Steps to reproduce
- Upgrade Nextcloud from 14 to 15 with previously working U2F authentication.
- Attempt to log in.
- Receive error message "Sign failed."
Expected behaviour
Tell us what should happen
U2F should work.
Actual behaviour
Tell us what happens instead
Error message "Sign failed" and unable to log in.
Server configuration
Operating system: Ubuntu 18.04
Web server: Apache
Database: MariaDB
PHP version: 7.2
Version: (see admin page) App version 2.1.0, Nextcloud version 15
Updated from an older version or fresh install: Updated and fresh install (removed app and reinstalled as troubleshooting after Nextcloud upgrade)
List of activated apps:
If you have access to your command line run e.g.:
sudo -u www-data php occ app:list
from within your server installation folder
Enabled:
- accessibility: 1.1.0
- cloud_federation_api: 0.1.0
- comments: 1.5.0
- dav: 1.8.0
- federatedfilesharing: 1.5.0
- files: 1.10.0
- files_pdfviewer: 1.4.0
- files_sharing: 1.7.0
- files_texteditor: 2.7.0
- files_trashbin: 1.5.0
- files_versions: 1.8.0
- files_videoplayer: 1.4.0
- gallery: 18.2.0
- logreader: 2.0.0
- lookup_server_connector: 1.3.0
- nextcloud_announcements: 1.4.0
- notes: 2.5.1
- notifications: 2.3.0
- oauth2: 1.3.0
- password_policy: 1.5.0
- passwords: 2019.1.0
- phonetrack: 0.4.0
- provisioning_api: 1.5.0
- serverinfo: 1.5.0
- spreed: 5.0.0
- support: 1.0.0
- systemtags: 1.5.0
- twofactor_backupcodes: 1.4.1
- twofactor_totp: 2.1.0
- twofactor_u2f: 2.1.0
- updatenotification: 1.5.0
- workflowengine: 1.5.0
Disabled:
- activity
- admin_audit
- encryption
- federation
- files_external
- firstrunwizard
- sharebymail
- survey_client
- theming
- user_external
- user_ldap
The content of config/config.php:
If you have access to your command line run e.g.:
sudo -u www-data php occ config:list system
from within your Nextcloud installation folder
or
Insert your config.php content here
Make sure to remove all sensitive content such as passwords. (e.g. database password, passwordsalt, secret, smtp password, …)
{
"system": {
"instanceid": "REMOVED SENSITIVE VALUE",
"passwordsalt": "REMOVED SENSITIVE VALUE",
"secret": "REMOVED SENSITIVE VALUE",
"trusted_domains": [
"[REDACTED]"
],
"datadirectory": "REMOVED SENSITIVE VALUE",
"overwrite.cli.url": "[REDACTED]",
"dbtype": "mysql",
"version": "15.0.0.10",
"dbname": "REMOVED SENSITIVE VALUE",
"dbhost": "REMOVED SENSITIVE VALUE",
"dbport": "",
"dbtableprefix": "oc_",
"dbuser": "REMOVED SENSITIVE VALUE",
"dbpassword": "REMOVED SENSITIVE VALUE",
"installed": true,
"memcache.local": "\OC\Memcache\APCu",
"mail_smtpmode": "smtp",
"mail_smtpauthtype": "LOGIN",
"maintenance": false,
"htaccess.RewriteBase": "/",
"theme": "",
"loglevel": 2,
"updater.release.channel": "stable",
"updater.secret": "REMOVED SENSITIVE VALUE"
}
}
Client configuration
Browser:
Pale Moon 28.2.1, using Firefox U2F Support Add-on 1.0.1
Operating system:
Linux Mint 17.1
Logs
Web server error log
Insert your webserver log here
(Nothing related to this issue in error log)
Server log (data/nextcloud.log)
Insert your server log here
(Nothing related to this issue in access log)
Browser log
Insert your browser log here, this could for example include:
a) The javascript console log
b) The network log
could not sign u2f challenge Error: Sign failed
Stack trace:
u@https://[REDACTED]/apps/twofactor_u2f/js/challenge.js?v=160f7233:33:14231
e.sign/</</<@https://[REDACTED]/apps/twofactor_u2f/js/challenge.js?v=160f7233:33:15283
challenge.js:60:17630
Error: Sign failed
Log from U2F add-on:
EB1 sign https://[REDACTED] [{challenge:"[REDACTED]", appId:"[REDACTED]"}] null
EB2 /home/[REDACTED]/extensions/[email protected]/bin/linux_x86_64-gcc3/u2f
EB3 ({killed:false, exitCode:(void 0), signalCode:(void 0), stdin:{readable:false, writable:false, encoding:null}, stdout:{readable:false, writable:false, encoding:null}, stderr:{readable:false, writable:false, encoding:null}})
stdin s001b00010061 https://[REDACTED]{"challenge":"[REDACTED]","appId":"https://[REDACTED]"}
EBD e0046{"errorCode": 2, "errorMessage":"authenticate:error in JSON handling"}
exit 1 null
-----EDIT-----
I stepped through the Javascript involved with the authentication and found that neither the key_handle value nor the version value are being properly passed from the Nextcloud U2F app functions to the authenticator addon functions. The values of both of those remain undefined in the U2F addon functions and hence the authentication fails as no key_handle value is presented to the U2F device.
I was able to successfully log in using the following process:
- Open the Javascript debugger in Pale Moon.
- Load the Nextcloud login page.
- Set a breakpoint on line 68 of content-worker.js from the Add-on SDK. The file path is resource://gre/modules/commonjs/sdk/content/content-worker.js (This exact line was found by single-stepping from another breakpoint set in the content-script.js from the U2F addon.)
- Enter valid user credentials.
- Single-step (F11) through the code until the variable k = "keyHandle".
- Change the value of the variable v from undefined to the string value of key_handle found in the oc_twofactor_u2f_registrations table in the Nextcloud database.
- Click the resume button (F8) to continue to run the rest of the code normally. This triggers the prompt to push the button on the U2F device and allows the login to continue as expected. I had to click the run option in the debugger a couple more times as the breakpoint was hit again during the login process.
I found that steps 5 through 7 must be completed in under 30 seconds to avoid triggering a timeout and causing the login process to fail.