[Bug]: External storage will prompt for password but always tell you it's the wrong password

[cmdrscotty]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

Similar to (#51637) when trying to add/edit external storage or save global creds it will prompt for password but always tell you it's the wrong password.
This is specifically for using the Default user management backend (no LDAP, ODIC, etc...)

Steps to reproduce

1. Log into NC as an admin
2. go to External Storage administration
3. attempt to either create a new external storage and save it, or edit an existing one and save it, or update global creds
4. system will give password box to prompt for your password to confirm
5. entering the correct password will give the error it's incorrect

*note doesn't matter if you've been logged in for 5 seconds or 5 minutes, it always will request re-authentication

Expected behavior

It should correctly validate the password against the database and save the settings.

Nextcloud Server version

30

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.3

Web server

Apache (supported)

Database engine version

MySQL

Is this bug present after an update or on a fresh install?

Updated from a MINOR version (ex. 32.0.1 to 32.0.2)

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "nas.commanderscotty.com",
            "192.168.2.252"
        ],
        "auto_logout": true,
        "session_keepalive": true,
        "session.cookie_lifetime": 900,
        "default_phone_region": "US",
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "30.0.8.1",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "filesystem_check_changes": 1,
        "filelocking.enabled": false,
        "mail_smtpmode": "smtp",
        "mail_smtpsecure": "ssl",
        "mail_sendmailmode": "smtp",
        "mail_smtpauth": 1,
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "465",
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "maintenance_window_start": 1,
        "maintenance": false,
        "defaultapp": "files",
        "overwrite.cli.url": "https:\/\/nas.commanderscotty.com",
        "overwriteprotocol": "https",
        "theme": "",
        "loglevel": 2,
        "default_language": "en",
        "default_locale": "en_US",
        "default_timezone": "America\/Phoenix",
        "memories.exiftool": "\/var\/www\/nextcloud\/apps\/memories\/bin-ext\/exiftool-amd64-glibc",
        "memories.vod.path": "\/var\/www\/nextcloud\/apps\/memories\/bin-ext\/go-vod-amd64",
        "memories.vod.ffmpeg": "\/usr\/bin\/ffmpeg",
        "memories.vod.ffprobe": "\/usr\/bin\/ffprobe",
        "enabledPreviewProviders": [
            "OC\\Preview\\Movie",
            "OC\\Preview\\TIFF",
            "OC\\Preview\\HEIC",
            "OC\\Preview\\Image"
        ],
        "preview_max_x": 1024,
        "preview_max_y": 1024,
        "preview_max_memory": 2048,
        "updater.release.channel": "stable"
    }
}

List of activated Apps

Enabled:
  - activity: 3.0.0
  - announcementcenter: 7.1.0
  - audioplayer: 3.4.1
  - bruteforcesettings: 3.0.0
  - calendar: 5.2.0
  - circles: 30.0.0
  - cloud_federation_api: 1.13.0
  - comments: 1.20.1
  - contacts: 7.0.4
  - contactsinteraction: 1.11.0
  - dashboard: 7.10.0
  - dav: 1.31.1
  - external: 5.5.2
  - federatedfilesharing: 1.20.0
  - federation: 1.20.0
  - files: 2.2.0
  - files_downloadlimit: 3.0.0
  - files_external: 1.22.0
  - files_pdfviewer: 3.0.0
  - files_reminders: 1.3.0
  - files_sharing: 1.22.0
  - files_trashbin: 1.20.1
  - files_versions: 1.23.0
  - firstrunwizard: 3.0.0
  - impersonate: 1.17.1
  - integration_github: 3.1.1
  - integration_google: 3.2.0
  - integration_youtube: 0.3.1
  - logreader: 3.0.0
  - lookup_server_connector: 1.18.0
  - mail: 4.3.2
  - memegen: 1.1.1
  - memories: 7.5.2
  - nextcloud_announcements: 2.0.0
  - notes: 4.11.0
  - notifications: 3.0.0
  - oauth2: 1.18.1
  - password_policy: 2.0.0
  - passwords: 2025.2.20
  - photos: 3.0.2
  - previewgenerator: 5.8.0
  - privacy: 2.0.0
  - provisioning_api: 1.20.0
  - recommendations: 3.0.0
  - related_resources: 1.5.0
  - serverinfo: 2.0.0
  - settings: 1.13.0
  - sharebymail: 1.20.0
  - socialsharing_email: 3.3.0
  - spreed: 20.1.5
  - support: 2.0.0
  - survey_client: 2.0.0
  - systemtags: 1.20.0
  - text: 4.1.0
  - theming: 2.6.0
  - twofactor_backupcodes: 1.19.0
  - updatenotification: 1.20.0
  - user_status: 1.10.0
  - viewer: 3.0.0
  - weather_status: 1.10.0
  - webhook_listeners: 1.1.0-dev
  - workflowengine: 2.12.0
Disabled:
  - admin_audit: 1.20.0
  - app_api: 4.0.6 (installed 2.7.0)
  - assistant: 2.4.0 (installed 2.4.0)
  - duplicatefinder: 1.6.1 (installed 1.6.1)
  - encryption: 2.18.0
  - google_synchronization: 3.0.0 (installed 3.0.0)
  - integration_giphy: 2.0.1 (installed 2.0.1)
  - integration_openai: 3.5.0 (installed 3.5.0)
  - integration_reddit: 2.0.5 (installed 2.0.5)
  - maps: 1.5.0 (installed 1.5.0)
  - music: 2.1.2 (installed 2.1.2)
  - phonetrack: 0.8.2 (installed 0.8.2)
  - suspicious_login: 8.0.0
  - twofactor_nextcloud_notification: 4.0.0
  - twofactor_totp: 12.0.0-dev
  - user_ldap: 1.21.0

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

{"reqId":"eS3eC7HeNMq2TJQCUrn7","level":3,"time":"2025-04-03T14:45:04+00:00","remoteAddr":"192.168.2.5","user":"kenneth","app":"PHP","method":"POST","url":"/index.php/apps/files_external/globalstorages","message":"Undefined array key 1 at /var/www/nextcloud/lib/private/AppFramework/Middleware/Security/PasswordConfirmationMiddleware.php#82","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0","version":"30.0.8.1","data":{"app":"PHP"}}
{"reqId":"eS3eC7HeNMq2TJQCUrn7","level":2,"time":"2025-04-03T14:45:05+00:00","remoteAddr":"192.168.2.5","user":"kenneth","app":"core","method":"POST","url":"/index.php/apps/files_external/globalstorages","message":"Login failed: 'kenneth' (Remote IP: '192.168.2.5')","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0","version":"30.0.8.1","data":{"app":"core"}}

Additional info

Browser console log when trying to enter password at prompt

        
       
       POST https://nas.commanderscotty.com/index.php/apps/files_external/globalcredentials 403 (Forbidden)
(anonymous) @ xhr.js:195
xhr @ xhr.js:15
f @ dispatchRequest.js:51
Promise.then
_request @ Axios.js:163
request @ Axios.js:40
(anonymous) @ bind.js:5
(anonymous) @ settings.js:1529
dispatch @ jquery.js:5145
g.handle @ jquery.js:4949```

[cmdrscotty]

Wanted to provide more info, switched logging to debug to get some additional context, this is what it's putting out now:

{"reqId":"TMYe9vEBSsfXWlUxld01","level":1,"time":"2025-04-03T16:30:39+00:00","remoteAddr":"","user":"--","app":"passwords","method":"","url":"--","message":"Passwords runs occ in global mode","userAgent":"--","version":"30.0.8.1","data":{"app":"passwords"},"id":"67eeb7beecc42"}
{"reqId":"ljnTGgjUbvsXcG2xk8w7","level":3,"time":"2025-04-03T16:30:47+00:00","remoteAddr":"192.168.2.5","user":"kenneth","app":"PHP","method":"PUT","url":"/index.php/apps/files_external/globalstorages/5","message":"Undefined array key 1 at /var/www/nextcloud/lib/private/AppFramework/Middleware/Security/PasswordConfirmationMiddleware.php#82","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0","version":"30.0.8.1","data":{"app":"PHP"},"id":"67eeb7beecc3f"}
{"reqId":"ljnTGgjUbvsXcG2xk8w7","level":0,"time":"2025-04-03T16:30:47+00:00","remoteAddr":"192.168.2.5","user":"kenneth","app":"PHP","method":"PUT","url":"/index.php/apps/files_external/globalstorages/5","message":"str_replace(): Passing null to parameter #3 ($subject) of type array|string is deprecated at /var/www/nextcloud/lib/private/User/Manager.php#222","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0","version":"30.0.8.1","data":{"app":"PHP"},"id":"67eeb7beecc3c"}
{"reqId":"ljnTGgjUbvsXcG2xk8w7","level":2,"time":"2025-04-03T16:30:47+00:00","remoteAddr":"192.168.2.5","user":"kenneth","app":"core","method":"PUT","url":"/index.php/apps/files_external/globalstorages/5","message":"Login failed: 'kenneth' (Remote IP: '192.168.2.5')","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0","version":"30.0.8.1","data":{"app":"core"},"id":"67eeb7beecc38"}
{"reqId":"ljnTGgjUbvsXcG2xk8w7","level":0,"time":"2025-04-03T16:30:47+00:00","remoteAddr":"192.168.2.5","user":"kenneth","app":"no app in context","method":"PUT","url":"/index.php/apps/files_external/globalstorages/5","message":"Password confirmation is required","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 OPR/117.0.0.0","version":"30.0.8.1","exception":{"Exception":"OC\\AppFramework\\Middleware\\Security\\Exceptions\\NotConfirmedException","Message":"Password confirmation is required","Code":403,"Trace":[{"file":"/var/www/nextcloud/lib/private/AppFramework/Middleware/MiddlewareDispatcher.php","line":73,"function":"beforeController","class":"OC\\AppFramework\\Middleware\\Security\\PasswordConfirmationMiddleware","type":"->"},{"file":"/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php","line":106,"function":"beforeController","class":"OC\\AppFramework\\Middleware\\MiddlewareDispatcher","type":"->"},{"file":"/var/www/nextcloud/lib/private/AppFramework/App.php","line":161,"function":"dispatch","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->"},{"file":"/var/www/nextcloud/lib/private/Route/Router.php","line":303,"function":"main","class":"OC\\AppFramework\\App","type":"::"},{"file":"/var/www/nextcloud/lib/base.php","line":1010,"function":"match","class":"OC\\Route\\Router","type":"->"},{"file":"/var/www/nextcloud/index.php","line":24,"function":"handleRequest","class":"OC","type":"::"}],"File":"/var/www/nextcloud/lib/private/AppFramework/Middleware/Security/PasswordConfirmationMiddleware.php","Line":85,"message":"Password confirmation is required","exception":[],"CustomMessage":"Password confirmation is required"},"id":"67eeb7beecc35"}

