nextcloud / nextcloud/user_oidc

Keycloak OpenID connect redirect not working

Open
#1,267 16 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

discussion needs info
Dominant language
PHP
Stars
181
Forks
60
Avg merge
7h 34m
Merged PRs (30d)
26

Description

How to use GitHub
  • Please use the 👍 reaction to show that you are affected by the same issue.
  • Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
  • Subscribe to receive notifications on status change and new comments.

It was running without issues, one if the updates must have broken it. OIDC Login wasn't tested after the updates, just if nextcloud is available and the nextcloud desktop client is working. This is still working, just the web based Login with Keycloak not. Another Service (not nextcloud), which is on the same server, also with keycloak oidc is working without any issues. So it's not Keycloak and nothing in between.

Steps to reproduce
  1. Using OpenID Connect user backend Version 8.1.0
  2. On Nextcloud Hub 10 (31.0.11), registered Providers, add keycloak
  3. On login page, click on "Login with Keycloak"
  4. See broken redirect, as it ends up on a nextcloud error page:
Page not found
The page could not be found on the server or you may not be allowed to view it.
Expected behaviour

Should redirect to keycloak and showing the keycloak login form.

Actual behaviour

Ends up on a nextcloud page:

Page not found
The page could not be found on the server or you may not be allowed to view it.
Server configuration

Web server: Nginx stable docker image ("org.opencontainers.image.version": "1.28.0")

Database: PostgreSQL (postgres 17.5 docker image)

PHP version: 8.2/8.3/8.4
"org.opencontainers.image.base.name": "php:8.3-fpm-trixie"

Nextcloud version: (see Nextcloud admin page)
nextcloud stable-fpm docker image ("org.opencontainers.image.version": "31.0.11-fpm")

List of activated apps 
Enabled:
  - activity: 4.0.0
  - admin_audit: 1.21.0
  - app_api: 5.0.2
  - bruteforcesettings: 4.0.0
  - circles: 31.0.0
  - cloud_federation_api: 1.14.0
  - comments: 1.21.0
  - contactsinteraction: 1.12.1
  - dashboard: 7.11.0
  - dav: 1.33.0
  - federatedfilesharing: 1.21.0
  - federation: 1.21.0
  - files: 2.3.1
  - files_downloadlimit: 4.0.0
  - files_pdfviewer: 4.0.0
  - files_reminders: 1.4.0
  - files_sharing: 1.23.2
  - files_trashbin: 1.21.0
  - files_versions: 1.24.0
  - firstrunwizard: 4.0.0
  - logreader: 4.0.0
  - lookup_server_connector: 1.19.0
  - nextcloud_announcements: 3.0.0
  - notifications: 4.0.0
  - oauth2: 1.19.1
  - password_policy: 3.0.0
  - photos: 4.0.0
  - privacy: 3.0.0
  - profile: 1.0.0
  - provisioning_api: 1.21.0
  - recommendations: 4.0.0
  - related_resources: 2.0.0
  - serverinfo: 3.0.0
  - settings: 1.14.0
  - sharebymail: 1.21.0
  - support: 3.0.0
  - survey_client: 3.0.0
  - systemtags: 1.21.1
  - text: 5.0.2
  - theming: 2.6.1
  - twofactor_backupcodes: 1.20.0
  - updatenotification: 1.21.0
  - user_oidc: 8.1.0
  - user_status: 1.11.0
  - viewer: 4.0.0
  - weather_status: 1.11.0
  - webhook_listeners: 1.2.0
  - workflowengine: 2.13.0
Nextcloud configuration 
{
    "system": {
        "skeletondirectory": "",
        "htaccess.RewriteBase": "\/",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "apps_paths": [
            {
                "path": "\/var\/www\/html\/apps",
                "url": "\/apps",
                "writable": false
            },
            {
                "path": "\/var\/www\/html\/custom_apps",
                "url": "\/custom_apps",
                "writable": true
            }
        ],
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "nextcloud1:8080",
            "nextcloud.my-domain.com",
            "nextcloud1.my-domain.com",
            "keycloak.my-domain.com"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "pgsql",
        "version": "31.0.11.2",
        "overwrite.cli.url": "https:\/\/nextcloud.my-domain.com",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "mail_smtpmode": "smtp",
        "mail_smtpsecure": "tls",
        "mail_sendmailmode": "smtp",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpauthtype": "LOGIN",
        "mail_smtpauth": 1,
        "mail_smtpport": "587",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "loglevel": 0,
        "maintenance": false,
        "default_phone_region": "DE",
        "allow_local_remote_servers": "true",
        "debug": false,
        "overwriteprotocol": "https",
        "maintenance_window_start": 1,
        "upgrade.disable-web": true
    }
}
Browser

Browser name:
Safari
Firefox

Browser version:
Safari Version 26.1 (21622.2.11.11.9)
Firefox 145.0.2 (aarch64)

Operating system: Mac

Browser log 
https://keycloak.my-domain.com/realms/my-domain/protocol/openid-connect/auth?client_id=my-client-id&response_type=code&scope=openid+email+profile+groups&redirect_uri=https%3A%2F%2Fnextcloud.my-domain.com%2Fapps%2Fuser_oidc%2Fcode&claims=%7B%22id_token%22%3A%7B%22email%22%3Anull%2C%22name%22%3Anull%2C%22quota%22%3Anull%2C%22groups%22%3Anull%2C%22preferred_username%22%3A%7B%22essential%22%3Atrue%7D%7D%2C%22userinfo%22%3A%7B%22email%22%3Anull%2C%22name%22%3Anull%2C%22quota%22%3Anull%2C%22groups%22%3Anull%2C%22preferred_username%22%3A%7B%22essential%22%3Atrue%7D%7D%7D&state=G10...&nonce=VJ...&code_challenge=XU...&code_challenge_method=S256
Failed to load resource: the server responded with a status of 404 ()

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Run the reported login flow and inspect the failing /apps/user_oidc/code request in the browser log. Trace how the user_oidc app handles that callback and compare it with the supplied Nextcloud, Nginx, and Keycloak configuration. Done means clicking Login with Keycloak reaches Keycloak and returns to Nextcloud without the 404.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
authentication, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.