nextcloud / nextcloud/user_oidc

Failed to provision user

Open
#903 11 comments 6 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug discussion priority: normal question
Dominant language
PHP
Stars
181
Forks
60
Avg merge
7h 34m
Merged PRs (30d)
26

Description

Hi,

I have an existing Nextcloud with users already created from LDAP. I'm using Authelia for SSO, and wanting to login through Authelia and it bring up the existing users Files, Mail, etc. (Not create a new user).

I'm using the mappings-id setting for user_oidc to match the same one LDAP uses, and I also have auto_provision = false in config.php (To let LDAP take user creation). It always gives me the error below.
I've tried every setting for mappings-id as well (preferred_username, uid, mail, etc).

"Access Forbidden"
Failed to provision the user

I can't see to find any log files or where to start debugging this. I have found another user that had the same issue (https://github.com/nextcloud/user_oidc/issues/869) and set the mappings-id for users to preferred_username but that doesn't do anything for me.
If I take auto_provision = false out of Nextcloud then it will work, but it creates a totally new user in Nextcloud and doesn't use the existing user from LDAP.
It seems if auto_provision = false is set in Nextcloud then nothing will work to even login, and always gives the "Failed to provision the user" error.

I have also unchecked "Use unique user ID" box and tried with it. It has no difference. This is on user_oidc: 6.0.0 and user_oidc: 5.0.3

Any help would be much appreciated. Thank you

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

The report names config.php and the user_oidc mappings-id and auto_provision settings; start by reproducing the login with LDAP users and comparing those configurations. Check the available Nextcloud/user_oidc diagnostics around the “Failed to provision the user” response. Done means an existing LDAP user can log in through Authelia without a duplicate account being created.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.