oc_preferences contains outdated email addresses

[busted-it-guy]

Update by @ChristophWurst: the oc_preferences table contained outdated email addresses because the email address scheme was changed once. IMO this should not result in inconsitent data or even errors like these. Apparently the email login uses a quick and dirty hack to look up UIDs for email addresses by querying the user preferences for email addresses and takes the very first one. If the first one is wrong, this fails hard because the UID mapping is wrong.
This has been fixed manually: #7306 (comment).

---

Nextcloud version (eg, 10.0.2): 12.0.1 RC4
Operating system and version (eg, Ubuntu 16.04): Ubuntu 16.04
Apache or nginx version (eg, Apache 2.4.25): apache
PHP version (eg, 5.6): 7.0.2.2
Is this the first time you’ve seen this error?: No but first time reporting

Can you reliably replicate it? (If so, please outline steps): No but it logs every couple of seconds or so it seems

The issue you are facing:

Our log is being flooded with:
Fatal webdav Sabre\DAV\Exception\ServiceUnavailable: TypeError: Argument 1 passed to OC\Authentication\TwoFactorAuth\Manager::isTwoFactorAuthenticated() must be an instance of OCP\IUser, null given, called in /var/www/nextcloud/lib/private/User/Session.php on line 453
[internal function] {closure}(Object(Sabre\HTTP\Request), Object(Sabre\HTTP\Response))
/var/www/nextcloud/3rdparty/sabre/event/lib/EventEmitterTrait.php - line 105: call_user_func_array(Object(Closure), Array)
/var/www/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php - line 466: Sabre\Event\EventEmitter->emit(‘beforeMethod’, Array)
/var/www/nextcloud/3rdparty/sabre/dav/lib/DAV/Server.php - line 254: Sabre\DAV\Server->invokeMethod(Object(Sabre\HTTP\Request), Object(Sabre\HTTP\Response))
/var/www/nextcloud/remote.php - line 70: Sabre\DAV\Server->exec()
/var/www/nextcloud/remote.php - line 167: handleException(Object(TypeError))
{main}

The output of your Nextcloud log in Admin > Logging:

This would be a spamming of the above error for days

…
‘trusted_domains’ =>
array (
0 => ‘digitalfile.domain1.com’,
1 => ‘digital.domain2.com’,
),
‘datadirectory’ => ‘/var/www/nextcloud-data’,
‘overwrite.cli.url’ => ‘http://digital.domain2.com’,
‘dbtype’ => ‘mysql’,
‘version’ => ‘12.0.1.3’,
‘dbname’ => ‘nextcloud’,
‘dbhost’ => ‘localhost’,
‘dbport’ => ‘’,
‘dbtableprefix’ => ‘oc_’,
‘dbuser’ => ‘nextclouduser’,
‘dbpassword’ => ‘***********’,
‘logtimezone’ => ‘UTC’,
‘installed’ => true,
‘memcache.distributed’ => ‘\OC\Memcache\Redis’,
‘memcache.local’ => ‘\OC\Memcache\Redis’,
‘memcache.locking’ => ‘\OC\Memcache\Redis’,
‘redis’ =>
array (
‘host’ => ‘localhost’,
‘port’ => 6379,
),
‘ldapIgnoreNamingRules’ => false,
‘ldapProviderFactory’ => ‘\OCA\User_LDAP\LDAPProviderFactory’,
‘updater.release.channel’ => ‘daily’,
‘maintenance’ => false,
‘theme’ => ‘’,
‘loglevel’ => 2,
‘mail_smtpmode’ => ‘smtp’,
‘mail_smtpauthtype’ => ‘LOGIN’,
‘mail_from_address’ => ‘digital-file-transfer’,
‘mail_domain’ => ‘domain1,com’,
‘mail_smtphost’ => ‘smtp.office365.com’,
‘mail_smtpport’ => ‘587’,
‘mail_smtpsecure’ => ‘tls’,
‘mail_smtpauth’ => 1,
‘mail_smtpname’ => ‘user@domain1.com’,
‘mail_smtppassword’ => ‘**********’,
);

m.

[MorrisJobke]

cc @ChristophWurst

[ChristophWurst]

I think I know where that problem might come from, but it's pretty strange.

So where it fails is here

server/lib/private/User/Session.php

Lines 442 to 453 in 041e327

	if (is_null($user)) {
	$users = $this->manager->getByEmail($username);
	if (empty($users)) {
	return false;
	}
	if (count($users) !== 1) {
	return true;
	}
	$user = $users[0];
	}
	// DI not possible due to cyclic dependencies :'-/
	return OC::$server->getTwoFactorAuthManager()->isTwoFactorAuthenticated($user);

Following those checks, the $user should actually have a value, unless the manager returns [null].

server/lib/private/User/Manager.php

Lines 535 to 545 in 041e327

	/**
	* @param string $email
	* @return IUser[]
	* @since 9.1.0
	*/
	public function getByEmail($email) {
	$userIds = $this->config->getUsersForUserValue('settings', 'email', $email);
	return array_map(function($uid) {
	return $this->get($uid);
	}, $userIds);

Looking at the manager, we can see that it maps config UIDs to IUser objects. This will produce [null] if $this->get(…) returns null - which it only does if either the UID is invalid or the user cannot be found.

Something's wrong here. I don't get why the manager does not find that user. Is there garbage in the user settings/preferences?. I could imagine this happening if a user is deleted and then another one is created with the same email. Then maybe it looks up the old UID and thus fails to load the user object. But I'm not sure because I cannot reproduce this.

[busted-it-guy]

Where are you referring to for user/settings/preferences? I can go to users and select settings, but there is not preferences. Are we talking about a file? My users are primarily created by LDAP. Could it evere be that LDAP would be unreachable, and the users be recreated in Nextcloud?

[ChristophWurst]

Where are you referring to for user/settings/preferences? I can go to users and select settings, but there is not preferences. Are we talking about a file? My users are primarily created by LDAP. Could it evere be that LDAP would be unreachable, and the users be recreated in Nextcloud?

I'm talking about user settings in the DB. They might be generated automatically, that's nothing you can/should change as a user.

[busted-it-guy]

oh ic. Well let me know if there is anything I can do or provide to help with this.

[ChristophWurst]

@busted-it-guy do you know what specific user and email this fails with? Then you could query your database with select * from oc_preferences where configkey="email" and configvalue="<email>" and check whether the reported userids match the actual user ID of that email address.
I'm not a 100% sure if that helps but if you detect a mismatch that would confirm my suspicion from above.

[busted-it-guy]

beautiful.

Forgot that all my users are form LDAP and a few months ago we went through a change of their primary email address. This created 2 users.. one from @olddomain and one from @newdomain

When I did a configvalue of "username%" it showed 2 for each user. Then I did a delete from oc_preferences where all configvalue that equaled "%olddomain". That blew away the secondary accounts and kept all the newdomain.com accounts.

Does this all sound right?

[ChristophWurst]

Sounds good. Did it solve the errors?

[busted-it-guy]

yup! all good to go now. Thanks for your help on this.. I would have never put two and two together when I was seeing "multifactor" type of errors which we do not use at all.

[ChristophWurst]

Great to hear it's working now! I'll keep this ticket open because I'll take a look if we can somehow prevent this scenario.

[ChristophWurst]

I've updated the original ticket description with my findings. While I do not know an immediate solution, I'd like to keep this open if case anybody else experiences this. This should be fixed a some point.