[Bug]: NC31 FIDO2/webauthn stopped working after update #51137
Labels
0. Needs triage
Pending check for reproducibility or if it fits our roadmap
31-feedback
bug
feature: authentication
high
Comments
davodego
added
0. Needs triage
|
I have the same symptom that device login via twofactor_webauthn app stopped working after nextcloud server upgrade from 30 to 31. Extract from nextcloud log after yubikey registration attempt for 'Passwordless Authentication', which fails with GUI message 'Error: Could not register device': Extract from nextcloud log on debug level, after attempting device login: Note that the same yubikey can be registered as U2F security key and successfully used as second factor, but fails to be registered and used as WebAuthn device. Server is running with Debian 12, PostgreSQL 15, Apache 2.4.62, PHP 8.2 App list: |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Bug description
Since the update to NC 31.0.0.18, passwordless login with webauthn (FIDO2) no longer works for me.
I wanted to log in with my Yubikey, the login screen showed no reaction and the Yubikey did not flash either. I logged in with my password, deleted the configuration on the security page and tried to create the passwordless login with my Yubikey again. But that didn’t work.
An error message appears: “Error, the device could not be registered”. Regardless of whether the Yubiky is plugged into the USB port or not.
U2FA with security key is not affected. This works with a Yubikey.
Steps to reproduce
1.Go to Personal Settings > Security
2. Choose Login without Password > Click "Add Webauthn Device"
3. An error Message was Displayed "Error, the device could not be registered"
Expected behavior
The webauthn device is linked to the user's login for passwordless login.
Nextcloud Server version
31
Operating system
Debian/Ubuntu
PHP engine version
PHP 8.3
Web server
Apache (supported)
Database engine version
PostgreSQL
Is this bug present after an update or on a fresh install?
Upgraded to a MAJOR version (ex. 31 to 32)
Are you using the Nextcloud Server Encryption module?
Encryption is Disabled
What user-backends are you using?
Configuration report
{ "system": { "instanceid": "***REMOVED SENSITIVE VALUE***", "passwordsalt": "***REMOVED SENSITIVE VALUE***", "secret": "***REMOVED SENSITIVE VALUE***", "trusted_domains": [ "xxxxx.xxxxx.xx", "127.0.0.1", "xxx.xxx.x.xx", "localhost" ], "allow_local_remote_servers": true, "datadirectory": "***REMOVED SENSITIVE VALUE***", "overwritewebroot": "\/xxxxx", "overwrite protocol": "https", "overwrite.cli.url": "https:\/\/xxxx.xxxx.xx\/xxxx", "dbtype": "pgsql", "version": "31.0.0.18", "dbname": "***REMOVED SENSITIVE VALUE***", "dbhost": "***REMOVED SENSITIVE VALUE***", "dbport": "", "dbtableprefix": "oc_", "dbuser": "***REMOVED SENSITIVE VALUE***", "dbpassword": "***REMOVED SENSITIVE VALUE***", "installed": true, "app.mail.verify-tls-peer": false, "mail_from_address": "***REMOVED SENSITIVE VALUE***", "mail_smtpmode": "sendmail", "mail_smtpauthtype": "LOGIN", "mail_domain": "***REMOVED SENSITIVE VALUE***", "maintenance": false, "filelocking.enabled": true, "memcache.locking": "\\OC\\Memcache\\Redis", "memcache.local": "\\OC\\Memcache\\APCu", "memcache.distributed": "\\OC\\Memcache\\Redis", "redis": { "host": "***REMOVED SENSITIVE VALUE***", "port": 0, "dbindex": 0, "timeout": 1.5 }, "theme": "", "loglevel": 