[Bug]: oauth clients fail since 30.0.6

[normen]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

Since updating to Nextcloud 30.0.6 two of my WebApps that use my NextCloud as OAuth login ceased to work. These are Peertube and Gitea. Both worked fine in 30.0.5.

WordPress (with OIDC plugin) and OpenWebUI can still use the NextCloud OAuth login after the update, only Peertube and Gitea give errors when trying to log in.

Steps to reproduce

1. Set up peertube and gitea with OAuth login through Nextcloud
2. Update Nextcloud to 30.0.6
3. See the login doesn't work anymore

Expected behavior

The OAuth login should work for all external apps.

Nextcloud Server version

30

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.4

Web server

Nginx

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Updated from a MINOR version (ex. 32.0.1 to 32.0.2)

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "htaccess.RewriteBase": "\/",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "appstoreenabled": true,
        "apps_paths": [
            {
                "path": "\/var\/www\/html\/apps",
                "url": "\/apps",
                "writable": false
            },
            {
                "path": "\/var\/www\/html\/custom_apps",
                "url": "\/custom_apps",
                "writable": true
            }
        ],
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "simpleSignUpLink.shown": false,
        "trusted_domains": [
            "cloud.bitwaves.de",
            "localhost",
            "nextcloud-fpm",
            "127.0.0.",
            "172.21.0.42"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "skeletondirectory": "",
        "templatedirectory": "",
        "dbtype": "mysql",
        "version": "30.0.6.2",
        "overwrite.cli.url": "http:\/\/cloud.bitwaves.de",
        "overwriteprotocol": "https",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpmode": "smtp",
        "mail_sendmailmode": "smtp",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpauthtype": "LOGIN",
        "mail_smtpauth": 1,
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "maintenance": false,
        "loglevel": 2,
        "log.condition": {
            "apps": [
                "admin_audit"
            ]
        },
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "password": "***REMOVED SENSITIVE VALUE***",
            "port": 6379
        },
        "app_install_overwrite": [
            "social",
            "jsloader",
            "ocdownloader",
            "ncdownloader",
            "news",
            "jitsi",
            "talk_matterbridge"
        ],
        "theme": "",
        "ncd_admin_settings": {
            "disallow_aria2_settings": "1",
            "ncd_disable_bt": "1"
        },
        "defaultapp": "",
        "maintenance_window_start": 3,
        "updater.release.channel": "stable",
        "default_phone_region": "DE"
    }
}

List of activated Apps

Enabled:
  - activity: 3.0.0
  - admin_audit: 1.20.0
  - assistant: 2.3.0
  - calendar: 5.1.0
  - cloud_federation_api: 1.13.0
  - comments: 1.20.1
  - contacts: 7.0.0
  - cookbook: 0.11.2
  - cospend: 3.0.11
  - dav: 1.31.1
  - deck: 1.14.3
  - external: 5.5.2
  - federatedfilesharing: 1.20.0
  - federation: 1.20.0
  - files: 2.2.0
  - files_accesscontrol: 1.20.1
  - files_automatedtagging: 1.20.0
  - files_downloadlimit: 3.0.0
  - files_external: 1.22.0
  - files_pdfviewer: 3.0.0
  - files_reminders: 1.3.0
  - files_sharing: 1.22.0
  - files_trashbin: 1.20.1
  - files_versions: 1.23.0
  - files_zip: 2.1.0
  - flow_notifications: 1.10.1
  - forms: 4.3.7
  - gpxpod: 7.0.4
  - groupfolders: 18.1.0
  - impersonate: 1.17.1
  - integration_openai: 3.4.0
  - integration_peertube: 1.2.0
  - integration_youtube: 0.3.1
  - logreader: 3.0.0
  - lookup_server_connector: 1.18.0
  - mail: 4.2.0
  - ncdownloader: 1.0.21
  - news: 25.2.1
  - nextcloud_announcements: 2.0.0
  - notes: 4.11.0
  - notifications: 3.0.0
  - oauth2: 1.18.1
  - oidc: 1.4.0
  - password_policy: 2.0.0
  - passwords: 2024.12.21
  - polls: 7.3.1
  - privacy: 2.0.0
  - provisioning_api: 1.20.0
  - related_resources: 1.5.0
  - serverinfo: 2.0.0
  - settings: 1.13.0
  - sharebymail: 1.20.0
  - spreed: 20.1.4
  - talk_matterbridge: 1.31.1026000
  - tasks: 0.16.1
  - text: 4.1.0
  - theming: 2.6.0
  - twofactor_backupcodes: 1.19.0
  - unroundedcorners: 1.1.4
  - updatenotification: 1.20.0
  - viewer: 3.0.0
  - webhook_listeners: 1.1.0-dev
  - whiteboard: 1.0.5
  - workflow_ocr: 1.30.1
  - workflow_pdf_converter: 1.15.1
  - workflow_script: 1.15.0
  - workflowengine: 2.12.0
Disabled:
  - analytics: 5.2.4 (installed 5.2.4)
  - app_api: 4.0.6 (installed 3.2.1)
  - bruteforcesettings: 3.0.0 (installed 2.4.0)
  - circles: 30.0.0 (installed 24.0.1)
  - contactsinteraction: 1.11.0 (installed 1.5.0)
  - dashboard: 7.10.0 (installed 7.6.0)
  - encryption: 2.18.0
  - files_downloadactivity: 1.17.0 (installed 1.17.0)
  - files_scripts: 4.1.0 (installed 4.1.0)
  - firstrunwizard: 3.0.0 (installed 2.9.0)
  - integration_dropbox: 3.0.3 (installed 3.0.3)
  - integration_giphy: 2.0.1 (installed 2.0.1)
  - jitsi: 0.19.0 (installed 0.19.0)
  - jsloader: 1.5.0 (installed 1.5.0)
  - maps: 1.5.0 (installed 1.5.0)
  - photos: 3.0.2 (installed 1.0.0)
  - recommendations: 3.0.0 (installed 0.7.0)
  - richdocuments: 8.5.3 (installed 8.5.3)
  - sharelisting: 1.2.0 (installed 1.2.0)
  - sharerenamer: 3.4.0 (installed 3.4.0)
  - side_menu: 4.0.1 (installed 4.0.1)
  - social: 0.7.0 (installed 0.7.0)
  - support: 2.0.0 (installed 1.2.1)
  - survey_client: 2.0.0 (installed 1.8.0)
  - suspicious_login: 8.0.0 (installed 4.4.0)
  - systemtags: 1.20.0 (installed 1.14.0)
  - tables: 0.8.4 (installed 0.8.4)
  - translate: 2.2.0 (installed 2.2.0)
  - twofactor_nextcloud_notification: 4.0.0
  - twofactor_totp: 12.0.0-dev
  - user_ldap: 1.21.0
  - user_status: 1.10.0 (installed 1.0.1)
  - weather_status: 1.10.0 (installed 1.0.0)
  - workflow_media_converter: 1.12.0 (installed 1.12.0)

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

Additional info

No response

[susnux]

WordPress (with OIDC plugin) and OpenWebUI can still use the NextCloud OAuth login after the update, only Peertube and Gitea give errors when trying to log in.

Some working some not sounds like a problem with external software.

Nevertheless without logs we can not debug this further, so please add corresponding logs.

[lhsei]

#50619

In this bugreport the logs are included. The error is related to the Nextcloud Files and Nextcloud Talk-App too. Since 30.0.6 there is no possibility to log in.

And it's independend from OS. The error is on iOS and Android.

[normen]

Theres no specific error messages from Nextcloud, it plays as if everything went normal. But the apps are reporting that the login failed when the callback is reached. Downgrading to 30.0.5 fixes the issue and there were no changes to either Gitea or Peertube installs, so I doubt its external software. I guess the issue is in the callback which is handled differently in the external apps.

And yeah, given there seem to be multiple issues around OAuth client and provider since 30.0.6 - maybe its in order not to dismiss this right away and look into it. Just my two cents, I can stick to 30.0.5 🤷‍♂️

[joshtrichards]

@lhsei Are you using oauth? I didn't see any references in your linked bug report.

[susnux]

@st3iny the only change for oauth between 30.0.5 and 30.0.6 is the backport of #50193
Do you think it could be related?

@normen did re-setup gitea oauth resolve the issue?

[st3iny]

My PR only added repair jobs and didn't change the authentication logic.

I have one more question to be sure: @normen Did you downgrade by simply replacing the server files or did you also restore an old database backup?

If you also restored a backup it could mean that the new migration code in the repair jobs is too aggressive. Ideally, repair jobs should not touch OAuth2 tables if the instance was not migrated from ownCloud since they last ran.

[normen]

The latter, full restore, wouldn't know how to downgrade Nextcloud otherwise