nextcloud / nextcloud/user_oidc

Wrong redirect if already authenticated with SSO

Open
#766 2 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

bug needs info priority: normal question
Dominant language
PHP
Stars
181
Forks
60
Avg merge
7h 34m
Merged PRs (30d)
26

Description

Dear devs,

thank you very much for this app. I integrated Nextcloud with keycloak and see a redirect error if I am already authenticated with Keycloak.

Steps to reproduce:

  1. Get a valid session with keycloak by logging in to some other service on the same realm
  2. Access the nextcloud base url (https://xxx.tld/nextcloud/)
  3. Observe the following 302 redirects: (https://xxx.tld/nextcloud/login --> https://xxx.tld/nextcloud/apps/user_oidc/login/1 --> https://xxx.tld/nextcloud/index.php_oidc/login/1)
  4. The last redirect results in a 404 not found, because the URL does not exists. Note the index.php_oidc/login/1 part that looks wrong to me.

What I think is happening

user_oidc is checking with keycloak for authentication, realizes the session is already authenticated with keycloak, authenticates the user with nextcloud and immediately tries to redirect back to nextcloud. But somehow the redirect URL gets mangled.
This error does not occur when logging in directly with nextlcoud, e.g. with no prior authentication with keycloak.

Cheers
Robert

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the redirect sequence from /login through apps/user_oidc/login/1, focusing on the transition to the malformed index.php_oidc/login/1 URL. Trace the already-authenticated SSO redirect handling and verify that the flow returns to a valid Nextcloud URL without a 404.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
authentication
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.