nextcloud / nextcloud/user_saml
InResponseTo mismatch causes "user not provisioned" error
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 104
- Forks
- 85
- Avg merge
- 1d 15h
- Merged PRs (30d)
- 16
Description
Steps to reproduce
not known so far
Expected behaviour
Login via Keycloak as SAML IdP should work without error.
Actual behaviour
Sometimes users on my instance get a "user not provisioned error" after login via Keycloak. Accessing the page for a second time the error seems to disappear and Nextcloud can be accessed.
The NC logs show the following kind of message:
The InResponseTo of the Response: ONELOGIN_13562acfd3890b72005f7093d5c88eb3e7d9f01e, does not match the ID of the AuthNRequest sent by the SP: ONELOGIN_de689d902ad50a04240e2370cd937a9f7621a35e
Nextcloud version:
15.0.2 via Docker
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by examining the SAML login flow that creates and validates AuthNRequest and InResponseTo values, using the reported Nextcloud logs as the initial clue. Reproduce the intermittent Keycloak login failure if possible and verify that the response matches the request sent by the service provider without producing a user-not-provisioned error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100