[alphasixsevenkali]

this shit is taking too long to solve, i have been totally unable to create external storage mounts and no one who has idea helps on this issue, definetly deleting nextcloud next week

[cmdrscotty]

this shit is taking too long to solve, i have been totally unable to create external storage mounts and no one who has idea helps on this issue, definetly deleting nextcloud next week

I think part of it has also been subject to past issues reported were specific to SSO/ODIC/LDAP user auth methods and not the built in system. But yes, this really seems like it's been an issue since 30.0.4 (IIRC) before that it just worked, after that version it started doing this.

[skjnldsv]

Can people try the fix from #50465 please ?

[leftybournes]

I tried reproducing the issue on a local dev environment and set it up as close as I could (Nextcloud 30, php 8.3 and mysql) and was unable to reproduce the bug. Can you provide more information on how your instance is setup? Maybe updating from 30.0.8 to 30.0.10 might help?

[cmdrscotty]

I tried reproducing the issue on a local dev environment and set it up as close as I could (Nextcloud 30, php 8.3 and mysql) and was unable to reproduce the bug. Can you provide more information on how your instance is setup? Maybe updating from 30.0.8 to 30.0.10 might help?

Finally got around to this, so upgraded to the latest version that is shown in the updater (31.0.4) but still getting the same issue:

Did have a look at #50465 and did see a comment from Zorn-v that indicated this fix doesn't work if you are using the local db (no sso or oath login) I'm also not using the Social Login app that was referenced either so I don't have that option to disable

zorn-v/nextcloud-social-login#494 (comment)

[djagiello]

Latest version; 32.0.0 dev
Still have this problem

System Ubuntu,
Php 8.3.6

Apps:

Enabled:
  - cloud_federation_api: 1.15.0
  - comments: 1.22.0
  - contactsinteraction: 1.13.0
  - dashboard: 7.12.0
  - dav: 1.34.0
  - federatedfilesharing: 1.22.0
  - federation: 1.22.0
  - files: 2.4.0
  - files_external: 1.24.0
  - files_reminders: 1.5.0
  - files_sharing: 1.24.0
  - files_trashbin: 1.22.0
  - files_versions: 1.25.0
  - lookup_server_connector: 1.20.0
  - oauth2: 1.20.0
  - profile: 1.1.0
  - provisioning_api: 1.22.0
  - settings: 1.15.0
  - sharebymail: 1.22.0
  - systemtags: 1.22.0
  - theming: 2.7.0
  - twofactor_backupcodes: 1.21.0
  - updatenotification: 1.22.0
  - user_status: 1.12.0
  - weather_status: 1.12.0
  - webhook_listeners: 1.3.0
  - workflowengine: 2.14.0
Disabled:
  - admin_audit: 1.22.0
  - encryption: 2.20.0
  - testing: 1.22.0
  - user_ldap: 1.23.0

Database: MariaDB

Config

<?php
$CONFIG = array (
  'instanceid' => 'ocd83l62qevd',
  'debug' => true,
  'passwordsalt' => 'uBiFs9f2qsJxUK+nmyKPqkT5E1HN6W',
  'secret' => 'KEJeT9EXaHRRgmvLIO/V27boOxPlWEpqIUrXEupbPD2vvMx/',
  'trusted_domains' =>
  array (
    0 => 'localhost',
    1 => '192.168.68.115',
  ),
  'datadirectory' => '/raid',
  'dbtype' => 'mysql',
  'version' => '32.0.0.0',
  'overwrite.cli.url' => 'http://192.168.68.115/',
  'dbname' => 'nextcloud',
  'dbhost' => 'localhost',
  'dbport' => '',
  'dbtableprefix' => 'oc_',
  'mysql.utf8mb4' => true,
  'dbuser' => 'oc_admin',
  'dbpassword' => '^I9J($qVaFx+R=)acpy6wK/p2C{j-%',
  'updater.release.channel' => 'git',
  'installed' => true,
);

Thats is fresh install.