[Bug]: Can not confirm my password for administrative actions when logged in via LDAP / SAML

⚠️ This issue respects the following points: ⚠️

This is a bug, not a question or a configuration/webserver/proxy issue.
This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
I agree to follow Nextcloud's Code of Conduct.

Bug description

Nextcloud 28.0.2

We primarily use SAML via Active Directory for authentication. If I am logged in for a longer period of time I have to confirm my password for certain tasks such as disabling users, installing apps, etc.

When I now enter my SAML password I receive a 403 Forbidden in the console, and the confirmation prompt displays "wrong password"

Steps to reproduce

Login via SAML
Wait some time to be asked for your password again
Enter the password and be denied

Expected behavior

Password is checked against SAML and I can continue without having to log out and log in again

Installation method

None

Nextcloud Server version

28.0.2

Operating system

Ubuntu

PHP engine version

8.1.21

Web server

Apache2

Database engine version

Mysql

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

Default user-backend (database)
LDAP/ Active Directory
SSO - SAML
Other

Configuration report

{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "nextcloud.***REMOVED SENSITIVE VALUE***.com"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "28.0.2.5",
        "overwrite.cli.url": "http:\/\/172.22.1.77\/nextcloud",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpmode": "smtp",
        "mail_sendmailmode": "smtp",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "trashbin_retention_obligation": "1, 3",
        "maintenance": false,
        "theme": "",
        "loglevel": 2,
        "defaultapp": "files",
        "default_phone_region": "AT",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "skeletondirectory": "",
        "ldapProviderFactory": "OCA\\User_LDAP\\LDAPProviderFactory",
        "twofactor_enforced": "true",
        "twofactor_enforced_groups": [
            "guest_app"
        ],
        "twofactor_enforced_excluded_groups": [],
        "app_install_overwrite": [
            "cfg_share_links",
            "files_downloadlimit"
        ]
    }
}

List of activated Apps

Enabled:
  - activity: 2.20.0
  - admin_audit: 1.18.0
  - bruteforcesettings: 2.8.0
  - cfg_share_links: 4.2.0
  - cloud_federation_api: 1.11.0
  - dav: 1.29.1
  - federatedfilesharing: 1.18.0
  - files: 2.0.0
  - files_accesscontrol: 1.18.0
  - files_downloadlimit: 1.1.0
  - files_external: 1.20.0
  - files_pdfviewer: 2.9.0
  - files_reminders: 1.1.0
  - files_sharing: 1.20.0
  - files_trashbin: 1.18.0
  - files_versions: 1.21.0
  - group_default_quota: 0.1.8
  - groupfolders: 16.0.3
  - guests: 3.0.1
  - logreader: 2.13.0
  - lookup_server_connector: 1.16.0
  - notifications: 2.16.0
  - oauth2: 1.16.3
  - password_policy: 1.18.0
  - provisioning_api: 1.18.0
  - serverinfo: 1.18.0
  - settings: 1.10.1
  - theming: 2.3.0
  - twofactor_admin: 4.4.0
  - twofactor_backupcodes: 1.17.0
  - twofactor_totp: 10.0.0-beta.2
  - user_ldap: 1.19.0
  - user_saml: 6.1.1
  - viewer: 2.2.0
  - workflowengine: 2.10.0
Disabled:
  - circles: 28.0.0-dev (installed 27.0.1)
  - comments: 1.18.0 (installed 1.17.0)
  - contactsinteraction: 1.9.0 (installed 1.8.0)
  - dashboard: 7.8.0 (installed 7.0.0)
  - encryption: 2.16.0
  - federation: 1.18.0 (installed 1.17.0)
  - firstrunwizard: 2.17.0 (installed 2.16.0)
  - nextcloud_announcements: 1.17.0 (installed 1.16.0)
  - photos: 2.4.0 (installed 2.3.0)
  - privacy: 1.12.0 (installed 1.11.0)
  - recommendations: 2.0.0 (installed 1.6.0)
  - related_resources: 1.3.0 (installed 1.1.0-alpha1)
  - sharebymail: 1.18.0 (installed 1.17.0)
  - support: 1.11.0 (installed 1.10.0)
  - survey_client: 1.16.0 (installed 1.15.0)
  - suspicious_login: 6.0.0
  - systemtags: 1.18.0 (installed 1.17.0)
  - text: 3.9.1 (installed 3.9.1)
  - updatenotification: 1.18.0 (installed 1.17.0)
  - user_status: 1.8.1 (installed 1.0.1)
  - weather_status: 1.8.0 (installed 1.0.0)

Nextcloud Signing status

too long, will upload paste if neccesary

Nextcloud Logs

{"reqId":"tNWjYe683QXSWajw1iy6","level":2,"time":"2024-02-16T10:50:02+00:00","remoteAddr":"**removed**","user":"adminsega","app":"core","method":"POST","url":"/index.php/login/confirm","message":"Login failed: 'adminsega' (Remote IP: '**removed**')","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36","version":"28.0.2.5","data":{"app":"core"},"id":"65cf3ddfb2338"}

Additional info

No response

This does affect all supported versions, not only 28 (same issue occurs on v26).

