nextcloud / nextcloud/user_oidc
[Bug]: Random Logouts for Nextcloud Client Users using user_oidc
Open
Nobody has claimed this yet.
bug
priority: normal
- Dominant language
- PHP
- Stars
- 181
- Forks
- 60
- Avg merge
- 7h 34m
- Merged PRs (30d)
- 26
Description
⚠️ This issue respects the following points: ⚠️
- This is a bug, not a question or a configuration/webserver/proxy issue.
- This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
- Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
- I agree to follow Nextcloud's Code of Conduct.
Bug description
We are experiencing an issue where users of the Nextcloud desktop client on Linux machines are randomly logged out. This occurs when logging in via Authentik (OIDC), while users authenticating directly through Nextcloud's default login do not seem to be affected. When a logout occurs, the user's token is revoked, requiring them to re-authenticate. This behavior appears to be intermittent and has only been reported on Linux clients. Our setup uses LDAP for user provisioning and Authentik for OIDC authentication.
Steps to reproduce
- Nextcloud client version: 3.16.5
- Operating System: Linux
- Authentication Method: Login with Nextcloud Client via Authentik OIDC
Expected behavior
The Nextcloud desktop client should maintain a stable, persistent session for users authenticated via Authentik OIDC, without unexpected logouts or token revocations.
Nextcloud Server version
31
Operating system
Debian/Ubuntu
PHP engine version
PHP 8.4
Web server
Apache (supported)
Database engine version
MySQL
Is this bug present after an update or on a fresh install?
Upgraded to a MAJOR version (ex. 31 to 32)
Are you using the Nextcloud Server Encryption module?
Encryption is Disabled
What user-backends are you using?
- Default user-backend (database)
- LDAP/ Active Directory
- SSO - SAML
- Other
Configuration report
{
"system": {
"instanceid": "***REMOVED SENSITIVE VALUE***",
"passwordsalt": "***REMOVED SENSITIVE VALUE***",
"secret": "***REMOVED SENSITIVE VALUE***",
"trusted_domains": [
"nextcloud.seemoo.tu-darmstadt.de"
],
"datadirectory": "***REMOVED SENSITIVE VALUE***",
"dbtype": "mysql",
"version": "31.0.6.2",
"overwrite.cli.url": "https:\/\/nextcloud.seemoo.tu-darmstadt.de",
"dbname": "***REMOVED SENSITIVE VALUE***",
"dbhost": "***REMOVED SENSITIVE VALUE***",
"dbport": "3306",
"dbtableprefix": "oc_",
"mysql.utf8mb4": true,
"dbuser": "***REMOVED SENSITIVE VALUE***",
"dbpassword": "***REMOVED SENSITIVE VALUE***",
"installed": true,
"memcache.local": "\\OC\\Memcache\\APCu",
"memcache.locking": "\\OC\\Memcache\\Redis",
"memcache.distributed": "\\OC\\Memcache\\Redis",
"redis": {
"host": "***REMOVED SENSITIVE VALUE***",
"port": 6379
},
"htaccess.RewriteBase": "\/",
"ldapIgnoreNamingRules": false,
"ldapProviderFactory": "OCA\\User_LDAP\\LDAPProviderFactory",
"mail_from_address": "***REMOVED SENSITIVE VALUE***",
"mail_smtpmode": "smtp",
"mail_sendmailmode": "smtp",
"mail_domain": "***REMOVED SENSITIVE VALUE***",
"mail_smtphost": "***REMOVED SENSITIVE VALUE***",
"mail_smtpport": "25",
"maintenance": false,
"mail_smtpsecure": "tls",
"theme": "",
"loglevel": 1,
"defaultapp": "files",
"updater.release.channel": "stable",
"default_phone_region": "DE",
"app_install_overwrite": [
"checksum",
"mailnotifier",
"appointments",
"sharelisting"
],
"maintenance_window_start": 21,
"allow_local_remote_servers": true
}
}
List of activated Apps
Enabled:
- activity: 4.0.0
- admin_audit: 1.21.0
- app_api: 5.0.2
- appointments: 2.4.5
- calendar: 5.3.3
- checksum: 1.2.6
- circles: 31.0.0
- cloud_federation_api: 1.14.0
- comments: 1.21.0
- contacts: 7.1.3
- contactsinteraction: 1.12.0
- dashboard: 7.11.0
- dav: 1.33.0
- deck: 1.15.1
- federatedfilesharing: 1.21.0
- federation: 1.21.0
- files: 2.3.1
- files_accesscontrol: 2.0.0
- files_automatedtagging: 2.0.0
- files_downloadlimit: 4.0.0
- files_external: 1.23.0
- files_pdfviewer: 4.0.0
- files_reminders: 1.4.0
- files_sharing: 1.23.1
- files_trashbin: 1.21.0
- files_versions: 1.24.0
- firstrunwizard: 4.0.0
- flow_notifications: 2.0.1
- forms: 5.1.0
- groupfolders: 19.1.0
- logreader: 4.0.0
- lookup_server_connector: 1.19.0
- nextcloud_announcements: 3.0.0
- notifications: 4.0.0
- oauth2: 1.19.1
- password_policy: 3.0.0
- photos: 4.0.0-dev.1
- polls: 7.4.4
- privacy: 3.0.0
- profile: 1.0.0
- provisioning_api: 1.21.0
- recommendations: 4.0.0
- related_resources: 2.0.0
- richdocuments: 8.7.1
- serverinfo: 3.0.0
- settings: 1.14.0
- sharebymail: 1.21.0
- sharelisting: 1.2.0
- support: 3.0.0
- survey_client: 3.0.0
- systemtags: 1.21.1
- tasks: 0.16.1
- text: 5.0.0
- theming: 2.6.1
- twofactor_backupcodes: 1.20.0
- twofactor_totp: 13.0.0-dev.0
- twofactor_webauthn: 2.2.0
- updatenotification: 1.21.0
- user_ldap: 1.22.0
- user_oidc: 7.2.0
- user_status: 1.11.0
- viewer: 4.0.0
- webhook_listeners: 1.2.0
- workflow_script: 2.0.0
- workflowengine: 2.13.0
Disabled:
- bruteforcesettings: 4.0.0 (installed 2.4.0)
- encryption: 2.19.0
- groupquota: 0.2.2 (installed 0.2.2)
- sharereview: 1.4.0 (installed 1.4.0)
- spreed: 21.1.0 (installed 21.1.0)
- suspicious_login: 9.0.1
- twofactor_nextcloud_notification: 5.0.0
- weather_status: 1.11.0 (installed 1.0.0)
Nextcloud Signing status
Nextcloud Logs
{
"reqId":"9sIO7UarC2sXBMWRjO60",
"level":2,
"time":"2025-05-19T09:07:31+00:00",
"remoteAddr":"<REDACTED_IP>",
"user":"<REDACTED_USER_ID>",
"app":"core",
"method":"GET",
"url":"/ocs/v2.php/apps/notifications/api/v2/notifications?format=json",
"message":"Session token credentials are invalid",
"userAgent":"Mozilla/5.0 (Linux) mirall/3.16.4-1 (Debian built) (Nextcloud, debian-6.12.27-amd64 ClientArchitecture: x86_64 OsArchitecture: x86_64)",
"version":"31.0.5.1",
"data":{"app":"core","user":"null"}
}
{
"reqId":"X1NJ0l4MR9SzC7VIv1nf",
"level":2,
"time":"2025-05-19T09:27:36+00:00",
"remoteAddr":"<REDACTED_IP>",
"user":"<REDACTED_USER_ID>",
"app":"core",
"method":"GET",
"url":"/login/v2/flow/<REDACTED_FLOW_ID>",
"message":"Session token credentials are invalid",
"userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:138.0) Gecko/20100101 Firefox/138.0",
"version":"31.0.5.1",
"data":{"app":"core","user":"null"}
}
{
"reqId":"X1NJ0l4MR9SzC7VIv1nf",
"level":3,
"time":"2025-05-19T09:27:36+00:00",
"remoteAddr":"<REDACTED_IP>",
"user":"<REDACTED_USER_ID>",
"app":"core",
"method":"GET",
"url":"/login/v2/flow/<REDACTED_FLOW_ID>",
"message":"Renewing session token failed: ",
"userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:138.0) Gecko/20100101 Firefox/138.0",
"version":"31.0.5.1",
"exception":{
"Exception":"OC\\Authentication\\Exceptions\\TokenPasswordExpiredException",
"Message":"",
"Code":0,
"Trace":[
{"file":"/var/www/nextcloud/lib/private/Authentication/Token/PublicKeyTokenProvider.php","line":152,"function":"checkToken","class":"OC\\Authentication\\Token\\PublicKeyTokenProvider","type":"->"},
{"file":"/var/www/nextcloud/lib/private/Authentication/Token/PublicKeyTokenProvider.php","line":232,"function":"getToken","class":"OC\\Authentication\\Token\\PublicKeyTokenProvider","type":"->","args":["*** sensitive parameters replaced ***"]},
],
"File":"/var/www/nextcloud/lib/private/Authentication/Token/PublicKeyTokenProvider.php",
"Line":226,
"message":"Renewing session token failed: ",
"user":"<REDACTED_USER_ID>",
"exception":{},
"CustomMessage":"Renewing session token failed: "
}
}
Additional info
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Begin with lib/private/Authentication/Token/PublicKeyTokenProvider.php and the /login/v2/flow endpoint shown in the logs. Trace session-token renewal for user_oidc authentication and compare the invalid-credentials and TokenPasswordExpiredException entries. Done means the cause of the intermittent logout is isolated and sessions no longer undergo unexpected revocation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- authentication, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100