[Bug]: remote.php/webdav issue with authentication plugins

⚠️ This issue respects the following points: ⚠️

This is a bug, not a question or a configuration/webserver/proxy issue.
This issue is not already reported on Github (I've searched it).
Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
I agree to follow Nextcloud's Code of Conduct.

Bug description

Hi. I help maintaining the nextcloud-oidc-login plugin to allow authentication against an OpenID Connect identity provider. The plugin works great for regular login, or against the remote.php/dav endpoint with either a token or a password.

However, there are some clients that still do not use the new remote.php/dav endpoint but stick to the old remote.php/webdav, as GNOME Online Accounts. GOA covers a very large userbase, but there is almost no maintenance on the project nowadays. No patch has been submitted for this yet, but even so, it would very unlikely be merged soon, and it would reach end-users on long term distributions like Debian very late. I really would like to reach those users.

I would like implement the support for BasicAuthentication against the remote.php/webdav endpoint with nextcloud-oidc-login, but I face a technical issue.

Steps to reproduce

Plugin registration

The endpoint registers a \OCA\DAV\Connector\Sabre\Auth and a \OCA\DAV\Connector\Sabre\BearerAuth authentication backends by default.

server/apps/dav/appinfo/v1/webdav.php

Lines 54 to 68 in a353db2

    
           $authBackend = new \OCA\DAV\Connector\Sabre\Auth( 
        
           	\OC::$server->getSession(), 
        
           	\OC::$server->getUserSession(), 
        
           	\OC::$server->getRequest(), 
        
           	\OC::$server->getTwoFactorAuthManager(), 
        
           	\OC::$server->getBruteForceThrottler(), 
        
           	'principals/' 
        
           ); 
        
           $authPlugin = new \Sabre\DAV\Auth\Plugin($authBackend); 
        
           $bearerAuthPlugin = new \OCA\DAV\Connector\Sabre\BearerAuth( 
        
           	\OC::$server->getUserSession(), 
        
           	\OC::$server->getSession(), 
        
           	\OC::$server->getRequest() 
        
           ); 
        
           $authPlugin->addBackend($bearerAuthPlugin);

I can register a custom backend due to the addPlugin event emitted just a few LOC later:

server/apps/dav/appinfo/v1/webdav.php

Line 80 in a353db2

$dispatcher->dispatch('OCA\DAV\Connector\Sabre::addPlugin', $event);

https://github.com/pulsejet/nextcloud-oidc-login/blob/0c072ecaa02579384bb5e10fbb9d219bbd96cfb8/lib/WebDAV/BasicAuthBackend.php#L95

Authentication request handling

So now we have three authentication backends registered, the default ones, and the nextcloud-oidc-login one. When a request is handled, all the backends are tested, beginning by the default ones:

https://github.com/nextcloud/3rdparty/blob/1269091e96a2a550912db37c0d2b29ed5c0aa60f/sabre/dav/lib/DAV/Auth/Plugin.php#L178

        foreach ($this->backends as $backend) {
            $result = $backend->check(
                $request,
                $response
            );

The default backends have zero way to know if an authentication request is valid or not, as I store all the relevant data in my OIDC provider, so this backend always fails to validate the authentication request.

https://github.com/nextcloud/3rdparty/blob/3fad2cede25f6cce70d4eb4e5f2e4fbceac583f8/sabre/dav/lib/DAV/Auth/Backend/AbstractBasic.php#L103

        if (!$this->validateUserPass($userpass[0], $userpass[1])) {
            return [false, 'Username or password was incorrect'];
        }

After the failure the default Auth backend closes the session:

server/apps/dav/lib/Connector/Sabre/Auth.php

Line 135 in 47e03cb

$this->session->close();

The issue

This is problematic for two reasons:

This generates tons of Login failed log entries, because the default auth backend always fails.

server/lib/private/User/Manager.php

Line 232 in f9fb5f5

    
           \OC::$server->getLogger()->warning('Login failed: \''. $loginName .'\' (Remote IP: \''. \OC::$server->getRequest()->getRemoteAddress(). '\')', ['app' => 'core']);

The next backends on the line finds a closed session, so a OCP\Session\Exceptions\SessionNotAvailableException is soon raised, preventing other backends to handle the session, thus making them unusable in some cases.
https://github.com/pulsejet/nextcloud-oidc-login/blob/85b175221677214f3cdd1389a0014e1bf0178c9f/lib/Service/LoginService.php#L336-L343
https://github.com/pulsejet/nextcloud-oidc-login/blob/268ba9483d0ecfdc506f6818b4de2db446979172/lib/WebDAV/BasicAuthBackend.php#L109-L116

