Push test notifications OAuth : There are no tokens for this user

Description:

Sending a push test notification through the official gateway returns "There are no tokens for this user".

Steps to reproduce:

Prerequisites

• Custom OAuth is enabled (Keycloak) and well configured
• Rocket-Chat official Android App is installed
• User is logged in the official Android App
• Same user is logged in the browser or desktop app
• User has "admin" privileges
• Push notification enabled
• Server is registered
• Privacy terms have been accepted

Steps

1. Login using SSO authentication
2. Go to "Administration" section
3. Go to the "Push" section
4. Click on "Send a test push for my user"

Expected behavior:

Push test notification is correctly send.

Actual behavior:

An error is reported in both UI and logs : "There are no tokens for this user".
HTTP response code from the push gateway is 200.

Please note that we already tried to disconnect/connect several times the user on both mobile/browser apps.

Server Setup Information:

• Version of Rocket.Chat Server: 3.12.1
• Operating System: Debian 9
• Deployment Method: Docker (rocket.chat:3.12.1)
• Number of Running Instances: 1
• DB Replicaset Oplog: rs0
• NodeJS Version: Not relevant
• MongoDB Version: 4.0
• Behind an Nginx reverse proxy (Nginx configuration is provided as it could differs a little from the official one in terms of supported TLS protocols and ciphers)
• Upfront Pfsense firewall allowing only requests on port 80/443 to be forwarded to the RP
• Back side Pfsense firewall allowing only port 3000 requests to be routed from the RP to the Rocket-Chat server instance DMZ zone

Client Setup Information

• Desktop App or Browser Version: Not relevant as the issue is the same on any browser or via the desktop app
• Operating System: Windows 10

Additional context

Nginx configuration

# Rocket Chat
upstream backend {
        server rocket-chat.local.xxx.xx:3000;
}

server {
        listen  80;
        server_name rocket-chat.xxx.xx;
        return 301 https://$host$request_uri;
}

server {
        listen  443 ssl http2;
        server_name rocket-chat.xxx.xx;

        ssl_certificate /etc/nginx/certificates/xxx.xx/fullchain.pem;
        ssl_certificate_key /etc/nginx/certificates/xxx.xx/privkey.pem;

        ssl_protocols TLSv1.3 TLSv1.2;
        ssl_ecdh_curve secp384r1;
        ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
        ssl_prefer_server_ciphers on;

        ssl_trusted_certificate /etc/nginx/certificates/xxx.xx/fullchain.pem;
        ssl_stapling on;
        ssl_stapling_verify on;

        add_header Strict-Transport-Security "max-age=15552000; includeSubdomains; preload";

        ssl_session_cache shared:SSL:10m;
        ssl_session_timeout 5m;
        ssl_session_tickets off;

        client_max_body_size 200M;

        location / {
                proxy_pass http://backend;
                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "upgrade";
                proxy_set_header Host $http_host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto https;
                proxy_set_header X-Nginx-Proxy true;
                proxy_redirect off;
        }
}

Relevant logs:

Server logs

I20210312-17:39:04.982(0) server.js:204 API ➔ debug POST: /api/v1/method.call/push_test 
I20210312-17:39:04.985(0) server.js:204 Meteor ➔ method push_test -> userId: HxE3CvkHCknm2CF39, arguments: [] 
I20210312-17:39:04.996(0) Exception while invoking method push_test Error: There are no tokens for this user [error-no-tokens-for-this-user]     at MethodInvocation.push_test (server/lib/pushConfig.js:51:10)     at MethodInvocation.methodsMap.<computed> (app/lib/server/lib/debug.js:76:34)     at maybeAuditArgumentChecks (packages/ddp-server/livedata_server.js:1771:12)     at packages/ddp-server/livedata_server.js:1689:15     at Meteor.EnvironmentVariable.EVp.withValue (packages/meteor.js:1234:12)     at packages/ddp-server/livedata_server.js:1687:36     at new Promise (<anonymous>)     at Server.applyAsync (packages/ddp-server/livedata_server.js:1686:12)     at Server.apply (packages/ddp-server/livedata_server.js:1625:26)     at Server.call (packages/ddp-server/livedata_server.js:1607:17)     at Object.post (app/api/server/v1/misc.js:263:26)     at app/api/server/api.js:394:82     at Meteor.EnvironmentVariable.EVp.withValue (packages/meteor.js:1234:12)     at Object._internalRouteActionHandler [as action] (app/api/server/api.js:394:39)     at Route.share.Route.Route._callEndpoint (packages/nimble_restivus/lib/route.coffee:150:32)     at packages/nimble_restivus/lib/route.coffee:59:33     at packages/simple_json-routes.js:98:9  => awaited here:     at Promise.await (/app/bundle/programs/server/npm/node_modules/meteor/promise/node_modules/meteor-promise/promise_server.js:60:12)     at Server.apply (packages/ddp-server/livedata_server.js:1638:22)     at Server.call (packages/ddp-server/livedata_server.js:1607:17)     at Object.post (app/api/server/v1/misc.js:263:26)     at app/api/server/api.js:394:82     at Meteor.EnvironmentVariable.EVp.withValue (packages/meteor.js:1234:12)     at Object._internalRouteActionHandler [as action] (app/api/server/api.js:394:39)     at Route.share.Route.Route._callEndpoint (packages/nimble_restivus/lib/route.coffee:150:32)     at packages/nimble_restivus/lib/route.coffee:59:33     at packages/simple_json-routes.js:98:9 
I20210312-17:39:05.001(0) server.js:204 API ➔ debug Success {   statusCode: 200,   body: {     message: '{"msg":"result","id":"43","error":{"isClientSafe":true,"error":"error-no-tokens-for-this-user","reason":"There are no tokens for this user","details":{"method":"push_test"},"message":"There are no tokens for this user [error-no-tokens-for-this-user]","errorType":"Meteor.Error"}}',     success: true   } }

Client logs

Nothing logged

Thanks in advance if you can provide us any clues :)
Paco

Start with server/lib/pushConfig.js at the push_test method shown in the stack trace, then trace how tokens are registered for an OAuth-authenticated mobile user. Reproduce the Administration > Push test flow using the listed setup and inspect the server logs. Done means the test notification reaches the Android app without the no-tokens error.