How to get new users set up using SSO with NextCloud

adam42

I'm trying to set up a controlled Flarum and NextCloud platform, where I am using the Third Party Login Only plugin and the NextCloud oAuth plugin to do SSO.

It seems the obvious approach is to let new users set themselves up on Flarum after they've been signed up on NextCloud. This seems to work as new users are presented with the "Sign Up" dialog after granting access from NextCloud, and their details are automatically populated in the Sign Up form.

However when the new user clicks "Sign Up", an error message occurs: "Oops! Something went wrong. Please reload the page and try again." Yet this actually creates the user account on Flarum and everything seems to be OK on the second attempt - the user just logs in and is presented with the "Choose Flags to follow" dialog.

How can I work out what went wrong and hopefully correct it?

Thanks
Adam

luceos

adam42 How can I work out what went wrong and hopefully correct it?

Debug and the logs will be helpful, see: https://docs.flarum.org/troubleshoot

adam42

Well the only thing I've got is from apache.error.log:

[Tue Sep 06 18:37:37.615067 2022] [proxy_fcgi:error] [pid 56155:tid 139873861424896] [client 51.155.201.220:56892] AH01071: Got error 'PHP message: PHP Fatal error: Cannot use ::class with dynamic class name in /home/carbonc/sites/flarum/storage/views/9b7fa1be6c50ebe5e1807399018192674d974eaa.php on line 5', referer: https://forum.ecocounts.community/

Guess I'll have to try debugging.

adam42

and with debug, the dialog error message is: 500 POST https://forum.ecocounts.community/register

Nothing else though - no errors in the php-fpm.slow.log or php-fpm.mail.log, and no entry for /register in the php-fpm.access.log

And nothing in storage/logs

luceos

Can you share the output of php flarum info please.

adam42

`carbonc@webarch7:~/sites/flarum$ php flarum info
Flarum core 1.2.1
PHP version: 7.4.30
MySQL version: 5.5.5-10.5.15-MariaDB-0+deb11u1
Loaded extensions: Core, date, libxml, openssl, pcre, zlib, filter, hash, pcntl, Reflection, SPL, session, standard, sodium, mysqlnd, PDO, xml, apcu, bcmath, bz2, calendar, ctype, curl, dom, mbstring, FFI, fileinfo, ftp, gd, geoip, gettext, gmp, iconv, imagick, imap, intl, json, ldap, exif, mysqli, pdo_mysql, pdo_sqlite, apc, posix, readline, shmop, SimpleXML, soap, sockets, sqlite3, sysvmsg, sysvsem, sysvshm, tokenizer, uploadprogress, xmlreader, xmlrpc, xmlwriter, xsl, zip, Phar, Zend OPcache
+---------------------------------------+---------+--------+
| Flarum Extensions | | |
+---------------------------------------+---------+--------+
| ID | Version | Commit |
+---------------------------------------+---------+--------+
| flarum-flags | v1.2.0 | |
| flarum-subscriptions | v1.2.0 | |
| flarum-tags | v1.2.0 | |
| fof-oauth | 1.2.2 | |
| flarum-suspend | v1.2.0 | |
| flarum-approval | v1.2.0 | |
| fof-follow-tags | 1.1.1 | |
| v17development-third-party-login-only | v0.1.1 | |
| justoverclock-guestengagement | 1.0.3 | |
| frie-nextcloud-oauth | 0.2 | |
| fof-user-directory | 1.2.2 | |
| fof-upload | 1.1.0 | |
| fof-subscribed | 1.1.0 | |
| fof-split | 1.0.1 | |
| fof-pretty-mail | 1.0.1 | |
| fof-pages | 1.0.3 | |
| fof-links | 1.0.3 | |
| fof-default-user-preferences | 1.0.0 | |
| fof-cookie-consent | 1.1.0 | |
| flarum-sticky | v1.2.0 | |
| flarum-statistics | v1.2.0 | |
| flarum-nicknames | v1.2.0 | |
| flarum-mentions | v1.2.0 | |
| flarum-markdown | v1.2.0 | |
| flarum-lock | v1.2.0 | |
| flarum-likes | v1.2.0 | |
| flarum-lang-english | v1.2.0 | |
| flarum-emoji | v1.2.0 | |
| flarum-bbcode | v1.2.0 | |
| clarkwinkelmann-mailing | 1.0.0 | |
| clarkwinkelmann-follow-tags-prompt | 1.0.1 | |
| clarkwinkelmann-create-user-modal | 1.3.1 | |
+---------------------------------------+---------+--------+
Base URL: https://forum.ecocounts.community
Installation path: /home/carbonc/sites/flarum
Queue driver: sync
Mail driver: smtp
Debug mode: ON

Don't forget to turn off debug mode! It should never be turned on in a production system.
carbonc@webarch7:~/sites/flarum$
`

luceos

Looks like third-party-login-only disables the user create endpoint, unless it's used with a token (using outside API)...

https://github.com/v17development/flarum-third-party-login-only/blob/8bb5c1dc7c4633e3273a38aa276dd676badb68e3/src/Api/CreateUserController.php#L40-L43

It actually makes sense for the API route to be disabled, you will need to make the Sign Up button link to the NextCloud sign up form. Not sure it allows to be redirect back again once signed up, but that would be a common flow.

adam42

Ah, ok. That's logical at least.

My use case requires admin creation of user accounts, so there is no sign up form on NextCloud.

It looks like I will have to add the Flarum user creation to the admin onboarding process, temporarily disabling the Third Party Login plugin and disabling sign up in the Permissions at that point in order to add them manually using the Create User Modal plugin.

I guess it's not a big deal - the admin task already requires account creation on the mediawiki and Wordpress platforms in the SSO realm.

luceos

adam42 you can theoretically use doorman to send invites to users, or private forum facade to completely block off the community unless you have an account. Not entirely sure this matches your use case 😉

https://extiverse.com/extension/fof/doorman
https://extiverse.com/extension/sycho/flarum-private-facade

adam42

We have a "General" tab which is viewable to the public, and hopefully acts as a sort of advertisement for our group, so complete privacy isn't in our use case, no.

The issue with Doorman and invitation codes is that the user could then sign up with a different email address (I assume) which would break the SSO that relies on the email address (or the same applies if SSO uses the username from NextCloud but the user has chosen a different one).

luceos

adam42 hm yeah, that's true Perhaps something custom could be made that invites users based on your NextCloud data...

adam42

Regarding the user registration / create new user functionality - I'm not seeing the logic with the Sign Up permissions being boolean open/closed and when closed, disabling admin registration of new users.

Shouldn't there be group-based permissions on the create new user function that is independent of the Sign Up function?