Frequent session timeouts when using External users (OC_User_IMAP) #101
Comments
|
GitMate.io thinks possibly related issues are nextcloud/server#5566 (Error when adding external user), nextcloud/server#3132 (User backend OC_User_IMAP already initialized), nextcloud/server#5079 (Frequent File Locking with External Storage), nextcloud/server#2158 (LDAP-Users can't use external storage), and nextcloud/server#3723 (Auth - Session). |
|
I am also experiencing similar issues (nextcloud 13.0.5 and 14.0.3) w/ PHP 7.0.30 on debian stretch |
|
I upgraded to NextCloud 14.0.3 and PHP 7.2.11 and still experiencing the same. |
|
In the end we discovered it was the session cleaning settings in our PHP configuration. We were using a 1/100 requests start session cleaning (and sessions shouldn't last more than 3600s). By disabling it we stopped having random log outs. It's worth trying to tweak it to something less frequent. |
|
We have been struggling with this issue for several weeks. We disabled garbage collection, session expiration and everything else with no effect: 5 minutes after login, you were redirected to login again. We are authenticating using IMAP-SSL We have tested with PHP as an Apache module, FPM, versions from 7.0 to 7.3. No difference. Same problem a few minutes after login. So after several sessions of debug, we found lib/private/User/Session.php, line 680: function checkToken: 680 private function checkTokenCredentials(IToken $dbToken, $token) { Nextcloud is checking the password again after 5 minutes. Unfortunately, external_user must be missing something here, and the test always fails. As a result, the token is invalidated and the session must start again. As a mitigation (in order to avoid user's rage) we have changed the time to 5000 minutes: 685 if ($lastCheck > ($now - 60 * 5000)) { This is something we would rather don't do, as it opens the door to unsynced password problems. Can anyone check why the external_user app is failing this check? Best regards. |
|
Moved this issue to the right repository. Is this still relevant? |
kesselb
added
0. Needs triage
bug
|
this looks the same as #70 @ediazcomellas as you have debugged this issue: how are you sure this issue is on the side of the user external app? could you hop through the steps with a debugger and check what is going wrong when password check is triggered from |
|
We still had some issues (not so often, but from time to time). We finally changed the auth backend to LDAP and everything was fixed. |
|
Could that be the source if downloading huge files (download time greater than 5min) in Nextcloud app is not working? |
|
@Mannshoch if you don't get the "auto" logout then this is probably an other issue with your webserver configuration. Please check your php timeouts etc. |
|
since I updated from 5.0.1 to 9 I have also this issue. I today had a talk with nextcloud talk with measuring the time. After 5 minutes the session got killed and nextcloud changed to the login screen. |
|
e.g. The Thunderbird addon Cardbook seems not able to save the password. I'm not sure why it is not able to use the already saved password. |
|
Finally got annoyed enough at the frequent logouts that I tracked down the root of the problem... There's a thorough description of the bug (design flaw in the nextcloud app loading logic), in nextcloud/server#20756, and I've issued a pull-request with the fix nextcloud/server#20757. As mentioned in the issue description, it may be possible for user_external to work around the bug, but it would be a bit of a hack, and I'd have to make sure it didn't break anything important before I'd submit a pull here... I could provide a backport pull to stable18 too if there's interest, but it's easy enough to apply the patch (OC_App.php used be called app.php). |
|
I'm interested in a backport for 18. My Nextcloud I'm responsible for is actually on 17. I plan an upgrade in the next weeks. Would be nice If it works directly after upgrading. |
|
cool @sshambar ! |
|
OK, I'll wait for feedback... BTW, a solid workaround for the logout issue is to set the password for the nextcloud user to the same as the external authentication (if you know the password). If the passwords match, the user will be accepted as a DB user, not a user_external one (and won't be logged out at token validation time). Alternatively, if the passwords differ, but you login with the DB password, you also won't be logged out... |
|
Just an FYI: I was getting random logouts when I turned caching off during my testing, and tracked the problem to memcached session locking occasionally failing (which triggers a logout)... I fixed it with the following in php.ini: [memcached] memcached.sess_lock_retries = 50; If you're getting hit by logouts, this could be another cause :) |
|
php.ini is ReadOnly for me but I can say that I do not have any [memcached] entries in it. |
|
Ah, thought it was clear that this only affects sessions that use memcached... basically, if you don't have: session.save_handler = memcached in your php.ini/php.d then this won't affect you. I can only reproduce the memcached problem when I turn off my browser cache (simulating the first time a user loads nextcloud), and it's just triggered by the sheer number of connections nextcloud makes on that initial login page load (all of which try to load the session from memcached)... people kept saying they'd log in and be immediately logged out, and this was the cause (unrelated to any bugs in user_external). Just thought I'd mention it in case someone came here when dealing with random logouts... |
|
BTW, an update from the pull request, I've update the patch to solve the session timeouts a different way (there was concerns about skipping any user validation in the first patch). Also, there's also another, simpler workaround... since this bug only impacts users who appear in both oc_users and oc_users_external with the same userid, one of the nextcloud devs suggested that deleting the user from oc_users would solve the problem (and it does indeed work, I even deleted the admin user and things still worked fine with users just in oc_users_external). The only drawback is that there's no "fallback" login if user_external is disabled (of course, users can be added back to the oc_users table easily enough, but passwords would have to be reset). Yet another solution would be temporarily changing the userids in oc_users (adding a prefix like "disabled-"), which would be easily reversible and keep the original password. Realistically, users_external probably should have been written to use a unique userid from day one -- as the other login apps do -- but adding it now would require some migration magic (basically, a userid migration on login or upgrade, but I've no idea how that could be done reliably...). Of course, combining the above would provide a true fix in user_external... which could simply check if the userid exists in oc_users, and if so change that userid to have a prefix/postfix (or other mapping), so that db users will never match user_external users -- and reverse it when the app is disabled. If there's interest, I'd be willing to offer a patch...(don't think it'd be difficult). |
|
May a bit to much and may against my wish for a fast fix but I link this Enhancement Request. |
|
Just checking... is this the issue that may be responsible for our users getting logged out after we upgraded from 16.x to 18.x? I got a bit confused by #101 (comment)
So just to double check: that was an old assumption right? It is no longer valid? The current fix is to upgrade to 19.0.0? |
|
Oh, not in 19.0.0 it seems. |
|
I've applied the patch to 18.x. Let's see how it goes. This is what I did (in the nextcloud root directory): |