Comparison with the v2 routes

I do not encounter those issues with the v2 routes, notably because the authInit event is dispatched before the registration of the Auth backend.
The code from v2 has even hints that those backends can be problematic as they raise exceptions, and thus should be loaded last:

server/apps/dav/lib/Server.php

Lines 136 to 146 in f116c87

    
           $newAuthEvent = new SabrePluginAuthInitEvent($this->server); 
        
           $newDispatcher->dispatchTyped($newAuthEvent); 
        
           $bearerAuthBackend = new BearerAuth( 
        
           	\OC::$server->getUserSession(), 
        
           	\OC::$server->getSession(), 
        
           	\OC::$server->getRequest() 
        
           ); 
        
           $authPlugin->addBackend($bearerAuthBackend); 
        
           // because we are throwing exceptions this plugin has to be the last one 
        
           $authPlugin->addBackend($authBackend);

Expected behavior

I can think of two ways to solve this situation:

Emit a authInit event (or another kind of event, say authInitV1) before Auth and BearerAuth backends are registered, like this is done in route v2.
Emit the addPlugin event before the Auth backend is registered. I don't know about compatibility though.
Defer the session closing elsewhere than in the validateUserPass method. I suppose this would be quite some work.
Give a way to reorder backends (maybe by implementing a insertBackend method in sabre DAV in addition to addBackend. This have been somewhat requested on the Sabre bugtracker but this would imply contributions being merged in Sabre before the fix could be in nextcloud.

I am not very familiar with the nextcloud implementation so I do not know which option would be prefered, however my favorite solution is number 1 as it would be simple to implement and would not break compatibility .If we agree on a solution I volunteer to provide a patch.

What do you think?

Technical information

### Installation method

Manual installation

Operating system

Other

PHP engine version

PHP 8.0

Web server

Nginx

Database engine version

PostgreSQL

Is this bug present after an update or on a fresh install?

Fresh Nextcloud Server install

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

Default user-backend (database)
LDAP/ Active Directory
SSO - SAML
Other

Configuration report

{
    "system": {
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "nuage.yaal.coop"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "pgsql",
        "version": "23.0.0.10",
        "overwrite.cli.url": "https:\/\/nuage.yaal.coop",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "skeletondirectory": "",
        "default_language": "fr",
        "default_locale": "fr_FR",
        "defaultapp": "files",
        "knowledgebaseenabled": false,
        "allow_user_to_change_display_name": false,
        "auth.bruteforce.protection.enabled": true,
        "auth.webauthn.enabled": true,
        "lost_password_link": "https:\/\/auth.yaal.coop\/reset",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": 587,
        "mail_smtpsecure": "tls",
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "htaccess.RewriteBase": "\/",
        "htaccess.IgnoreFrontController": false,
        "logfile": "\/opt\/nextcloud\/logs\/nextcloud.log",
        "logtimezone": "Europe\/Paris",
        "apps_paths": [
            {
                "path": "\/opt\/nextcloud\/src\/apps",
                "url": "\/apps",
                "writable": true
            }
        ],
        "memcache.local": "\\OC\\Memcache\\APCu",
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 6379,
            "timeout": 0,
            "password": "***REMOVED SENSITIVE VALUE***",
            "dbindex": 0
        },
        "upgrade.disable-web": true,
        "simpleSignUpLink.shown": false,
        "oidc_login_provider_url": "https:\/\/auth.yaal.coop",
        "oidc_login_client_id": "09ssYCqdo62yP01e9Cn5j9Vp",
        "oidc_login_client_secret": "jOxzUQazvCDtjK7csUa8TFaqGNbT5RtQxkXdbVSfTVRWg49H",
        "oidc_login_auto_redirect": true,
        "oidc_login_logout_url": "https:\/\/auth.yaal.coop\/logout",
        "oidc_login_default_quota": "5368709120",
        "oidc_login_button_text": "Se connecter avec canaille",
        "oidc_login_hide_password_form": true,
        "oidc_login_attributes": {
            "id": "sub",
            "name": "name",
            "mail": "email",
            "ldap_uid": "sub",
            "groups": "groups"
        },
        "oidc_login_default_group": "",
        "oidc_login_use_external_storage": false,
        "oidc_login_scope": "profile email groups",
        "oidc_login_proxy_ldap": false,
        "oidc_login_disable_registration": false,
        "oidc_login_redir_fallback": false,
        "oidc_login_tls_verify": true,
        "default_phone_region": "FR",
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "maintenance": false,
        "loglevel": 2,
        "oidc_login_webdav_enabled": true,
        "oidc_login_public_key_caching_time": 86400,
        "oidc_login_min_time_between_jwks_requests": 10,
        "oidc_login_well_known_caching_time": 86400,
        "oidc_create_groups": true,
        "oidc_login_password_authentication": true,
        "oidc_login_use_id_token": true,
        "oidc_login_end_session_redirect": false,
        "debug": true
    }
}

List of activated Apps

Enabled:
  - accessibility: 1.9.0
  - calendar: 3.0.5
  - cloud_federation_api: 1.6.0
  - comments: 1.13.0
  - contacts: 4.0.7
  - contactsinteraction: 1.4.0
  - dav: 1.21.0
  - federatedfilesharing: 1.13.0
  - federation: 1.13.0
  - files: 1.18.0
  - files_pdfviewer: 2.4.0
  - files_rightclick: 1.2.0
  - files_sharing: 1.15.0
  - files_trashbin: 1.13.0
  - files_versions: 1.16.0
  - files_videoplayer: 1.12.0
  - firstrunwizard: 2.12.0
  - impersonate: 1.10.0
  - logreader: 2.8.0
  - lookup_server_connector: 1.11.0
  - nextcloud_announcements: 1.12.0
  - notes: 4.3.0
  - notifications: 2.11.1
  - oauth2: 1.11.0
  - oidc_login: 2.2.0
  - onlyoffice: 7.3.0
  - password_policy: 1.13.0
  - photos: 1.5.0
  - privacy: 1.7.0
  - provisioning_api: 1.13.0
  - recommendations: 1.2.0
  - serverinfo: 1.13.0
  - settings: 1.5.0
  - sharebymail: 1.13.0
  - support: 1.6.0
  - survey_client: 1.11.0
  - systemtags: 1.13.0
  - tasks: 0.14.2
  - text: 3.4.0
  - theming: 1.14.0
  - twofactor_backupcodes: 1.12.0
  - updatenotification: 1.13.0
  - user_status: 1.3.1
  - viewer: 1.7.0
  - workflowengine: 2.5.0
Disabled:
  - activity
  - admin_audit
  - circles
  - dashboard
  - documentserver_community
  - encryption
  - files_external
  - user_ldap
  - weather_status

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

No response

Additional info

No response

@rullzer

@rullzer @juliushaertl @schiessle @LukasReschke
I gently ping you because you have intervened on files related to this bug (although it may have been long ago). I volunteer to provide a patch for this bug (if no one more competent than me does) but I would like to be sure that you share my observations, and to hear you thoughts on this. If you are not competent on this matter, I would really appreciate if you could point me to people who might help me. Thank you in advance.

For my understanding, why is it necessary to have the plugin for remote.php/dav endpoints but not remote.php/webdav? Do they work differently?

@ChristophWurst

I am not sure to understand your question @ChristophWurst
Currently the nextcloud-oidc-plugin works great with remote.php/dav but not with remote.php/webdav. I would like to make it work on remote.php/webdav too, even if this route is deprecated, as it reaches a large user base, notably because this is the route used by GNOME Online Accounts. Did I answered your question?

@ChristophWurst

@ChristophWurst gentle ping 🙏

Did you understand the issue I am raising, or should I try to reformulate?
Is one of the solutions I suggest OK to you?
If so, do you want me to submit a patch or do you prefer to tackle this yourself?

I'm not familiar with the code and unable to comprehend the problem and proposed solution. I will try to book some more time for a deeper look.

Ok. If you want we can meet on jitsi/zoom/... so I can try to tell you more clearly what it is about. You can find my email address in my github profile.

@ChristophWurst

@ChristophWurst I am sorry to insist, did you find an hour to spent on this in your schedule?

@azmeuk

@azmeuk I've been talking about this with @julien-nc and I think it should work if you would implement your own AuthPlugin class by extending the Sabre one and just override the initialize method with a higher priority.

https://github.com/nextcloud/3rdparty/blob/1269091e96a2a550912db37c0d2b29ed5c0aa60f/sabre/dav/lib/DAV/Auth/Plugin.php#L81

That way the beforeMethod event should be called first for your auth plugin.

Defer the session closing elsewhere than in the validateUserPass method. I suppose this would be quite some work.

Session closing should not block this anymore after #32162 where sessions could now also be reopened.

@azmeuk

@azmeuk I've been talking about this with @julien-nc and I think it should work if you would implement your own AuthPlugin class by extending the Sabre one and just override the initialize method with a higher priority.

Thank you @juliushaertl for your suggestion. Actually we may need to implement a whole UserBackend for other reasons, so this may not be necessary in the end. We have to think about this.

Anyways, if I were to implement a Sabre AuthPlugin, how could I replace the existing one in the remote.php/webdav route?

Session closing should not block this anymore after #32162 where sessions could now also be reopened.

As of today in the master branch, sessions are still closed is the Sabre basic auth backend:

server/apps/dav/lib/Connector/Sabre/Auth.php

Lines 112 to 121 in aec8dce

    
           try { 
        
           	if ($this->userSession->logClientIn($username, $password, $this->request, $this->throttler)) { 
        
           		\OC_Util::setupFS($this->userSession->getUser()->getUID()); 
        
           		$this->session->set(self::DAV_AUTHENTICATED, $this->userSession->getUser()->getUID()); 
        
           		$this->session->close(); 
        
           		return true; 
        
           	} else { 
        
           		$this->session->close(); 
        
           		return false; 
        
           	}

Good news. GOA will support the new endpoint with GNOME 44.

@szaimen

Hi @szaimen
Sorry I missed you message. This bug still happens with nextcloud 25.0.5
Debian 12 has reached code freeze, and will presumably ship GNOME 43 in which this bug still occur. So the ticket will at least be pertinent a few years unless this is fixed in nextcloud.

Can you please reopen the ticket? 🙏

After reviewing this request and considering community feedback, it appears there hasn't been significant interest or engagement from other users.

We appreciate your suggestion and understand the value you see in it. However, at this time, we will not be pursuing its implementation.

Especially because this endpoint is deprecated for a long time - all apps should use the new dav endpoint.

Thank you for your understanding.

I understand that your resources are limited and that you need to prioritize.
However I find it sad because 3 years ago I offered my help to implement a fix and only requested implementation feedback, so my work could fit in your design and roadmap.
Moreover, while this endpoint is indeed deprecated, it will still be used by Debian 12 lts users until 2028.

Navigation Menu

Repository navigation

[Bug]: `remote.php/webdav` issue with authentication plugins #31091

Bug description

Steps to reproduce

Plugin registration

Authentication request handling

The issue

Comparison with the v2 routes

Expected behavior

Operating system

PHP engine version

Web server

Database engine version

Is this bug present after an update or on a fresh install?

Are you using the Nextcloud Server Encryption module?

What user-backends are you using?

Configuration report

List of activated Apps

Nextcloud Signing status

Nextcloud Logs

Additional info

1 remaining item

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

	$authBackend = new \OCA\DAV\Connector\Sabre\Auth(
	\OC::$server->getSession(),
	\OC::$server->getUserSession(),
	\OC::$server->getRequest(),
	\OC::$server->getTwoFactorAuthManager(),
	\OC::$server->getBruteForceThrottler(),
	'principals/'
	);
	$authPlugin = new \Sabre\DAV\Auth\Plugin($authBackend);
	$bearerAuthPlugin = new \OCA\DAV\Connector\Sabre\BearerAuth(
	\OC::$server->getUserSession(),
	\OC::$server->getSession(),
	\OC::$server->getRequest()
	);
	$authPlugin->addBackend($bearerAuthPlugin);

	$newAuthEvent = new SabrePluginAuthInitEvent($this->server);
	$newDispatcher->dispatchTyped($newAuthEvent);

	$bearerAuthBackend = new BearerAuth(
	\OC::$server->getUserSession(),
	\OC::$server->getSession(),
	\OC::$server->getRequest()
	);
	$authPlugin->addBackend($bearerAuthBackend);
	// because we are throwing exceptions this plugin has to be the last one
	$authPlugin->addBackend($authBackend);

	try {
	if ($this->userSession->logClientIn($username, $password, $this->request, $this->throttler)) {
	\OC_Util::setupFS($this->userSession->getUser()->getUID());
	$this->session->set(self::DAV_AUTHENTICATED, $this->userSession->getUser()->getUID());
	$this->session->close();
	return true;
	} else {
	$this->session->close();
	return false;
	}

[Bug]: remote.php/webdav issue with authentication plugins #31091

Description

Bug description

Steps to reproduce

Plugin registration

Authentication request handling

The issue

Comparison with the v2 routes

Expected behavior

Operating system

PHP engine version

Web server

Database engine version

Is this bug present after an update or on a fresh install?

Are you using the Nextcloud Server Encryption module?

What user-backends are you using?

Configuration report

List of activated Apps

Nextcloud Signing status

Nextcloud Logs

Additional info

Activity

azmeuk commented on Mar 2, 2022

ChristophWurst commented on Mar 21, 2022

azmeuk commented on Mar 23, 2022

azmeuk commented on Jun 13, 2022

ChristophWurst commented on Jun 27, 2022

azmeuk commented on Jun 27, 2022

azmeuk commented on Jul 19, 2022

juliusknorr commented on Oct 24, 2022

azmeuk commented on Oct 26, 2022

azmeuk commented on Nov 29, 2022

szaimen commented on Jan 23, 2023

azmeuk commented on Jan 23, 2023

1 remaining item

azmeuk commented on Apr 7, 2023

umeshtomar2002 commented on Aug 29, 2023

azmeuk commented on Aug 29, 2023

susnux commented on Mar 13, 2025

azmeuk commented on Mar 13, 2025

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

[Bug]: `remote.php/webdav` issue with authentication plugins #31091