Allow Client Certificate Login with NextCloud

[seifer44]

Scope

• I'm sure that this feature request belongs here and not into Discussions.

Description

I'm running a NextCloud server that requires a client certificate to log in, in addition to NextCloud's normal authentication.

When I attempt to run a Provider-specific login for NextCloud against a URL of https://example.com/, I'm granted with an error

Couldn't obtain login URL.

Advanced Login already supports client certificates. I'm guessing this wouldn't be too much work to add in 😄

Further info

When I run an Advanced Login of https://example.com/remote.php/dav/calendars/USERNAME/CALENDARNAME, type in my Nextcloud username and password, and select a client certificate installed on the device, this is also not successful.

Nginx Proxy Configuration Example

The following is configured on my internet-facing NGINX. This hands off to Apache hosting Nextcloud. It's important to note that my mobile Android clients are able to log into Nextcloud with client certs on the Nextcloud mobile app.

server {
  listen 443 ssl http2;
  ssl_certificate /etc/example.com_fullchain.pem;
  ssl_certificate_key /etc/example.com_privkey.pem;
  ssl_client_certificate /etc/ssl/certs/private-ca.crt;
  ssl_verify_client on;

  ssl_dhparam /etc/ssl/certs/dhparam-2048.pem;

  location / {
    proxy_pass https://example.com:443;
    proxy_redirect off;

    proxy_set_header Upgrade           $http_upgrade;
    proxy_set_header Connection        "upgrade";
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header        X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-Host  $host;
    proxy_set_header X-Forwarded-Port  $server_port;
    proxy_hide_header x-powered-by;
  }
}

[rfc2822]

Advanced Login already supports client certificates. I'm guessing this wouldn't be too much work to add in 😄

I wonder why this isn't working already. What do the verbose logs say? Is a certificate sent? How does the server deny the request?

Which DAVx5 version did you try? Sounds like #787

[seifer44]

This is when I try to run a provider-specific login.

192.168.1.162 - - [07/Jun/2024:21:37:32 +0000] "POST /index.php/login/v2 HTTP/2.0" 400 230 "-" "DAVx5/4.4.0.1-ose (2024/06/05; dav4jvm; okhttp/4.12.0) Android/14" "-"

Huh, now advanced login is working. It wasn't with 4.3.16, but my phone updated to 4.4.0.1.

[rfc2822]

This is when I try to run a provider-specific login.

"Login with Nextcloud" doesn't support client certificates. It lets a browser do the login and only gets the token from the browser, but not a possible certificate.

Huh, now advanced login is working. It wasn't with 4.3.16, but my phone updated to 4.4.0.1.

Fine, please always use advanced login when using a client certificate.