Login Flow v2

[mahibi]

Implement Login Flow v2

Doc:
https://docs.nextcloud.com/server/19/developer_manual/client_apis/LoginFlow/index.html#login-flow-v2

See android files app:

• Login Flow v2 android#12922
• Remove Login Flow v1 android#14461

This will also avoid issues like #3386

The best approach would be to extract Login&Authentication Screens to https://github.com/nextcloud/android-common and use them for all Nextcloud android apps.

[mario-spitze]

We still have problems while we login by username and password. Our nextcloud server working well behind an apache reverse proxy with subdirectory. If we try to login with some apps like the talk app for iOS and android we get requests like the following at the last login-step:

xx.xx.xx.174 - - [21/Feb/2025:10:02:24 +0100] "POST /bhhcloud/login/flow HTTP/1.1" 303 1069 "-" "Volla Volla Phone 22 (Nextcloud Talk)"
xx.xx.xx.174 - - [21/Feb/2025:10:02:25 +0100] "GET /server:https://myweb.de/cloud&user:username&password:1euf6i7sWv4VFoJ2TUFsb1ITnbO99lDdxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxA16gSLLL HTTP/1.1" 404 577 "-" "Volla Volla Phone 22 (Nextcloud Talk)"

I have no idea where this request have to be redirected to by the proxy. The last try was with the android talk app 20.1.1 installed by F-Droid an Nextcloud Server 30.0.6.
Login by App-Password and QR-Code is a well known workaround but the android app can not login by QR-Code.

The login flow documentation talks about URLs like this. (https://docs.nextcloud.com/server/31/developer_manual/client_apis/LoginFlow/index.html#obtaining-the-login-credentials) Now my question is, could this problem be solved by implementing the login flow v 2? I don't now witch version is used by other working apps. If this could solve my problem it would save some off my time. Otherwise i will walk on and open a new ticket.

[mahibi]

I'm not sure why it fails for you but login flow v2 would solve this. However we might not find the time to switch to this in the near future

[wegylexy]

The in-app browser doesn't support SSO that requires WebAuthn or opening another native app to complete the OIDC login flow.

[mahibi]

@rapterjet2004 can you work on this?

It's okay to have an initial version by copy&paste from the files app.
(but extracting common code to the android-common lib should be tried afterwards in another PR)

[mahibi]

@nickvergessen told that there were many bugs fixed on serverside that should explain why login v2 did not work for clients a few weeks/months ago when we tried to implement it on android.
@nickvergessen can you link these fixes here? Are all of them deployed on sermo and cnc?

@rapterjet2004 could you give it another try?

[nickvergessen]

E.g.

• fix(2fa): Fix 2FA session setup when ephemeral session is used server#54605
• Load scripts if a user is logged in and is allowed invite guests guests#1402

and yes those are deployed on both. Others are not affecting the instances as we don't have the weird apps there.