镜像站点 · 本页由第三方 GitHub 只读镜像提供，非 GitHub 官方站点，不接受任何登录或凭据输入。前往 github.com
Skip to content

[Bug]: Creating App Password not possible when using SAML Auth #44822

Open
Open
[Bug]: Creating App Password not possible when using SAML Auth#44822
Labels
0. Needs triagePending check for reproducibility or if it fits our roadmap28-feedback29-feedback30-feedbackbugfeature: authenticationneeds reviewNeeds review to determine if still applicable or covered by other Issues

Description

@MasterPuffin
MasterPuffin
opened on Apr 14, 2024

⚠️ This issue respects the following points: ⚠️

Bug description

When SAML is configured to be the only possible option for login, it is not possible to create an app password.
When trying to crate an app password the server responds with a 503, however no error is displayed in the webinterface.
The log states
Call to undefined method OCA\User_SAML\UserBackend::checkPassword()

Steps to reproduce

  1. Click on create app password

Expected behavior

An app password is created or at least an error is shown

Installation method

Community Web installer on a VPS or web space

Nextcloud Server version

28

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.2

Web server

Apache (supported)

Database engine version

MySQL

Is this bug present after an update or on a fresh install?

None

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

  • Default user-backend (database)
  • LDAP/ Active Directory
  • SSO - SAML
  • Other

