Nextcloud fails to provision my users after upgrade to v30.05

[coniunctio]

Slightly different issue but I presume related: Ever since Cloudron's Nextcloud app updated one or two updates ago, I lost the ability to log in with username/email+password on Nextcloud and am forced to log in via my Cloudron authentication.

When I log in via my Cloudron authentication, my Nextcloud admin loses admin privileges even after resetting privileges via Nextcloud's CLI to restore admin account:

sudo -u www-data php occ group:adduser admin <my_username>

I am locked out of administrating my own Nextcloud instance. I am unable to figure out how to remove the Cloudron only login to go back to the way I used to log in and am slightly nervous to make any major changes to how I log in to Nextcloud lest I accidentally completely lock myself out.

@odie Does this sound like it might be in any way related to your issue or totally different? I was just about to create a new post when I saw your message here and don't want to double up if it's related to the same issue.

[jdaviescoates]

@coniunctio they are related in that both are due to the Nextcloud app switching from LDAP to OIDC - but as @girish has said, it wasn't an automated update and warnings would've been given when manually updating. I've updated some of my smaller less important instances and it all seems to have gone fine (I think having OIDC is ultimately a lot better the LDAP user/ pass), but I've not updated my primary instance yet.

[odie]

@girish said in Nextcloud fails to provision my users after upgrade to v30.05:

@odie The app won't update automatically since this is pushed a major package release.

Are you able to clone your app and provide us access to the test app instance? Understand that it's probably very technical. We can debug the issue further. Can you write to support@cloudron.io , please?

Apologies for the delay. Things exploded at work. I've cloned the app and sent an e-mail to support.

[girish]

@coniunctio said in Nextcloud fails to provision my users after upgrade to v30.05:

sudo -u www-data php occ user:setgroup admin <my_username>

I guess you mean sudo -u www-data php occ group:adduser admin <my_username> . The above one doesn't work for me (unless some plugin is providing this).

Which package version are you on? There was a bug in the initial package that the groups of a user are reset on login. This has since been fixed. If you go to Admin -> OpenID Connect -> Cloudron -> edit -> User group provisioning must be unchecked.

[coniunctio]

@girish You are probably correct about that I typed whatever you wrote (I hope!) but just to safe, I'll try what you wrote again and report back if anything changes.

Just to add, I've been able to correctly change the account to "admin" privileges but it doesn't stick once I actually login to the account. The Nextcloud notifications will even show that the privileges were added, but then removed when I login via the Cloudron login method vs the older username/password approach. Also, for whatever reason, my former password associated with the account just stopped working since this newer login method took effect. It's not like I can use either username/password OR Cloudron login. Just the latter.

Okay, just tested to confirm and yes, I incorrectly wrote the command I used to change to admin. Your way is correct. Thank you for pointing that out. I'll edit my original post to reduce confusion for future readers.

Secondly, I noticed that when I add myself as admin, I get the privileges until logging out and then when logging back in they are removed.

Logged in, added privileges via the OCC command:

Logged out and logged back in via Cloudron login:

[jdaviescoates]

@girish said in Nextcloud fails to provision my users after upgrade to v30.05:

Which package version are you on? There was a bug in the initial package that the groups of a user are reset on login. This has since been fixed. If you go to Admin -> OpenID Connect -> Cloudron -> edit -> User group provisioning must be unchecked.

It does sound like you are still on the old broken version. Answering this direct question will help the team to help you @coniunctio

[odie]

@odie said in Nextcloud fails to provision my users after upgrade to v30.05:

@girish said in Nextcloud fails to provision my users after upgrade to v30.05:

@odie The app won't update automatically since this is pushed a major package release.

Are you able to clone your app and provide us access to the test app instance? Understand that it's probably very technical. We can debug the issue further. Can you write to support@cloudron.io , please?

Apologies for the delay. Things exploded at work. I've cloned the app and sent an e-mail to support.

Hello again

I haven't heard back from support, but I noticed I sent it from the wrong email address (an address unassociated with my Cloudron setup). Should I resend from my Clodron associated email?

Apologies, Friday suddenly became an insane day at work (good stuff, but urgent stuff).

On a side note - on the cloned app instance. I tried the update, and that too fails in the same way (same error message: Failed to provision the user). I know that Cloudron accepts the login, as I get a "new login" email. So it's something happening after the login is accepted by Cloudron.

[jdaviescoates]

@odie said in Nextcloud fails to provision my users after upgrade to v30.05:

I tried the update, and that too fails in the same way (same error message: Failed to provision the user). I know that Cloudron accepts the login, as I get a "new login" email. So it's something happening after the login is accepted by Cloudron.

Please mention exactly which package you've updated to as it sounds like you might be on Cloudron package 5.0.0 where this issue happened and e.g. users couldn't be made admins etc (well, they could, but not in a way that persisted), but there were some fixes in 5.0.1 and later updates.

[girish]

Sorry hit the weekend, so couldn't spend time on debugging it. But https://git.cloudron.io/packages/nextcloud-app/-/merge_requests/14 should hopefully fix the problem.

[odie]

@girish said in Nextcloud fails to provision my users after upgrade to v30.05:

Sorry hit the weekend, so couldn't spend time on debugging it. But https://git.cloudron.io/packages/nextcloud-app/-/merge_requests/14 should hopefully fix the problem.

Thank you, @girish for debugging and fixing today. Everything was working great.

... until it wasn't. Upon installing tonight's update (version 5.1.0), I get the same error message (Access forbidden: Failed to provision the user) when I try to add new clients. This happens on web and via Nextcloud sync clients. On clients where I managed to log in (after the update you fixed earlier today, but before v5.1.0 (could it be Package v5.0.4, perhaps), your fixes worked. But they seem to have been re-introduced in package v5.1.0.

The behaviour is strange. After updating to v5.1.0, I can still log in and work with files etc. on clients that were logged in before updating to 5.1.0. But after the update, any new client that attempts to connect, get the "Failed to provision the user" error message.

I restored the v5.0.4 backup, and with this version, I can log in with Cloudron. But once I install v5.1.0, the same errors trigger again.

[girish]

@odie my bad I fogot to make a patch on top of 5.1.0 as well. Hold on, 5.1.1 is coming

[girish]

@odie this should be fixed now. Update to 5.1.1 and it should work.

[odie]

@girish said in Nextcloud fails to provision my users after upgrade to v30.05:

@odie this should be fixed now. Update to 5.1.1 and it should work.

Thanks! Updating now, will report back if there are any issues (updates take some time due to large backups). Edit: Updated to 5.1.1, the fixes are working. Thanks.

[coniunctio]

@jdaviescoates I updated the setting per your instructions and that did the trick! Thank you.