Does the same problem occur with social login? I think this is a nextcloud issue.

I am not sure I agree with this decision... yes, there may be a ticket in the according SSO plugin repo (in my case actually pulsejet/nextcloud-oidc-login#54) – but those plugins seemingly cannot "fix" this, because it is a problem/missing feature with the server. There should at least be an option for the admin to turn this off as a workaround.

It is by the way hard to reproduce. I gave somebody admin rights but they couldn't do anything due to this until I defined them a password. For me however, there wasn't a single verification form even tho I also was coming from SSO.

I was expecting an issue with oidc, but never seen one. But have a server only fix candidate. OK, reopening here, and closing there.

Confirm, using oidc. Nextcloud asks for password on App Update for example. As a workaround I have to logout and login again to do admin tasks

Same issue still, I can only complete admin tasks by logging out and back in again. I could use the account's old NextCloud password, as the OIDC is just linked to an existing account on NextCloud (not newly provisioned), but that would defeat the purpose of an SSO entirely. Any workarounds for this in terms of config or so yet?

should be working in 28.0.9 and 29.0.5

should be working in 28.0.9 and 29.0.5

I have just taken the L. I had attached to old users, used the User Migration app to export all of their data, unlinked them from their old accounts, and then had Authentik automatically provision new accounts that are natively created via OIDC/OAuth2 and thus require no password. Then just imported their data, and so it was done. Luckily, in an environment such as ours, which right now only has about 20 users, this was done with a day's work.

This is still affecting 30.0.6 with the OIDC plugin. Wondering how this issue was closed?

@julien-nc

@julien-nc are you aware of anything? ^

@blizzz

@blizzz How do you prevent password confirmation in user_saml?

There is something done in user_oidc (by @juliusknorr ): https://github.com/nextcloud/user_oidc/blob/de9c250/lib/Controller/LoginController.php#L541-L542

Is it not enough?

@blizzz

In both apps, the last-password-confirm key is set in the session. The difference is:

in user_oidc, it's done once on login
in user_saml it's done everytime the user Id is obtained from the user backend: https://github.com/nextcloud/user_saml/blob/master/lib/UserBackend.php#L397

I guess last-password-confirm disappears when the session expires and gets renewed.

So @blizzz @juliusknorr would that be enough to call $this->session->set('last-password-confirm', strtotime('+4 year', time())) in user_oidc's backend::getCurrentUserId?

@julien-nc

@julien-nc we also changed it to have scope set to the token meanwhile, because the session was unreliable: #43942

There were strange things with the session we could not debug/reproduce though. The data should have been restored, and at least for user_saml it carries more necessary information than just that.

@blizzz

@blizzz Thanks. Can you point me to where you set the token scope in user_saml?

I think I get it. user_oidc does not create the user session the same way. It is never going through OC_User::loginWithApache.

I guess we need to manually set the token scope in user_oidc. PR incoming.

I think I get it. user_oidc does not create the user session the same way. It is never going through OC_User::loginWithApache.

I guess we need to manually set the token scope in user_oidc. PR incoming.

That explains it. Thanks for checking!

Thank you for looking into it again!

nextcloud/user_oidc#1061 Should prevent password confirmation in user_oidc.

Navigation Menu

Repository navigation

[Bug]: Can not confirm my password for administrative actions when logged in via LDAP / SAML #43612

⚠️ This issue respects the following points: ⚠️

Bug description

Steps to reproduce

Expected behavior

Installation method

Nextcloud Server version

Operating system

PHP engine version

Web server

Database engine version

Is this bug present after an update or on a fresh install?

Are you using the Nextcloud Server Encryption module?

What user-backends are you using?

Configuration report

List of activated Apps

Nextcloud Signing status

Nextcloud Logs

Additional info

5 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[Bug]: Can not confirm my password for administrative actions when logged in via LDAP / SAML #43612

Description

⚠️ This issue respects the following points: ⚠️

Bug description

Steps to reproduce

Expected behavior

Installation method

Nextcloud Server version

Operating system

PHP engine version

Web server

Database engine version

Is this bug present after an update or on a fresh install?

Are you using the Nextcloud Server Encryption module?

What user-backends are you using?

Configuration report

List of activated Apps

Nextcloud Signing status

Nextcloud Logs

Additional info

Activity

solracsf commented on Feb 16, 2024

verymilan commented on Feb 29, 2024

solracsf commented on Feb 29, 2024

DatNoHand commented on Feb 29, 2024

blizzz commented on Feb 29, 2024

verymilan commented on Mar 1, 2024

blizzz commented on Mar 1, 2024

5 remaining items

LokeYourC3PH commented on Sep 9, 2024

blizzz commented on Sep 10, 2024

LokeYourC3PH commented on Sep 10, 2024

waza-ari commented on Feb 17, 2025

blizzz commented on Feb 17, 2025

julien-nc commented on Feb 18, 2025

julien-nc commented on Feb 18, 2025

blizzz commented on Feb 18, 2025

julien-nc commented on Feb 18, 2025

julien-nc commented on Feb 18, 2025

blizzz commented on Feb 18, 2025

waza-ari commented on Feb 18, 2025

julien-nc commented on Feb 18, 2025

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions