[Bug]: Sharing between NC instances (federation) fails since v32 if instances use URL prefixes

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

Two Nextcloud instances share multiple folders in a federation. Since Nextcloud upgrade from 31.0.14 to 32.0.6 this fails both for existing shares and newly created shares.

The problem occurs for on new NC instances and on upgraded NC instances.

The problem only occurs, if the NC instances use URL prefixes like "/nextcloud" in https://www.my-domain.com/nextcloud.

Steps to reproduce

1. Create 2 NC instances with version 32.0.6 and URL prefixes like https://www.my-domain.com/nextcloud
2. Create at least one remote share from NC 1 to NC 2
3. Check if the remote share works on NC 2 (the remote share is stuck as pending)

Expected behavior

Remote shares work

Nextcloud Server version

32

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.3

Web server

Apache (supported)

Database engine version

MySQL

Is this bug present after an update or on a fresh install?

Upgraded to a MAJOR version (ex. 31 to 32)

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "www.my-domain.com"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "htaccess.RewriteBase": "\/nextcloud",
        "overwrite.cli.url": "https:\/\/www.my-domain.com\/nextcloud",
        "trashbin_retention_obligation": "7, 14",
        "dbtype": "mysql",
        "version": "32.0.6.1",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "logtimezone": "UTC",
        "installed": true,
        "forcessl": true,
        "forceSSLforSubdomains": true,
        "mail_smtpmode": "smtp",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "app.mail.importance_classification_default": false,
        "enable_certificate_management": true,
        "filelocking.enabled": true,
        "memcache.local": "\\OC\\Memcache\\APCu",
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 0,
            "password": "***REMOVED SENSITIVE VALUE***",
            "dbindex": 1
        },
        "maintenance": false,
        "loglevel": 2,
        "log.condition": {
            "apps": [
                "admin_audit"
            ]
        },
        "integrity.check.disabled": true,
        "theme": "",
        "twofactor_enforced": "true",
        "twofactor_enforced_groups": [
            "multifactorauth"
        ],
        "twofactor_enforced_excluded_groups": [],
        "mysql.utf8mb4": true,
        "log_rotate_size": 10485760,
        "allow_local_remote_servers": true,
        "default_phone_region": "DE",
        "app_install_overwrite": [
            "twofactor_admin",
            "user_external"
        ],
        "maintenance_window_start": 1,
        "mail_sendmailmode": "smtp",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "587",
        "mail_smtpauth": 1,
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***"
    }
}

List of activated Apps

Enabled:
  - activity: 5.0.0
  - admin_audit: 1.22.0
  - app_api: 32.0.0
  - bruteforcesettings: 5.0.0
  - circles: 32.0.0
  - cloud_federation_api: 1.16.0
  - comments: 1.22.0
  - contactsinteraction: 1.13.1
  - dashboard: 7.12.0
  - dav: 1.34.2
  - federatedfilesharing: 1.22.0
  - federation: 1.22.0
  - files: 2.4.0
  - files_downloadlimit: 5.0.0-dev.0
  - files_external: 1.24.1
  - files_pdfviewer: 5.0.0
  - files_reminders: 1.5.0
  - files_sharing: 1.24.1
  - files_trashbin: 1.22.0
  - files_versions: 1.25.0
  - firstrunwizard: 5.0.0
  - logreader: 5.0.0
  - lookup_server_connector: 1.20.0
  - nextcloud_announcements: 4.0.0
  - notifications: 5.0.0
  - oauth2: 1.20.0
  - password_policy: 4.0.0
  - photos: 5.0.0
  - privacy: 4.0.0
  - profile: 1.1.0
  - provisioning_api: 1.22.0
  - recommendations: 5.0.0
  - related_resources: 3.0.0
  - serverinfo: 4.0.0
  - settings: 1.15.1
  - sharebymail: 1.22.0
  - support: 4.0.0
  - survey_client: 4.0.0
  - suspicious_login: 10.0.0
  - systemtags: 1.22.0
  - text: 6.0.1
  - theming: 2.7.0
  - twofactor_backupcodes: 1.21.0
  - twofactor_totp: 14.0.0
  - updatenotification: 1.22.0
  - user_status: 1.12.0
  - viewer: 5.0.0
  - weather_status: 1.12.0
  - webhook_listeners: 1.3.0
  - workflowengine: 2.14.0
Disabled:
  - contacts: 7.3.15 (installed 7.3.15)
  - encryption: 2.20.0
  - groupfolders: 19.1.17 (installed 19.1.17)
  - mail: 5.6.13 (installed 5.6.13)
  - twofactor_admin: 4.9.0 (installed 4.9.0)
  - twofactor_nextcloud_notification: 6.0.0
  - user_ldap: 1.23.0

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

{"reqId":"tE7zYnOIjXVvpuTjBDOY","level":2,"time":"2026-02-21T23:35:10+00:00","remoteAddr":"2a00:1169:11c:af60::","user":"--","app":"no app in context","method":"POST","url":"/nextcloud/index.php/ocm/shares","scriptName":"/nextcloud/index.php","message":"signature could not be verified","userAgent":"Nextcloud Server Crawler","version":"32.0.6.1","exception":{"Exception":"NCU\\Security\\Signature\\Exceptions\\SignatoryNotFoundException","Message":"empty result from getRemoteSignatory","Code":0,"Trace":[{"file":"/var/www/nextcloud-extern/lib/private/Security/Signature/SignatureManager.php","line":155,"function":"getSaneRemoteSignatory","class":"OC\\Security\\Signature\\SignatureManager","type":"->"},{"file":"/var/www/nextcloud-extern/lib/private/Security/Signature/SignatureManager.php","line":108,"function":"confirmIncomingRequestSignature","class":"OC\\Security\\Signature\\SignatureManager","type":"->"},{"file":"/var/www/nextcloud-extern/apps/cloud_federation_api/lib/Controller/RequestHandlerController.php","line":460,"function":"getIncomingSignedRequest","class":"OC\\Security\\Signature\\SignatureManager","type":"->"},{"file":"/var/www/nextcloud-extern/apps/cloud_federation_api/lib/Controller/RequestHandlerController.php","line":125,"function":"getSignedRequest","class":"OCA\\CloudFederationAPI\\Controller\\RequestHandlerController","type":"->"},{"file":"/var/www/nextcloud-extern/lib/private/AppFramework/Http/Dispatcher.php","line":204,"function":"addShare","class":"OCA\\CloudFederationAPI\\Controller\\RequestHandlerController","type":"->"},{"file":"/var/www/nextcloud-extern/lib/private/AppFramework/Http/Dispatcher.php","line":118,"function":"executeController","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/var/www/nextcloud-extern/lib/private/AppFramework/App.php","line":153,"function":"dispatch","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/var/www/nextcloud-extern/lib/private/Route/Router.php","line":321,"function":"main","class":"OC\\AppFramework\\App","type":"::"},{"file":"/var/www/nextcloud-extern/lib/base.php","line":1091,"function":"match","class":"OC\\Route\\Router","type":"->"},{"file":"/var/www/nextcloud-extern/index.php","line":25,"function":"handleRequest","class":"OC","type":"::"}],"File":"/var/www/nextcloud-extern/lib/private/Security/Signature/SignatureManager.php","Line":305,"message":"signature could not be verified","exception":[],"signedRequest":{"body":"{\"shareWith\":\"admin@https:\\/\\/www.my-domain.com\\/nextcloud\",\"shareType\":\"user\",\"name\":\"I21_05_Neue TGM Website\",\"resourceType\":\"file\",\"description\":\"\",\"providerId\":\"2110\",\"owner\":\"projektadmin@cloud.vpn.my-domain.com\\/nextcloud\",\"ownerDisplayName\":\"projektadmin\",\"sharedBy\":\"projektadmin@cloud.vpn.my-domain.com\\/nextcloud\",\"sharedByDisplayName\":\"projektadmin\",\"sender\":\"projektadmin@cloud.vpn.my-domain.com\\/nextcloud\",\"senderDisplayName\":\"projektadmin\",\"protocol\":{\"name\":\"webdav\",\"options\":{\"sharedSecret\":\"mVuF1o1xhvinvr3\",\"permissions\":\"{http:\\/\\/open-cloud-mesh.org\\/ns}share-permissions\"}}}","digest":"SHA-512=yFJX4BLD5yzv2YEk+fIdyaD3ZyEkdl1IqT/XYIUNoHBmVTOw4ujL6OT1GZUK7vGQikOO3T5i+iiwPQ+36K6ybQ==","digestAlgorithm":"SHA-512","signingElements":{"keyId":"https://cloud.vpn.my-domain.com/nextcloud/index.php/ocm#signature","algorithm":"rsa-sha512","headers":"(request-target) content-length