Configuration report

No response

List of activated Apps

No response

Nextcloud Signing status

No response

Nextcloud Logs

Error
Call to undefined method OCA\User_SAML\UserBackend::checkPassword()
/var/www/hostname/lib/private/User/Session.php
line 627
OC\User\Manager->checkPasswordNoLogging(
  "*** sensitive parameters replaced ***"
)
/var/www/hostname/lib/private/User/Session.php
line 356
OC\User\Session->loginWithPassword(
  "*** sensitive parameters replaced ***"
)
/var/www/hostname/lib/private/User/Session.php
line 453
OC\User\Session->login(
  "*** sensitive parameters replaced ***"
)
/var/www/hostname/apps/dav/lib/Connector/Sabre/Auth.php
line 113
OC\User\Session->logClientIn(
  "*** sensitive parameters replaced ***"
)
/var/www/hostname/3rdparty/sabre/dav/lib/DAV/Auth/Backend/AbstractBasic.php
line 103
OCA\DAV\Connector\Sabre\Auth->validateUserPass(
  "*** sensitive parameters replaced ***"
)
/var/www/hostname/apps/dav/lib/Connector/Sabre/Auth.php
line 231
Sabre\DAV\Auth\Backend\AbstractBasic->check(
  [
    "Sabre\\HTTP\\Request"
  ],
  [
    "Sabre\\HTTP\\Response"
  ]
)
/var/www/hostname/apps/dav/lib/Connector/Sabre/Auth.php
line 138
OCA\DAV\Connector\Sabre\Auth->auth(
  [
    "Sabre\\HTTP\\Request"
  ],
  [
    "Sabre\\HTTP\\Response"
  ]
)
/var/www/hostname/3rdparty/sabre/dav/lib/DAV/Auth/Plugin.php
line 179
OCA\DAV\Connector\Sabre\Auth->check(
  [
    "Sabre\\HTTP\\Request"
  ],
  [
    "Sabre\\HTTP\\Response"
  ]
)
/var/www/hostname/3rdparty/sabre/dav/lib/DAV/Auth/Plugin.php
line 135
Sabre\DAV\Auth\Plugin->check(
  [
    "Sabre\\HTTP\\Request"
  ],
  [
    "Sabre\\HTTP\\Response"
  ]
)
/var/www/hostname/3rdparty/sabre/event/lib/WildcardEmitterTrait.php
line 89
Sabre\DAV\Auth\Plugin->beforeMethod(
  [
    "Sabre\\HTTP\\Request"
  ],
  [
    "Sabre\\HTTP\\Response"
  ]
)
/var/www/hostname/3rdparty/sabre/dav/lib/DAV/Server.php
line 456
Sabre\DAV\Server->emit(
  "beforeMethod:OPTIONS",
  [
    [
      "Sabre\\HTTP\\Request"
    ],
    [
      "Sabre\\HTTP\\Response"
    ]
  ]
)
/var/www/hostname/3rdparty/sabre/dav/lib/DAV/Server.php
line 253
Sabre\DAV\Server->invokeMethod(
  [
    "Sabre\\HTTP\\Request"
  ],
  [
    "Sabre\\HTTP\\Response"
  ]
)
/var/www/hostname/3rdparty/sabre/dav/lib/DAV/Server.php
line 321
Sabre\DAV\Server->start()
/var/www/hostname/apps/dav/lib/Server.php
line 370
Sabre\DAV\Server->exec()
/var/www/hostname/apps/dav/appinfo/v2/remote.php
line 35
OCA\DAV\Server->exec()
/var/www/hostname/remote.php
line 172
undefinedundefinedrequire_once(
  "/var/www/hostname/apps/dav/appinfo/v2/remote.php"
)
Raw log entry
{
  "reqId": "aG2wEPA7jJK5VHAkwgqn",
  "level": 3,
  "time": "2024-04-14T19:52:25+00:00",
  "remoteAddr": "IP",
  "user": "--",
  "app": "webdav",
  "method": "OPTIONS",
  "url": "/remote.php/dav/files/Username",
  "message": "Call to undefined method OCA\\User_SAML\\UserBackend::checkPassword()",
  "userAgent": "gvfs/1.52.2",
  "version": "28.0.2.5",
  "exception": {
    "Exception": "Error",
    "Message": "Call to undefined method OCA\\User_SAML\\UserBackend::checkPassword()",
    "Code": 0,
    "Trace": [
      {
        "file": "/var/www/hostname/lib/private/User/Session.php",
        "line": 627,
        "function": "checkPasswordNoLogging",
        "class": "OC\\User\\Manager",
        "type": "->",
        "args": [
          "*** sensitive parameters replaced ***"
        ]
      },
      {
        "file": "/var/www/hostname/lib/private/User/Session.php",
        "line": 356,
        "function": "loginWithPassword",
        "class": "OC\\User\\Session",
        "type": "->",
        "args": [
          "*** sensitive parameters replaced ***"
        ]
      },
      {
        "file": "/var/www/hostname/lib/private/User/Session.php",
        "line": 453,
        "function": "login",
        "class": "OC\\User\\Session",
        "type": "->",
        "args": [
          "*** sensitive parameters replaced ***"
        ]
      },
      {
        "file": "/var/www/hostname/apps/dav/lib/Connector/Sabre/Auth.php",
        "line": 113,
        "function": "logClientIn",
        "class": "OC\\User\\Session",
        "type": "->",
        "args": [
