`nextcloud:32` (Trixie/Debian 13 base) — Guzzle/libcurl returns HTTP 404 for Microsoft Entra OIDC discovery URL; PHP stream wrapper returns 200 from same container
还没有人认领这个 Issue。
评估
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 新手友好度
- 38/100
- Issue 类型
- 缺陷
- 描述清晰度
- 基本清楚
- 活跃度
- 冷清
- 技术栈
- docker, php
调研方向
从基于 php:8.3-apache-trixie 的官方 nextcloud:31/32 Dockerfile 开始，并在容器内复现对 Microsoft Entra discovery URL 的 curl 请求。将该结果与 PHP file_get_contents 和 Docker 主机上的结果进行比较，然后确定 image/libcurl 交互是否是导致问题的原因，以及哪种经过验证的修复措施能够解决 OIDC 失败问题。
由索引模型根据 Issue 内容生成。
描述
Summary
On a clean install of Nextcloud 32 using the official nextcloud:32-apache Docker image, the user_oidc app cannot reach the Microsoft Entra OIDC discovery endpoint. Nextcloud logs a GuzzleHttp\Exception\ClientException with 404 NotFound. The same URL returns HTTP 200 when fetched by PHP's stream wrapper (file_get_contents) from inside the same container, and from the Docker host using curl. The failure is isolated to the libcurl path inside the container.
Environment
| Component | Version |
|---|---|
| Nextcloud | 31.0.14.1 (image nextcloud:31, which resolves to this) |
| Docker image base | php:8.3-apache-trixie (Debian 13 — pre-release) |
| PHP | 8.3.30 |
| libcurl | 8.14.1 |
| OpenSSL | 3.5.5 (27 Jan 2026) |
| user_oidc app | v8.7.0 |
| Host OS | Ubuntu (Debian 12 / Bookworm-based) |
| Host libcurl | Stable Bookworm build |
| Identity provider | Microsoft Entra ID (Azure AD) |
Note: the nextcloud:32 Dockerfile at the time of writing also uses FROM php:8.3-apache-trixie, so this affects NC32 as well.
Discovery URL being fetched
https://login.microsoftonline.com/{tenant-id}/v2.0/.well-known/openid-configuration
URL is correct per Microsoft OIDC documentation.
Evidence
# curl from inside nextcloud_app container
docker exec nextcloud_app curl -4 -sS -D - https://login.microsoftonline.com/{tenant}/v2.0/.well-known/openid-configuration
HTTP/2 404
# same result with --tlsv1.2 and --http1.1
# PHP file_get_contents from inside nextcloud_app container
# (script transferred via base64, executed with docker exec)
HTTP/1.1 200 OK
{"token_endpoint":"https://login.microsoftonline.com/...","...": "..."}
# curl from Docker host (Debian 12 Bookworm)
HTTP/2 200
Nextcloud application log entry:
{"app":"user_oidc","message":"Could not reach the provider at URL https://login.microsoftonline.com/{tenant}/v2.0/.well-known/openid-configuration","exception":{"Exception":"GuzzleHttp\\Exception\\ClientException","Message":"Client error: `GET ...` resulted in a `404 NotFound` response"}}
What was ruled out
- TLS version:
--tlsv1.2still returns 404 - HTTP version:
--http1.1still returns 404 - Request headers: matching Nextcloud's User-Agent and Accept-Encoding on the host still returns 200
- NAT/egress IP: host and container share the same public IP — confirmed via
https://api.ipify.org - Entra registration: the discovery URL is correct and the Entra app is configured properly
- General container networking: DNS resolves, TLS handshake succeeds, other HTTPS endpoints work
Hypothesis
libcurl 8.14.1 on Debian 13 Trixie generates a TLS ClientHello that Microsoft's CDN/Front Door infrastructure responds to with 404, while stable libcurl builds (Debian 12 Bookworm) and PHP's stream wrapper do not trigger this response. This may be a curl regression, a Microsoft-side TLS fingerprint behaviour, or an interaction between the two.
Impact
Any user running nextcloud:31 or nextcloud:32 from the official Docker image who configures Microsoft Entra (Azure AD) OIDC authentication will find that OIDC login is silently broken on a clean install.
- 主要语言
- Shell
- 星标
- 7.4k
- 派生
- 1.9k
- PR 合并指标
- 30 天内没有已合并 PR
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
nextcloud/docker 的其他 Issue
-
1. To develop bug feature: cron image
难度 2/5 1-3 小时 新手友好度 68/100
-
难度 2/5 1-3 小时 新手友好度 70/100
-
bug docs
难度 1/5 1 小时以内 新手友好度 72/100
-
0. Needs triage bug
难度 4/5 3-5 天 新手友好度 35/100
-
Imagick architecture mismatch (x86_64 vs aarch64) on official arm64 image causes Apache segfaults未关闭0. Needs triage bug
难度 4/5 3-5 天 新手友好度 50/100
相似的 Issue
-
难度 1/5 1 小时以内 新手友好度 85/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 68/100
ajeetdsouza/zoxide#1323 ·
维护者通常 1 天内回复
-
e2e-failure ready-to-code
难度 2/5 1-3 小时 新手友好度 72/100
redhat-developer/rhdh-plugin-export-overlays#4391 · 1 条评论 ·
维护者通常 1 天内回复
-
documentation good first issue
难度 2/5 1-3 小时 新手友好度 72/100
graygarbage/HermesKey#20 ·
-
Version-drift constraint evaluator (#40): validate the candidate version and run its unit test in CI未关闭
难度 2/5 1-3 小时 新手友好度 78/100
n8n-io/terraform-google-n8n#41 ·
维护者通常 5 天内回复