nextcloud / nextcloud/user_oidc
Wrong redirect if already authenticated with SSO
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 181
- Forks
- 60
- Avg merge
- 7h 34m
- Merged PRs (30d)
- 26
Description
Dear devs,
thank you very much for this app. I integrated Nextcloud with keycloak and see a redirect error if I am already authenticated with Keycloak.
Steps to reproduce:
- Get a valid session with keycloak by logging in to some other service on the same realm
- Access the nextcloud base url (https://xxx.tld/nextcloud/)
- Observe the following 302 redirects: (https://xxx.tld/nextcloud/login --> https://xxx.tld/nextcloud/apps/user_oidc/login/1 --> https://xxx.tld/nextcloud/index.php_oidc/login/1)
- The last redirect results in a 404 not found, because the URL does not exists. Note the index.php_oidc/login/1 part that looks wrong to me.
What I think is happening
user_oidc is checking with keycloak for authentication, realizes the session is already authenticated with keycloak, authenticates the user with nextcloud and immediately tries to redirect back to nextcloud. But somehow the redirect URL gets mangled.
This error does not occur when logging in directly with nextlcoud, e.g. with no prior authentication with keycloak.
Cheers
Robert
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the redirect sequence from /login through apps/user_oidc/login/1, focusing on the transition to the malformed index.php_oidc/login/1 URL. Trace the already-authenticated SSO redirect handling and verify that the flow returns to a valid Nextcloud URL without a 404.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100