Active Directory password change revokes APP tokens

[PiotrIr]

Steps to reproduce

1. Create app token for WebDAV connection and login to sync client 2.6.2
2. Change password in Active Directory

Expected behaviour
Starting with Nextcloud 15
For password changes in external user backends the device-specific passwords are marked as invalid and once a login of the user account with the main password happens all device-specific passwords are updated and work again.

Actual behaviour
After login to Nextcloud using web browser, all app tokens (WebDAV and Nexcloud sync client) don't work.

Server configuration
Operating system: Ubuntu 18.04

Web server: nginx-1.16.1

Database: MariaDB 10.4.11

PHP version: 7.3.13

Nextcloud version: 17.0.2

Updated from an older Nextcloud/ownCloud or fresh install: Fresh install

Could you help me with this please?

[violoncelloCH]

cc @ChristophWurst as you're the authentication / app password expert

[PiotrIr]

Thank you

[PiotrIr]

I've just tested and changing password works as expected when user is local. Issue seems to be only when user is in Active Directory.

[PiotrIr]

Hi,
I just wander - is any chance it will be looked at? I've tested also on Nextcloud 15 and this doesn't work as well.

[ChristophWurst]

This should be fixed since nextcloud/server#11390. cc @rullzer

[PiotrIr]

Hi Christoph,

Many thanks for your reply.

I've just enabled debug level of logs and done some additional tests - it looks the behaviour is more complex than just working or not. I have WebDav mapped drive using RaiDrive (with manually created token) and Nextcloud client 2.6.2 on the same Windows 10 machine. I've repeated the test twice again - results below.

1. Surprisingly WebDav after a while of waiting (and after I've logged to web) started working. Nextcloud client prompted me to login but it didn't prompt about password - just to grant access.

2. WebDav stopped to work completely and even putting the same app password didn't help. I tried to use WebDav on another computer with Windows client, but the password doesn't work as well. However the client is just working and didn't prompt me about anything so looks this particular app token is working fine.

Will you be able to put some light on it? Is anything what I missed in my test?

Below log from server related to WebDav authentication.

[webdav] Debug: Sabre\DAV\Exception\NotAuthenticated: Username or password was incorrect, No 'Authorization: Bearer' header found. Either the client didn't send one, or the server is mis-configured at <>

0. <>
   Sabre\DAV\Auth\Plugin->beforeMethod(Sabre\HTTP\Reque ... "}, Sabre\HTTP\Response {})
1. /var/www/nextcloud/3rdparty/sabre/event/lib/EventEmitterTrait.php line 105
   undefinedundefinedcall_user_func_array([Sabre\DAV\Auth\ ... "], [Sabre\HTTP\Requ ... }])
2. /var/www/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php line 466
   Sabre\Event\EventEmitter->emit("beforeMethod", [Sabre\HTTP\Requ ... }])
3. /var/www/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php line 254
   Sabre\DAV\Server->invokeMethod(Sabre\HTTP\Reque ... "}, Sabre\HTTP\Response {})
4. /var/www/nextcloud/apps/dav/appinfo/v1/webdav.php line 80
   Sabre\DAV\Server->exec()
5. /var/www/nextcloud/remote.php line 163
   undefinedundefinedrequire_once("/var/www/nextcl ... p")

PROPFIND /remote.php/webdav/
from 192.168.2.44 at 2020-01-27T15:15:52+01:00

[PiotrIr]

Hi,
I believe - just narrowed this down. Basically, if I change password and then login to nextcloud website in 5 minutes, the app tokens are working fine. However if I wait longer (tested around 1 hour) and then login to to web browser, all APP tokens are revoked.
If you need me to do any other test - please let me know - I can do it.

[rullzer]

Can you try on a more recent nextcloud version? 15 is eol.

[PiotrIr]

I'm using Nextcloud version: 17.0.2 so I guess this is latest production version?

[PiotrIr]

Is any chance somebody will look at it? I've just tested it again and even I change password and login to browser straight away, it does sometimes work and sometimes doesn't. I can't find even pattern for this.

[PiotrIr]

Sadly nobody helps me with this :-( Is anybody else who has this issue? I don't believe nobody is using WebDAV with 2FA and password change policy from Active Directory? It would be great if Virtual Drive would be released but for now I need to use WebDAV....

[ChristophWurst]

You could check help.nextcloud.com for similar reports from the community.