
  - recommendations: 3.0.0 (installed 0.7.0)
  - richdocuments: 8.5.3 (installed 8.5.3)
  - sharelisting: 1.2.0 (installed 1.2.0)
  - sharerenamer: 3.4.0 (installed 3.4.0)
  - side_menu: 4.0.1 (installed 4.0.1)
  - social: 0.7.0 (installed 0.7.0)
  - support: 2.0.0 (installed 1.2.1)
  - survey_client: 2.0.0 (installed 1.8.0)
  - suspicious_login: 8.0.0 (installed 4.4.0)
  - systemtags: 1.20.0 (installed 1.14.0)
  - tables: 0.8.4 (installed 0.8.4)
  - translate: 2.2.0 (installed 2.2.0)
  - twofactor_nextcloud_notification: 4.0.0
  - twofactor_totp: 12.0.0-dev
  - user_ldap: 1.21.0
  - user_status: 1.10.0 (installed 1.0.1)
  - weather_status: 1.10.0 (installed 1.0.0)
  - workflow_media_converter: 1.12.0 (installed 1.12.0)

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

Additional info

No response

@normen normen added 0. Needs triage Pending check for reproducibility or if it fits our roadmap bug labels Feb 20, 2025
@susnux
Copy link
Contributor

susnux commented Feb 20, 2025

WordPress (with OIDC plugin) and OpenWebUI can still use the NextCloud OAuth login after the update, only Peertube and Gitea give errors when trying to log in.

Some working some not sounds like a problem with external software.

Nevertheless without logs we can not debug this further, so please add corresponding logs.

@lhsei
Copy link

lhsei commented Feb 20, 2025

#50619

In this bugreport the logs are included. The error is related to the Nextcloud Files and Nextcloud Talk-App too. Since 30.0.6 there is no possibility to log in.

And it's independend from OS. The error is on iOS and Android.

@normen
Copy link
Author

normen commented Feb 20, 2025

Theres no specific error messages from Nextcloud, it plays as if everything went normal. But the apps are reporting that the login failed when the callback is reached. Downgrading to 30.0.5 fixes the issue and there were no changes to either Gitea or Peertube installs, so I doubt its external software. I guess the issue is in the callback which is handled differently in the external apps.

And yeah, given there seem to be multiple issues around OAuth client and provider since 30.0.6 - maybe its in order not to dismiss this right away and look into it. Just my two cents, I can stick to 30.0.5 🤷‍♂️

@joshtrichards
Copy link
Member

@lhsei Are you using oauth? I didn't see any references in your linked bug report.

@susnux
Copy link
Contributor

susnux commented Feb 23, 2025

@st3iny the only change for oauth between 30.0.5 and 30.0.6 is the backport of #50193
Do you think it could be related?

@normen did re-setup gitea oauth resolve the issue?

@st3iny
Copy link
Member

st3iny commented Feb 23, 2025

My PR only added repair jobs and didn't change the authentication logic.

I have one more question to be sure: @normen Did you downgrade by simply replacing the server files or did you also restore an old database backup?

If you also restored a backup it could mean that the new migration code in the repair jobs is too aggressive. Ideally, repair jobs should not touch OAuth2 tables if the instance was not migrated from ownCloud since they last ran.

@normen
Copy link
Author

normen commented Feb 23, 2025

The latter, full restore, wouldn't know how to downgrade Nextcloud otherwise

@normen
Copy link
Author

normen commented Feb 23, 2025

@st3iny the only change for oauth between 30.0.5 and 30.0.6 is the backport of #50193
Do you think it could be related?

@normen did re-setup gitea oauth resolve the issue?

No, I tried fiddling in Gitea and Peertube, also set up a completely new auth for Peertube but no dice

@st3iny
Copy link
Member

st3iny commented Feb 23, 2025

In that case the migration code changes could be related. Although, I'd expect to see errors in the log.

@normen If you are up for it, I'd like to get some more data on the matter:

  1. Could you please run the following SQL query on your DB: describe oc_oauth2_clients;
  2. Did you try creating a new OAuth2 client in Nextcloud, configuring it on one of the external platforms and did it work then?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
0. Needs triage Pending check for reproducibility or if it fits our roadmap 30-feedback bug feature: authentication
Projects
None yet
Development

No branches or pull requests

6 participants