Crash when the username is 22 characters long

Steps to reproduce

1. Create a user with a username that is 22 characters long.
2. Try logging in.

Expected behaviour

It should work.

Actual behaviour

The user get the internal error page.
Less or more than 22 characters usernames works.

Server configuration

Operating system:
Linux

SAML Provider
Keycloak

Web server:
Nginx

Database:
Postgres

PHP version:
7.4.23

Nextcloud version: (see Nextcloud admin page)

• 20.0.12
• 21.0.4
• 22.1.1

Where did you install Nextcloud from:
Docker

List of activated apps:

  - accessibility: 1.6.0
  - activity: 2.13.4
  - admin_audit: 1.10.0
  - apporder: 0.13.0
  - bruteforcesettings: 2.2.0
  - calendar: 2.3.3
  - cloud_federation_api: 1.3.0
  - comments: 1.10.0
  - contactsinteraction: 1.1.0
  - dav: 1.16.2
  - federatedfilesharing: 1.10.2
  - federation: 1.10.1
  - files: 1.15.0
  - files_pdfviewer: 2.0.1
  - files_rightclick: 0.17.0
  - files_sharing: 1.12.2
  - files_trashbin: 1.10.1
  - files_versions: 1.13.0
  - files_videoplayer: 1.9.0
  - indie_external: 3.9.0
  - logreader: 2.5.0
  - lookup_server_connector: 1.8.0
  - nextcloud_announcements: 1.9.0
  - notifications: 2.8.0
  - oauth2: 1.8.0
  - onlyoffice: 7.1.2
  - password_policy: 1.10.1
  - photos: 1.2.3
  - privacy: 1.4.0
  - provisioning_api: 1.10.0
  - recommendations: 0.8.0
  - settings: 1.2.0
  - sharebymail: 1.10.0
  - survey_client: 1.8.0
  - systemtags: 1.10.0
  - text: 3.1.0
  - theming: 1.11.0
  - twofactor_backupcodes: 1.9.0
  - user_saml: 3.3.5
  - user_status: 1.0.1
  - viewer: 1.4.0
  - weather_status: 1.0.0
  - workflowengine: 2.2.0

Nextcloud configuration:

{
    "system": {
        "installed": "true",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "***REMOVED SENSITIVE VALUE***"
        ],
        "overwrite.cli.url": "***REMOVED SENSITIVE VALUE***",
        "overwriteprotocol": "",
        "version": "20.0.12.1",
        "debug": false,
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "config_is_read_only": true,
        "skeletondirectory": "",
        "updatechecker": "false ",
        "updater.server.url": "https:\/\/updates.nextcloud.com\/updater_server\/",
        "updater.release.channel": "stable",
        "upgrade.disable-web": true,
        "sharing.maxAutocompleteResults": 10,
        "sharing.minSearchStringLength": 2,
        "dbtype": "pgsql",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "5432",
        "dbtableprefix": false,
        "mysql.utf8mb4": false,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "apps_paths": [
            {
                "path": "\/usr\/src\/nextcloud\/apps",
                "url": "\/apps",
                "writable": false
            }
        ],
        "default_language": "fr",
        "default_locale": "fr",
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "password": "***REMOVED SENSITIVE VALUE***",
            "port": 6379
        },
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "objectstore": {
            "class": "\\OC\\Files\\ObjectStore\\S3",
            "arguments": {
                "bucket": "***REMOVED SENSITIVE VALUE***",
                "autocreate": false,
                "key": "***REMOVED SENSITIVE VALUE***",
                "secret": "***REMOVED SENSITIVE VALUE***",
                "region": "default",
                "hostname": "***REMOVED SENSITIVE VALUE***",
                "port": "443",
                "use_ssl": true,
                "use_path_style": true
            }
        },
        "mail_smtpmode": "smtp",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "587",
        "mail_smtpsecure": "tls",
        "mail_smtpauth": true,
        "mail_smtpauthtype": "LOGIN",
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "appstoreenabled": false
    }
}

Client configuration

Browser:

Operating system:

Logs

Nextcloud log (data/owncloud.log)

  Error   index   InvalidArgumentException: User "" is not valid at apps/user_saml/lib/Controller/SAMLController.php line 357                     2021-09-08T15:33:26+00:00

                  0. lib/private/AppFramework/Http/Dispatcher.php line 169
                     OCA\User_SAML\Controller\SAMLController->assertionConsumerService(

                     )
                  1. lib/private/AppFramework/Http/Dispatcher.php line 100
                     OC\AppFramework\Http\Dispatcher->executeController(OCA\User_SAML\Controller\SAMLController {}, "assertionConsumerService")
                  2. lib/private/AppFramework/App.php line 152
                     OC\AppFramework\Http\Dispatcher->dispatch(OCA\User_SAML\Controller\SAMLController {}, "assertionConsumerService")
                  3. lib/private/Route/Router.php line 309
                     OC\AppFramework\App::main(
                       "OCA\\User_SAML\\Controller\\SAMLController",
                       "assertionConsumerService",
                       OC\AppFramework\DependencyInjection\DIContainer {},
                       {_route:"user_saml.SAML.assertionConsumerService"}
                     )
                  4. lib/base.php line 1008
                     OC\Route\Router->match("\/apps\/user_saml\/saml\/acs")
                  5. index.php line 37
                     OC::handleRequest(

                     )

Browser log

Start with apps/user_saml/lib/Controller/SAMLController.php at line 357 and reproduce the SAML login using a 22-character username. Compare the failing assertion-consumer flow with usernames of other lengths and use the reported exception as the failure signal. Done means the affected user can log in without reaching the internal error page.