nextcloud / nextcloud/user_saml

'multiple user back-ends' disabled but users can login via direct login page

Open
#284 9 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
PHP
Stars
104
Forks
85
Avg merge
1d 15h
Merged PRs (30d)
16

Description

Steps to reproduce

  1. Disable Allow the use of multiple user back-ends (e.g. LDAP) in /settings/admin/saml
    image

  2. Follow the next URL https://<your.nextcloud.domain>/login?direct=1 and login using login/pass (no matter what backend — LDAP/internal/other)

  3. And voila! You are logged in!

Expected behaviour

Ignoring direct=1 param if option Allow the use of multiple user back-ends (e.g. LDAP) is disabled

Actual behaviour

The param Allow the use of multiple user back-ends (e.g. LDAP) is disabled but users can login via internal nextcloud's back-end

Server configuration detail

Operating system: Linux 3.10.0-957.1.3.el7.x86_64 #1 SMP Thu Nov 29 14:49:43 UTC 2018 x86_64

Webserver: nginx/1.14.2 (fpm-fcgi)

Database: mysql 5.7.24

PHP version:
7.0.33

Modules loaded: Core, date, libxml, openssl, pcre, zlib, filter, hash, Reflection, SPL, session, standard, cgi-fcgi, bcmath, bz2, calendar, ctype, curl, dom, mbstring, fileinfo, ftp, gd, gettext, gmp, iconv, imap, intl, json, ldap, exif, mcrypt, mysqlnd, PDO, pgsql, apcu, posix, recode, shmop, SimpleXML, soap, sockets, sqlite3, sysvmsg, sysvsem, sysvshm, tidy, tokenizer, xml, xmlwriter, xsl, mysqli, pdo_mysql, pdo_pgsql, pdo_sqlite, wddx, xmlreader, apc, igbinary, msgpack, uploadprogress, zip, Phar, memcached, mysql, redis, Zend OPcache

Nextcloud version: 14.0.4 - 14.0.4.2

Updated from an older Nextcloud/ownCloud or fresh install:

Where did you install Nextcloud from: unknown

List of activated apps 
Enabled:
 - activity: 2.7.0
 - bruteforcesettings: 1.2.0
 - cloud_federation_api: 0.0.1
 - dav: 1.6.0
 - federatedfilesharing: 1.4.0
 - files: 1.9.0
 - files_external: 1.5.0
 - files_pdfviewer: 1.3.2
 - files_sharing: 1.6.2
 - files_texteditor: 2.6.0
 - files_trashbin: 1.4.1
 - files_versions: 1.7.1
 - files_videoplayer: 1.3.0
 - gallery: 18.1.0
 - issuetemplate: 0.4.0
 - lookup_server_connector: 1.2.0
 - nextcloud_announcements: 1.3.0
 - notifications: 2.2.1
 - oauth2: 1.2.1
 - provisioning_api: 1.4.0
 - sharebymail: 1.4.0
 - spreed: 4.0.1
 - survey_client: 1.2.0
 - theming: 1.5.0
 - twofactor_backupcodes: 1.3.1
 - twofactor_totp: 1.5.0
 - updatenotification: 1.4.1
 - user_ldap: 1.4.0
 - user_saml: 2.1.0
 - workflowengine: 1.4.0
Disabled:
 - accessibility
 - admin_audit
 - comments
 - encryption
 - federation
 - firstrunwizard
 - logreader
 - password_policy
 - serverinfo
 - support
 - systemtags
 - user_external
Configuration (config/config.php) 
{
    "instanceid": "***REMOVED SENSITIVE VALUE***",
    "passwordsalt": "***REMOVED SENSITIVE VALUE***",
    "secret": "***REMOVED SENSITIVE VALUE***",
    "trusted_domains": [
        "***REMOVED SENSITIVE VALUE***"
    ],
    "datadirectory": "***REMOVED SENSITIVE VALUE***",
    "overwrite.cli.url": "***REMOVED SENSITIVE VALUE***",
    "dbtype": "mysql",
    "version": "14.0.4.2",
    "dbname": "***REMOVED SENSITIVE VALUE***",
    "dbhost": "***REMOVED SENSITIVE VALUE***",
    "dbport": "",
    "dbtableprefix": "oc_",
    "mysql.utf8mb4": true,
    "dbuser": "***REMOVED SENSITIVE VALUE***",
    "dbpassword": "***REMOVED SENSITIVE VALUE***",
    "installed": true,
    "ldapIgnoreNamingRules": false,
    "ldapProviderFactory": "\\OCA\\User_LDAP\\LDAPProviderFactory",
    "loglevel": 2,
    "mail_domain": "***REMOVED SENSITIVE VALUE***",
    "mail_from_address": "***REMOVED SENSITIVE VALUE***",
    "mail_smtpauth": 1,
    "mail_smtpauthtype": "PLAIN",
    "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
    "mail_smtpmode": "smtp",
    "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
    "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
    "mail_smtpport": "465",
    "mail_smtpsecure": "ssl",
    "maintenance": false,
    "memcache.local": "\\OC\\Memcache\\Redis",
    "redis": {
        "host": "***REMOVED SENSITIVE VALUE***",
        "port": 6379,
        "timeout": 0,
        "password": "***REMOVED SENSITIVE VALUE***",
        "dbindex": 2
    },
    "theme": "",
    "updater.release.channel": "stable"
}

Are you using external storage, if yes which one: local

Are you using encryption: no

Are you using an external user-backend, if yes which one: LDAP/SAML

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the behavior by disabling the option at /settings/admin/saml and opening /login?direct=1. Trace how the direct-login parameter is handled when multiple user back-ends are disabled. Done means the parameter is ignored in that configuration and the resulting login behavior matches the expected restriction.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
authentication
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.