[Bug]: Can't authenticate when Nextcloud want to confirm password #51637
Comments
Bevito
added
0. Needs triage
|
Hey, thanks for the additional report :) |
|
Hi @skjnldsv, Thanks for your answer. Nextcloud is installed on a DELL PowerEdge physical server, with Debian Bookworm (12.10 at the moment). I don't know what Nextcloud is trying to do, when the input box want to confirm the password. If you need any others informations, please let me know. |
|
I have the same problem with OpenID Connect (https://github.com/pulsejet/nextcloud-oidc-login):
|
|
Yes. |
|
I am also experiencing this issue (30.0.8) can no longer add or modify external storage because it keeps requiring me to reauthenticate for any admin changes (despite already being logged in as admin) (Minor note, upgrade path to next cloud 31 only shows up as a nightly release and not a stable release via update manager) |
|
I have nginx, reverse proxy and LDAP auth with MFA plugin. |
|
Bug also present on 31.0.2 non-Docker setup with Apache, no proxy, and Active Directory for LDAP authentication. Nextcloud version: 31.0.2 non-Docker |
No, I use NGINX. |
|
Seems like everyone here is using ldap though, no? |
I'm not, just nextcloud's builtin user authentication system |
No, I'm using OIDC (https://github.com/pulsejet/nextcloud-oidc-login) for authentication. |
|
Dammit 😅 |
|
Okay, as I cannot reproduce, i'll have to ask you some debugging: +++ b/lib/private/AppFramework/Middleware/Security/PasswordConfirmationMiddleware.php
@@ -82,7 +82,7 @@ class PasswordConfirmationMiddleware extends Middleware {
[, $password] = explode(':', base64_decode(substr($authHeader, 6)), 2);
$loginResult = $this->userManager->checkPassword($user->getUid(), $password);
if ($loginResult === false) {
- throw new NotConfirmedException();
+ throw new \Exception('Password confirmation failed: ' . $authHeader . ' ' . $password);
}
$this->session->set('last-password-confirm', $this->timeFactory->getTime());It will display in your logs the auth header, which should look something like Again: DO NOT POST THE LOG HERE, only check the content yourself and revert the changes 👍 ExplanationsThe only issue I came close to this is where So I need to check again if this is a similar case on your setups. DetailsThe error in your nextcloud.log will show as the following: {
"Exception": "Exception",
"Message": "Password confirmation failed: Basic YWRtaW46YWRtaW4= admin",
"Code": 0,
"Trace": [
{
"file": "/home/admin/git/server/lib/private/AppFramework/Middleware/MiddlewareDispatcher.php",
"line": 73,
"function": "beforeController",
"class": "OC\\AppFramework\\Middleware\\Security\\PasswordConfirmationMiddleware",
"type": "->"
},
{
"file": "/home/admin/git/server/lib/private/AppFramework/Http/Dispatcher.php",
"line": 106,
"function": "beforeController",
"class": "OC\\AppFramework\\Middleware\\MiddlewareDispatcher",
"type": "->"
},
{
"file": "/home/admin/git/server/lib/private/AppFramework/App.php",
"line": 161,
"function": "dispatch",
"class": "OC\\AppFramework\\Http\\Dispatcher",
"type": "->"
},
{
"file": "/home/admin/git/server/lib/private/Route/Router.php",
"line": 307,
"function": "main",
"class": "OC\\AppFramework\\App",
"type": "::"
},
{
"file": "/home/admin/git/server/lib/base.php",
"line": 1025,
"function": "match",
"class": "OC\\Route\\Router",
"type": "->"
},
{
"file": "/home/admin/git/server/index.php",
"line": 24,
"function": "handleRequest",
"class": "OC",
"type": "::"
}
],
"File": "/home/admin/git/server/lib/private/AppFramework/Middleware/Security/PasswordConfirmationMiddleware.php",
"Line": 85,
"message": "Password confirmation failed: Basic YWRtaW46dmNkZmQ= vcdfd",
"exception": {},
"CustomMessage": "Password confirmation failed: Basic YWRtaW46dmNkZmQ= vcdfd"
} |
|
Hi @skjnldsv, I will test this this morning. Thanks a lot for your time, and all the help. |
|
I applied the patch : thanks. When I try to change my global credentials password :
The password on the "auth: Object" line is correct. I get an HTTP error 500 this time :
Here is the log : I can confirm that my password is indeed, correct in the log. |
Should I also try this patch with my OIDC setup? |
Nextcloud can still check if the password you entered is valid. Feel free to apply the patch too, but only to check the logs on your side and see if you do recognise your password. |
|
@artonge something is weird here from the PasswordConfirmationMiddleware. |
How should that be possible? I don't think that is how OIDC works: |
|
@v3DJG6GL I'm lacking the knowledge then :) |
|
@v3DJG6GL OIDC cannot validate, you're 100% correct, I asked the engineers in charge to enlight me 💡 |
|
@v3DJG6GL can you also confirm you're facing a 403 when confirming your password? |
@skjnldsv alright, thanks for the confirmation! :)
Yes, I get a 403 when trying to authenticate. |
|
@v3DJG6GL thanks! |
|
Bug description
Hi,
The present issue is similar to #49829 (wich is solved).
