Login dialog displayed after successful mtls auth in 21.0.0 RC1

Steps to reproduce

Nextcloud Talk 21.0.0 RC1 with https://github.com/nextcloud/talk-android/pull/4634 allows one to select client cert on initial connection screen; this may be simplified - just popup this window automatically (like nc android client app does) if server requests client cert in handshake.

After successful authentication with client certificate, talk application should be authorized without any other confirmations, permissions, tokens, passwords. Now talk app redirects to browser to have additional confirmation which should be not required because client cert auth is enough proof for application to be authenticated and authorized for access (similar as K-9 Mail or DAVx5 work with client certs).

When client cert are used, should work with reverse proxies and user_saml without messing with additional stuff like passwords, confirmations, tokens (just like in SSO environments).

Related: https://github.com/nextcloud/talk-android/issues/3907
Related: https://github.com/nextcloud/android/issues/12997
Related: https://github.com/nextcloud/talk-android/pull/4634

Expected behaviour

Successful mTLS auth with reverse proxy and user_saml should be enough for android talk client to be authenticated.

Initial connection screen should automatically ask for client cert if asked by server in TLS handshake.

Actual behaviour

Successful mTLS auth with reverse proxy and user_saml starts additional confirmation process in browser.

Initial connection screen does not automatically ask for client cert if asked by server in TLS handshake. Manual client cert choosing is required.

Device brand and model

Any

Android version

15

Nextcloud Talk app version

21.0.0 RC1

Nextcloud server version

v30.0.5

Talk version

v20.1.3

Custom Signaling server configured

Yes (specify version in Additional Information)

Custom TURN server configured

None

Custom STUN server configured

None

Android logs

No response

Server log

Additional information

No response

Start by reviewing the linked pull request 4634 and tracing the initial connection screen, TLS client-certificate request, and browser redirect described here. Done means the app automatically requests a certificate when the server asks during the handshake and treats successful mTLS authentication as sufficient without another browser confirmation.