date digest host","signature":"K8WXSSF/8vpyluCGpiOSUcdikEg0sXN9GH4GsCdRzbM3oYpalvzt3kkEV+GxpGcD+YWIuzunywFHS9j7U3Td6/wH7m4Ugeft+yAT3PVFRTaVZ9o8lzmRDKIQE6bskmIr79lrZegVh9Qgdxj2Hz8VO57QCkk1ujnAXMwtZaf+dkeBDA4y5QTrnRnBJx0TAJEcUex4pOdZcyQkpPCME2bl8O0LHvj0SL3SagAXh4YveVBUKEHa/7WteJXOAi/Tkok1nxbELJxaBfiC2zXd40IXvqCzKnqhxPP/xltdJjXK5HvC0CjTriaLpgzp0YY6iw9PkXVxveZok/KAyGQ9IeSFjA=="},"signatureData":["(request-target): post /nextcloud/index.php/ocm/shares","content-length: 584","date: Sat, 21 Feb 2026 23:35:10 GMT","digest: SHA-512=yFJX4BLD5yzv2YEk+fIdyaD3ZyEkdl1IqT/XYIUNoHBmVTOw4ujL6OT1GZUK7vGQikOO3T5i+iiwPQ+36K6ybQ==","host: www.my-domain.com"],"signature":"K8WXSSF/8vpyluCGpiOSUcdikEg0sXN9GH4GsCdRzbM3oYpalvzt3kkEV+GxpGcD+YWIuzunywFHS9j7U3Td6/wH7m4Ugeft+yAT3PVFRTaVZ9o8lzmRDKIQE6bskmIr79lrZegVh9Qgdxj2Hz8VO57QCkk1ujnAXMwtZaf+dkeBDA4y5QTrnRnBJx0TAJEcUex4pOdZcyQkpPCME2bl8O0LHvj0SL3SagAXh4YveVBUKEHa/7WteJXOAi/Tkok1nxbELJxaBfiC2zXd40IXvqCzKnqhxPP/xltdJjXK5HvC0CjTriaLpgzp0YY6iw9PkXVxveZok/KAyGQ9IeSFjA==","signatory":false,"options":{"algorithm":"rsa-sha512","digestAlgorithm":"SHA-512","extraSignatureHeaders":[],"ttl":300,"dateHeader":"D, d M Y H:i:s T","ttlSignatory":259200,"bodyMaxSize":50000},"origin":"cloud.vpn.my-domain.com"},"signatoryManager":"OC\\OCM\\OCMSignatoryManager","CustomMessage":"signature could not be verified"},"id":"699a46ca6e0ea"}
{"reqId":"tE7zYnOIjXVvpuTjBDOY","level":2,"time":"2026-02-21T23:35:10+00:00","remoteAddr":"2a00:1169:11c:af60::","user":"--","app":"no app in context","method":"POST","url":"/nextcloud/index.php/ocm/shares","scriptName":"/nextcloud/index.php","message":"fail to get remote signatory","userAgent":"Nextcloud Server Crawler","version":"32.0.6.1","exception":{"Exception":"OCP\\OCM\\Exceptions\\OCMProviderException","Message":"error while requesting remote ocm provider","Code":0,"Trace":[{"file":"/var/www/nextcloud-extern/lib/private/OCM/OCMDiscoveryService.php","line":70,"function":"discover","class":"OC\\OCM\\OCMDiscoveryService","type":"->"},{"file":"/var/www/nextcloud-extern/lib/private/OCM/OCMSignatoryManager.php","line":149,"function":"discover","class":"OC\\OCM\\OCMDiscoveryService","type":"->"},{"file":"/var/www/nextcloud-extern/lib/private/Security/Signature/SignatureManager.php","line":303,"function":"getRemoteSignatory","class":"OC\\OCM\\OCMSignatoryManager","type":"->"},{"file":"/var/www/nextcloud-extern/lib/private/Security/Signature/SignatureManager.php","line":155,"function":"getSaneRemoteSignatory","class":"OC\\Security\\Signature\\SignatureManager","type":"->"},{"file":"/var/www/nextcloud-extern/lib/private/Security/Signature/SignatureManager.php","line":108,"function":"confirmIncomingRequestSignature","class":"OC\\Security\\Signature\\SignatureManager","type":"->"},{"file":"/var/www/nextcloud-extern/apps/cloud_federation_api/lib/Controller/RequestHandlerController.php","line":460,"function":"getIncomingSignedRequest","class":"OC\\Security\\Signature\\SignatureManager","type":"->"},{"file":"/var/www/nextcloud-extern/apps/cloud_federation_api/lib/Controller/RequestHandlerController.php","line":125,"function":"getSignedRequest","class":"OCA\\CloudFederationAPI\\Controller\\RequestHandlerController","type":"->"},{"file":"/var/www/nextcloud-extern/lib/private/AppFramework/Http/Dispatcher.php","line":204,"function":"addShare","class":"OCA\\CloudFederationAPI\\Controller\\RequestHandlerController","type":"->"},{"file":"/var/www/nextcloud-extern/lib/private/AppFramework/Http/Dispatcher.php","line":118,"function":"executeController","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/var/www/nextcloud-extern/lib/private/AppFramework/App.php","line":153,"function":"dispatch","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/var/www/nextcloud-extern/lib/private/Route/Router.php","line":321,"function":"main","class":"OC\\AppFramework\\App","type":"::"},{"file":"/var/www/nextcloud-extern/lib/base.php","line":1091,"function":"match","class":"OC\\Route\\Router","type":"->"},{"file":"/var/www/nextcloud-extern/index.php","line":25,"function":"handleRequest","class":"OC","type":"::"}],"File":"/var/www/nextcloud-extern/lib/private/OCM/OCMDiscoveryService.php","Line":152,"message":"fail to get remote signatory","exception":[],"remote":"cloud.vpn.my-domain.com","CustomMessage":"fail to get remote signatory"},"id":"699a46ca6e102"}
{"reqId":"tE7zYnOIjXVvpuTjBDOY","level":2,"time":"2026-02-21T23:35:10+00:00","remoteAddr":"2a00:1169:11c:af60::","user":"--","app":"no app in context","method":"POST","url":"/nextcloud/index.php/ocm/shares","scriptName":"/nextcloud/index.php","message":"error while discovering ocm provider","userAgent":"Nextcloud Server Crawler","version":"32.0.6.1","exception":{"Exception":"GuzzleHttp\\Exception\\ClientException","Message":"Client error: `GET http://cloud.vpn.my-domain.com/ocm-provider` resulted in a `404 Not Found` response:\n<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\">\n<html><head>\n<title>404 Not Found</title>\n</head><body>\n<h1>Not Found (truncated...)\n","Code":404,"Trace":[{"file":"/var/www/nextcloud-extern/3rdparty/guzzlehttp/guzzle/src/Middleware.php","line":72,"function":"create","class":"GuzzleHttp\\Exception\\RequestException","type":"::","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/nextcloud-extern/3rdparty/guzzlehttp/promises/src/Promise.php","line":209,"function":"GuzzleHttp\\{closure}","class":"GuzzleHttp\\Middleware","type":"::","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/nextcloud-extern/3rdparty/guzzlehttp/promises/src/Promise.php","line":158,"function":"callHandler","class":"GuzzleHttp\\Promise\\Promise","type":"::"},{"file":"/var/www/nextcloud-extern/3rdparty/guzzlehttp/promises/src/TaskQueue.php","line":52,"function":"GuzzleHttp\\Promise\\{closure}","class":"GuzzleHttp\\Promise\\Promise","type":"::","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/nextcloud-extern/3rdparty/guzzlehttp/promises/src/Promise.php","line":251,"function":"run","class":"GuzzleHttp\\Promise\\TaskQueue","type":"->"},{"file":"/var/www/nextcloud-extern/3rdparty/guzzlehttp/promises/src/Promise.php","line":227,"function":"invokeWaitFn","class":"GuzzleHttp\\Promise\\Promise","type":"->"},{"file":"/var/www/nextcloud-extern/3rdparty/guzzlehttp/promises/src/Promise.php","line":272,"function":"waitIfPending","class":"GuzzleHttp\\Promise\\Promise","type":"->"},{"file":"/var/www/nextcloud-extern/3rdparty/guzzlehttp/promises/src/Promise.php","line":229,"function":"invokeWaitList","class":"GuzzleHttp\\Promise\\Promise","type":"->"},{"file":"/var/www/nextcloud-extern/3rdparty/guzzlehttp/promises/src/Promise.php","line":69,"function":"waitIfPending","class":"GuzzleHttp\\Promise\\Promise","type":"->"},{"file":"/var/www/nextcloud-extern/3rdparty/guzzlehttp/guzzle/src/Client.php