SSO & SAML authentication new account logins not getting auto group

[The0tter0ne]

When logging in via SSO & SAML (https://apps.nextcloud.com/apps/user_saml) connected to Azure AD the new user will not be assigned a group automatically.

[stjosh]

Hi @The0tter0ne,

Thanks for getting in touch! Just to be sure: Did you enable the option „Check for correct Auto Groups membership on every login“ at the bottom of the settings? This is required for the Auto Groups app to work correctly with external user backends.

Furthermore, a logout and re-login might be necessary.

Please let me know whether or not this makes it work in your case.

[The0tter0ne]

Hi,

Yes I checked the option. I also already did a login/logout and such with multiple test accounts.

See settings attached

[stjosh]

Hmm, thanks for the update. Honestly, I did not have the chance to test it with the SSO app so far.

Do you see anything suspicious in the logs? I.e., maybe an exception is thrown which would help us?

Meanwhile, I‘ll try to reproduce your setup in the coming days.

[stjosh]

This tutorial could help to test it with Auth0: https://medium.com/@mathiasconradt/nextcloud-single-sign-on-with-auth0-a546cdf1fccf

[stjosh]

Without having studied the code in great depth, I suspect that the SSO App does not emit the events which the Auto Groups app expects (i.e., at least UserLoggedIn and, optionally, also UserCreated).

I think the UserLoggedIn event should be emitted somewhere here:

https://github.com/nextcloud/user_saml/blob/6cca2ddf69457883e94ae803e13b90fc96612a2a/lib/Controller/SAMLController.php#L302

However, this needs further investigation.

[The0tter0ne]

Hmm, thanks for the update. Honestly, I did not have the chance to test it with the SSO app so far.

Do you see anything suspicious in the logs? I.e., maybe an exception is thrown which would help us?

Meanwhile, I‘ll try to reproduce your setup in the coming days.

I've checked the logs and could find no failures or whatsoever. I've set it up almost as similar to the setup described here:
https://medium.com/@ntrussell/enable-nextcloud-sso-authentication-through-microsoft-azure-active-directory-saml-abe37d735cd

[stjosh]

I see. Well, as I said, I think that simply the events expected by the Auto Groups app are not emitted when authenticating via the SSO app. I think we should first try to verify this assumption and, if verified, open an issue in the SSO app's issue tracker to add these events (at least the PostLoginEvent).

@The0tter0ne Do you think you could assist me in testing? The easiest would be if you could add an error/warning log line in the Auto Group app's source at the beginning of the addAndRemoveAutoGroups function here: https://github.com/stjosh/auto_groups/blob/master/lib/AutoGroupsManager.php#L84

e.g.,

$this->logger->warning("TEST - The PostLoginEvent has been triggered");

Then login and see if the log line appears in your logs. If it does not, that means that the event is never emitted when authenticating via the SSO app.

This would save me the time and effort to setup a working SSO setup myself.

[The0tter0ne]

I've added the line for the logging however it cannot be found in the logs, so it appears it's not emitting that event. (Deleted the user, logged in via SSO, no groups were added, logged out the user and back in and still no groups were added)

[stjosh]

Unfortunately, I did not manage to get a SAML setup working myself. So may I ask you to help testing again? I have attached a patched version of apps/user_saml/lib/Controller/SAMLController.php: SAMLController.php.zip

Here's the diff - basically, I have just added the necessary code to emit the PostLogin event:

--- SAMLControllerOriginal.php	2020-05-18 09:29:32.000000000 +0200
+++ SAMLController.php	2020-05-18 09:30:50.000000000 +0200
@@ -42,6 +42,9 @@ use OneLogin\Saml2\Error;
 use OneLogin\Saml2\Settings;
 use OneLogin\Saml2\ValidationError;

+use OCP\User\Events\PostLoginEvent;
+use OCP\EventDispatcher\IEventDispatcher;
+
 class SAMLController extends Controller {
 	/** @var ISession */
 	private $session;
@@ -62,6 +65,8 @@ class SAMLController extends Controller
 	/** @var IL10N */
 	private $l;

