Cannot login when using user_oidc

[ishioni]

⚠️ Before posting ⚠️

• This is a bug, not a question or an enhancement.
• I've searched for similar issues and didn't find a duplicate.
• I've written a clear and descriptive title for this issue, not just "Bug" or "Crash".
• I agree to follow Nextcloud's Code of Conduct.

Steps to reproduce

1. Setup nextcloud with https://github.com/nextcloud/user_oidc, successfully create an oidc-backed user
2. Try to log in to the instance using the mobile app

Expected behaviour

It should proceed to the login screen

Actual behaviour

"Unknown http error" comes up on the server url screen, nothing else can be done

Android version

13 (TP1A.221105.002)

Device brand and model

Google Pixel 4a

Stock or custom OS?

Stock

Nextcloud android app version

3.22.3

Nextcloud server version

25.0.1

Using a reverse proxy?

Yes

Android logs

11-21 08:56:11.819 29341 29341 D QRScannerQRCodeActivity: Got scan result from user loaded image :nc://login/user:movi&password:Kx8TY-3MZoQ-8by9M-fxkmY-c5Pg4&server:https://<domain>
11-21 08:56:11.834 29341 29341 D QrCodeActivity: onPause() ending
11-21 08:56:12.109 29341 29341 D AuthenticatorActivity: onStart() starting
11-21 08:56:12.111 29341 29341 D AuthenticatorActivity: onResume() starting
11-21 08:56:12.150 29341 29341 D OperationsService: Starting command with id 6
11-21 08:56:12.155 29341  7535 D OwnCloudClient #1: REQUEST GET /status.php
11-21 08:56:12.340 29341  7535 W HttpMethodBase: Going to buffer response body of large or unknown size. Using getResponseBodyAsStream instead is recommended.
11-21 08:56:12.341 29341  7535 I GetStatusRemoteOperation: Connection check at https://<domain>: Operation finished with HTTP status code -1 (success)
11-21 08:56:12.341 29341  7535 D GetServerInfoOperation: Trying empty authorization to detect authentication method
11-21 08:56:12.341 29341  7535 D OwnCloudClient #1: REQUEST HEAD /remote.php/dav
11-21 08:56:12.441 29341  7535 D RemoteOperationResult: RemoteOperationResult has processed UNHANDLED_HTTP_CODE: 405 Method Not Allowed
11-21 08:56:12.441 29341  7535 D ExistenceCheckRemoteOperation: Existence check for https://<domain>/remote.php/dav/files/null// targeting for  existence finished with HTTP status 405(FAIL)
11-21 08:56:12.441 29341  7535 D DetectAuthenticationMethodOperation: Authentication method found: UNKNOWN
11-21 08:56:12.441 29341  7535 D OperationsService: Called 1 listeners
11-21 08:56:12.441 29341  7535 D OperationsService: Stopping after command with id 6
11-21 08:56:12.685 29341 29341 D QrCodeActivity: onStop() ending
11-21 08:56:12.686 29341 29341 D QrCodeActivity: onDestroy() ending

Server error logs

172.16.133.235 - - [21/Nov/2022:01:18:51 +0000] "GET /status.php HTTP/1.1" 200 181 "-" "Mozilla/5.0 (Android) Nextcloud-android/3.22.3" "10.1.2.52"
172.16.133.235 - - [21/Nov/2022:01:18:51 +0000] "HEAD /remote.php/dav HTTP/1.1" 401 0 "-" "Mozilla/5.0 (Android) Nextcloud-android/3.22.3" "10.1.2.52"

Additional information

No response

[tobiasKaminsky]

11-21 08:56:12.441 29341 7535 D ExistenceCheckRemoteOperation: Existence check for https:///remote.php/dav/files/null// targeting for existence finished with HTTP status 405(FAIL)

This looks wrong. It should check for /files/$userId

Can you create us a test account and send the credentials to tobias at nextcloud dot com with a reference to this issue?

[ishioni]

@tobiasKaminsky This instance isn't public to the internet. But I'll make one for you, including an SSO user that you could use against it

[ishioni]

@tobiasKaminsky Sent you an email with the details

[tobiasKaminsky]

Intermediate status: https://server.com/remote.php/dav is not accessible.

[ishioni]

I'm guessing that's something that user_oidc does? I've cross-reported it here nextcloud/user_oidc#537

[tobiasKaminsky]

I honestly have no idea who/what is blocking/denying it…
Let's see what the devs of oidc say.

[ishioni]

Btw, i just checked, user_saml has the exact same problem

@tobiasKaminsky if you want to check if it's the same problem, the instance is available at the same domain as last time

[github-actions]

This bug report did not receive an update in the last 4 weeks. Please take a look again and update the issue with new details, otherwise the issue will be automatically closed in 2 weeks. Thank you!

[ishioni]

@tobiasKaminsky The lack of cookies on the 401 page was the actual culprit of this as I mentioned in user_oidc. Closing, all is well :)