nextcloud / user_saml

:lock: App for authenticating Nextcloud users using SAML https://apps.nextcloud.com/apps/user_saml
https://portal.nextcloud.com/article/configuring-single-sign-on-10.html
GNU Affero General Public License v3.0
95 stars 75 forks source link

Undefined variable $result at /var/www/nextcloud/apps/user_saml/lib/GroupBackend.php#219” #838

Open roynabb opened 6 months ago

roynabb commented 6 months ago

eb72e7ccf57529e6b6b2da89caad52f037789179

Hello,

I am encountering an issue with our Nextcloud. Attached is a screenshot of the error message, and the details are included in the ticket titles. The problem affects only some users, not all.

more logs:

-InvalidTokenException Token does not exist: token does not exist -Renewing session token failed: Token does not exist: token does not exist . -IDP parameter for the UID not found. Possible parameters are: [“groups”,“username”,“email”,“Role”]

-Exception Call to a member function addUser() on null in file ‘/var/www/nextcloud/apps/user_saml/lib/GroupManager.php’ line 193

The version of :

-Nexcloud : 28.0.4 . -SSO & SAML : 6.1.3

Thank you!!

blizzz commented 6 months ago

Hi @roynabb, thanks for reporting. The log entry about Call to a member function addUser() on null also has a an id passed as "reqId". Could you paste all lines from the log containing that id completely?

roynabb commented 6 months ago

Hi @roynabb, thanks for reporting. The log entry about Call to a member function addUser() on null also has a an id passed as "reqId". Could you paste all lines from the log containing that id completely?

Hello, Thank you for your time and effort.

[index] Error: Call to a member function addUser() on null in file '/var/www/nextcloud/apps/user_saml/lib/GroupManager.php' line 193 POST /index.php/apps/user_saml/saml/acs from .... by -- at May 2, 2024, 9:39:08 AM

blizzz commented 6 months ago

Thanks, unfortunately this is not complete. Please check in the nextcloud.log file in the data directory.

If your issue is reproducible, you may want to try to apply the changes in https://github.com/nextcloud/user_saml/pull/839/files for the file lib/GroupBackend.php (in /path/to/nextcloud/apps/user_saml/), enforce the error, and provide the resulting nextcloud.log. It will contain more information.

roynabb commented 6 months ago

Thanks, unfortunately this is not complete. Please check in the nextcloud.log file in the data directory.

If your issue is reproducible, you may want to try to apply the changes in https://github.com/nextcloud/user_saml/pull/839/files for the file lib/GroupBackend.php (in /path/to/nextcloud/apps/user_saml/), enforce the error, and provide the resulting nextcloud.log. It will contain more information.

Nextcloud.log file :

{"reqId":"o5NiTptBHUriM1iaiZx6","level":0,"time":"2024-04-29T08:34:33+00:00","remoteAddr":"","user":"leruyetj","app":"encryption","method":"GET","url":"/ocs/v2.php/apps/notifications/api/v2/notifications","message":"/appinfo/app.php is deprecated, use \OCP\AppFramework\Bootstrap\IBootstrap on the application class instead.","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0","version":"28.0.4.1","data":{"app":"encryption"}} {"reqId":"9nejvdnR6CUtwGDgB2US","level":0,"time":"2024-04-29T08:34:33+00:00","remoteAddr":"","user":"ollivierc","app":"{"reqId":"o5NiTptBHUriM1iaiZx6","level":0,"time":"2024-04-29T08:34:33+00:00","remoteAddr":"","user":"leruyetj","app":"encryption","method":"GET","url":"/ocs/v2.php/apps/notifications/api/v2/notifications","message":"/appinfo/app.php is deprecated, use \OCP\AppFramework\Bootstrap\IBootstrap on the application class instead.","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0","version":"28.0.4.1","data":{"app":"encryption"}} {"reqId":"9nejvdnR6CUtwGDgB2US","level":0,"time":"2024-04-29T08:34:33+00:00","remoteAddr":"","user":"ollivierc","app":"user_saml","method":"PROPFIND","url":"/remote.php/dav/files//","message":"/appinfo/app.php is deprecated, use \OCP\AppFramework\Bootstrap\IBootstrap on the application class instead.","userAgent":"Mozilla/5.0 (Windows) mirall/3.1.2stable-Win64 (build 20210128) (Nextcloud)","version":"28.0.4.1","data":{"app":"user_saml"}} {"reqId":"9nejvdnR6CUtwGDgB2US","level":0,"time":"2024-04-29T08:34:33+00:00","remoteAddr":"10.2.201.21","user":"User1","app":"encryption","method":"PROPFIND","url":"/remote.php/dav/files/User1/","message":"/appinfo/app.php is deprecated, use \OCP\AppFramework\Bootstrap\IBootstrap on the application class instead.","userAgent":"Mozilla/5.0 (Windows) mirall/3.1.2stable-Win64 (build 20210128) (Nextcloud)","version":"28.0.4.1","data":{"app":"encryption"}} {"reqId":"9nejvdnR6CUtwGDgB2US","level":0,"time":"2024-04-229T08:34:33+00:00","remoteAddr":"","user":"--","app":"user_saml","method":"PUT","url":"/ocs/v2.php/apps/user_status/api/v1/heartbeat?format=json","message":"/appinfo/app.php is deprecated, use \OCP\AppFramework\Bootstrap\IBootstrap on the application class instead.","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","version":"28.0.4.1","data":{"app":"user_saml"}} {"reqId":"llKzPEJrP2Q96JMEsqwf","level":0,"time":"2024-04-29T08:34:33+00:00","remoteAddr":"","user":"--","app":"encryption","method":"PUT","url":"/ocs/v2.php/apps/user_status/api/v1/heartbeat?format=json","message":"/appinfo/app.php is deprecated, use \OCP\AppFramework\Bootstrap\IBootstrap on the application class instead.","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","version":"28.0.4.1","data":{"app":"encryption"}} {"reqId":"llKzPEJrP2Q96JMEsqwf","level":1,"time":"2024-04-29T08:34:33+00:00","remoteAddr":"","user":"--","app":"core","method":"PUT","url":"/ocs/v2.php/apps/user_status/api/v1/heartbeat?format=json","message":"Tried to log in but could not verify token","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","version":"28.0.4.1","data":{"app":"core","user":"leclinffa"}} {"reqId":"llKzPEJrP2Q96JMEsqwf","level":0,"time":"2024-04-29T08:34:33+00:00","remoteAddr":"","user":"--","app":"no app in context","method":"PUT","url":"/ocs/v2.php/apps/user_status/api/v1/heartbeat?format=json","message":"Current user is not logged in","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36","version":"28.0.4.1","exception":{"Exception":"OC\AppFramework\Middleware\Security\Exceptions\NotLoggedInException","Message":"Current user is not logged in","Code":401,"Trace":[{"file":"/var/www/nextcloud/lib/private/AppFramework/Middleware/MiddlewareDispatcher.php","line":96,"function":"beforeController","class":"OC\AppFramework\Middleware\Security\SecurityMiddleware","type":"->"},{"file":"/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php","line":129,"function":"beforeController","class":"OC\AppFramework\Middleware\MiddlewareDispatcher","type":"->"},{"file":"/var/www/nextcloud/lib/private/AppFramework/App.php","line":184,"function":"dispatch","class":"OC\AppFramework\Http\Dispatcher","type":"->"},{"file":"/var/www/nextcloud/lib/private/Route/Router.php","line":315,"function":"main","class":"OC\AppFramework\App","type":"::"},{"file":"/var/www/nextcloud/ocs/v1.php","line":65,"function":"match","class":"OC\Route\Router","type":"->"},{"file":"/var/www/nextcloud/ocs/v2.php","line":23,"args":["/var/www/nextcloud/ocs/v1.php"],"function":"require_once"}],"File":"/var/www/nextcloud/lib/private/AppFramework/Middleware/Security/SecurityMiddleware.php","Line":161,"message":"Current user is not logged in","exception":{},"CustomMessage":"Current user is not logged in"}} {

blizzz commented 6 months ago

Hm, it does not include any related entry.

roynabb commented 6 months ago

Hm, it does not include any related entry.

New logs: -InvalidTokenException Token does not exist: 5d0cb6afefb5a5e08bb388f7e0eb8096aac66ce0f3d9f84641a56f4ab74c5f200572bdfd44477500b53333eb217c8b2e37528979b960736104ca9ba940f8adba

/var/www/nextcloud/lib/private/Authentication/Token/PublicKeyTokenProvider.phpline 167

OC\Authentication\Token\PublicKeyTokenProvider->getTokenFromCache(
  "*** sensitive parameters replaced ***"
)

/var/www/nextcloud/lib/private/Authentication/Token/PublicKeyTokenProvider.phpline 248

OC\Authentication\Token\PublicKeyTokenProvider->getToken(
  "*** sensitive parameters replaced ***"
)

/var/www/nextcloud/lib/public/AppFramework/Db/TTransactional.phpline 63

OC\Authentication\Token\PublicKeyTokenProvider->OC\Authentication\Token\{closure}(
  "*** sensitive parameters replaced ***"
)

/var/www/nextcloud/lib/private/Authentication/Token/PublicKeyTokenProvider.phpline 247

OC\Authentication\Token\PublicKeyTokenProvider->atomic()

/var/www/nextcloud/lib/private/Authentication/Token/Manager.phpline 172

OC\Authentication\Token\PublicKeyTokenProvider->renewSessionToken()

/var/www/nextcloud/lib/private/User/Session.phpline 929

OC\Authentication\Token\Manager->renewSessionToken()

/var/www/nextcloud/lib/base.phpline 1151

OC\User\Session->loginWithCookie(
  "*** sensitive parameters replaced ***"
)

/var/www/nextcloud/lib/base.phpline 1058

OC::handleLogin()

/var/www/nextcloud/index.phpline 39

OC::handleRequest()

Caused by Error Call to a member function addUser() on null

-Undefined variable $result at /var/www/nextcloud/apps/user_saml/lib/GroupBackend.php#219

blizzz commented 6 months ago

Thanks, the first one is probably unrelated, the second one does not give much more info.

https://github.com/nextcloud/user_saml/issues/838#issuecomment-2089837382 would reveal more (and the proper log file that can also be downloaded from the Logging page).

roynabb commented 6 months ago

Hello, thank you for your time and effort.

The previous versions we used without encountering this issue were:

Following the migration to these versions:

We identified the problem as being related to a group on our AD server that contains a space in its name. This issue appears to be caused by the new version of USER_SAML APP. For example, the group "Group1_DATA_2020 & PV- Y&N - XSL-Technicals - RO" worked fine before the migration, but after the migration, it caused this error: image

The correct format would be: "Group1_DATA_2020&PV-Y&N-XSL-Technicals-RO".

smoebody commented 5 months ago

Hi, i can confirm this issue. After logging an error message as above occurs and i am prompted to login again. My Upgrade was from nextcloud enterprise 28.0.3 (user_saml v6.1.1) to 28.0.5 (user_saml v6.1.3)

here is my log:

