Frequent session timeouts when using External users (OC_User_IMAP)

[gatoth]

Steps to reproduce

1. Enable External Users
2. Set user backends
   'user_backends' =>
   array (
   0 =>
   array (
   'class' => 'OC_User_IMAP',
   'arguments' =>
   array (
   0 => '{:993/imap/ssl/novalidate-cert}',
   ),
   ),
   ),
3. Log in with an IMAP backed account, and even if you keep browsing the folders and files continuously, the session expires after 5 minutes.
4. Use a non-IMAP user, do the same and the session does not expire after 5 minutes.

Expected behaviour

Session should not expire while user is active, regardless if user is backed by IMAP.

Actual behaviour

Session expires for IMAP users after 5 minutes, even if they are being active all the time.

Server configuration

Operating system: FreeBSD 11.2

Web server: Apache 2.4.34

Database: mysql 5.6.41

PHP version: 5.6.37

Nextcloud version: 13.0.6

Updated from an older Nextcloud/ownCloud or fresh install: Updated from 13.0.4 (freshly installed 13.0.4 had the same behaviour)

Where did you install Nextcloud from: Downloaded from nextcloud.com, updated with built-in updater.

Signing status:

Signing status

No errors have been found.

List of activated apps:

App list

The process control (PCNTL) extensions are required in case you want to interrupt long running commands - see http://php.net/manual/en/book.pcntl.php Enabled: - activity: 2.6.1 - calendar: 1.6.1 - comments: 1.3.0 - contacts: 2.1.5 - dav: 1.4.7 - federatedfilesharing: 1.3.1 - files: 1.8.0 - files_external: 1.4.1 - files_pdfviewer: 1.2.1 - files_sharing: 1.5.0 - files_texteditor: 2.5.1 - files_trashbin: 1.3.0 - files_versions: 1.6.0 - files_videoplayer: 1.2.0 - gallery: 18.0.0 - groupfolders: 1.3.3 - logreader: 2.0.0 - lookup_server_connector: 1.1.0 - nextcloud_announcements: 1.2.0 - notes: 2.4.1 - notifications: 2.1.2 - oauth2: 1.1.1 - password_policy: 1.3.0 - polls: 0.8.3 - provisioning_api: 1.3.0 - serverinfo: 1.3.0 - survey_client: 1.1.0 - systemtags: 1.3.0 - tasks: 0.9.7 - theming: 1.4.5 - twofactor_backupcodes: 1.2.3 - updatenotification: 1.3.0 - user_external: 0.4 - workflowengine: 1.3.0 Disabled: - admin_audit - bruteforcesettings - deck - encryption - federation - files_fulltextsearch - firstrunwizard - fulltextsearch - impersonate - mail - ojsxc - rainloop - ransomware_protection - sharebymail - spreed - unsplash - user_ldap

Nextcloud configuration:

Config report

The process control (PCNTL) extensions are required in case you want to interrupt long running commands - see http://php.net/manual/en/book.pcntl.php { "system": { "instanceid": "***REMOVED SENSITIVE VALUE***", "passwordsalt": "***REMOVED SENSITIVE VALUE***", "secret": "***REMOVED SENSITIVE VALUE***", "trusted_domains": [ "***REMOVED SENSITIVE VALUE***" ], "datadirectory": "***REMOVED SENSITIVE VALUE***", "overwrite.cli.url": "***REMOVED SENSITIVE VALUE***", "dbtype": "mysql", "version": "13.0.6.1", "dbname": "***REMOVED SENSITIVE VALUE***", "dbhost": "***REMOVED SENSITIVE VALUE***", "dbport": "", "dbtableprefix": "oc_", "dbuser": "***REMOVED SENSITIVE VALUE***", "dbpassword": "***REMOVED SENSITIVE VALUE***", "installed": true, "mail_from_address": "***REMOVED SENSITIVE VALUE***", "mail_smtpmode": "php", "mail_smtpauthtype": "LOGIN", "mail_domain": "***REMOVED SENSITIVE VALUE***", "theme": "", "loglevel": 0, "maintenance": false, "session_lifetime": 3600, "session_keepalive": true, "apps_paths": [ { "path": "\/usr\/local\/www\/nextcloud\/apps", "url": "\/apps", "writable": true }, { "path": "\/usr\/local\/www\/nextcloud\/apps-pkg", "url": "\/apps-pkg", "writable": false } ], "user_backends": [ { "class": "OC_User_IMAP", "arguments": [ "{server:993\/imap\/ssl\/novalidate-cert}" ] } ], "updater.secret": "***REMOVED SENSITIVE VALUE***" } }

Are you using external storage, if yes which one: NONE

Are you using encryption: no

Are you using an external user-backend, if yes which one: OC_User_IMAP

Client configuration

Browser: Firefox, Chrome

Operating system: Linux, Windows

Logs

Web server error log

Web server error log

[Sat Sep 08 15:24:26.306389 2018] [authz_core:error] [pid 41778] [client CLIENT_IP:41192] AH01630: client denied by server configuration: /usr/local/www/nextcloud/data/.ocdata [Sat Sep 08 15:43:46.530126 2018] [authz_core:error] [pid 71617] [client CLIENT_IP:42956] AH01630: client denied by server configuration: /usr/local/www/nextcloud/data/.ocdata

Nextcloud log (data/nextcloud.log)

Nextcloud log

[nextcloud.log](https://github.com/nextcloud/server/files/2363378/nextcloud.log)

Browser log

Browser log

Navigated to https://fqdn.net/nextcloud/index.php/login?redirect_url=/nextcloud/index.php/apps/files/%3Fdir%3D/Eln%25C3%25B6ks%25C3%25A9g/Ki%25C3%25A1ll%25C3%25ADt%25C3%25A1sok/2018%2520Orsz%25C3%25A1gos%2520Ki%25C3%25A1ll%25C3%25ADt%25C3%25A1s%26fileid%3D1705
Content Security Policy: Directive ‘child-src’ has been deprecated. Please use directive ‘worker-src’ to control workers, or directive ‘frame-src’ to control frames respectively.
JQMIGRATE: Migrate is installed, version 1.4.0 core.js:7:542
window.controllers/Controllers is deprecated. Do not use it for UA detection. merged.js:2171
Source map error: TypeError: NetworkError when attempting to fetch resource.
Resource URL: https://fqdn.net.hu/nextcloud/core/vendor/core.js?v=97481833-10
Source Map URL: purify.min.js.map[Learn More]
Shutting down notifications: [401] Unauthorized merged.js:285:5
_onFetchError
https://fqdn.net/nextcloud/index.php/js/notifications/merged.js:285:5
j
https://fqdn.net/nextcloud/core/vendor/core.js:2:26920
fireWith
https://fqdn.net/nextcloud/core/vendor/core.js:2:27738
x
https://fqdn.net/nextcloud/core/vendor/core.js:4:11276
b/<
https://fqdn.net/nextcloud/core/vendor/core.js:4:14765
Navigated to https://fqdn.net/nextcloud/index.php/apps/files/?dir=/Eln%C3%B6ks%C3%A9g/Ki%C3%A1ll%C3%ADt%C3%A1sok/2018%20Orsz%C3%A1gos%20Ki%C3%A1ll%C3%ADt%C3%A1s&fileid=1705

[nextcloud-bot]

GitMate.io thinks possibly related issues are nextcloud/server#5566 (Error when adding external user), nextcloud/server#3132 (User backend OC_User_IMAP already initialized), nextcloud/server#5079 (Frequent File Locking with External Storage), nextcloud/server#2158 (LDAP-Users can't use external storage), and nextcloud/server#3723 (Auth - Session).

[kienanstewart]

I am also experiencing similar issues (nextcloud 13.0.5 and 14.0.3) w/ PHP 7.0.30 on debian stretch

[gatoth]

I upgraded to NextCloud 14.0.3 and PHP 7.2.11 and still experiencing the same.

[kienanstewart]

In the end we discovered it was the session cleaning settings in our PHP configuration. We were using a 1/100 requests start session cleaning (and sessions shouldn't last more than 3600s). By disabling it we stopped having random log outs. It's worth trying to tweak it to something less frequent.

[ediazcomellas]

We have been struggling with this issue for several weeks. We disabled garbage collection, session expiration and everything else with no effect: 5 minutes after login, you were redirected to login again. We are authenticating using IMAP-SSL

We have tested with PHP as an Apache module, FPM, versions from 7.0 to 7.3. No difference. Same problem a few minutes after login.

So after several sessions of debug, we found lib/private/User/Session.php, line 680: function checkToken:

680 private function checkTokenCredentials(IToken $dbToken, $token) {
681 // Check whether login credentials are still valid and the user was not disabled
682 // This check is performed each 5 minutes
683 $lastCheck = $dbToken->getLastCheck() ? : 0;
684 $now = $this->timeFactory->getTime();
685 if ($lastCheck > ($now - 60 * 5)) {
686 // Checked performed recently, nothing to do now
687 return true;
688 }
689
690 try {
691 $pwd = $this->tokenProvider->getPassword($dbToken, $token);
692 } catch (InvalidTokenException $ex) {
693 // An invalid token password was used -> log user out
694 return false;
695 } catch (PasswordlessTokenException $ex) {
696 // Token has no password
697
698 if (!is_null($this->activeUser) && !$this->activeUser->isEnabled()) {
699 $this->tokenProvider->invalidateToken($token);
700 return false;
701 }
702
703 $dbToken->setLastCheck($now);
704 return true;
705 }

Nextcloud is checking the password again after 5 minutes. Unfortunately, external_user must be missing something here, and the test always fails. As a result, the token is invalidated and the session must start again.

As a mitigation (in order to avoid user's rage) we have changed the time to 5000 minutes:

685 if ($lastCheck > ($now - 60 * 5000)) {

This is something we would rather don't do, as it opens the door to unsynced password problems.

Can anyone check why the external_user app is failing this check?

Best regards.

[kesselb]

Moved this issue to the right repository. Is this still relevant?

[violoncelloCH]

this looks the same as #70
@kienanstewart interesting that the issue disappeared for you when changing php session settings?

@ediazcomellas as you have debugged this issue: how are you sure this issue is on the side of the user external app? could you hop through the steps with a debugger and check what is going wrong when password check is triggered from checkTokenCredentials() rather than when logging in?

[ediazcomellas]

We still had some issues (not so often, but from time to time). We finally changed the auth backend to LDAP and everything was fixed.

[Mannshoch]

Could that be the source if downloading huge files (download time greater than 5min) in Nextcloud app is not working?

[violoncelloCH]

@Mannshoch if you don't get the "auto" logout then this is probably an other issue with your webserver configuration. Please check your php timeouts etc.