Logging into Nextcloud after logging in via the YNH portal disables the user

Support apps
, , ,
1

I have searched the forum for similar issues

on

This category is for issues regarding specific apps, NOT general issues with YunoHost.

on

This form is written in English but feel free to write in French if you’re more comfortable!

on

What app is this about, and its version

Nextcloud, 34.0.4~ynh1

What YunoHost version are you running

12.1.41.2

What type of hardware are you using

VPS bought online

Describe your issue

When I log in directly via the Nextcloud portal, there are no issues.
When I access Nextcloud after logging in via the YNH portal (with the same user), the user account is immediately disabled.
It might be a coincidence, but this has been happening to me since the security update: 0037_fix_bad_permissions
Thanks in advance for your help.

Share relevant logs or error messages

I didn’t found any logs yet.

2

I tryied to reproduce your issue by logging in in the portal and then entering nexcloud via the tile but I am not facing the same issue. .
Is it the nexcloud account or the yunohost accound that is disabled ?

3

Hi, thank you for your time and your response.

It’s actually the Nextcloud user/account that is disabled.

Other information, I was forced to add my IP to the Fail2ban whitelist, otherwise all access to YNH services was blocked.

4

I’ve tested this with various users, and it seems to happen only to users who have Nextcloud 2FA enabled. I suspect there is a link between the YNH SSO login and this 2FA, which is causing the account to be blocked and disabled.
However, I have no idea why this is suddenly happening…

5

Up!
Has anyone else encountered the same problem? Or does anyone have an idea on how to resolve this issue? 2FA and SSO was working well so far.
Thanks.

6

Could you try this and let us know?

sudo yunohost app setting nextcloud protect_against_basic_auth_spoofing -v "false"
sudo yunohost app ssowatconf

If it doesn’t change anything

sudo yunohost app setting nextcloud -d protect_against_basic_auth_spoofing
sudo yunohost app ssowatconf
7

@Gwylohm

To be more complete: I think the authentication might fail because of this protection ( protect_against_basic_auth_spoofing).
Then, since the 2FA tries y retries the authentication, the ip gets banned both by the nextcloud fail2ban jail and by nextcloud’s brute-force protection.

After running

sudo yunohost app setting nextcloud protect_against_basic_auth_spoofing -v "false"
sudo yunohost app ssowatconf

You may have to run

sudo fail2ban-client status nextcloud

It might return a banned ip.
If so:

  • unban it from fail2ban
sudo fail2ban-client unban [ip]
  • unban it from nextcloud
yunohost app shell nextcloud
php occ security:bruteforce:reset [ip]
8

But the problem only seemed to start after the YNH SSO login, and that protection seems to permanently block basic auth. While the auth_header overwrite happens after ynh-SSO and, as you mentioned, keeps being relevant regardless of the general basic auth “protection” (i.e. if basic auth is disabled).

So it might also rather be the auth_header package setting that could need adjusting.

I could not find any official yunohost command to override that package manifest configuration with an an admin setting, to test it out, maybe manually edit /etc/yunohost/app/…/settings.. and restart nginx?

9

@Gwylohm Did you usually proceed this way? 1) Log in to the YunoHost portal → 2) two-factor authentication page (TOTP or something else)? :thinking:

10

Hi and thanks @otm33 and @tmb for your help!

@otm33 Unfortunately, none of the commands worked. My account gets blocked every time, if I leave 2FA enabled.

And I usually proceeded this way : 1) Log into the YunoHost portal → 2) Click on the Nextcloud tile 3) Log into Nextcloud portal (id/password) 4) Nextcloud 2FA page 5) Access to Nextcloud

Now 3) shows a “Error” page :frowning:

11

You had to reauthenticate at step 3 ? Quite weird since SSO is supposed to authenticate you with nextcloud.

12

Yes, I agree. But I suppose I didn’t pay attention to it since two-factor authentication was enabled; so I thought it was normal, until it blocked me a few weeks ago. -_-’

13

Did you also try editing /etc/yunohost/apps/nextcloud/settings.yml to set all auth_header: false and then

sudo yunohost tools regen-conf --with-diff --force
sudo yunohost app ssowatconf
sudo systemctl restart nginx
14

Sure, it will work but will remove the SSO authentication.

15

Seems an ugly workaround to make login work, by disabling broken SSO.

Whenever the login only works if auth_header (SSO) is disabled, the problem could be with overriding the app’s own authorisation header.

Guess apps themselves set and check the auth header after taking the user info from the ynh provided SSO authUserHeaders (SSOwat/access.lua at a59b558bbbcaeb00199a19ce952bf3c75ce78bef · YunoHost/SSOwat · GitHub).

So if those authUserHeaders really are the ones mentioned at SSO/LDAP integration | Yunohost …

Could it be a general and severe SSO bug that there is no way to configure inserting the SSO authUserHeaders without overriding the app’s authorisation header?

Testing this with nextcloud could be interesting for the general discussion at:

16

I hadn’t tried that workaround, so thanks a lot for that; it seems to have solved the problem, even if it’s only a temporary fix.

I hope we can find a more reliable solution to make Yunohost SSO and Nextcloud 2FA work together.

17

Could you please say what “seems soved” means:

Our postulation here was that SSO stops working (login required despite prior YNH login) but 2FA works.

If so, could you file an issue at Issues · YunoHost/issues · GitHub , mentioning your problem and workaround results and the SSO thread (SSO bugs: still always auth_header basic password injected & apps that need basic-email as login broken?).

Problem:

there is no way to configure inserting the SSO authUserHeaders without overriding the app’s authorisation header

18

Unfortunateley, it seems that Nextcloud does not accept Basic Auth (> yunohost SSO) for an user if 2FA is enabled.