When an access token is created, the loginName is taken from the Session

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

https://github.com/nextcloud/server/blob/master/lib/private/legacy/OC_User.php#L194C71-L194C71

This setup was using ldap user backend before. The LDAP user backend set the user ids to the GUID from ldap.
I'm simply providing the GUID from SAML as UID to keep existing users.

As one can see, the Session will be initialized with $uid,$uid. The screenshot shows modified code where I tried to mitigate that problem.

When an access token is created, the loginName is taken from the Session.

https://github.com/nextcloud/server/blob/master/apps/settings/lib/Controller/AuthSettingsController.php#L137

Which results in the loginName beeing the UID in case of a SAML setup.

My modified code does not respect or test other setups, which is why I did not issue a pull request.

I'd be very happy about ideas on how to configure / code this properly. I'm guessing maybe a hook from user_saml dependant on propper configuration may be the best approach.

Steps to reproduce

1. Configure user_saml
2. Generate an app token under personal settings -> security
3. See that the login for that token is the user UID

Expected behavior

The Token Login should be a variant of email or other user attribute. The UID is not guaranteed to be anything readable

Installation method

Community Manual installation with Archive

Nextcloud Server version

26

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.1

Web server

Apache (supported)

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Fresh Nextcloud Server install

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

No response

List of activated Apps

No response

Nextcloud Signing status

No response

Nextcloud Logs

No response

Additional info

No response

Start with lib/private/legacy/OC_User.php around line 194 and apps/settings/lib/Controller/AuthSettingsController.php around line 137, then reproduce the issue with a SAML user by generating an app token under Personal Settings > Security. Trace how the session values become the token loginName. Done means SAML token logins use an appropriate readable user attribute instead of the UID without regressing other user backends.