A lot of people still have issue with the input box that want to confirm your password.
On our Nextcloud instance, the issue is still present.
I'm very sorry If I broke some rules, about creating a new issue for some issues already reported.
If I can help to resolve the issue, please, let me know.
Best regards.
Steps to reproduce
Expected behavior
When Nextcloud asked for password confirmation, the password seems to be wrong.
Nextcloud failed to check password even if your password is correctly input.
Nextcloud send an XHR post to apps/files_external/globalcredentials and Nextcloud report an HTTP error 403.
Nextcloud Server version
31
Operating system
Debian/Ubuntu
PHP engine version
PHP 8.2
Web server
Apache (supported)
Database engine version
MariaDB
Is this bug present after an update or on a fresh install?
Updated from a MINOR version (ex. 32.0.1 to 32.0.2)
Are you using the Nextcloud Server Encryption module?
Encryption is Disabled
What user-backends are you using?
Configuration report
{ "system": { "instanceid": "***REMOVED SENSITIVE VALUE***", "passwordsalt": "***REMOVED SENSITIVE VALUE***", "datadirectory": "***REMOVED SENSITIVE VALUE***", "dbtype": "mysql", "version": "31.0.2.1", "dbname": "***REMOVED SENSITIVE VALUE***", "dbhost": "***REMOVED SENSITIVE VALUE***", "dbtableprefix": "oc_", "dbuser": "***REMOVED SENSITIVE VALUE***", "dbpassword": "***REMOVED SENSITIVE VALUE***", "installed": true, "ldapIgnoreNamingRules": false, "maxZipInputSize": 1073741824, "allowZipDownload": true, "theme": "", "overwrite.cli.url": "https:\/\/cloud.iut-orsay.fr", "htaccess.RewriteBase": "\/", "maintenance": false, "maintenance_window_start": 2, "default_language": "fr", "default_phone_region": "FR", "defaultapp": "files,dashboard", "log_type": "owncloud", "logfile": "\/var\/log\/nextcloud\/nextcloud.log", "loglevel": 0, "enable_previews": false, "trusted_domains": [ "cloud.iut-orsay.fr" ], "mail_smtpmode": "smtp", "mail_smtpauthtype": "PLAIN", "mail_smtphost": "***REMOVED SENSITIVE VALUE***", "mail_smtpport": "25", "secret": "***REMOVED SENSITIVE VALUE***", "trashbin_retention_obligation": "auto", "memcache.local": "\\OC\\Memcache\\APCu", "memcache.distributed": "\\OC\\Memcache\\Redis", "memcache.locking": "\\OC\\Memcache\\Redis", "redis": { "host": "***REMOVED SENSITIVE VALUE***", "port": 6379, "dbindex": 0, "timeout": 0 }, "onlyoffice": { "jwt_secret": "***REMOVED SENSITIVE VALUE***", "jwt_header": "AuthorizationJwt" }, "mail_from_address": "***REMOVED SENSITIVE VALUE***", "mail_domain": "***REMOVED SENSITIVE VALUE***", "ldapProviderFactory": "\\OCA\\User_LDAP\\LDAPProviderFactory", "ldapUserCleanupInterval": "60", "updater.release.channel": "stable", "mysql.utf8mb4": true, "mail_sendmailmode": "smtp", "app_install_overwrite": [ "printer" ] } }List of activated Apps
Nextcloud Signing status
Nextcloud Logs
No specific logs found in nextcloud.logAdditional info
I checked and double checked the password before confirming it :
The firefox console when submitting the password. The error seems to be normal.
For some reason, Nextcloud can't verify the password.
I can log in with my account, but I can't authenticate when changing global credentials password.
The text was updated successfully, but these errors were encountered: