SAML App generates double URL on Loginpage

[ALX-495]

How to use GitHub

• Please use the 👍 reaction to show that you are affected by the same issue.
• Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
• Subscribe to receive notifications on status change and new comments.

---

Steps to reproduce

1.Configure SAML and keep the loginpage enabled.
2.Login with MS Entra ID Button => https://name.domain.com/apps/user_saml/saml/login?idp=1&method=get&originalUrl=https://name.domain.com/https://name.domain.com/&requesttoken=
3.Get redirected to double URL. Obviously the space https://name.domain.com/ does not exist. And it requests to go back. But this causes issues for the Nextcloud app.

Expected behaviour

Tell us what should happen
The loginpage should direct to the correct URL https://name.domain.com/ when using Microsoft Entra ID.

Actual behaviour

Tell us what happens instead, if possible also add a screenshot
It does in fact direct towards https://name.domain.com/https://name.domain.com/.
I noticed that the button already generates the incorrect URL: https://name.domain.com/apps/user_saml/saml/login?idp=1&method=get&originalUrl=https://name.domain.com/https://name.domain.com/&requesttoken=

Server configuration

    "system": {
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "scvnextcloud01:8443",
            "name.domain.com"
        ],
        "dbtype": "mysql",
        "version": "34.0.1.2",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "skeletondirectory": "",
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 6379
        },
        "memcache.local": "\\OC\\Memcache\\APCu",
        "filelocking.enabled": true,
        "upgrade.disable-web": true,
        "maintenance": false,
        "app_install_overwrite": [],
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpmode": "smtp",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "25",
        "mail_sendmailmode": "smtp",
        "mail_smtpstreamoptions": {
            "ssl": {
                "allow_self_signed": false,
                "verify_peer": true,
                "verify_peer_name": true
            }
        },
        "forbidden_filename_basenames": [
            "con",
            "prn",
            "aux",
            "nul",
            "com0",
            "com1",
            "com2",
            "com3",
            "com4",
            "com5",
            "com6",
            "com7",
            "com8",
            "com9",
            "com\u00b9",
            "com\u00b2",
            "com\u00b3",
            "lpt0",
            "lpt1",
            "lpt2",
            "lpt3",
            "lpt4",
            "lpt5",
            "lpt6",
            "lpt7",
            "lpt8",
            "lpt9",
            "lpt\u00b9",
            "lpt\u00b2",
            "lpt\u00b3"
        ],
        "forbidden_filename_characters": [
            "<",
            ">",
            ":",
            "\"",
            "|",
            "?",
            "*",
            "\\",
            "\/"
        ],
        "forbidden_filename_extensions": [
            " ",
            ".",
            ".filepart",
            ".part"
        ],
        "twofactor_enforced": "true",
        "twofactor_enforced_groups": [
            "guest_app",
            "admin",
            "Extern",
            "Pankl"
        ],
        "twofactor_enforced_excluded_groups": [],
        "maintenance_window_start": 2,
        "serverid": "0",
        "default_phone_region": "AT",
        "default_language": "en",
        "default_timezone": "Europe\/Vienna",
        "default_locale": "en_AT",
        "loglevel": 2,
        "overwritehost": "name.domain.com",
        "overwriteprotocol": "https",
        "overwrite.cli.url": "https:\/\/name.domain.com"
    }
}

Web server: Nginx

Database: MariaDB

PHP version: 8.4.16

Nextcloud version: 34.0.1

List of activated apps

root@c10df333dab1:/# occ app:list
Enabled:

• activity: 7.0.0
• appstore: 1.0.0
• bruteforcesettings: 7.0.0
• circles: 34.0.0
• cloud_federation_api: 1.18.0
• contacts: 8.7.4
• dav: 1.39.0
• federatedfilesharing: 1.24.0
• files: 2.6.0
• files_antivirus: 6.3.2
• files_automatedtagging: 5.0.0
• files_downloadlimit: 5.2.0-dev.0
• files_lock: 34.0.0
• files_pdfviewer: 7.0.0-dev.0
• files_retention: 5.0.0
• files_sharing: 1.26.0
• files_trashbin: 1.24.0
• files_versions: 1.27.0
• groupfolders: 22.0.3
• guests: 4.8.0
• logreader: 7.0.0
• lookup_server_connector: 1.22.0
• notifications: 7.0.0-dev.1
• oauth2: 1.22.0
• password_policy: 6.0.0-dev.0
• privacy: 6.0.0-dev.1
• profile: 1.3.0
• provisioning_api: 1.24.0
• serverinfo: 6.0.0
• settings: 1.17.0
• sharebymail: 1.24.0
• survey_client: 6.0.0-dev.0
• systemtags: 1.24.0
• text: 8.0.0
• theming: 2.9.0
• twofactor_backupcodes: 1.23.0
• twofactor_totp: 16.0.0
• updatenotification: 1.24.0
• user_saml: 8.2.0
• viewer: 7.0.0-dev.0
• workflowengine: 2.16.0
  Disabled:
• admin_audit: 1.24.0
• app_api: 34.0.0 (installed 34.0.0)
• comments: 1.24.0 (installed 1.24.0)
• contactsinteraction: 1.15.0 (installed 1.15.0)
• dashboard: 7.14.0 (installed 7.14.0)
• encryption: 2.22.0
• federation: 1.24.0 (installed 1.24.0)
• files_external: 1.26.0
• files_reminders: 1.7.0 (installed 1.7.0)
• firstrunwizard: 7.0.0-dev.0 (installed 7.0.0-dev.0)
• nextcloud_announcements: 6.0.0 (installed 6.0.0)
• office: 1.0.0 (installed 1.0.0)
• photos: 7.0.0 (installed 7.0.0)
• recommendations: 7.0.0 (installed 7.0.0)
• related_resources: 5.0.0-dev.0 (installed 5.0.0-dev.0)
• support: 6.0.0 (installed 6.0.0)
• suspicious_login: 12.0.0-dev.0
• twofactor_nextcloud_notification: 8.0.0
• user_ldap: 1.25.0 (installed 1.25.0)
• user_status: 1.14.0 (installed 1.14.0)
• weather_status: 1.14.0 (installed 1.14.0)
• webhook_listeners: 1.6.0 (installed 1.6.0) ```

Browser

Browser name: Firefox/Edge

Browser version: 140.12.0esr/150.0.4078.83

Operating system: Windows

Workaround: (from my post https://help.nextcloud.com/t/double-url-with-saml-app-azure-loginpage-wrong-redirect/247252)
It was suggested to me to open this issue on github. Carlschwan is already on it as far as I gathered.

Since I had a double URL I searched where this is generated.
Which is: **/opt/nextcloud/config/www/nextcloud/apps/user_saml/lib/AlternativeLogin/AlternativeLoginProvider.php

Specifically this part:

I changed to

I have no deep knowledge of php. But what happens at $absoluteRedirectUrl seems to generate the double URL for me. Also I noticed without this part the URL from myapps would fail and only direct to the loginpage. But the SSO from the loginpage would work as expected when I get the Entra ID logon.

I am just really wondering if this is an actual bug or a config mistake.
I checked the logs if I found anything relevant to that. But it seems literally just this one URL generating thing.

[ALX-495]

I think the fix is being made here.
#1196
So this is probably something that will be fixed soon.