{
    "reqId": "qq143twnex3d06g6PHQz",
    "level": 3,
    "time": "2024-05-22T11:38:22+00:00",
    "remoteAddr": "10.0.6.2",
    "user": "--",
    "app": "core",
    "method": "GET",
    "url": "/apps/theming/theme/light-highcontrast.css?plain=0&v=2bddf2c5",
    "message": "Renewing session token failed: Token does not exist: b2956a9668ffeb4fb41977416f819dc46d75ec475d1bb5bd7809ff5924700fadad54bd64f7a6c2ecf2b820496e5ee6af5b6f9fc90b368f789693ccf0259eb2c6",
    "userAgent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36",
    "version": "28.0.5.2",
    "exception": {
        "Exception": "OC\\Authentication\\Exceptions\\InvalidTokenException",
        "Message": "Token does not exist: b2956a9668ffeb4fb41977416f819dc46d75ec475d1bb5bd7809ff5924700fadad54bd64f7a6c2ecf2b820496e5ee6af5b6f9fc90b368f789693ccf0259eb2c6",
        "Code": 0,
        "Trace": [
            {
                "file": "/var/www/html/lib/private/Authentication/Token/PublicKeyTokenProvider.php",
                "line": 167,
                "function": "getTokenFromCache",
                "class": "OC\\Authentication\\Token\\PublicKeyTokenProvider",
                "type": "->",
                "args": [
                    "*** sensitive parameters replaced ***"
                ]
            },
            {
                "file": "/var/www/html/lib/private/Authentication/Token/PublicKeyTokenProvider.php",
                "line": 248,
                "function": "getToken",
                "class": "OC\\Authentication\\Token\\PublicKeyTokenProvider",
                "type": "->",
                "args": [
                    "*** sensitive parameters replaced ***"
                ]
            },
            {
                "file": "/var/www/html/lib/public/AppFramework/Db/TTransactional.php",
                "line": 63,
                "function": "OC\\Authentication\\Token\\{closure}",
                "class": "OC\\Authentication\\Token\\PublicKeyTokenProvider",
                "type": "->",
                "args": [
                    "*** sensitive parameters replaced ***"
                ]
            },
            {
                "file": "/var/www/html/lib/private/Authentication/Token/PublicKeyTokenProvider.php",
                "line": 247,
                "function": "atomic",
                "class": "OC\\Authentication\\Token\\PublicKeyTokenProvider",
                "type": "->",
                "args": [
                    [
                        "Closure"
                    ],
                    [
                        "OC\\DB\\ConnectionAdapter"
                    ]
                ]
            },
            {
                "file": "/var/www/html/lib/private/Authentication/Token/Manager.php",
                "line": 172,
                "function": "renewSessionToken",
                "class": "OC\\Authentication\\Token\\PublicKeyTokenProvider",
                "type": "->",
                "args": [
                    "*** sensitive parameters replaced ***",
                    "5b435bb22f4a3dee33c4418a19398fb0"
                ]
            },
            {
                "file": "/var/www/html/lib/private/User/Session.php",
                "line": 929,
                "function": "renewSessionToken",
                "class": "OC\\Authentication\\Token\\Manager",
                "type": "->",
                "args": [
                    "*** sensitive parameters replaced ***",
                    "5b435bb22f4a3dee33c4418a19398fb0"
                ]
            },
            {
                "file": "/var/www/html/lib/base.php",
                "line": 1151,
                "function": "loginWithCookie",
                "class": "OC\\User\\Session",
                "type": "->",
                "args": [
                    "*** sensitive parameters replaced ***"
                ]
            },
            {
                "file": "/var/www/html/lib/base.php",
                "line": 1058,
                "function": "handleLogin",
                "class": "OC",
                "type": "::",
                "args": [
                    [
                        "OC\\AppFramework\\Http\\Request"
                    ]
                ]
            },
            {
                "file": "/var/www/html/index.php",
                "line": 39,
                "function": "handleRequest",
                "class": "OC",
                "type": "::",
                "args": []
            }
        ],
        "File": "/var/www/html/lib/private/Authentication/Token/PublicKeyTokenProvider.php",
        "Line": 197,
        "message": "Renewing session token failed: Token does not exist: b2956a9668ffeb4fb41977416f819dc46d75ec475d1bb5bd7809ff5924700fadad54bd64f7a6c2ecf2b820496e5ee6af5b6f9fc90b368f789693ccf0259eb2c6",
        "user": "us66zumi",
        "exception": {},
        "CustomMessage": "Renewing session token failed: Token does not exist: b2956a9668ffeb4fb41977416f819dc46d75ec475d1bb5bd7809ff5924700fadad54bd64f7a6c2ecf2b820496e5ee6af5b6f9fc90b368f789693ccf0259eb2c6"
    }
}