+	private $eventDispatcher;
+
 	/**
 	 * @param string $appName
 	 * @param IRequest $request
@@ -85,7 +90,8 @@ class SAMLController extends Controller
 								IURLGenerator $urlGenerator,
 								IUserManager $userManager,
 								ILogger $logger,
-								IL10N $l) {
+								IL10N $l,
+								IEventDispatcher $eventDispatcher) {
 		parent::__construct($appName, $request);
 		$this->session = $session;
 		$this->userSession = $userSession;
@@ -96,6 +102,7 @@ class SAMLController extends Controller
 		$this->userManager = $userManager;
 		$this->logger = $logger;
 		$this->l = $l;
+		$this->eventDispatcher = $eventDispatcher;
 	}

 	/**
@@ -294,6 +301,8 @@ class SAMLController extends Controller
 			if($firstLogin) {
 				$this->userBackend->initializeHomeDir($user->getUID());
 			}
+
+			$this->eventDispatcher->dispatchTyped(new PostLoginEvent($user, '', false));
 		} catch (\Exception $e) {
 			$this->logger->logException($e, ['app' => $this->appName]);
 			return new Http\RedirectResponse($this->urlGenerator->linkToRouteAbsolute('user_saml.SAML.notProvisioned'));

Can you try whether replacing the SAMLController.php with this patched version fixes the issue with the Auto Groups? (Of course, make sure to backup the original one and restore it after your test... 😉)

[The0tter0ne]

This fixes it, left the log write in the line and it triggered and wrote line in the log:

The group gets automatically assigned now.

[stjosh]

Great. I'd suggest to do a last test before opening an issue in the SSO & SAML repo. Specifically, I noticed that there are two events, i.e., PostLoginEvent and UserLoggedInEvent. Currently, AutoGroups is listening to the PostLoginEvent.

I am not sure what the difference is between those two events, but I'd like to test whether or not it makes a difference if we listen to the UserLoggedInEvent instead.

Therefore, could you please,

• Restore the original SAMLController.php (in case you haven't already done so)
• Replace the two occurrences of PostLoginEvent with UserLoggedInEvent in AutoGroupsManager.php (there should be two of them)

Then, do your tests again. If the result is the same as above, I can probably simply change the event AutoGroups is listening to. If the auto groups are not assigned and the log messages do not appear anymore, that's an issue which needs to be fixed in the SSO & SAML app.

[The0tter0ne]

Changing the PostLoginEvent to UserLoggedInEvent also appears to be working. (Deleted user -> Logged in via SSO -> Login successful with folders) Also provides logfile, would be nice to have an info log if a new user is logging in via this method and gets group(s) but that's probably up to the SSO & SAML app.

[stjosh]

@The0tter0ne Great!! Just to double-check: SAMLController.php is back to its original state? If so, I'll change the event type, make sure all tests pass and publish a new release tonight.

would be nice to have an info log if a new user is logging in via this method and gets group(s) but that's probably up to the SSO & SAML app.

Well, Auto Groups writes logs, but only with log level notice: https://github.com/stjosh/auto_groups/blob/master/lib/AutoGroupsManager.php#L102 . You'll probably have to adjust your loglevel in config.php to 1 in order to see it - see also https://docs.nextcloud.com/server/stable/admin_manual/configuration_server/logging_configuration.html

[The0tter0ne]

@The0tter0ne Great!! Just to double-check: SAMLController.php is back to its original state? If so, I'll change the event type, make sure all tests pass and publish a new release tonight.

would be nice to have an info log if a new user is logging in via this method and gets group(s) but that's probably up to the SSO & SAML app.

Well, Auto Groups writes logs, but only with log level notice: https://github.com/stjosh/auto_groups/blob/master/lib/AutoGroupsManager.php#L102 . You'll probably have to adjust your loglevel in config.php to 1 in order to see it - see also https://docs.nextcloud.com/server/stable/admin_manual/configuration_server/logging_configuration.html

Yes I've put the original file back and only put in the edit with the changed Event. Thanks for the support.

