[Bug]: SAML login fails behind reverse proxy when index.php is removed from the public URL

Aperta
  • Qualcosa non va?
#1,183 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
57/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Tranquilla
Stack tecnologico
php
Ambito
authentication

Direzione di ricerca

Inizia in user_saml/lib/Controller/SAMLController.php, nel flusso assertionConsumerService, e verifica come processResponse riceve l’URL della richiesta. Riproduci la configurazione del reverse proxy con index.php rimosso, quindi verifica che la validazione SAML utilizzi l’URL pubblico /apps/user_saml/saml/acs corrispondente a IdP Destination senza compromettere il ripristino della richiesta.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

0. Needs triage bug
⚠️ This issue respects the following points: ⚠️
Bug description

SAML authentication fails when Nextcloud is configured behind a reverse proxy that removes index.php from the public URL.
I have used

sudo nextcloud.occ config:system:set overwrite.cli.url --value="https://mydomain.com"

sudo nextcloud.occ config:system:set htaccess.RewriteBase --value="/"

The SAML response received from the IdP contains the correct Destination:
https://mydomain.com/apps/user_saml/saml/acs

However, onelogin/php-saml reconstructs the current URL from the internal PHP request and generates an incorrect URL:
https://mydomain.com/apps/user_saml/saml/index.phpacs

As a result, SAML validation fails with:

The response was received at
https://mydomain.com/apps/user_saml/saml/index.phpacs
instead of
https://mydomain.com/apps/user_saml/saml/acs

Please note the extra index.php in the first URL.

As a temporary workaround I have modified
/var/snap/nextcloud/ current /nextcloud/extra-apps/user_saml/lib/Controller/SAMLController.php

and replaced:

                $this->callWithXmlEntityLoader(function () use ($auth, $AuthNRequestID): void {
                        $auth->processResponse($AuthNRequestID);
                });

with

$oldRequestUri = $_SERVER['REQUEST_URI'] ?? null;

$_SERVER['REQUEST_URI'] = parse_url(
    $this->urlGenerator->linkToRouteAbsolute(
        'user_saml.SAML.assertionConsumerService'
    ),
    PHP_URL_PATH
);

try {
    $this->callWithXmlEntityLoader(function () use ($auth, $AuthNRequestID): void {
        $auth->processResponse($AuthNRequestID);
    });
} finally {
    if ($oldRequestUri !== null) {
        $_SERVER['REQUEST_URI'] = $oldRequestUri;
    }
}
Steps to reproduce

  1. Enable SAML

  2. Execute

sudo nextcloud.occ config:system:set overwrite.cli.url --value="https://mydomain.com"
sudo nextcloud.occ config:system:set htaccess.RewriteBase --value="/"

  1. Set up nginx rules to proxy_pass the missing public url index.php
location / {
    try_files $uri @nextcloud_index;

    proxy_pass http://127.0.0.1:9988;

    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto https;

    proxy_redirect off;
}

location @nextcloud_index {
    rewrite ^/(.*)$ /index.php/$1 break;

    proxy_pass http://127.0.0.1:9988;

    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto https;

    proxy_redirect off;
}
  1. SAML login fails with the referred error
Expected behavior

Normal SAML login

Nextcloud Server version

34

Operating system

Debian/Ubuntu

PHP engine version

No response

Web server

No response

Database engine version

No response

Is this bug present after an update or on a fresh install?

No response

Are you using the Nextcloud Server Encryption module?

No response

What user-backends are you using?
  • Default user-backend (database)
  • LDAP/ Active Directory
  • SSO - SAML
  • Other
Configuration report
List of activated Apps
Nextcloud Signing status
Nextcloud Logs
Additional info

No response

Lingua principale
PHP
Stelle
106
Fork
84
Merge medio
1g 11h
PR unite (30g)
14

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di nextcloud/user_saml

Tutte le issue di nextcloud/user_saml

Issue simili

Altre issue su PHP

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.