Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

bug(ci): Samba Kerberos SSO tests failing since 2026-05-30 due to unpinned Docker images

Open Beginner friendly
  • Is something wrong?
#60,892 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
78/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Quiet
Tech stack
docker
Domain
ci-cd

Research direction

Start with .github/workflows/files-external-smb-kerberos.yml and compare its image references with the digest-pinned images in other workflows. Check the three Samba test image pulls and the last passing and first failing commits to determine the image digests to pin. Done means the workflow uses digest-pinned images and the Samba Kerberos SSO CI check passes.

Written by the indexing model from the issue text.

Description

Summary

The Samba Kerberos SSO CI check has been failing on every master merge since 2026-05-30. The failure is not caused by any code change — no DAV, authentication, or SSO-related files changed in the window where it broke.

Failure

Checking that we can authenticate using kerberos: ✔️
Getting test file: ❌
<?xml version="1.0" encoding="utf-8"?>
<d:error xmlns:d="DAV:" xmlns:s="http://sabredav.org/ns">
  <s:exception>Sabre\DAV\Exception\NotAuthenticated</s:exception>
  <s:message>No 'Authorization: Basic' header found. Either the client didn't send one, or the server is misconfigured.
  No 'Authorization: Bearer' header found. Either the client didn't send one, or the server is misconfigured.</s:message>
</d:error>

Kerberos ticket acquisition succeeds, but the subsequent WebDAV request fails — the server is not accepting the Negotiate authorization header.

Root cause

The workflow pulls all three test images by floating tag with no digest pin:

docker pull ghcr.io/icewind1991/samba-krb-test-dc
docker pull ghcr.io/icewind1991/samba-krb-test-apache-gssapi:8.4
docker pull ghcr.io/icewind1991/samba-krb-test-client

One of these (most likely samba-krb-test-apache-gssapi:8.4 given the GSSAPI/WebDAV auth failure) was updated around 2026-05-29/30 and broke the test environment.

Last passing run: commit 04668560 (2026-05-29 03:21 UTC)
First failing run: commit b064def8 (2026-05-30 03:18 UTC)
No relevant code changes merged between those two commits.

Fix

Pin the images by digest in .github/workflows/files-external-smb-kerberos.yml, the same way other workflows pin their images (e.g. localstack/localstack@sha256:...).

cc @icewind1991 — these are your images, could you check if samba-krb-test-apache-gssapi:8.4 (or one of the others) was updated recently in a way that would break GSSAPI auth against Nextcloud's WebDAV endpoint?

Dominant language
PHP
Stars
36.9k
Forks
5.2k
Avg merge
2d 5h
Merged PRs (30d)
735

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from nextcloud/server

All issues in nextcloud/server

Similar issues

More PHP issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.