[Bug]: SAML login fails behind reverse proxy when index.php is removed from the public URL

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

SAML authentication fails when Nextcloud is configured behind a reverse proxy that removes index.php from the public URL.
I have used

sudo nextcloud.occ config:system:set overwrite.cli.url --value="https://mydomain.com"

sudo nextcloud.occ config:system:set htaccess.RewriteBase --value="/"

The SAML response received from the IdP contains the correct Destination:
https://mydomain.com/apps/user_saml/saml/acs

However, onelogin/php-saml reconstructs the current URL from the internal PHP request and generates an incorrect URL:
https://mydomain.com/apps/user_saml/saml/index.phpacs

As a result, SAML validation fails with:

The response was received at
https://mydomain.com/apps/user_saml/saml/index.phpacs
instead of
https://mydomain.com/apps/user_saml/saml/acs

Please note the extra index.php in the first URL.

As a temporary workaround I have modified
/var/snap/nextcloud/ current /nextcloud/extra-apps/user_saml/lib/Controller/SAMLController.php

and replaced:

                $this->callWithXmlEntityLoader(function () use ($auth, $AuthNRequestID): void {
                        $auth->processResponse($AuthNRequestID);
                });

with

$oldRequestUri = $_SERVER['REQUEST_URI'] ?? null;

$_SERVER['REQUEST_URI'] = parse_url(
    $this->urlGenerator->linkToRouteAbsolute(
        'user_saml.SAML.assertionConsumerService'
    ),
    PHP_URL_PATH
);

try {
    $this->callWithXmlEntityLoader(function () use ($auth, $AuthNRequestID): void {
        $auth->processResponse($AuthNRequestID);
    });
} finally {
    if ($oldRequestUri !== null) {
        $_SERVER['REQUEST_URI'] = $oldRequestUri;
    }
}

Steps to reproduce

1. Enable SAML

2. Execute

sudo nextcloud.occ config:system:set overwrite.cli.url --value="https://mydomain.com"
sudo nextcloud.occ config:system:set htaccess.RewriteBase --value="/"

3. Set up nginx rules to proxy_pass the missing public url index.php

location / {
    try_files $uri @nextcloud_index;

    proxy_pass http://127.0.0.1:9988;

    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto https;

    proxy_redirect off;
}

location @nextcloud_index {
    rewrite ^/(.*)$ /index.php/$1 break;

    proxy_pass http://127.0.0.1:9988;

    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto https;

    proxy_redirect off;
}

4. SAML login fails with the referred error

Expected behavior

Normal SAML login

Nextcloud Server version

34

Operating system

Debian/Ubuntu

PHP engine version

No response

Web server

No response

Database engine version

No response

Is this bug present after an update or on a fresh install?

No response

Are you using the Nextcloud Server Encryption module?

No response

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

List of activated Apps

Nextcloud Signing status

Nextcloud Logs

Additional info

No response

Start in user_saml/lib/Controller/SAMLController.php at the assertionConsumerService flow and inspect how processResponse receives the request URL. Reproduce the reverse-proxy setup with index.php removed, then verify that SAML validation uses the public /apps/user_saml/saml/acs URL matching the IdP Destination without breaking request restoration.