0, "twofactor_enforced": "false", "twofactor_enforced_groups": [], "twofactor_enforced_excluded_groups": [], "mysql.utf8mb4": true, "clear_site_data": true, "mail_sendmailmode": "smtp", "updater.release.channel": "stable", "app_install_overwrite": [ "ocr", "files_ebookreader", "epubreader", "dicomviewer", "mindmap_app", "fulltextsearch", "fulltextsearch_elasticsearch", "files_fulltextsearch", "files_fulltextsearch_tesseract", "riotchat", "ojsxc", "extract", "memories", "music", "files_rightclick", "metadata", "talk_matterbridge", "files_archive", "cfg_share_links", "files_mindmap", "tasks", "occweb", "radio", "files_antivirus", "side_menu", "duplicatefinder", "epubviewer", "maps", "electronicsignatures", "intros", "thesearchpage", "timemanager", "uppush" ], "preview_max_x": 2048, "preview_max_y": 2048, "jpeg_quality": 60, "default_phone_region": "DE", "enable_previews": true, "session_relaxed_expiry": true, "trusted_proxies": "***REMOVED SENSITIVE VALUE***", "memories.exiftool": "\/var\/www\/nextcloud\/apps\/memories\/bin-ext\/exiftool-amd64-glibc", "memories.vod.path": "\/var\/www\/nextcloud\/apps\/memories\/bin-ext\/go-vod-amd64", "memories.vod.ffmpeg": "\/usr\/bin\/ffmpeg", "memories.vod.ffprobe": "\/usr\/bin\/ffprobe", "maintenance_window_start": 100, "trashbin_retention_obligation": "auto, 30", "versions_retention_obligation": "auto, 180", "activity_expire_days": 365, "memories.db.triggers.fcu": true, "data-fingerprint": "2f550edebc0aa062e8c84b74fddcb9bc", "auth.webauthn.enabled": true } }List of activated Apps
Nextcloud Signing status
Nextcloud Logs
{"reqId":"Z8FRoyF1TPO1rrGTsgZ1CgAAigE","level":0,"time":"2025-02-28T06:03:15+00:00","remoteAddr":"xxx.xxx.xxx.xxx","user":false,"app":"PHP","method":"PUT","url":"/ocs/v2.php/apps/user_status/api/v1/heartbeat?format=json","message":"Creation of dynamic property OCA\\Extract\\AppInfo\\Application::$appName is deprecated at /var/www/nextcloud/apps/extract/lib/AppInfo/Application.php#35","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0","version":"31.0.0.18","data":{"app":"PHP"}} {"reqId":"Z8FRoyF1TPO1rrGTsgZ1CwAAjQg","level":0,"time":"2025-02-28T06:03:16+00:00","remoteAddr":"xxx.xxx.xxx.xxx","user":false,"app":"PHP","method":"GET","url":"/index.php/settings/api/personal/webauthn/registration","message":"Creation of dynamic property OCA\\Extract\\AppInfo\\Application::$appName is deprecated at /var/www/nextcloud/apps/extract/lib/AppInfo/Application.php#35","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0","version":"31.0.0.18","data":{"app":"PHP"}} {"reqId":"Z8FRoyF1TPO1rrGTsgZ1CwAAjQg","level":0,"time":"2025-02-28T06:03:16+00:00","remoteAddr":"xxx.xxx.xxx.xxx","user":"me","app":"settings","method":"GET","url":"/index.php/settings/api/personal/webauthn/registration","message":"Starting WebAuthn registration","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0","version":"31.0.0.18","data":{"app":"settings"}}Additional info
Browser console error:
Starting WebAuthn registration AddDevice.vue:129
[DEBUG] settings: Fetching webauthn registration data
Object { app: "settings", uid: "daniel", level: 0 }
app: "settings"
level: 0
uid: "me"
: Object { … }
index.mjs:45:16
[DEBUG] settings: Start webauthn registration
Object { app: "settings", uid: "me", level: 0 }
app: "settings"
level: 0
uid: "me"
: Object { … }
index.mjs:45:16
[ERROR] settings: Unexpected TypeError "e is undefined"
Object { app: "settings", uid: "me", level: 0, error: TypeError }
app: "settings"
error: TypeError: e is undefined
level: 0
uid: "me"
The text was updated successfully, but these errors were encountered: