integration_zimbra fails with Zimbra 2FA enabled

🐛 Bug Report: integration_zimbra fails when Zimbra 2FA is enabled

Summary

When two-factor authentication (2FA) is enabled in Zimbra, the integration_zimbra app for Nextcloud fails to store or use Zimbra credentials. The frontend returns a 500 Internal Server Error, and the backend logs show decryption errors when attempting to load the integration. As a result, users cannot use the app if Zimbra 2FA is active.

---

Environment

Component	Version
Nextcloud	31.0.6 (Hub 10)
integration_zimbra	1.0.13
Zimbra	10.1.9_GA_4780 (20250611104926)
Browser	Chrome 133 / Opera 118
OS	macOS 10.15.7

---

Steps to Reproduce

1. Enable 2FA for a user in Zimbra.
2. Log into Nextcloud and go to Settings > Zimbra Integration.
3. Enter Zimbra credentials and attempt to save.
4. The request fails with a 500 error, and the app does not initialize.

---

Expected Behavior

• The app should support Zimbra accounts with 2FA enabled, preferably via app-specific passwords or token-based authentication.
• Alternatively, it should provide a clear error message if password-based login is incompatible with 2FA.

---

Actual Behavior

• The frontend shows:

  PUT /apps/integration_zimbra/sensitive-config 500 (Internal Server Error)
  

• Chrome DevTools log:

  AxiosError: Request failed with status code 500
  Uncaught TypeError: Cannot read properties of null (reading 'dataset')
  

• Nextcloud nextcloud.log output:

  "Could not boot integration_zimbra: Authenticated ciphertext could not be decoded."
  

---

Logs

📜 Web Console (Chrome)

PUT https://files.hkn.cloud/apps/integration_zimbra/sensitive-config 500 (Internal Server Error)
AxiosError: Request failed with status code 500
Uncaught TypeError: Cannot read properties of null (reading 'dataset')

🧱 Nextcloud Log Excerpt (nextcloud.log)

{
  "app": "no app in context",
  "message": "Could not boot integration_zimbra: Authenticated ciphertext could not be decoded.",
  "file": "/var/www/nextcloud/lib/private/Security/Crypto.php",
  "line": 114,
  "user": "drauer"
}

full text log
´´´
{"reqId":"szZ7NgYSNPIK57aeIqx4","level":4,"time":"2025-06-24T08:30:02+00:00","remoteAddr":"185.90.228.7","user":"sselker","app":"no app in context","method":"POST","url":"/apps/text/session/1161434/sync","message":"Could not boot integration_zimbra: Authenticated ciphertext could not be decoded.","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:139.0) Gecko/20100101 Firefox/139.0","version":"31.0.6.2","exception":{"Exception":"Exception","Message":"Authenticated ciphertext could not be decoded.","Code":0,"Trace":[{"file":"/var/www/nextcloud/lib/private/Security/Crypto.php","line":102,"function":"decryptWithoutSecret","class":"OC\Security\Crypto","type":"->","args":["*** sensitive parameters replaced "]},{"file":"/var/www/nextcloud/custom_apps/integration_zimbra/lib/Service/ZimbraAPIService.php","line":74,"function":"decrypt","class":"OC\Security\Crypto","type":"->","args":[" sensitive parameters replaced "]},{"file":"/var/www/nextcloud/custom_apps/integration_zimbra/lib/Service/ZimbraAPIService.php","line":82,"function":"decryptIfNotEmpty","class":"OCA\Zimbra\Service\ZimbraAPIService","type":"->","args":[" sensitive parameters replaced ***"]},{"file":"/var/www/nextcloud/custom_apps/integration_zimbra/lib/AppInfo/Application.php","line":86,"function":"isUserConnected","class":"OCA\Zimbra\Service\ZimbraAPIService","type":"->","args":["sselker"]},{"file":"/var/www/nextcloud/lib/private/AppFramework/Bootstrap/FunctionInjector.php","line":28,"function":"registerAddressBook","class":"OCA\Zimbra\AppInfo\Application","type":"->","args":[{"class":"OC\User\Session"},{"class":"OC\ContactsManager"},{"class":"OCA\Zimbra\ZimbraAddressBook"},{"class":"OCA\Zimbra\Service\ZimbraAPIService"}]},{"file":"/var/www/nextcloud/lib/private/AppFramework/Bootstrap/BootContext.php","line":32,"function":"injectFn","class":"OC\AppFramework\Bootstrap\FunctionInjector","type":"->","args":[{"class":"Closure"}]},{"file":"/var/www/nextcloud/custom_apps/integration_zimbra/lib/AppInfo/Application.php","line":75,"function":"injectFn","class":"OC\AppFramework\Bootstrap\BootContext","type":"->","args":[{"class":"Closure"}]},{"file":"/var/www/nextcloud/lib/private/AppFramework/Bootstrap/Coordinator.php","line":157,"function":"boot","class":"OCA\Zimbra\AppInfo\Application","type":"->","args":[{"class":"OC\AppFramework\Bootstrap\BootContext"}]},{"file":"/var/www/nextcloud/lib/private/App/AppManager.php","line":479,"function":"bootApp","class":"OC\AppFramework\Bootstrap\Coordinator","type":"->","args":["integration_zimbra"]},{"file":"/var/www/nextcloud/lib/private/App/AppManager.php","line":248,"function":"loadApp","class":"OC\App\AppManager","type":"->","args":["integration_zimbra"]},{"file":"/var/www/nextcloud/lib/private/legacy/OC_App.php","line":82,"function":"loadApps","class":"OC\App\AppManager","type":"->","args":[[]]},{"file":"/var/www/nextcloud/lib/base.php","line":1020,"function":"loadApps","class":"OC_App","type":"::","args":[]},{"file":"/var/www/nextcloud/index.php","line":24,"function":"handleRequest","class":"OC","type":"::","args":[]}],"File":"/var/www/nextcloud/lib/private/Security/Crypto.php","Line":114,"message":"Could not boot integration_zimbra: Authenticated ciphertext could not be decoded.","exception":[],"CustomMessage":"Could not boot integration_zimbra: Authenticated ciphertext could not be decoded."},"id":"685a620abfe71"}

---

### Possible Cause

- The Zimbra 2FA flow blocks password-based authentication.
- The integration fails to handle Zimbra's 2FA challenge or redirect.
- Additionally, saved credentials may become undecryptable if the encryption key/secret is lost or changed.

---

### Workaround

- **Disable 2FA** in Zimbra for the affected user.
- Re-enter credentials in Nextcloud → integration works.

---

### Proposed Fixes

- Support for app-specific passwords or token-based authentication.
- Catch decryption errors on boot gracefully.
- Detect 2FA on failed login attempts and show a proper warning to the user.

---

### Notes

This issue blocks secure usage of the integration in environments where Zimbra 2FA is mandatory. We'd appreciate guidance or a fix roadmap.

Start with lib/Service/ZimbraAPIService.php at lines 74 and 82, then follow its boot-time use from lib/AppInfo/Application.php at line 86. Reproduce the Settings > Zimbra Integration save through PUT /apps/integration_zimbra/sensitive-config with Zimbra 2FA enabled and inspect the decryption and authentication behavior. Done means the integration handles the 2FA case without a 500 error and gives a clear result when credentials cannot be used.