nextcloud / nextcloud/user_saml

SSO mode does not offer multiple user back-ends anymore

Open
#400 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
PHP
Stars
104
Forks
85
Avg merge
1d 15h
Merged PRs (30d)
16

Description

Steps to reproduce
  1. After Upgrading my NC installation from 13 to 17, The SSO/SAML App needed to be upgraded aswell to 2.4.1
  2. The SSO configuration Tab does not offer the "allow multiple back ends" configuration option anymore
Expected behaviour

The SSO configuration Tab does offer the "allow multiple back ends" configuration option.
So users on non-domain devices can log in by typing in their credentials.

Actual behaviour

The SSO configuration Tab does not offer the "allow multiple back ends" configuration option.
This effectively renders users on non-domain joined devices unable to log in anymore.

Server configuration

Nextcloud version:
17

List of activated apps:
user_saml

Apache configuration:

 <IfModule mod_auth_gssapi.c>
  <Location "/index.php/apps/user_saml/saml/login">
   AuthName "kleinet Nextcloud - Kerberos Login"
   AuthType GSSAPI
#   ErrorDocument 401 /index.php/login?direct=1
   GssapiCredStore keytab:/etc/httpd.keytab
   GssapiAllowedMech krb5
   GssapiLocalName on
   LogLevel debug
   Require valid-user
  </Location>
 </IfModule>

Apache logs:

non-domain joined device

abcd:defg:8c5::1f:949e:c01d - - [12/Feb/2020:16:38:37 +0100] "GET / HTTP/1.1" 302 -
abcd:defg:8c5::1f:949e:c01d - - [12/Feb/2020:16:38:39 +0100] "GET /index.php/login HTTP/1.1" 302 -
abcd:defg:8c5::1f:949e:c01d - - [12/Feb/2020:16:38:39 +0100] "GET / HTTP/1.1" 302 -
abcd:defg:8c5::1f:949e:c01d - - [12/Feb/2020:16:38:39 +0100] "GET /index.php/apps/user_saml/saml/login?originalUrl=&idp=1&requesttoken=8egn8jGhBvUhENqEJyWt%2BTr5vQEmHnVJGE9sw5FSmMY%3D%3AhttWxkH7dJ9Vd7m2Sn/OtgKs6U5KVUF7TR4Bhuc06rw%3D HTTP/1.1" 401 381
abcd:defg:8c5::1f:949e:c01d - - [12/Feb/2020:16:38:39 +0100] "GET /index.php/login HTTP/1.1" 302 -
abcd:defg:8c5::1f:949e:c01d - - [12/Feb/2020:16:38:39 +0100] "GET /index.php/apps/user_saml/saml/login?originalUrl=&requesttoken=vLIe5CwrkgatgDiT5EpzHwo0KBY1oOQhsMT82Fxh4/o%3D%3Ay4Fv0Fxx4GzZ51uhiRAQUDJhfFlZ69AT5ZWRnSoHkYA%3D&idp=1 HTTP/1.1" 401 381

domain joined device

fd00::201:9d26:c5b5:ec6f:5c94 - - [12/Feb/2020:16:38:49 +0100] "GET / HTTP/1.1" 302 -
fd00::201:9d26:c5b5:ec6f:5c94 - - [12/Feb/2020:16:38:49 +0100] "GET /index.php/login HTTP/1.1" 302 -
fd00::201:9d26:c5b5:ec6f:5c94 - - [12/Feb/2020:16:38:49 +0100] "GET /index.php/apps/user_saml/saml/login?originalUrl=&requesttoken=oiyLa1rGL0sxQoghotBuU5b3K/sjo8vgCBlHni5p5CM%3D%3Awx/vWmyqbQ1yEOVzyYMcJvmdGa1oyo6EYGg1xGonplM%3D&idp=1 HTTP/1.1" 401 381
fd00::201:9d26:c5b5:ec6f:5c94 - kleinem [12/Feb/2020:16:38:49 +0100] "GET /index.php/apps/user_saml/saml/login?originalUrl=&requesttoken=oiyLa1rGL0sxQoghotBuU5b3K/sjo8vgCBlHni5p5CM%3D%3Awx/vWmyqbQ1yEOVzyYMcJvmdGa1oyo6EYGg1xGonplM%3D&idp=1 HTTP/1.1" 303 -
fd00::201:9d26:c5b5:ec6f:5c94 - - [12/Feb/2020:16:38:50 +0100] "GET / HTTP/1.1" 302 -
fd00::201:9d26:c5b5:ec6f:5c94 - - [12/Feb/2020:16:38:50 +0100] "GET /index.php/apps/files/ HTTP/1.1" 200 49386

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the upgrade from Nextcloud 13 to 17 with user_saml 2.4.1 and inspect the SSO configuration tab. Trace the missing “allow multiple back ends” option and verify that the option is available and permits non-domain-joined users to log in with their credentials.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
authentication, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.