|
How is the current state? |
|
It's not clear to me if if we still have the same issue. We only recently upgraded away from v18 when it went EOL. We're now on 20.0.7. The patch can still apply cleanly but I don't know if it is needed. My first indication was that we are not seeing the timeouts anymore (without patch)... but i could be wrong. And you? Do you still have the issue? With what nextcloud version? Maybe worth testing v20? I see your comments in #70 were tagged as spam. But I presume for this issue they are valid questions... |
|
I'm also on 20.0.7 I did not install any patch. I still have the problem, that I have to accept the Nextcloud-client on every restart in the browser. I only have this Problem on the Nextcloud that use IMAP to check valid user. Other Nextcloud do not have that problem, once approved it works for ever. |
|
Right, so you have the Windows(?) client and after a computer restart it asks you to open a browser, login and "grant access"? I am using 3.1.2 on Windows myself with a 20.0.7 server, now with the patch applied (did so an hour ago, figured why not). Cannot reproduce the issue. Not sure if these issues and the patch are related though. Like I said, i thought they were more related to the webinterface if you were >5m idle. |
|
I use Ubuntu and Nextcloud 3.1.2 also. |
|
@Mannshoch we now have multiple reports with the same problem that you describe. After a reboot the nextcloud client asks to "grant access" via the browser again, next reboot the same, etc etc. |
|
May an interesting symptom. The first link the nextcloud-client open in Browser do not work. I get a Token error |
|
```
{"reqId":"YC1xrhf1cRoHe@SQS-9F6QAAAAs","level":0,"time":"2021.02.17, 20:42:38","remoteAddr":"xxx.xxx.xxx.xxx","user":"--","app":"no app in context","method":"PROPFIND","url":"/remote.php/dav/addressbooks/users/USER@DOMAIN.COM/Presse_shared_by_cloud/","message":{"Exception":"OC\Authentication\Exceptions\InvalidTokenException","Message":"Token does not exist","Code":0,"Trace":[{"file":"/NEXTCLOUD/lib/private/Authentication/Token/Manager.php","line":147,"function":"getToken","class":"OC\Authentication\Token\DefaultTokenProvider","type":"->","args":["*** sensitive parameters replaced "]},{"file":"/NEXTCLOUD/lib/private/User/Session.php","line":532,"function":"getToken","class":"OC\Authentication\Token\Manager","type":"->","args":[" sensitive parameters replaced "]},{"file":"/NEXTCLOUD/lib/private/User/Session.php","line":448,"function":"isTokenPassword","class":"OC\User\Session","type":"->","args":[" sensitive parameters replaced "]},{"file":"/NEXTCLOUD/apps/dav/lib/Connector/Sabre/Auth.php","line":131,"function":"logClientIn","class":"OC\User\Session","type":"->","args":[" sensitive parameters replaced "]},{"file":"/NEXTCLOUD/3rdparty/sabre/dav/lib/DAV/Auth/Backend/AbstractBasic.php","line":106,"function":"validateUserPass","class":"OCA\DAV\Connector\Sabre\Auth","type":"->","args":[" sensitive parameters replaced "]},{"file":"/NEXTCLOUD/apps/dav/lib/Connector/Sabre/Auth.php","line":254,"function":"check","class":"Sabre\DAV\Auth\Backend\AbstractBasic","type":"->","args":[{"class":"Sabre\HTTP\Request"},{"class":"Sabre\HTTP\Response"}]},{"file":"/NEXTCLOUD/apps/dav/lib/Connector/Sabre/Auth.php","line":156,"function":"auth","class":"OCA\DAV\Connector\Sabre\Auth","type":"->","args":[{"class":"Sabre\HTTP\Request"},{"class":"Sabre\HTTP\Response"}]},{"file":"/NEXTCLOUD/3rdparty/sabre/dav/lib/DAV/Auth/Plugin.php","line":192,"function":"check","class":"OCA\DAV\Connector\Sabre\Auth","type":"->","args":[{"class":"Sabre\HTTP\Request"},{"class":"Sabre\HTTP\Response"}]},{"file":"/NEXTCLOUD/3rdparty/sabre/dav/lib/DAV/Auth/Plugin.php","line":144,"function":"check","class":"Sabre\DAV\Auth\Plugin","type":"->","args":[{"class":"Sabre\HTTP\Request"},{"class":"Sabre\HTTP\Response"}]},{"file":"/NEXTCLOUD/3rdparty/sabre/event/lib/WildcardEmitterTrait.php","line":89,"function":"beforeMethod","class":"Sabre\DAV\Auth\Plugin","type":"->","args":[{"class":"Sabre\HTTP\Request"},{"class":"Sabre\HTTP\Response"}]},{"file":"/NEXTCLOUD/3rdparty/sabre/dav/lib/DAV/Server.php","line":458,"function":"emit","class":"Sabre\DAV\Server","type":"->","args":["beforeMethod:PROPFIND",[{"class":"Sabre\HTTP\Request"},{"class":"Sabre\HTTP\Response"}]]},{"file":"/NEXTCLOUD/3rdparty/sabre/dav/lib/DAV/Server.php","line":251,"function":"invokeMethod","class":"Sabre\DAV\Server","type":"->","args":[{"class":"Sabre\HTTP\Request"},{"class":"Sabre\HTTP\Response"}]},{"file":"/NEXTCLOUD/3rdparty/sabre/dav/lib/DAV/Server.php","line":319,"function":"start","class":"Sabre\DAV\Server","type":"->","args":[]},{"file":"/NEXTCLOUD/apps/dav/lib/Server.php","line":332,"function":"exec","class":"Sabre\DAV\Server","type":"->","args":[]},{"file":"/NEXTCLOUD/apps/dav/appinfo/v2/remote.php","line":35,"function":"exec","class":"OCA\DAV\Server","type":"->","args":[]},{"file":"/NEXTCLOUD/remote.php","line":167,"args":["/NEXTCLOUD/apps/dav/appinfo/v2/remote.php"],"function":"require_once"}],"File":"/NEXTCLOUD/lib/private/Authentication/Token/DefaultTokenProvider.php","Line":160,"Previous":{"Exception":"OCP\AppFramework\Db\DoesNotExistException","Message":"token does not exist","Code":0,"Trace":[{"file":"/NEXTCLOUD/lib/private/Authentication/Token/DefaultTokenProvider.php","line":158,"function":"getToken","class":"OC\Authentication\Token\DefaultTokenMapper","type":"->","args":[" sensitive parameters replaced "]},{"file":"/NEXTCLOUD/lib/private/Authentication/Token/Manager.php","line":147,"function":"getToken","class":"OC\Authentication\Token\DefaultTokenProvider","type":"->","args":[" sensitive parameters replaced "]},{"file":"/NEXTCLOUD/lib/private/User/Session.php","line":532,"function":"getToken","class":"OC\Authentication\Token\Manager","type":"->","args":[" sensitive parameters replaced "]},{"file":"/NEXTCLOUD/lib/private/User/Session.php","line":448,"function":"isTokenPassword","class":"OC\User\Session","type":"->","args":[" sensitive parameters replaced "]},{"file":"/NEXTCLOUD/apps/dav/lib/Connector/Sabre/Auth.php","line":131,"function":"logClientIn","class":"OC\User\Session","type":"->","args":[" sensitive parameters replaced "]},{"file":"/NEXTCLOUD/3rdparty/sabre/dav/lib/DAV/Auth/Backend/AbstractBasic.php","line":106,"function":"validateUserPass","class":"OCA\DAV\Connector\Sabre\Auth","type":"->","args":[" sensitive parameters replaced "]},{"file":"/NEXTCLOUD/apps/dav/lib/Connector/Sabre/Auth.php","line":254,"function":"check","class":"Sabre\DAV\Auth\Backend\AbstractBasic","type":"->","args":[{"class":"Sabre\HTTP\Request"},{"class":"Sabre\HTTP\Response"}]},{"file":"/NEXTCLOUD/apps/dav/lib/Connector/Sabre/Auth.php","line":156,"function":"auth","class":"OCA\DAV\Connector\Sabre\Auth","type":"->","args":[{"class":"Sabre\HTTP\Request"},{"class":"Sabre\HTTP\Response"}]},{"file":"/NEXTCLOUD/3rdparty/sabre/dav/lib/DAV/Auth/Plugin.php","line":192,"function":"check","class":"OCA\DAV\Connector\Sabre\Auth","type":"->","args":[{"class":"Sabre\HTTP\Request"},{"class":"Sabre\HTTP\Response"}]},{"file":"/NEXTCLOUD/3rdparty/sabre/dav/lib/DAV/Auth/Plugin.php","line":144,"function":"check","class":"Sabre\DAV\Auth\Plugin","type":"->","args":[{"class":"Sabre\HTTP\Request"},{"class":"Sabre\HTTP\Response"}]},{"file":"/NEXTCLOUD/3rdparty/sabre/event/lib/WildcardEmitterTrait.php","line":89,"function":"beforeMethod","class":"Sabre\DAV\Auth\Plugin","type":"->","args":[{"class":"Sabre\HTTP\Request"},{"class":"Sabre\HTTP\Response"}]},{"file":"/NEXTCLOUD/3rdparty/sabre/dav/lib/DAV/Server.php","line":458,"function":"emit","class":"Sabre\DAV\Server","type":"->","args":["beforeMethod:PROPFIND",[{"class":"Sabre\HTTP\Request"},{"class":"Sabre\HTTP\Response"}]]},{"file":"/NEXTCLOUD/3rdparty/sabre/dav/lib/DAV/Server.php","line":251,"function":"invokeMethod","class":"Sabre\DAV\Server","type":"->","args":[{"class":"Sabre\HTTP\Request"},{"class":"Sabre\HTTP\Response"}]},{"file":"/NEXTCLOUD/3rdparty/sabre/dav/lib/DAV/Server.php","line":319,"function":"start","class":"Sabre\DAV\Server","type":"->","args":[]},{"file":"/NEXTCLOUD/apps/dav/lib/Server.php","line":332,"function":"exec","class":"Sabre\DAV\Server","type":"->","args":[]},{"file":"/NEXTCLOUD/apps/dav/appinfo/v2/remote.php","line":35,"function":"exec","class":"OCA\DAV\Server","type":"->","args":[]},{"file":"/NEXTCLOUD/remote.php","line":167,"args":["/NEXTCLOUD/apps/dav/appinfo/v2/remote.php"],"function":"require_once"}],"File":"/NEXTCLOUD/lib/private/Authentication/Token/DefaultTokenMapper.php","Line":91},"CustomMessage":"Token is not valid: Token does not exist"},"userAgent":"DAVx5/3.3.8-ose (2021/01/13; dav4jvm; okhttp/4.9.0) Android/9","version":"20.0.7.1"} |
|
The users who reported the problem(s) earlier are saying everything is fine now. I ensured they are really on 3.1.2 (Windows) and that they logged in. They both rebooted and did not have to relogin. So I'm done with this for now, if it changes i will let you know. As always, user reports were/are vague, it's better to have someone who experiences the problem first hand, like you. |
|
@sshambar If anybody still cares, the exact same problem still exists in NextCloud 23. And the patch also applies successfully, and fixes the issue right away. I wonder why it's not applied to the whole project yet. |
|
I care....because i've been having the same issue in 27.1.4 and it's driving a couple of us nuts! |
|
@ediazcomellas is right, the problem is still the incorrect revalidation of the user in user_external. In NextCloud, this timer is hard-coded to 5 minutes and can therefore only be changed directly in the file: Whereas in OwnCloud this value can be adjusted via the database. Since the database entry was missing in my OwnCloud, I simply had to/was able to add it: This way, the user (who is authenticated via user_external) is logged out hard after 8 hours (480 minutes). |
Steps to reproduce
'user_backends' =>
array (
0 =>
array (
'class' => 'OC_User_IMAP',
'arguments' =>
array (
0 => '{:993/imap/ssl/novalidate-cert}',
),
),
),
Expected behaviour
Session should not expire while user is active, regardless if user is backed by IMAP.
Actual behaviour
Session expires for IMAP users after 5 minutes, even if they are being active all the time.
Server configuration
Operating system: FreeBSD 11.2
Web server: Apache 2.4.34
Database: mysql 5.6.41
PHP version: 5.6.37
Nextcloud version: 13.0.6
Updated from an older Nextcloud/ownCloud or fresh install: Updated from 13.0.4 (freshly installed 13.0.4 had the same behaviour)
Where did you install Nextcloud from: Downloaded from nextcloud.com, updated with built-in updater.
Signing status:
Signing status
No errors have been found.
List of activated apps:
App list
The process control (PCNTL) extensions are required in case you want to interrupt long running commands - see http://php.net/manual/en/book.pcntl.php Enabled: - activity: 2.6.1 - calendar: 1.6.1 - comments: 1.3.0 - contacts: 2.1.5 - dav: 1.4.7 - federatedfilesharing: 1.3.1 - files: 1.8.0 - files_external: 1.4.1 - files_pdfviewer: 1.2.1 - files_sharing: 1.5.0 - files_texteditor: 2.5.1 - files_trashbin: 1.3.0 - files_versions: 1.6.0 - files_videoplayer: 1.2.0 - gallery: 18.0.0 - groupfolders: 1.3.3 - logreader: 2.0.0 - lookup_server_connector: 1.1.0 - nextcloud_announcements: 1.2.0 - notes: 2.4.1 - notifications: 2.1.2 - oauth2: 1.1.1 - password_policy: 1.3.0 - polls: 0.8.3 - provisioning_api: 1.3.0 - serverinfo: 1.3.0 - survey_client: 1.1.0 - systemtags: 1.3.0 - tasks: 0.9.7 - theming: 1.4.5 - twofactor_backupcodes: 1.2.3 - updatenotification: 1.3.0 - user_external: 0.4 - workflowengine: 1.3.0 Disabled: - admin_audit - bruteforcesettings - deck - encryption - federation - files_fulltextsearch - firstrunwizard - fulltextsearch - impersonate - mail - ojsxc - rainloop - ransomware_protection - sharebymail - spreed - unsplash - user_ldapNextcloud configuration:
Config report
The process control (PCNTL) extensions are required in case you want to interrupt long running commands - see http://php.net/manual/en/book.pcntl.php { "system": { "instanceid": "***REMOVED SENSITIVE VALUE***", "passwordsalt": "***REMOVED SENSITIVE VALUE***", "secret": "***REMOVED SENSITIVE VALUE***", "trusted_domains": [ "***REMOVED SENSITIVE VALUE***" ], "datadirectory": "***REMOVED SENSITIVE VALUE***", "overwrite.cli.url": "***REMOVED SENSITIVE VALUE***", "dbtype": "mysql", "version": "13.0.6.1", "dbname": "***REMOVED SENSITIVE VALUE***", "dbhost": "***REMOVED SENSITIVE VALUE***", "dbport": "", "dbtableprefix": "oc_", "dbuser": "***REMOVED SENSITIVE VALUE***", "dbpassword": "***REMOVED SENSITIVE VALUE***", "installed": true, "mail_from_address": "***REMOVED SENSITIVE VALUE***", "mail_smtpmode": "php", "mail_smtpauthtype": "LOGIN", "mail_domain": "***REMOVED SENSITIVE VALUE***", "theme": "", "loglevel": 0, "maintenance": false, "session_lifetime": 3600, "session_keepalive": true, "apps_paths": [ { "path": "\/usr\/local\/www\/nextcloud\/apps", "url": "\/apps", "writable": true }, { "path": "\/usr\/local\/www\/nextcloud\/apps-pkg", "url": "\/apps-pkg", "writable": false } ], "user_backends": [ { "class": "OC_User_IMAP", "arguments": [ "{server:993\/imap\/ssl\/novalidate-cert}" ] } ], "updater.secret": "***REMOVED SENSITIVE VALUE***" } }Are you using external storage, if yes which one: NONE
Are you using encryption: no
Are you using an external user-backend, if yes which one: OC_User_IMAP
Client configuration
Browser: Firefox, Chrome
Operating system: Linux, Windows
Logs
Web server error log
Web server error log
[Sat Sep 08 15:24:26.306389 2018] [authz_core:error] [pid 41778] [client CLIENT_IP:41192] AH01630: client denied by server configuration: /usr/local/www/nextcloud/data/.ocdata [Sat Sep 08 15:43:46.530126 2018] [authz_core:error] [pid 71617] [client CLIENT_IP:42956] AH01630: client denied by server configuration: /usr/local/www/nextcloud/data/.ocdataNextcloud log (data/nextcloud.log)
Nextcloud log
[nextcloud.log](https://github.com/nextcloud/server/files/2363378/nextcloud.log)Browser log
Browser log
Navigated to https://fqdn.net/nextcloud/index.php/login?redirect_url=/nextcloud/index.php/apps/files/%3Fdir%3D/Eln%25C3%25B6ks%25C3%25A9g/Ki%25C3%25A1ll%25C3%25ADt%25C3%25A1sok/2018%2520Orsz%25C3%25A1gos%2520Ki%25C3%25A1ll%25C3%25ADt%25C3%25A1s%26fileid%3D1705
Content Security Policy: Directive ‘child-src’ has been deprecated. Please use directive ‘worker-src’ to control workers, or directive ‘frame-src’ to control frames respectively.
JQMIGRATE: Migrate is installed, version 1.4.0 core.js:7:542
window.controllers/Controllers is deprecated. Do not use it for UA detection. merged.js:2171
Source map error: TypeError: NetworkError when attempting to fetch resource.
Resource URL: https://fqdn.net.hu/nextcloud/core/vendor/core.js?v=97481833-10
Source Map URL: purify.min.js.map[Learn More]
Shutting down notifications: [401] Unauthorized merged.js:285:5
_onFetchError
https://fqdn.net/nextcloud/index.php/js/notifications/merged.js:285:5
j
https://fqdn.net/nextcloud/core/vendor/core.js:2:26920
fireWith
https://fqdn.net/nextcloud/core/vendor/core.js:2:27738
x
https://fqdn.net/nextcloud/core/vendor/core.js:4:11276
b/<
https://fqdn.net/nextcloud/core/vendor/core.js:4:14765
Navigated to https://fqdn.net/nextcloud/index.php/apps/files/?dir=/Eln%C3%B6ks%C3%A9g/Ki%C3%A1ll%C3%ADt%C3%A1sok/2018%20Orsz%C3%A1gos%20Ki%C3%A1ll%C3%ADt%C3%A1s&fileid=1705
The text was updated successfully, but these errors were encountered: