OCS request fails with Bearer authentication in user_oidc 7.3.2 and Nextcloud 31

[iLinaza]

How to use GitHub

• Please use the 👍 reaction to show that you are affected by the same issue.
• Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
• Subscribe to receive notifications on status change and new comments.

---

Steps to reproduce

1. Have Nextcloud 31 and user_oidc 7.3.2
2. Make a request to an OCS API endpoint with Bearer authentication

Expected behaviour

Request should have user authenticated given valid credentials, and a valid result.

Actual behaviour

Request results ni a "Current user is not logged in" error.

I think this is the cause of the error:

In version 7.3.2 of user_oidc, the way in which the user backend is registered has been changed.

Until this version, OC_User was used to register the backend, with the useBackend method.

In addition to registering the backend in the UserManager, version 31 of Nextcloud also stores it in the static variable _usedBackends. This is later on used to get the active backend in findFirstActiveUsedBackend method.

Now, in 7.3.2, the backend is registered directly against the UserManager, which is probably fine in Nextcloud 32, since the OC_User class algo changed. But in nextcloud 31, this causes the error i am describing.

Server configuration

Web server: Nginx

Database: Maria

PHP version: 8.3

Nextcloud version: 31.0.8

List of activated apps

If you have access to your command line run e.g.:
sudo -u www-data php occ app:list
from within your Nextcloud installation folder

Nextcloud configuration

If you have access to your command line run e.g.:
sudo -u www-data php occ config:list system
from within your Nextcloud installation folder

Browser

Browser name: Firefox/Chrome/Safari/…

Browser version: 124/125/…

Operating system: Windows/Ubuntu/Mac/…

Browser log

Insert your browser log here, this could for example include:
a) The javascript console log
b) The network log
c) ...

[julien-nc]

Thanks for reporting this with details.

What are you using as bearer token? An app password created in the UI in the security settings?
I want to make sure i reproduce this issue to start fixing it.

Also, could you validate that if you replace $userManager->registerBackend($this->backend); by \OC_User::useBackend($this->backend); it fixes the issue on your side?

[julien-nc]

So far I can't reproduce when using an app password.

So I guess you are using an OIDC id/access token as bearer token and you expect it to be validated by the user_oidc user backend. Right?

[iLinaza]

Hi @julien-nc, yes, i can confirm both. I am using an OIDC jwt token. And, if using \OC_User::useBackend($this->backend); it fixed the issue.

[julien-nc]

Thanks. I can reproduce on 31 and 32. But putting back \OC_User::useBackend($this->backend); just works on 31. I need to investigate. I'll keep you updated.

[julien-nc]

Ok I got it. Thanks to your issue I also saw that soft auto provisioning was not working correctly when validating bearer tokens. This is fixed in #1192.

So #1193 should fix the user backend registration in NC < 32.

If you confirm that #1193 works fine on your side, I could merge it and make a release.

[iLinaza]

Hello Julien,

Thank you very much for your prompt reply. I can confirm that #1193 solves my problem.

Thank you very much!