Cannot log into Nextcloud after update to 9.2 - Access Forbidden - Failed to contact the OIDC provider token endpoint: grant request is invalid

[avatar1024]

Hello,

Since this morning, on one of my instance (which has 3 nextclouds), I cannot access any of them where when trying get in normally (clicking on the app or going to the url) I'm getting this:

The last thing that happened on that server is the update to Cloudron 9.2, yet on another server, also upgrade to 9.2, it works just fine.

Here is what I see in the log of a broken instance when trying to log in:

Any clues?

[avatar1024]

cleared the cache and it all works - apologies...

I don't know how I hadn't tried it before posting to be honest, very sorry about that!

Especially as I regularly have login weirdness with OIDC and NC which require clearing the browser's cache. I don't know if anything can be done to prevent that.

Like @jdaviescoates, I also have a setting enabled not to display the NC login page and so it always auto connect if I'm logged into cloudron, or send me to the cloudron login page if I'm not. Maybe this confuses the browser at times, I don't know.

[james]

Hello @avatar1024
Please post the output of cloudron-support --troubleshoot

[jdaviescoates]

I'm also unable to login to my Nextlouds and I'm still on 9.17

I don't get the screen you get though, just the standard login screen with a passkey option but no OIDC.

I had also previously changed some config somewhere so that the standard login screen wasn't displayed and it only have OIDC option, which normally meant it just logged in without doing anything as I'm already logged into Cloudron

[james]

Hello @jdaviescoates and @avatar1024
If you open the browser developer tools and view the network inspect while trying to log in.
Is there anything erroring there?

[jdaviescoates]

@james I'm on mobile on a train.

It obviously is trying to do OIDC because that actual URL it's at is https://my.uniteddiversity.coop/openid/interaction/gBxXyLN46NPdakIokzKWVMhLaCWOHERhmVZpX0nUQeh

I'd guess the issue is with Nextcloud OIDC plugin.

[avatar1024]

@james said:

Hello @avatar1024
Please post the output of cloudron-support --troubleshoot

Vendor: netcup Product: KVM Server
Linux: 5.15.0-130-generic
Ubuntu: noble 24.04
Cloudron: 9.2.0
Execution environment: kvm
Processor: AMD EPYC 7702P 64-Core Processor
BIOS pc-i440fx-6.2  CPU @ 2.0GHz x 6
RAM: 16372656KB
Disk: /dev/sda3       153G
[OK]    Root disk usage is OK (50%)
[WARN]  Memory is 86% used
[OK]    Clock is NTP-synchronized
[OK]    node version is correct
[OK]    IPv6 is enabled in kernel. No public IPv6 address
[OK]    docker is running
[OK]    docker version is correct
[OK]    MySQL is running
[OK]    netplan is good
[OK]    DNS is resolving via systemd-resolved
[OK]    unbound is running
[OK]    IPv4 HTTPS to api.cloudron.io/api/v1/helper/public_ip
[SKIP]  IPv6 HTTPS to api.cloudron.io/api/v1/helper/public_ip — no public IPv6 address
[OK]    IPv4 HTTPS to auth.docker.io/token
[SKIP]  IPv6 HTTPS to auth.docker.io/token — no public IPv6 address
[OK]    IPv4 HTTPS to acme-v02.api.letsencrypt.org
[SKIP]  IPv6 HTTPS to acme-v02.api.letsencrypt.org — no public IPv6 address
[OK]    nginx is running
[OK]    dashboard cert is valid
[OK]    dashboard is reachable via loopback
[OK]    No pending database migrations
[OK]    Service 'mysql' is running and healthy
[OK]    Service 'postgresql' is running and healthy
[OK]    Service 'mongodb' is running and healthy
[OK]    Service 'mail' is running and healthy
[OK]    Service 'graphite' is running and healthy
[OK]    Service 'sftp' is running and healthy
[OK]    box v9.2.0 is running
[OK]    Dashboard is reachable via IPv4 (https://my.catalystcollective.org)
[SKIP]  Dashboard IPv6 reachability — no public IPv6 address
[OK]    Domain catalystcollective.org is valid and has not expired

======== Summary ========
PASS:  26
WARN:  1
FAIL:  0
SKIP:  4

Warnings:
  - Memory is 86% used

I can't any major problem here.

@james said:

f you open the browser developer tools and view the network inspect while trying to log in.
Is there anything erroring there?

Not as far as I can see.

[avatar1024]

cleared the cache and it all works - apologies...

I don't know how I hadn't tried it before posting to be honest, very sorry about that!

Especially as I regularly have login weirdness with OIDC and NC which require clearing the browser's cache. I don't know if anything can be done to prevent that.

Like @jdaviescoates, I also have a setting enabled not to display the NC login page and so it always auto connect if I'm logged into cloudron, or send me to the cloudron login page if I'm not. Maybe this confuses the browser at times, I don't know.