","line":189,"function":"wait","class":"GuzzleHttp\\Promise\\Promise","type":"->"},{"file":"/var/www/nextcloud-extern/lib/private/Http/Client/Client.php","line":206,"function":"request","class":"GuzzleHttp\\Client","type":"->"},{"file":"/var/www/nextcloud-extern/lib/private/OCM/OCMDiscoveryService.php","line":117,"function":"get","class":"OC\\Http\\Client\\Client","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/nextcloud-extern/lib/private/OCM/OCMDiscoveryService.php","line":70,"function":"discover","class":"OC\\OCM\\OCMDiscoveryService","type":"->"},{"file":"/var/www/nextcloud-extern/lib/private/OCM/OCMSignatoryManager.php","line":149,"function":"discover","class":"OC\\OCM\\OCMDiscoveryService","type":"->"},{"file":"/var/www/nextcloud-extern/lib/private/Security/Signature/SignatureManager.php","line":303,"function":"getRemoteSignatory","class":"OC\\OCM\\OCMSignatoryManager","type":"->"},{"file":"/var/www/nextcloud-extern/lib/private/Security/Signature/SignatureManager.php","line":155,"function":"getSaneRemoteSignatory","class":"OC\\Security\\Signature\\SignatureManager","type":"->"},{"file":"/var/www/nextcloud-extern/lib/private/Security/Signature/SignatureManager.php","line":108,"function":"confirmIncomingRequestSignature","class":"OC\\Security\\Signature\\SignatureManager","type":"->"},{"file":"/var/www/nextcloud-extern/apps/cloud_federation_api/lib/Controller/RequestHandlerController.php","line":460,"function":"getIncomingSignedRequest","class":"OC\\Security\\Signature\\SignatureManager","type":"->"},{"file":"/var/www/nextcloud-extern/apps/cloud_federation_api/lib/Controller/RequestHandlerController.php","line":125,"function":"getSignedRequest","class":"OCA\\CloudFederationAPI\\Controller\\RequestHandlerController","type":"->"},{"file":"/var/www/nextcloud-extern/lib/private/AppFramework/Http/Dispatcher.php","line":204,"function":"addShare","class":"OCA\\CloudFederationAPI\\Controller\\RequestHandlerController","type":"->"},{"file":"/var/www/nextcloud-extern/lib/private/AppFramework/Http/Dispatcher.php","line":118,"function":"executeController","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/var/www/nextcloud-extern/lib/private/AppFramework/App.php","line":153,"function":"dispatch","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/var/www/nextcloud-extern/lib/private/Route/Router.php","line":321,"function":"main","class":"OC\\AppFramework\\App","type":"::"},{"file":"/var/www/nextcloud-extern/lib/base.php","line":1091,"function":"match","class":"OC\\Route\\Router","type":"->"},{"file":"/var/www/nextcloud-extern/index.php","line":25,"function":"handleRequest","class":"OC","type":"::"}],"File":"/var/www/nextcloud-extern/3rdparty/guzzlehttp/guzzle/src/Exception/RequestException.php","Line":111,"message":"error while discovering ocm provider","exception":[],"remote":"http://cloud.vpn.my-domain.com","CustomMessage":"error while discovering ocm provider"},"id":"699a46ca6e123"}

Additional info

No response

Start with the stack trace in lib/private/Security/Signature/SignatureManager.php and follow the calls through OCMSignatoryManager, OCMDiscoveryService, and apps/cloud_federation_api/lib/Controller/RequestHandlerController.php. Reproduce federation sharing between two prefixed instances and inspect the /nextcloud/index.php/ocm/shares request. Done means remote shares no longer remain pending and the incoming signature is accepted.