Closed Varbin closed 3 years ago
Thanks for your report! We will have a look at it and try to investigate if there are unexpected conflicts with the LDAP user backend.
Regarding the LDAP issue: I set up a Nextcloud test instance with the LDAP user backend enabled and connected to an openldap container. With one of the LDAP users, I was able to create an eID connection without any error. Do you have a different setup? More detailed log files would be helpful to further track down the problem.
Hello,
the same thing happens here. Once a user has successfully added an E-ID, the APP passwords and thus CalDav and CardDav synchronizations no longer work.
What is active for me is the "Two-Factor TOTP provider". It still works so far, but I suspect that's where the conflicts are.
At the webfrontend I can login with both options "User + PW + TFA" and e-ID without any problems. Only the APP passwords do not work. If you deactivate the e-ID link, the passwords work again.
Regarding the LDAP issue: I set up a Nextcloud test instance with the LDAP user backend enabled and connected to an openldap container. With one of the LDAP users, I was able to create an eID connection without any error. Do you have a different setup? More detailed log files would be helpful to further track down the problem.
From a user perspective, using the eID to sign in works without (a visible) problem (besides app passwords - maybe only the ones that existed before eID configuration?). Here are the logs I promised:
Requests from Firefox are Browser sessions, "mirall/2.6.2" is the Desktop Client, "Nextcloud-android" is the mobile app, DAVx5 is Cal/CardDAV synchronisation. I only saw those kind of messages while having eID signing active and configured for my user.
The above errors where seen only while an eID was configured for my account. After deactivation, all app passwords started to work again, signing in with Password + MFA worked as well, exactly as @micha1848 confirmed.
Thank you both for your input!
We were able to reproduce the issue with the app passwords and let you know if there is any progress on this.
After investigating this, I think the behaviour is the following:
The behaviour is the same when doing an WebAuthn based password less login. An pull request regarding the behaviour has been made.
For the moment you can do the following to keep app passwords valid AND use the eID based login:
Hope this helps. The documentation will be updated to reflect the current behaviour.
I will close this issue, as hopefully nextcloud will change the token handling, to prevent this behaviour.
After activation of the eID app login configuration, all active sessions are revoked and (existing?) app passwords do not work anymore. Additionally the session timeout seems to drastically reduced (from multiple weeks by default to a few minutes). After deactivation of the eID login, app passwords started working again. The option to enforce eID usage was not enabled.
While I assume this is intended, it was a bit unexpected and it is not mentioned in the admin documentation. Would it be possible to add this to the documentation and more clearly document this?
Anyway, signing in with an eID works as intended.
In the case this is a bug, the LDAP user backend is in use on my Nextcloud instance. Below is a screens hot of my logs, the entries only appear after activation of eID sign-in. I'll attach a textual copy once I have more time.
The used Nextcloud version is 21.0.2.
Thanks in advance!