OAuth broken with 23.0.0 (since 22.0.0)

The way an OAuth login works doesn't seem to work anymore. So far I have always used an OAuth sign-in in RocketChat (configuration and more see below). That doesn't seem to work anymore. The only thing Nextcloud outputs as a log is a "Login failed: ". But I don't know where there would be more logs (if Nextcloud creates more logs at all). If there are more logs, please let me know where I can find these logs and I will be happy to provide them as soon as possible but my search did not result to more useful informations.

Steps to reproduce

Login on RocketChat with OAuth
Give access to RocketChat OAuth Client within the Nextcloud Authorization Flow
After successfull Nextcloud Authorization Flow the OAuth Client receives that: Exception while invoking method login Error: Failed to complete OAuth handshake with nextcloud at https://XXXXXXXX/index.php/apps/oauth2/api/v1/token. failed [401] {"message":""} - while Nextcloud does only log that: Login failed: '<OAuth Client ID)' (Remote IP: 'XXX')

Server configuration

Operating system:
Debian 10

Web server:
Latest NGINX

Database:
MySQL 10.3.29

PHP version:
7.4.21

Nextcloud version:
22.0.0.11

Where did you install Nextcloud from:
Website

Signing status:

Signing status

No errors have been found.

List of activated apps:

App list

Enabled:
  - accessibility: 1.7.0
  - activity: 2.15.0
  - admin_audit: 1.11.0
  - apporder: 0.13.0
  - bruteforcesettings: 2.2.0
  - circles: 22.0.0
  - cloud_federation_api: 1.4.0
  - comments: 1.11.0
  - contacts: 4.0.1
  - contactsinteraction: 1.2.0
  - dashboard: 7.1.0
  - dav: 1.18.0
  - external: 3.9.0
  - extract: 1.3.2
  - federatedfilesharing: 1.11.0
  - files: 1.16.0
  - files_accesscontrol: 1.12.0
  - files_pdfviewer: 2.3.0
  - files_rightclick: 1.1.0
  - files_sharing: 1.13.2
  - files_trashbin: 1.11.0
  - files_versions: 1.14.0
  - files_videoplayer: 1.11.0
  - firstrunwizard: 2.11.0
  - groupfolders: 10.0.0-beta1
  - impersonate: 1.9.0
  - integration_gitlab: 1.0.1
  - logreader: 2.7.0
  - lookup_server_connector: 1.9.0
  - mail: 1.10.2
  - nextcloud_announcements: 1.11.0
  - notes: 4.1.0
  - notifications: 2.10.1
  - oauth2: 1.9.0
  - password_policy: 1.12.0
  - passwords: 2021.7.23
  - photos: 1.4.0
  - privacy: 1.6.0
  - provisioning_api: 1.11.0
  - quota_warning: 1.11.0
  - recommendations: 1.1.0
  - serverinfo: 1.12.0
  - settings: 1.3.0
  - sharebymail: 1.11.0
  - spreed: 12.0.1
  - survey_client: 1.10.0
  - systemtags: 1.11.0
  - text: 3.3.0
  - theming: 1.12.0
  - twofactor_backupcodes: 1.10.1
  - updatenotification: 1.11.0
  - user_status: 1.1.1
  - viewer: 1.6.0
  - weather_status: 1.1.0
  - workflowengine: 2.3.0

Disabled:
  - afterlogic
  - deck
  - encryption
  - federation
  - files_external
  - files_texteditor
  - hsts
  - metadata
  - polls
  - social
  - support
  - user_ldap

Nextcloud configuration:

Config report

{
    "system": {
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "default_language": "de_DE",
        "activity_expire_days": 1,
        "force_language": "de_DE",
        "default_locale": "de_DE",
        "default_phone_region": "DE",
        "trusted_domains": [
            "localhost",
            "<OAuth Client URL :)>"
        ],
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "22.0.0.11",
        "overwrite.cli.url": "http:\/\/localhost",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpmode": "smtp",
        "mail_smtpauthtype": "LOGIN",
        "mail_sendmailmode": "smtp",
        "mail_smtpauth": 1,
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpsecure": "ssl",
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "465",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "maintenance": false,
        "loglevel": 2,
        "updater.secret": "***REMOVED SENSITIVE VALUE***",
        "theme": "",
        "updater.release.channel": "stable"
    }
}

Are you using encryption: no

Are you using an external user-backend, if yes which one: no

Client configuration

Browser:
Latest Firefox, latest Chrome

Operating system:

Win10

Log from OAuth Client (RocketChat):

I20210730-15:34:19.956(0) Exception while invoking method login Error: Failed to complete OAuth handshake with nextcloud at https://XXXXXXXX/index.php/apps/oauth2/api/v1/token. failed [401] {"message":""}

No useful logs from Webserver

nextcloud.log

{"reqId":"xxxx","level":2,"time":"2021-07-30T15:34:19+00:00","remoteAddr":"xxxxx","user":"--","app":"core","method":"POST","url":"/index.php/apps/oauth2/api/v1/token","message":"Login failed: '<OAuth Client ID>' (Remote IP: 'XXX')","userAgent":"Meteor/METEOR@2.1.1","version":"22.0.0.11"}

Again: please let me know where I can find more logs and I will be happy to provide them as soon as possible but my search did not result to more useful informations from Nextcloud. I wish to see more informations what exactly has gone wrong.
It seems to be an issue since Nextcloud 22, because before it had worked.

Edit:
It's been almost 3 months now, I can confirm that with 22.2.0 OAuth is still not working.

