nextcloud / nextcloud/user_saml

User ID mismatch

Open
#295 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
PHP
Stars
104
Forks
85
Avg merge
1d 15h
Merged PRs (30d)
16

Description

Steps to reproduce

Log in with user 'jack' (with SSO, that populates HTTP_REMOTE_USER with the users' uid), then logout outside NextCloud (with the SSO logout URL).
Then, log in with the 'john' user in the same way.

Expected behaviour

The first time, we expect to be logged in in NextCloud with the user 'jack'.
The second time, we expect to be logged in with the user 'john'.

Actual behaviour

The first time we are logged in in NextCloud with 'jack', but the second time we are still logged in with 'jack' (despite the http_remote_user header is correctly valued in both cases).

Server configuration detail

Operating system: RHEL 7.6

Webserver: Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 (fpm-fcgi)

Database: mysql 5.5.60

PHP version:

7.2.13
Modules loaded: Core, date, libxml, openssl, pcre, zlib, filter, hash, Reflection, SPL, session, standard, cgi-fcgi, apcu, bz2, calendar, ctype, curl, dom, mbstring, fileinfo, ftp, gd, gettext, gmp, iconv, intl, json, ldap, exif, mcrypt, mysqli, PDO, pdo_mysql, pdo_sqlite, Phar, posix, shmop, SimpleXML, sockets, sqlite3, sysvmsg, sysvsem, sysvshm, tokenizer, xml, wddx, xmlreader, xmlwriter, xsl, zip, Zend OPcache

Nextcloud version: 14.0.4 - 14.0.4.2

Updated from an older Nextcloud/ownCloud or fresh install:

Where did you install Nextcloud from: unknown

Signing status
List of activated apps 
Enabled:
 - accessibility: 1.0.1
 - activity: 2.7.0
 - admin_audit: 1.4.0
 - bruteforcesettings: 1.3.0
 - cloud_federation_api: 0.0.1
 - comments: 1.4.0
 - dav: 1.6.0
 - external: 3.1.0
 - federatedfilesharing: 1.4.0
 - files: 1.9.0
 - files_pdfviewer: 1.3.2
 - files_sharing: 1.6.2
 - files_texteditor: 2.6.0
 - files_trashbin: 1.4.1
 - files_versions: 1.7.1
 - files_videoplayer: 1.3.0
 - gallery: 18.1.0
 - issuetemplate: 0.4.0
 - logreader: 2.0.0
 - lookup_server_connector: 1.2.0
 - notifications: 2.2.1
 - oauth2: 1.2.1
 - password_policy: 1.4.0
 - provisioning_api: 1.4.0
 - serverinfo: 1.4.0
 - sharebymail: 1.4.0
 - support: 1.0.0
 - twofactor_backupcodes: 1.3.1
 - updatenotification: 1.4.1
 - user_ldap: 1.4.0
 - user_saml: 2.1.0
 - workflowengine: 1.4.0
Disabled:
 - announcementcenter
 - encryption
 - federation
 - files_external
 - firstrunwizard
 - nextcloud_announcements
 - survey_client
 - systemtags
 - theming
 - theming_customcss
 - user_external
Configuration (config/config.php) 
{
    "instanceid": "***REMOVED SENSITIVE VALUE***",
    "passwordsalt": "***REMOVED SENSITIVE VALUE***",
    "secret": "***REMOVED SENSITIVE VALUE***",
    "trusted_domains": [
        "*********"
    ],
    "datadirectory": "***REMOVED SENSITIVE VALUE***",
    "overwrite.cli.url": "https:\/\/********",
    "dbtype": "mysql",
    "version": "14.0.4.2",
    "dbname": "***REMOVED SENSITIVE VALUE***",
    "dbhost": "***REMOVED SENSITIVE VALUE***",
    "dbtableprefix": "oc_",
    "dbuser": "***REMOVED SENSITIVE VALUE***",
    "dbpassword": "***REMOVED SENSITIVE VALUE***",
    "logtimezone": "UTC",
    "installed": true,
    "mail_smtpmode": "smtp",
    "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
    "mail_smtpport": "25",
    "mail_from_address": "***REMOVED SENSITIVE VALUE***",
    "mail_domain": "***REMOVED SENSITIVE VALUE***",
    "ldapUserCleanupInterval": 360,
    "ldapIgnoreNamingRules": false,
    "enable_avatars": false,
    "session_keepalive": false,
    "knowledgebaseenabled": false,
    "allow_user_to_change_display_name": false,
    "memcache.local": "\\OC\\Memcache\\APCu",
    "default_language": "fr",
    "cron_log": true,
    "log_type": "owncloud",
    "loglevel": 0,
    "log_rotate_size": 1073742000,
    "maintenance": false,
    "trashbin_retention_obligation": 30,
    "trashbin_auto_expire": true,
    "activity_expire_days": 90,
    "ldapProviderFactory": "\\OCA\\User_LDAP\\LDAPProviderFactory",
    "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
    "forwarded_for_headers": [
        "HTTP_X_FORWARDED",
        "HTTP_FORWARDED_FOR",
        "HTTP_X_FORWARDED_FOR"
    ],
    "auth.bruteforce.protection.enabled": true,
}

Are you using external storage, if yes which one: local/smb/sftp/...

Are you using encryption:

Are you using an external user-backend, if yes which one: LDAP

LDAP configuration (delete this par if not used)

Client configuration

Browser: Mozilla/5.0 (X11; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0

Operating system:

Logs

Browser log
Nextcloud log
Browser log

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No source file, entry point, or test is identified in the issue. Start by reproducing the SAML logout and subsequent login flow with the reported LDAP setup, then trace how the HTTP_REMOTE_USER value is handled across sessions. Done means logging in as jack, logging out externally, and then logging in as john creates the john session.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
authentication
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.