owncloud / owncloud/android

[BUG] 2FA problem: Does not take authorization in the first go

Open
#4,508 9 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Type:bug
Dominant language
Kotlin
Stars
4.2k
Forks
3.1k
Avg merge
1d 12h
Merged PRs (30d)
7

Description

Actual behaviour

-When you authorize using 2FA (here: via Free OTP) you have to perform the authentication procedure twice.

Expected behaviour

-The app should accept the authorization the first time it is presented

Steps to reproduce
  1. Start OwnCloud app and connect to the cloud
  2. You get redirected due to authorization expiration, so you enter your credentials in the Web browser that is opened for you, then you create the token for 2FA (here: via Free OTP) and enter it. In the browser the cloud opens up and also a popup comes that asks you "open in app?"
  3. Agree to opening in the app, OwnCloud app comes up again, but: complains about expiration once more, so go back to step 2 and repeat everything. This time the autorization gets accepted.

Can this problem be reproduced with the official owncloud server?
(url: https://ocis.ocis.master.owncloud.works, user: einstein, password: relativity)
Haven't tried so far.

Environment data

Android version:
10 (AOSP, Fairphone Open OS 23.02.0-rel.0 (latest version)
Device model:
Fairphone 2
Stock or customized system:
AOSP, but officially supported the manufacturer of the phone (Fairphone).
ownCloud app version:
4.4.1 (latest) - but this behaviour was also present on the two previous versions
ownCloud server version:
unknown (hosted by my employer).

Logs
Web server error log
Insert your webserver log here
ownCloud log (data/owncloud.log)
Insert your ownCloud log here

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the flow in the OwnCloud Android app: expiration, browser credentials, Free OTP, and the "open in app?" handoff. Compare the first and second authorization attempts and inspect the app and browser authorization transition. Done means a valid 2FA authorization is accepted on the first attempt; add logs if reproduction requires more evidence.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, kotlin
Domain
authentication, mobile
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.