nextcloud / nextcloud/user_saml
SSO mode does not offer multiple user back-ends anymore
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 104
- Forks
- 85
- Avg merge
- 1d 15h
- Merged PRs (30d)
- 16
Description
Steps to reproduce
- After Upgrading my NC installation from 13 to 17, The SSO/SAML App needed to be upgraded aswell to 2.4.1
- The SSO configuration Tab does not offer the "allow multiple back ends" configuration option anymore
Expected behaviour
The SSO configuration Tab does offer the "allow multiple back ends" configuration option.
So users on non-domain devices can log in by typing in their credentials.
Actual behaviour
The SSO configuration Tab does not offer the "allow multiple back ends" configuration option.
This effectively renders users on non-domain joined devices unable to log in anymore.
Server configuration
Nextcloud version:
17
List of activated apps:
user_saml
Apache configuration:
<IfModule mod_auth_gssapi.c>
<Location "/index.php/apps/user_saml/saml/login">
AuthName "kleinet Nextcloud - Kerberos Login"
AuthType GSSAPI
# ErrorDocument 401 /index.php/login?direct=1
GssapiCredStore keytab:/etc/httpd.keytab
GssapiAllowedMech krb5
GssapiLocalName on
LogLevel debug
Require valid-user
</Location>
</IfModule>
Apache logs:
non-domain joined device
abcd:defg:8c5::1f:949e:c01d - - [12/Feb/2020:16:38:37 +0100] "GET / HTTP/1.1" 302 -
abcd:defg:8c5::1f:949e:c01d - - [12/Feb/2020:16:38:39 +0100] "GET /index.php/login HTTP/1.1" 302 -
abcd:defg:8c5::1f:949e:c01d - - [12/Feb/2020:16:38:39 +0100] "GET / HTTP/1.1" 302 -
abcd:defg:8c5::1f:949e:c01d - - [12/Feb/2020:16:38:39 +0100] "GET /index.php/apps/user_saml/saml/login?originalUrl=&idp=1&requesttoken=8egn8jGhBvUhENqEJyWt%2BTr5vQEmHnVJGE9sw5FSmMY%3D%3AhttWxkH7dJ9Vd7m2Sn/OtgKs6U5KVUF7TR4Bhuc06rw%3D HTTP/1.1" 401 381
abcd:defg:8c5::1f:949e:c01d - - [12/Feb/2020:16:38:39 +0100] "GET /index.php/login HTTP/1.1" 302 -
abcd:defg:8c5::1f:949e:c01d - - [12/Feb/2020:16:38:39 +0100] "GET /index.php/apps/user_saml/saml/login?originalUrl=&requesttoken=vLIe5CwrkgatgDiT5EpzHwo0KBY1oOQhsMT82Fxh4/o%3D%3Ay4Fv0Fxx4GzZ51uhiRAQUDJhfFlZ69AT5ZWRnSoHkYA%3D&idp=1 HTTP/1.1" 401 381
domain joined device
fd00::201:9d26:c5b5:ec6f:5c94 - - [12/Feb/2020:16:38:49 +0100] "GET / HTTP/1.1" 302 -
fd00::201:9d26:c5b5:ec6f:5c94 - - [12/Feb/2020:16:38:49 +0100] "GET /index.php/login HTTP/1.1" 302 -
fd00::201:9d26:c5b5:ec6f:5c94 - - [12/Feb/2020:16:38:49 +0100] "GET /index.php/apps/user_saml/saml/login?originalUrl=&requesttoken=oiyLa1rGL0sxQoghotBuU5b3K/sjo8vgCBlHni5p5CM%3D%3Awx/vWmyqbQ1yEOVzyYMcJvmdGa1oyo6EYGg1xGonplM%3D&idp=1 HTTP/1.1" 401 381
fd00::201:9d26:c5b5:ec6f:5c94 - kleinem [12/Feb/2020:16:38:49 +0100] "GET /index.php/apps/user_saml/saml/login?originalUrl=&requesttoken=oiyLa1rGL0sxQoghotBuU5b3K/sjo8vgCBlHni5p5CM%3D%3Awx/vWmyqbQ1yEOVzyYMcJvmdGa1oyo6EYGg1xGonplM%3D&idp=1 HTTP/1.1" 303 -
fd00::201:9d26:c5b5:ec6f:5c94 - - [12/Feb/2020:16:38:50 +0100] "GET / HTTP/1.1" 302 -
fd00::201:9d26:c5b5:ec6f:5c94 - - [12/Feb/2020:16:38:50 +0100] "GET /index.php/apps/files/ HTTP/1.1" 200 49386
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the upgrade from Nextcloud 13 to 17 with user_saml 2.4.1 and inspect the SSO configuration tab. Trace the missing “allow multiple back ends” option and verify that the option is available and permits non-domain-joined users to log in with their credentials.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100