          "*** sensitive parameters replaced ***"
        ]
      },
      {
        "file": "/var/www/hostname/3rdparty/sabre/dav/lib/DAV/Auth/Backend/AbstractBasic.php",
        "line": 103,
        "function": "validateUserPass",
        "class": "OCA\\DAV\\Connector\\Sabre\\Auth",
        "type": "->",
        "args": [
          "*** sensitive parameters replaced ***"
        ]
      },
      {
        "file": "/var/www/hostname/apps/dav/lib/Connector/Sabre/Auth.php",
        "line": 231,
        "function": "check",
        "class": "Sabre\\DAV\\Auth\\Backend\\AbstractBasic",
        "type": "->",
        "args": [
          [
            "Sabre\\HTTP\\Request"
          ],
          [
            "Sabre\\HTTP\\Response"
          ]
        ]
      },
      {
        "file": "/var/www/hostname/apps/dav/lib/Connector/Sabre/Auth.php",
        "line": 138,
        "function": "auth",
        "class": "OCA\\DAV\\Connector\\Sabre\\Auth",
        "type": "->",
        "args": [
          [
            "Sabre\\HTTP\\Request"
          ],
          [
            "Sabre\\HTTP\\Response"
          ]
        ]
      },
      {
        "file": "/var/www/hostname/3rdparty/sabre/dav/lib/DAV/Auth/Plugin.php",
        "line": 179,
        "function": "check",
        "class": "OCA\\DAV\\Connector\\Sabre\\Auth",
        "type": "->",
        "args": [
          [
            "Sabre\\HTTP\\Request"
          ],
          [
            "Sabre\\HTTP\\Response"
          ]
        ]
      },
      {
        "file": "/var/www/hostname/3rdparty/sabre/dav/lib/DAV/Auth/Plugin.php",
        "line": 135,
        "function": "check",
        "class": "Sabre\\DAV\\Auth\\Plugin",
        "type": "->",
        "args": [
          [
            "Sabre\\HTTP\\Request"
          ],
          [
            "Sabre\\HTTP\\Response"
          ]
        ]
      },
      {
        "file": "/var/www/hostname/3rdparty/sabre/event/lib/WildcardEmitterTrait.php",
        "line": 89,
        "function": "beforeMethod",
        "class": "Sabre\\DAV\\Auth\\Plugin",
        "type": "->",
        "args": [
          [
            "Sabre\\HTTP\\Request"
          ],
          [
            "Sabre\\HTTP\\Response"
          ]
        ]
      },
      {
        "file": "/var/www/hostname/3rdparty/sabre/dav/lib/DAV/Server.php",
        "line": 456,
        "function": "emit",
        "class": "Sabre\\DAV\\Server",
        "type": "->",
        "args": [
          "beforeMethod:OPTIONS",
          [
            [
              "Sabre\\HTTP\\Request"
            ],
            [
              "Sabre\\HTTP\\Response"
            ]
          ]
        ]
      },
      {
        "file": "/var/www/hostname/3rdparty/sabre/dav/lib/DAV/Server.php",
        "line": 253,
        "function": "invokeMethod",
        "class": "Sabre\\DAV\\Server",
        "type": "->",
        "args": [
          [
            "Sabre\\HTTP\\Request"
          ],
          [
            "Sabre\\HTTP\\Response"
          ]
        ]
      },
      {
        "file": "/var/www/hostname/3rdparty/sabre/dav/lib/DAV/Server.php",
        "line": 321,
        "function": "start",
        "class": "Sabre\\DAV\\Server",
        "type": "->",
        "args": []
      },
      {
        "file": "/var/www/hostname/apps/dav/lib/Server.php",
        "line": 370,
        "function": "exec",
        "class": "Sabre\\DAV\\Server",
        "type": "->",
        "args": []
      },
      {
        "file": "/var/www/hostname/apps/dav/appinfo/v2/remote.php",
        "line": 35,
        "function": "exec",
        "class": "OCA\\DAV\\Server",
        "type": "->",
        "args": []
      },
      {
        "file": "/var/www/hostname/remote.php",
        "line": 172,
        "args": [
          "/var/www/hostname/apps/dav/appinfo/v2/remote.php"
        ],
        "function": "require_once"
      }
    ],
    "File": "/var/www/hostname/lib/private/User/Manager.php",
    "Line": 265,
    "message": "Call to undefined method OCA\\User_SAML\\UserBackend::checkPassword()",
    "exception": [],
    "CustomMessage": "Call to undefined method OCA\\User_SAML\\UserBackend::checkPassword()"
  },
  "id": "661c33fc04507"
}

Additional info

No response

Activity

  1. MasterPuffin
    added
    0. Needs triagePending check for reproducibility or if it fits our roadmap
    bug
    on Apr 14, 2024
  2. szaimen
    added
    28-feedback
    on Apr 14, 2024

  3. solracsf commented on Apr 15, 2024

    @solracsf
    solracsf
    on Apr 15, 2024
    Member

    Possible duplicate of nextcloud/user_saml#826

  4. adsche commented on Jun 4, 2024

    @adsche
    adsche
    on Jun 4, 2024

    Possible duplicate of nextcloud/user_saml#826

    I don't think it is. Our user_saml has the fixed version of lib/UserBackend.php but we still cannot create app passwords. There are no error messages for the user nor in the Nextcloud or php_fpm logs. Devtools shows a 503 response to the POST request to /settings/personal/authtokens (request only containing the "name" for the new app, JSON encoded).

  5. Naia-love commented on Jun 14, 2024

    @Naia-love
    Naia-love
    on Jun 14, 2024

    I can confirm adsche comment
    No log in nextcloud.log
    the button just dosent do anything, and in webbrowser's console it just show a 503 for a POST request to https://diopbox.fr/settings/personal/authtokens

    It appear that loggin off and back in fix it, I suppose its linked to this patch? https://github.com/nextcloud/server/pull/7487/files
    which appear to set a timer for it (30m, i can try to wait rn and see)

    edit: dosent happen anymore, I'll try to find an actual way to replicate it

  6. adsche commented on Jun 22, 2024

    @adsche
    adsche
    on Jun 22, 2024

    Wow! Indeed, it works right after login for a while (more than 30 min) but stops working at some point.

  7. aurelilia commented on Jun 27, 2024

    @aurelilia
    aurelilia
    on Jun 27, 2024

    I can confirm that this bug, including the timed behavior and no errors, also happens with OIDC login.

  8. adsche commented on Jun 28, 2024

    @adsche
    adsche
    on Jun 28, 2024

    I upgraded to 29.0.3 because I almost expected #43942 (#45705) to fix this issue as it seems related. Unfortunately it doesn't seem to have fixed it. App password creation was again possible for only a short time after SSO login.

  9. Naia-love commented on Jun 28, 2024

    @Naia-love
    Naia-love
    on Jun 28, 2024

    can confirm upgraded to 29.0.3 and it still have the same problem

  10. j007bond007 commented on Jul 19, 2024

    @j007bond007
    j007bond007
    on Jul 19, 2024

    Confirmed... only recent login allows it to work - affects installing Apps as well

  11. joshtrichards
    added
    feature: authentication
    on Aug 2, 2024

  12. battosai30 commented on Aug 30, 2024

    @battosai30
    battosai30
    on Aug 30, 2024

    I confirm. Account deconnection/Reconnection solves the issue

  13. joshtrichards
    added
    needs reviewNeeds review to determine if still applicable or covered by other Issues
    on Nov 6, 2024

  14. meyca commented on Nov 23, 2024

    @meyca
    meyca
    on Nov 23, 2024

    Using [Nextcloud Hub 8] (29.0.8) and OIDC: Logout and Re-Login is needed to manipulate App Passwords.

  15. wintix commented on Dec 9, 2024

    @wintix
    wintix
    on Dec 9, 2024

    Same here, logout and re-login is needed for it to work.

  16. EnercoopJNE commented on Mar 7, 2025

    @EnercoopJNE
    EnercoopJNE
    on Mar 7, 2025

    Since last comment is 3 months old, I'm just here to tell that it's still happening with version 30.0.6

  17. gonzalo commented on Mar 24, 2025

    @gonzalo
    gonzalo
    on Mar 24, 2025
    Contributor

    Just started experimenting this behaviour on last upgrade to Nextcloud 30.0.8

  18. adsche commented on Mar 24, 2025

    @adsche
    adsche
    on Mar 24, 2025

    @szaimen - as you added the "28 feedback" tag and there wasn't any response/acknowledgement from the team since then, I'd just like to point out that this is still valid in 29 and 30 ...

  19. szaimen
    added
    29-feedback
    30-feedback
    on Mar 24, 2025
  20. susnux
    added this to 🧑‍🤝‍🧑 Community triageon Apr 1, 2025
  21. susnux
    moved this to Backlog in 🧑‍🤝‍🧑 Community triageon Apr 1, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    0. Needs triagePending check for reproducibility or if it fits our roadmap28-feedback29-feedback30-feedbackbugfeature: authenticationneeds reviewNeeds review to determine if still applicable or covered by other Issues

    Type

    No type

    Projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions