Cloudron makes it easy to run web apps like WordPress, Nextcloud, GitLab on your server. Find out more or install now.


Skip to content
  • Categories
  • Recent
  • Tags
  • Popular
  • Bookmarks
  • Search
Skins
  • Light
  • Cerulean
  • Cosmo
  • Flatly
  • Journal
  • Litera
  • Lumen
  • Lux
  • Materia
  • Minty
  • Morph
  • Pulse
  • Sandstone
  • Simplex
  • Sketchy
  • Spacelab
  • United
  • Yeti
  • Zephyr
  • Dark
  • Cyborg
  • Darkly
  • Quartz
  • Slate
  • Solar
  • Superhero
  • Vapor

  • Default (No Skin)
  • No Skin
Collapse
Brand Logo

Cloudron Forum

Apps | Demo | Docs | Install
  1. Cloudron Forum
  2. Nextcloud
  3. Nextcloud OIDC integration

Nextcloud OIDC integration

Scheduled Pinned Locked Moved Nextcloud
118 Posts 12 Posters 17.2k Views 11 Watching
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • nebulonN nebulon

    Do you have any nextcloud extension or other configs, which might have a blocklist or other security features added? If curl works, this must be some nextcloud code blocking the outgoing request?

    andreasduerenA Offline
    andreasduerenA Offline
    andreasdueren
    wrote on last edited by andreasdueren
    #51

    @nebulon Unlikely but I can check. This is a pretty fresh installation without any users or data. Don't remember setting anything up

    Edit: these are the installed apps now (I disabled a bunch but they were all standard apps)
    Screenshot 2025-02-01 at 09.51.41.png

    1 Reply Last reply
    0
    • andreasduerenA andreasdueren

      @andreasdueren Not that adding 127.0.1.1 to the proxies did the trick but rebooting the app will reset this section in the config file.

      J Offline
      J Offline
      joseph
      Staff
      wrote on last edited by
      #52

      @andreasdueren said in Nextcloud OIDC integration:

      @andreasdueren Not that adding 127.0.1.1 to the proxies did the trick but rebooting the app will reset this section in the config file.

      What proxy are you referring to here?

      andreasduerenA 1 Reply Last reply
      0
      • J joseph

        @andreasdueren said in Nextcloud OIDC integration:

        @andreasdueren Not that adding 127.0.1.1 to the proxies did the trick but rebooting the app will reset this section in the config file.

        What proxy are you referring to here?

        andreasduerenA Offline
        andreasduerenA Offline
        andreasdueren
        wrote on last edited by
        #53

        @Joseph In the config file:

          'trusted_proxies' => 
          array (
            0 => '172.18.0.1',
          ),
        
        1 Reply Last reply
        0
        • J Offline
          J Offline
          joseph
          Staff
          wrote on last edited by
          #54

          @andreasdueren can you tell me what made you add 127.0.1.1 ? Not sure what that IP is

          1 Reply Last reply
          0
          • andreasduerenA andreasdueren

            Just checked the logs (they are absolutely full):

            LocalServerException
            Host "127.0.1.1" (my.tld.onl:80) violates local access rules
            Could not reach the provider at URL https://my.tld.onl/openid/.well-known/openid-configuration
            
            andreasduerenA Offline
            andreasduerenA Offline
            andreasdueren
            wrote on last edited by
            #55

            @andreasdueren said in Nextcloud OIDC integration:

            Just checked the logs (they are absolutely full):

            LocalServerException
            Host "127.0.1.1" (my.tld.onl:80) violates local access rules
            Could not reach the provider at URL https://my.tld.onl/openid/.well-known/openid-configuration
            

            @joseph said in Nextcloud OIDC integration:

            @andreasdueren can you tell me what made you add 127.0.1.1 ? Not sure what that IP is

            The console complained about it

            1 Reply Last reply
            0
            • andreasduerenA Offline
              andreasduerenA Offline
              andreasdueren
              wrote on last edited by
              #56

              @Joseph So this is weird. Even a fresh install of NC in a new, clean Cloudron is throwing the same error. Any idea why that would be?

              1 Reply Last reply
              0
              • nebulonN Away
                nebulonN Away
                nebulon
                Staff
                wrote on last edited by
                #57

                Did you apply any extra configs to Nextcloud? It is still unclear to me who prints this LocalServerException and why Nextcloud would refuse to connect to that endpoint. Have you looked in the Nextcloud forum/issue tracker about this?

                Given that you mentioned, that curl to that endpoint from within the nextcloud container works fine, it is somethign within Nextcloud it seems.

                andreasduerenA 1 Reply Last reply
                0
                • nebulonN nebulon

                  Did you apply any extra configs to Nextcloud? It is still unclear to me who prints this LocalServerException and why Nextcloud would refuse to connect to that endpoint. Have you looked in the Nextcloud forum/issue tracker about this?

                  Given that you mentioned, that curl to that endpoint from within the nextcloud container works fine, it is somethign within Nextcloud it seems.

                  andreasduerenA Offline
                  andreasduerenA Offline
                  andreasdueren
                  wrote on last edited by
                  #58

                  @nebulon Nope, new Nextcloud, not even logged in yet

                  1 Reply Last reply
                  0
                  • J Offline
                    J Offline
                    joseph
                    Staff
                    wrote on last edited by
                    #59

                    Best to reach out at support@cloudron.io , it seems hard to debug . Atleast, fresh instances on all our servers and demo instances seem to work fine.

                    andreasduerenA 1 Reply Last reply
                    1
                    • J joseph

                      Best to reach out at support@cloudron.io , it seems hard to debug . Atleast, fresh instances on all our servers and demo instances seem to work fine.

                      andreasduerenA Offline
                      andreasduerenA Offline
                      andreasdueren
                      wrote on last edited by
                      #60

                      @Joseph Is this something you're interested in debugging? Otherwise I'll just wipe the machine and install fresh

                      J 1 Reply Last reply
                      1
                      • andreasduerenA andreasdueren

                        @Joseph Is this something you're interested in debugging? Otherwise I'll just wipe the machine and install fresh

                        J Offline
                        J Offline
                        joseph
                        Staff
                        wrote on last edited by
                        #61

                        @andreasdueren yes, we would like to take a quick look, if possible. Maybe it's something obvious we miss in the package or something else

                        1 Reply Last reply
                        2
                        • girishG Offline
                          girishG Offline
                          girish
                          Staff
                          wrote on last edited by
                          #62

                          @andreasdueren thanks for the access! I am making a new package to fix the issue.

                          For those interested, here is the technical information:

                          • On some VPS providers, when you create a VM with hostname my.foo.com , it will put an entry in /etc/hosts of the server with 127.0.1.1 .

                          • Starting Cloudron 8, we started using Docker for the DNS resolution. Docker reads /etc/hosts and starts resolving my.foo.com to 127.0.1.1 .

                          • This meant that for apps (which are running in containers) using the domain name my.foo.com (like OIDC service) does not work. This is because it's resolving to 127.0.1.1.

                          • To workaround this, we added ExtraHosts to container config. Docker simply adds entries to /etc/hosts of the container. Now, when apps try to resolve my.foo.com they will resolve to 172.18.0.1 because /etc/hosts has more priority than DNS look up.

                          • This works for all apps... except nextcloud has decided to implement some DNS pinning protection which I think is to prevent against DNS Rebinding attacks. This code looks up DNS directly (thus skipping /etc/hosts lookup) and thus ends up with 127.0.1.1 😕 It blocks the access thinking it's an attack.

                          • Luckily, there is a config dns_pinning to disable this functionality.

                          See also https://github.com/nextcloud/server/issues/42901

                          andreasduerenA 1 Reply Last reply
                          3
                          • girishG girish

                            @andreasdueren thanks for the access! I am making a new package to fix the issue.

                            For those interested, here is the technical information:

                            • On some VPS providers, when you create a VM with hostname my.foo.com , it will put an entry in /etc/hosts of the server with 127.0.1.1 .

                            • Starting Cloudron 8, we started using Docker for the DNS resolution. Docker reads /etc/hosts and starts resolving my.foo.com to 127.0.1.1 .

                            • This meant that for apps (which are running in containers) using the domain name my.foo.com (like OIDC service) does not work. This is because it's resolving to 127.0.1.1.

                            • To workaround this, we added ExtraHosts to container config. Docker simply adds entries to /etc/hosts of the container. Now, when apps try to resolve my.foo.com they will resolve to 172.18.0.1 because /etc/hosts has more priority than DNS look up.

                            • This works for all apps... except nextcloud has decided to implement some DNS pinning protection which I think is to prevent against DNS Rebinding attacks. This code looks up DNS directly (thus skipping /etc/hosts lookup) and thus ends up with 127.0.1.1 😕 It blocks the access thinking it's an attack.

                            • Luckily, there is a config dns_pinning to disable this functionality.

                            See also https://github.com/nextcloud/server/issues/42901

                            andreasduerenA Offline
                            andreasduerenA Offline
                            andreasdueren
                            wrote on last edited by
                            #63

                            @girish So I should add 'dns_pinning' => false, to the config file?

                            girishG 1 Reply Last reply
                            1
                            • andreasduerenA andreasdueren

                              @girish So I should add 'dns_pinning' => false, to the config file?

                              girishG Offline
                              girishG Offline
                              girish
                              Staff
                              wrote on last edited by
                              #64

                              @andreasdueren yes, pretty much. https://git.cloudron.io/packages/nextcloud-app/-/merge_requests/12

                              andreasduerenA 2 Replies Last reply
                              1
                              • girishG girish

                                @andreasdueren yes, pretty much. https://git.cloudron.io/packages/nextcloud-app/-/merge_requests/12

                                andreasduerenA Offline
                                andreasduerenA Offline
                                andreasdueren
                                wrote on last edited by
                                #65

                                @girish Works perfectly now, thanks!

                                1 Reply Last reply
                                2
                                • andreasduerenA Offline
                                  andreasduerenA Offline
                                  andreasdueren
                                  wrote on last edited by
                                  #66

                                  Migration of a smaller instance seems to work smoothly so far.

                                  1 Reply Last reply
                                  1
                                  • firmansiF Offline
                                    firmansiF Offline
                                    firmansi
                                    wrote on last edited by firmansi
                                    #67

                                    @girish Since my installation is user not managed by Cloudron so I can't enable OIDC (but not just this, I can't curl the OIDC Server eventhough it's the same Cloudron server),i just want to let know the issue that I experience lately, after I updated Nextcloud including latest update with DNS Pinning, after update I can't login since the LDAP and Group Backend disabled automaticall after update, so i have to enable manually in Nextcloud Apps, the config in Nextcloud Setting for LDAP/AD Integration is a bit different than previously before update but anywhow I can still login back normally. Please be aware of this issue. Thanks

                                    J 1 Reply Last reply
                                    0
                                    • girishG girish

                                      @andreasdueren yes, pretty much. https://git.cloudron.io/packages/nextcloud-app/-/merge_requests/12

                                      andreasduerenA Offline
                                      andreasduerenA Offline
                                      andreasdueren
                                      wrote on last edited by
                                      #68

                                      @girish Proposition to change the OpenID Identifier from "Cloudron" to "OpenID" or "SSO" since we can't have the branding from the Cloudron instance

                                      1 Reply Last reply
                                      1
                                      • firmansiF firmansi

                                        @girish Since my installation is user not managed by Cloudron so I can't enable OIDC (but not just this, I can't curl the OIDC Server eventhough it's the same Cloudron server),i just want to let know the issue that I experience lately, after I updated Nextcloud including latest update with DNS Pinning, after update I can't login since the LDAP and Group Backend disabled automaticall after update, so i have to enable manually in Nextcloud Apps, the config in Nextcloud Setting for LDAP/AD Integration is a bit different than previously before update but anywhow I can still login back normally. Please be aware of this issue. Thanks

                                        J Offline
                                        J Offline
                                        joseph
                                        Staff
                                        wrote on last edited by
                                        #69

                                        @firmansi the auth mechanism is chosen at install time. if you go behind cloudron's back and make changes to the app configuration, this will eventually not work. in your situation, you have installation nextcloud without LDAP/OIDC and then later configuring it inside the app manually. This won't work and is not supported. The way to fix this is like this:

                                        • take backup of your nextcloud. download the backup configuration of this new backup
                                        • install new nextcloud with cloudron user management
                                        • import the backup from setup 1 . app -> backups -> import

                                        It will work after this.

                                        firmansiF 2 Replies Last reply
                                        3
                                        • firmansiF Offline
                                          firmansiF Offline
                                          firmansi
                                          wrote on last edited by firmansi
                                          #70

                                          Do you mean I simply back up in Cloudron? From my understanding, if I do the back up from Cloudron, then when I do the import, it will adjust to the old one without user management managed by Cloudron, please let me know if my assumption is wrong

                                          1 Reply Last reply
                                          0
                                          Reply
                                          • Reply as topic
                                          Log in to reply
                                          • Oldest to Newest
                                          • Newest to Oldest
                                          • Most Votes


                                          • Login

                                          • Don't have an account? Register

                                          • Login or register to search.
                                          • First post
                                            Last post
                                          0
                                          • Categories
                                          • Recent
                                          • Tags
                                          • Popular
                                          • Bookmarks
                                          • Search