oidc error with user_oidc

[TheBest-Name]

How to use GitHub

• Please use the 👍 reaction to show that you are affected by the same issue.
• Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
• Subscribe to receive notifications on status change and new comments.

---

Steps to reproduce

Steps to reproduce the behavior:
Enable oidc app
Enable user_oidc app
Set this in config.php:
'user_oidc' =>
array (
'auto_provision' => false,
'oidc_provider_bearer_validation' => true,
),

Expected behaviour

Tell us what should happen
A clear and concise description of what you expected to happen.
No error?

Actual behaviour

Tell us what happens instead, if possible also add a screenshot
When I enable user_oidc
I get these two errors repeatedly and it fills the logs with hundreds or thousands of errors:
[oidc] Error: Provided JWT could not be decoded.
PROPFIND /remote.php/dav/files/my_username/

[oidc] Error: Provided JWT is malformed OR provided JWT is missing an algorithm / using an unsupported algorithm OR provided JWT algorithm does not match provided key OR provided key ID in key/key-array is empty or invalid.
PROPFIND /remote.php/dav/files/my_username/

Server configuration

Web server: Apache

Database: MariaDB

PHP version: 8.4

Nextcloud version: 32.0.6

List of activated apps

If you have access to your command line run e.g.:
sudo -u www-data php occ app:list
from within your Nextcloud installation folder

Nextcloud configuration

If you have access to your command line run e.g.:
sudo -u www-data php occ config:list system
from within your Nextcloud installation folder

Browser

Browser name: Edge

Browser version: 145

Operating system: Windows

Browser log

Insert your browser log here, this could for example include:

I tried to put the issue in this other repository, but it is supposed to be here,
H2CK/oidc#625
The original issue is there.

[julien-nc]

Hi,
I need more details about your context. So your Nextcloud instance is an OIDC provider but the Nextcloud users can authenticate using an external OIDC provider? Can you describe your setup?

I'm not sure why user_oidc would have an impact on the oidc app so it would trigger those error in the logs.

Also, can you give the full stack trace you get in your logs? This would help to follow the code path and understand what's happening.

[TheBest-Name]

I actually got the OIDC provider app just because I wanted to be able to use it even though I don't have it connected to anything. Then I got the user back-end app also just to see if I could use it and I was hoping that if I had both, I could have some sort of SSO. Basically, I had no idea what I was doing, so I actually had set them both up to reference each other at first. I thought that because looking at the documentation it said that I needed the certain line in the config and then it just said I could connect them. So, I thought I actually had to connect them in the usual way by specifying one as the client and as the provider. After, I took off the configuration specifying one is the client, one is the provider, but I still am getting that error.

I would like to get you the stack trace, but I'm not sure how you want me to do that. The two errors I gave you already are the only ones I see popped up in the logs in Nextcloud. I do get those every few minutes when it's enabled.

[TheBest-Name]

Was there something you wanted me to do to get the logs?
If you tell me what to do, I can get them.

[julien-nc]

Hey, what is your goal? Is it

1. To use an external IdP (keycloak, authelia etc...) to let your users authenticate in your Nextcloud instance? In this case, the external IdP is the entity that contains the users.
2. To use Nextcloud as an OIDC provider in other systems? In this case, Nextcloud is the one that contains the users

If you want 1., you just need the user_oidc app. Configure a provider that points to an Idp and you're good to go.
If you want 2., you just need the oidc app (OIDC Identity Provider). Then configure your other systems to use Nextcloud as the IdP.

Extra bit of clarification: If user_oidc tries to use Nextcloud as an IdP (with the oidc app), it's a logical loop. Nextcloud can't use itself as an external Idp.

About the logs, i would need the full log line that contains Error: Provided JWT is malformed OR provided JWT is missing an algorithm.... This can be found in nextcloud.log.

[TheBest-Name]

My goal is two, but if using oidc for user_oidc does not work, then what is this?
If you want to ask the OIDC Identity Provider app to validate a bearer token:

'user_oidc' => [
'oidc_provider_bearer_validation' => true,
],
This requires the OIDC Identity Provider app >= v1.4.0 . Access tokens and JWT tokens can be validated.

I actually don't know, that's why I'm asking. I kept trying to figure out, but I just think I don't know.
In my defense, the documentation digitally helped me and just made me more confused, and also even the AI on my web browser didn't seem to know.