However a new problem came up, when using this the users additional groups get removed as soon as you re-login. Also with the fix it suddenly stopped working as a whole. I removed app and re-enabled it and applied the fix but no luck after this.

After re-applying the patched version of the user_saml app it started working again.

[stjosh]

Sorry, now I‘m lost. 🤔

• When exchanging the event, auto groups were set, but all other groups were removed at the same time?
• When pathing user_saml, everything is working as expected?

It might help if you could give a more specific, verbose example, i.e., which groups were set in Auto Groups, which groups did the user have in addition, what was the state after login, what was the expected state after login, etc.

Thanks!

[The0tter0ne]

The fix appeared to work at first but didn't after I tried again today. So I re-applied the user_saml edit for the other app for SSO which appears to do the job all the time in regards to assigning groups automatically in combination with this app.

However, when assigning the user additional groups and the users then logs out and logs back in. All groups, other than the one selected in the auto_group app, gets removed.

The expected state after re-login was the user would have the assigned group from the earlier assigned auto group and additional group memberships assigned manual. This does not work with either the user_saml app edit or auto_group edit earlier.

[stjosh]

That leaves me puzzled. 🤔

The Auto Groups app will only ever remove users from a configured Auto Group. So, a few questions:

• Are the additional groups also "lost" if no group is configured as Auto Group or Override Group (i.e., if both configuration fields are empty)?
• Are the additional groups also "lost" if the Auto Groups app is disabled / uninstalled?
• What do the logs say if you set the log level to 1 (INFO) or even 0 (DEBUG) in config.php?

Unfortunately, I don't have the time at the moment to try getting a SAML setup working and reproduce the issue(s). I tried yesterday for 1.5hours and failed miserably...

[The0tter0ne]

I've illustrated the issue for you below.

• Settings:
  
• New user logs in via SSO, user gets assigned group
  
• Additional groups / permissions are given to the user:
  
• User then logs out, logs back in. Added groups are gone:
  

Find logs attached, I've briefly looked through them but cannot pinpoint the issue:
Nextcloud-Log.txt

Hope this makes it more clear.

[stjosh]

Many thanks for the pics & logs. Your pictures confirm that my understanding of the issue is correct. However, I do honestly doubt that AutoGroups is responsible for the "lost" groups:

• In the logs, there's multiple occurrences of AutoGroups adding the user to the Medewerkers group:

{"reqId":"pPkCPhNCIzAW35EjfFh5","level":1,"time":"2020-05-19T07:10:13+00:00","remoteAddr":"REMOTE.IP","user":"test.user@test.mail","app":"auto_groups","method":"POST","url":"/apps/user_saml/saml/acs","message":"Add user test.user@test.mail to auto group Medewerkers","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0","version":"18.0.4.2"}

• However, there's no indication of auto_groups removing any user from any group (that would trigger a similar log line as the one above)
• Finally, there's the following line, indicating to me that user_saml is actually fetching the group assignments from the SAML backend and seeing that it's empty:

{"reqId":"pPkCPhNCIzAW35EjfFh5","level":0,"time":"2020-05-19T07:10:13+00:00","remoteAddr":"REMOTE.IP","user":"test.user@test.mail","app":"user_saml","method":"POST","url":"/apps/user_saml/saml/acs","message":"Group attribute content: []","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0","version":"18.0.4.2"}

shortly followed by the following lines, indicating that the user was removed from some group, because the group attribute's content is empty:

{"reqId":"pPkCPhNCIzAW35EjfFh5","level":0,"time":"2020-05-19T07:10:13+00:00","remoteAddr":"REMOTE.IP","user":"test.user@test.mail","app":"no app in context","method":"POST","url":"/apps/user_saml/saml/acs","message":"Deprecated event type for OCP\\IGroup::preRemoveUser: Symfony\\Component\\EventDispatcher\\GenericEvent","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0","version":"18.0.4.2"}
{"reqId":"pPkCPhNCIzAW35EjfFh5","level":0,"time":"2020-05-19T07:10:13+00:00","remoteAddr":"REMOTE.IP","user":"test.user@test.mail","app":"no app in context","method":"POST","url":"/apps/user_saml/saml/acs","message":"Deprecated event type for OCP\\IGroup::postRemoveUser: Symfony\\Component\\EventDispatcher\\GenericEvent","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:76.0) Gecko/20100101 Firefox/76.0","version":"18.0.4.2"}

And right after these lines, the auto_groups does its duty and adds the configured Auto Group again. 😄

Thus, I'd propose to test the same workflow again with the "Auto Groups" app disabled, i.e., login, assign some groups, log out and log in again. If the groups are gone, it's probably the SAML app assigning the groups received by the SAML backend (e.g., the Azure AD). I'm pretty sure there's an option to disable this behavior.

[The0tter0ne]

Ah, it appears the mapping to groups messed it up in the SAML SSO app. Removed the mapping to group and this resolved it:

Furthermore, I checked with your previous fix with "Replace the two occurrences of PostLoginEvent with UserLoggedInEvent in AutoGroupsManager.php (there should be two of them)"; this works with the current setup.

Thanks for the support!

[stjosh]

Okay. great. Now we have a plan to fix it. 😃

[stjosh]

Release 1.2.0 is built and should fix your issue. It basically contains the fix that you have currently applied anyway.

Unfortunately, the nextcloud app store API seems to be down at the moment, so I can't push it to the app store.

I will close this issue once you have confirmed that Auto Groups works nicely with SAML using v1.2.0 from the official Nextcloud App store.

[stjosh]

v1.2.0 is now published to the App Store. Could you please verify and confirm that this is working with an unmodified user_saml? Many thanks!

[The0tter0ne]

The unmodified user_saml was already set back. Furthermore I checked and when removing the user and then logging in group gets assigned via SSO via Azure AD. Also when additional groups are assigned the group permission remains after a logging in and out.

Thanks for the fix!

[stjosh]

Great! 🥳

PS A positive rating in the app store would be appreciated 😉

[The0tter0ne]

After doing additional testing with other users it appears new users still do not get the auto group. The fix doesn't appear to do the trick unfortunately as the function is not called upon. Do you have any other ideas? Or should the user_saml app be updated perhaps?

[stjosh]

Hmm, nope, no other ideas except opening an issue for the user_saml app, saying that neither UserLoggedInEvent nor PostLoginEvent is emitted for user logins and asking whether or not this is intended behavior...

I think it might make sense if you opened that issue, since you will be able to test any proposals by the SAML team. I‘ll follow it as well, though, since I am curious about how this turns out. 😉

[The0tter0ne]

Thanks for the follow up, as you can see above I've created an issue with the app.

[menace133780]

sadly, I´m facing the same Problem at the moment on NC 19.0.3 an app version 1.2.0;
my nextcloud SAML accounts don`t get the configured default group;
when I make a new user in the nextcloud backend, this new user gets the configured default group;
the SAML accounts don´t get the group;

[stjosh]

@menace133780 Unfortunately, there‘s not much I can do about this. You may try to leave a note on nextcloud/user_saml#426 to increase the visibility on the user_saml side.

[stjosh]

@outofcontrol Seems that you have a working setup with SAML SSO and auto_groups? Could you please share a bit more about your configuration, i.e. which Core and App versions you are using?

Maybe, meanwhile the problem has been fixed either in core or in the user_saml app.

[stjosh]

@The0tter0ne and/or @menace133780 - maybe, if having this fixed would still provide value for you, you might want to try it again as it seems to work with recent versions of Nextcloud and the SAML SSO app.

[outofcontrol]

Nextcloud:
Nextcloud 24.0.5
SSO & SAML authentication 5.0.3
Auto Groups 1.4.1

Server:
Ubuntu 22.04.1 LTS
PHP 8.1
Apache/2.4.52

(Apologies for switching to my work on the other issue. Too many accounts)

[stjosh]

Great, many thanks for your config details!

[stjosh]

Closing this issue after more than a year without any feedback.