Microsoft Entra OIDC login fails on official Docker image (Debian 13 / libcurl 8.14.1) — cross-reference to nextcloud/docker issue

Summary

Logging this in user_oidc for discoverability. The user_oidc app correctly constructs and attempts to fetch the Microsoft Entra OIDC discovery URL, but the underlying HTTP client (Guzzle → libcurl) receives HTTP 404 from Microsoft's endpoint when running on the official nextcloud:32 Docker image. The same fetch succeeds via PHP's file_get_contents() from inside the same container, which rules out network configuration and confirms the failure is specific to the libcurl path.

Root cause (as far as we know)

The official nextcloud:31 and nextcloud:32 Docker images are built on php:8.3-apache-trixie (Debian 13 "Trixie" — currently pre-release). libcurl 8.14.1 on Trixie appears to produce a TLS ClientHello that Microsoft's CDN infastructure responds to with HTTP 404, while stable Debian 12 (Bookworm) libcurl builds return HTTP 200 for the same URL.

Related prior issue for context: nextcloud/user_oidc#397 reports a similar top-level error message but was resolved via local access rule changes (allow_local_remote_servers). Current findings indicate a different failure mode.

Full evidence and root cause analysis: nextcloud/docker#2560.

Workaround

Build a custom Nextcloud image using FROM php:8.3-apache-bookworm instead of the Trixie base. Nextcloud version and volumes are unchanged.

Environment

Start with the user_oidc OIDC discovery request path and the Guzzle-to-libcurl behavior described in the issue, then review the evidence in nextcloud/docker#2560. Reproduce the Microsoft Entra request on the nextcloud:31/32 Trixie image and the Bookworm-based workaround; done means identifying whether a fix belongs in user_oidc or the Docker image.