{"reqId":"ZsWYeMeOkIeX4HTx0pY0","level":3,"time":"2026-03-25T04:10:24+00:00","remoteAddr":"","user":"","app":"oidc","method":"REPORT","url":"/remote.php/dav/calendars//family-calendar-1/","scriptName":"/remote.php","message":"Provided JWT is malformed OR provided JWT is missing an algorithm / using an unsupported algorithm OR provided JWT algorithm does not match provided key OR provided key ID in key/key-array is empty or invalid.","userAgent":"python-caldav/2.1.0","version":"32.0.6.1","data":{"app":"oidc"}}
{"reqId":"ZsWYeMeOkIeX4HTx0pY0","level":3,"time":"2026-03-25T04:10:24+00:00","remoteAddr":"","user":"","app":"oidc","method":"REPORT","url":"/remote.php/dav/calendars//family-calendar-1/","scriptName":"/remote.php","message":"Provided JWT could not be decoded.","userAgent":"python-caldav/2.1.0","version":"32.0.6.1","data":{"app":"oidc"}}
{"reqId":"rNeQNqkqXPxVJ6FeCjRY","level":3,"time":"2026-03-25T04:11:55+00:00","remoteAddr":"","user":"--","app":"oidc","method":"GET","url":"/ocs/v2.php/cloud/capabilities?format=json","scriptName":"/ocs/v2.php","message":"Provided JWT is malformed OR provided JWT is missing an algorithm / using an unsupported algorithm OR provided JWT algorithm does not match provided key OR provided key ID in key/key-array is empty or invalid.","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Edg/146.0.0.0","version":"32.0.6.1","data":{"app":"oidc"}}
{"reqId":"rNeQNqkqXPxVJ6FeCjRY","level":3,"time":"2026-03-25T04:11:55+00:00","remoteAddr":"","user":"--","app":"oidc","method":"GET","url":"/ocs/v2.php/cloud/capabilities?format=json","scriptName":"/ocs/v2.php","message":"Provided JWT could not be decoded.","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Edg/146.0.0.0","version":"32.0.6.1","data":{"app":"oidc"}}
{"reqId":"3ntlk3q85xYqbJ0oMYFt","level":3,"time":"2026-03-25T04:11:55+00:00","remoteAddr":"","user":"--","app":"oidc","method":"POST","url":"/index.php/apps/bookmarks/public/rest/v2/lock","scriptName":"/index.php","message":"Provided JWT is malformed OR provided JWT is missing an algorithm / using an unsupported algorithm OR provided JWT algorithm does not match provided key OR provided key ID in key/key-array is empty or invalid.","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Edg/146.0.0.0","version":"32.0.6.1","data":{"app":"oidc"}}
{"reqId":"3ntlk3q85xYqbJ0oMYFt","level":3,"time":"2026-03-25T04:11:55+00:00","remoteAddr":"","user":"--","app":"oidc","method":"POST","url":"/index.php/apps/bookmarks/public/rest/v2/lock","scriptName":"/index.php","message":"Provided JWT could not be decoded.","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 Edg/146.0.0.0","version":"32.0.6.1","data":{"app":"oidc"}}

I tried hiding some things that I thought may be sensitive.

[julien-nc]

I think I get it now 😁

Because the user_oidc app is just configured to ask the oidc app to validate bearer tokens, the latter is asked to validate all authentication attempts to Nextcloud. So every time there is a request to NC with a Authorization header, the value is passed in a OCA\OIDCIdentityProvider\Event\TokenValidationRequestEvent to the oidc app. Whenever the auth is actually not a JWT token, the oidc app fails to validate and produce such log line.

After reading the user_oidc implementation, I see this app tries to validate the auth of all the request with an Authorization header set.
To improve this, we could ignore requests for which the Authorization header's value does not start with "bearer".
I'll make the change soon.

But then the oidc app will still fail to validate tokens from time to time when it receives unrelated authentication attempts.

[julien-nc]

#1386 should make things better. Can you try applying those changes and check if the amount of log goes down? I'll merge and make a release if we agree this is a proper fix/improvement.

Keep in mind the oidc will still produce the error log for each request to NC that uses an Authorization: Bearer ... header that is not a valid JWT token. This can happen quite often too. NC app passwords can be used as bearer tokens.

[julien-nc]

I admit all this is confusing in the first place.
Let's try to add a bit of clarification: Because the oidc app does not have a user backend (capable of validating API request authentication headers), the user_oidc app, which has a user backend and can validate auth headers, has this option to ask the oidc app to validate auth headers.

The user_oidc app is initially only supposed to validate tokens against external IdPs. This is an extra small feature to make it possible to authenticate NC's API network requests with OIDC tokens delivered to external services by the oidc app.