Hi there, did you make sure that you've correctly configured nginx?
https://docs.nextcloud.com/server/stable/admin_manual/installation/nginx.html?highlight=nginx

@szaimen

Hi there, did you make sure that you've correctly configured nginx?
https://docs.nextcloud.com/server/stable/admin_manual/installation/nginx.html?highlight=nginx

Hi @szaimen ,
yes, Nginx is configured well. Using the same vhost (also please notice that with Nextcloud 21 everything worked well).

It would be very great if nextcloud could log more than just that, so debugging could be easier...

https://user-images.githubusercontent.com/35430448/127677194-abc2bec1-5409-4c4a-a629-735a2e6056ae.png

Update:
Also does not work in 22.1.0. It definitely went broken with Nextcloud 22.

I do have the same problem with Nextcloud and Moodle. I upgrade to version 22.1.0 using the Docker images and get the following error message in Moodle when I try to authenticate.

Could not upgrade OAuth 2 token. HTTP status for remote endpoint: 401

The log-output from Nextcloud:

[core] Warning: Login failed: 'j7nWFkFbkrcYGYfUGIJSJCPfner94pnhnhFF2NqZakg45tPGI31qchrDe0EcxRNM' (Remote IP: '172.18.0.1')

POST /index.php/apps/oauth2/api/v1/token

from 172.18.0.1 at 2021-08-16T11:26:47+00:00

I've got the same issue with NC22 upgrade - and reported as #28554 (closed now)

An additional note. This bug also prevents the desktop client from sharing with other users:

on NC 21 it's working fine..

Issue still existing with the recent update to 22.1.1.

@nickvergessen

Unfortunately the problem still exists for me with v22.2.1.

Problem unchanged as already described at the end of July. @nickvergessen

Does it work for you? @FrankyB @TobjasR @pabsta1 @cjhille @charlax

Maybe there is someone here who uses Rocket Chat <=> NextCloud OAuth. @firlevapz

Double checked and that commit here is existing on the server:

03936d7

Fix basic auth for OAuth token endpoint

Yes, I'm using nextcloud + rocketchat. The nextcloud OAuth part is fixed, but since rocketchat 4.1.0 the OAuth integration is broken on their side, see: RocketChat/Rocket.Chat#23613 😢

Yes, I'm using nextcloud + rocketchat. The nextcloud OAuth part is fixed, but since rocketchat 4.1.0 the OAuth integration is broken on their side, see: RocketChat/Rocket.Chat#23613 😢

I don't want to sound disrespectful, but I don't think so. Because, as you can see in my screenshot, Nextcloud shows the same error as it did a few months ago - namely that Nextcloud's login fails.

And the quoted issue RocketChat/Rocket.Chat#23613 shows another error "Client authentication failed due to unknown client, no client authentication included, or unsupported authentication method" while I get no additional error message..

Also, another OAuth Service works for me in my RocketChat server...

I've just successfully SSO logged in (and then SSO auth'd to delete the same session) to my org's Element-Web using Nextcloud's OIDC.

This sounds like a RocketChat client regression.

v22.2.2 contains a fix

I don't want to sound disrespectful, but I don't think so. Because, as you can see in my screenshot, Nextcloud shows the same error as it did a few months ago - namely that Nextcloud's login fails.

You're right, the error is different now, i just wanted to mention it, because again the most recent versions are not compatible anymore between these systems. But it's a completely different issue...

Just upgraded to v22.2.2 dockerized deployment and OAuth2 (with patched Rocketchat) works for me!

The fix works for me. Thanks! :)

Looks like they released v22.2.3 (I didn't know that nextcloud has an auto-update feature, because my nextcloud already shows 22.2.3, but whatever)

Now I've found this in the rocketchat while nextcloud does not show any logs anymore:

{"level":50,"time":"2021-11-17T03:17:59.246Z","pid":8,"hostname":"7af58635f8c5","name":"System","msg":"Exception while invoking method login 'Failed to complete OAuth handshake with nextcloud at /index.php/apps/oauth2/api/v1/token. url must be absolute and start with http:// or https://'"}

(Of course the given nextcloud URL is valid)

Well, the search goes on - now on the rocketchat issues at github.

Edit:
Continuing here: RocketChat/Rocket.Chat#23654

Another update - and it is still not working (23.0.0).

As per above this is not a Nextcloud problem anymore.
The OAuth server and client parts work well sine 22.2.1

@sephentos

hi @sephentos, it works for me since nextcloud v22.2.2 again, i also think it's rocketchat related.

For me it helped, that i removed the existing previously configured OAuth2 connection and added a new Custom OAuth2 with following settings:

For me it does also work again. The User Info that comes back as a json had some added/changed fields, but after tweaking my code I am able to log in and verify again. Thank you!

Navigation Menu

Repository navigation

OAuth broken with 23.0.0 (since 22.0.0) #28261

Steps to reproduce

Server configuration

Client configuration

21 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

OAuth broken with 23.0.0 (since 22.0.0) #28261

Description

Steps to reproduce

Server configuration

Client configuration

Activity

szaimen commented on Aug 8, 2021

sephentos commented on Aug 13, 2021

stonerl commented on Aug 16, 2021

TobjasR commented on Aug 27, 2021

stonerl commented on Aug 27, 2021

TobjasR commented on Aug 29, 2021

sephentos commented on Sep 11, 2021

21 remaining items

sephentos commented on Nov 16, 2021

firlevapz commented on Nov 16, 2021

sephentos commented on Nov 16, 2021

EdGeraghty commented on Nov 16, 2021

stonerl commented on Nov 16, 2021

firlevapz commented on Nov 16, 2021

pabsta1 commented on Nov 16, 2021

sephentos commented on Nov 17, 2021

sephentos commented on Nov 30, 2021

nickvergessen commented on Nov 30, 2021

firlevapz commented on Nov 30, 2021

FrankyB commented on Dec 1, 2021

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions