#goauthentik + nextcloud + SAML + webdav agenda

1 messages · Page 1 of 1 (latest)

shell oyster
#

Hello, anyone already made agenda work with SAML ?

I can't figure out how to authenticate.
No problem connecting from browser, but I can't login from thunderbird.

I'm using https://fqdn/remote.php/dav to connect. It was working before when i was using LDAP as authentication backend.

Nextcloud is installed in a VM with Apache reverse proxy to php-fpm :

<VirtualHost local_ip1:80>
  DocumentRoot /var/www/nextcloud/
  ServerName  fqdn

  <Directory /var/www/nextcloud/>
    Require all granted
    AllowOverride All
    Options FollowSymLinks MultiViews

    <IfModule mod_dav.c>
      Dav off
    </IfModule>
  </Directory>
</VirtualHost>
#

There's a nginx reverse proxy in front of this VM :

server {

    listen local_ip2:80;
    server_name fqdn;
    access_log /var/log/nginx/nextcloud.access.log ltsv;
    error_log /var/log/nginx/nextcloud.error.log;

    server_tokens off;

    proxy_buffers 8 16k;
    proxy_buffer_size 32k;

    error_page 418 = @blockAccess;

    location /login {
        proxy_pass http://local_ip1/login;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
        # Prevent direct login
        set $forbidden 1;
        if ($arg_direct = "") {
           set $forbidden 0;
        }
        if ($arg_direct = 0) {
            set $forbidden 0;
        }
        if ($forbidden) {
           return 418;
        }
    }

    location /.well-known/carddav {
        return 301 https://$host/remote.php/dav;
    }
    
    location /.well-known/caldav {
        return 301 https://$host/remote.php/dav;
    }

    location / {
        proxy_pass http://local_ip1;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
        client_max_body_size 10240M;
        client_body_timeout 300s;
        client_body_buffer_size 512k;
    }

    location @blockAccess {
         deny all;
    }
}
#

Using tcpdump I can see there's no header for authentication :

20:52:41.631368 eth-met In  IP nextcloud.http > rvprx.44736: Flags [P.], seq 1:1692, ack 889, win 503, options [nop,nop,TS val 2526802502 ecr 2849238942], length 1691: HTTP: HTTP/1.1 401 Unauthorized
E...<.@.@...
2.

2...P..v...H.......35.....
...F....HTTP/1.1 401 Unauthorized
Date: Mon, 20 Nov 2023 19:52:41 GMT
Server: Apache/2.4.57 (Debian)
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Security-Policy: default-src 'none';
WWW-Authenticate: Basic realm="Nextcloud", charset="UTF-8"
Set-Cookie: oc_sessionPassphrase=xxxxxxxxxxxx%2xxxxxxxxxxxx%xxxxxxxxxxxxx%2Bvjbxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx; path=/; secure; HttpOnly; SameSite=Lax
Set-Cookie: __Host-nc_sameSiteCookielax=true; path=/; httponly;secure; expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=lax
Set-Cookie: __Host-nc_sameSiteCookiestrict=true; path=/; httponly;secure; expires=Fri, 31-Dec-2100 23:59:59 GMT; SameSite=strict
Set-Cookie: xxxxxxxxxxxxxxkc=xxxxxxxxxxxxxxxxxxxxxxxxx; path=/; secure; HttpOnly; SameSite=Lax
Referrer-Policy: no-referrer
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Permitted-Cross-Domain-Policies: none
X-Robots-Tag: noindex, nofollow
X-XSS-Protection: 1; mode=block
Connection: close
Content-Type: application/xml; charset=utf-8

<?xml version="1.0" encoding="utf-8"?>
<d:error xmlns:d="DAV:" xmlns:s="http://sabredav.org/ns">
  <s:exception>Sabre\DAV\Exception\NotAuthenticated</s:exception>
  <s:message>No public access to this resource., No 'Authorization: Basic' header found. Either the client didn't send one, or the server is misconfigured, No 'Authorization: Bearer' header found. Either the client didn't send one, or the server is mis-configured, No 'Authorization: Basic' header found. Either the client didn't send one, or the server is misconfigured</s:message>
</d:error>
#

I can't find any documentation about nextloud webdav and goauthentik

serene anchor
shell oyster
#

Then I must be missing something in my config

serene anchor
#

i have my NC setup with authentik saml and i have the calendar integrated in thundirbird.

serene anchor
#

what password are you using?

shell oyster
#

I tried with the standard password and an app password

serene anchor
#

you'll have to generate one time app password in nextcloud

#

sounds like you're doing it right then.

shell oyster
#

Ha you saved me ! I was missing the app password in nextcloud

serene anchor
#

haha glad to hear that

shell oyster
#

It works !