Admin asked for password even though logged in with SAML

[wiswedel]

Steps to reproduce

1. Login as Admin user by SAML
2. let some time go by
3. make an administrative change (e.g. install an app)

Actual behaviour

Admin gets asked for password confirmation before change can be applied.

Expected behaviour

Basically that confirmation dialog is a good thing, but if the admin is logged in via SAML, they don't have a password to provide. There should at least be some hint on the SAML config page that admins should store a generic password for those cases.

[schiessle]

Is this still the case... IIRC this was fixed long ago but I don't have a system to test it at the moment

[dugite-code]

@schiessle I'm still experiencing this with NC 24.0.4 and user_saml 5.0.2

[zroug]

I'm still experiencing this too on NC 24.0.4 and user_saml 5.0.2. However it only happens after a while of being logged in. Logging out and back in fixes this issue temporarily for me. Edit: Just seen that the delay was already stated in the main issue.

[fastlorenzo]

Same issue for me with 24.0.5

[pierreozoux]

same with 24.0.9

[zroug]

It looks like this problem also affects non-admin users. This is what I noticed after a user has been logged in for a while:

1. When a user tries to create an app password, he is prompted for a password.
2. The logout button doesn't use single logout, so the user doesn't get logged out properly.

Latest test with v5.1.2 and NC v25.0.4.

[GeorgeGedox]

This affects admins for administrative actions, ie. install an app but also the normal users that want to generate app passwords for use with 3rd party clients and apps.

I'm surprised this problem has gone unresolved since 2019, could someone have a look at this please?

[dugite-code]

@GeorgeGedox I'm sure this is actually an issue with Nextcloud itself as I've switched to Social login for OIDC and I'm also encountering this there. It looks like there was work done a long time ago on this: https://github.com/nextcloud/server/pull/7487 By my admittedly quick skimming over this it looks like the user backend is checked and if the user is a saml user then password confirmation is not required.

However I believe that my user is only LINKED to my SSO therefore the original user backend will never be SSO exclusive. This would be true with both SAML and now with OIDC where the user backend is shown as Database. You can see your users backend under the user management tab (Click settings and select show user backend)

*EDIT: Looks like the social login app actually had implemented this as a fix on a per-user basis. https://github.com/zorn-v/nextcloud-social-login/blob/fac1c374c5afd84417aeb0236c71f4be1db2e224/lib/AppInfo/Application.php#L48

[j007bond007]

This is an issue for me using SAML with Authentik, try to update a user's quota and it wont accept my pw

[blizzz]

*EDIT: Looks like the social login app actually had implemented this as a fix on a per-user basis. https://github.com/zorn-v/nextcloud-social-login/blob/fac1c374c5afd84417aeb0236c71f4be1db2e224/lib/AppInfo/Application.php#L48

SAML backend does the same: https://github.com/nextcloud/user_saml/blob/master/lib/UserBackend.php#L493C11-L493C30

Those effected, are you using env mode or built-in saml mode?

[blizzz]

Closing in favor of https://github.com/nextcloud/server/issues/43612 – oidc suffers as well and solution might be possible on server side. PR soon.