[BUG] OIDC authentication broken after upgrade to 0.8.0

[devlux]

Description

OIDC authentication / login broken by upgrading to v0.8.0.

To Reproduce

Take an existing OIDC user.

1. Try to login

Expected Behavior

User can login.

Screenshots

Environment

• OS: container image
• Browser: Firefox 152
• OxiCloud Version: 0.8.0
• Rust Version:

Additional Context

• IDM: kanidm 1.10.3

Possible Solution

[DioCrafts]

Hey @devlux could you provide us a little more details please?

[devlux]

hi @DioCrafts I've set log level to debug and now I'm flooded with the following logs:

2026-06-22T09:17:03.158994Z DEBUG sqlx::query: summary="SELECT id, file_id, op …" db.statement="\n\nSELECT id, file_id, op FROM storage.search_index_dirty ORDER BY id LIMIT $1\n" rows_affected=0 rows_returned=0 elapsed=549.607µs elapsed_secs=0.000549607
2026-06-22T09:17:03.598511Z DEBUG sqlx::query: summary="WITH drained AS ( …" db.statement="\n\n\n                    WITH drained AS (\n                        DELETE FROM storage.tree_etag_dirty\n                         WHERE id IN (SELECT id\n                                        FROM storage.tree_etag_dirty\n                                       ORDER BY id\n                                       LIMIT $1)\n                        RETURNING lpath, folder_id, drive_id\n                    ),\n                    targets AS (\n                        -- Captured chain: covers target folders deleted or\n                        -- moved away since enqueue (the old location's\n                        -- surviving ancestors still get their bump). drive_id\n                        -- comes along so the victims walk can enforce\n                        -- cross-drive isolation (D0-13).\n                        SELECT lpath, drive_id FROM drained\n                        UNION\n                        -- Flush-time resolution: a folder MOVED since\n                        -- enqueue had its subtree's lpaths rewritten, so\n                        -- the captured lpath no longer matches it — its id\n                        -- resolves to the CURRENT chain instead. Without\n                        -- this, a bump queued just before a move would be\n                        -- silently lost and sync clients would never\n                        -- discover the change.\n                        SELECT fo.lpath, fo.drive_id\n                          FROM storage.folders fo\n                          JOIN drained d ON fo.id = d.folder_id\n                    ),\n                    victims AS (\n                        -- `lpath @> target` = the target folder itself plus\n                        -- every ancestor (GiST-indexed). The `drive_id`\n                        -- predicate prevents a numerically-overlapping\n                        -- lpath in a SIBLING drive from spuriously matching\n                        -- (D0-13). Rows from old queue entries (pre-M4) have\n                        -- NULL `drive_id` — `IS NOT DISTINCT FROM` falls\n                        -- back to pure lpath matching for those, preserving\n                        -- the rollover semantics for any rows enqueued\n                        -- between this migration committing and the\n                        -- service restart.\n                        SELECT f.id\n                          FROM storage.folders f\n                         WHERE EXISTS (\n                             SELECT 1 FROM targets t\n                              WHERE f.lpath @> t.lpath\n                                AND (t.drive_id IS NULL\n                                     OR f.drive_id = t.drive_id)\n                         )\n                         ORDER BY f.id\n                           FOR NO KEY UPDATE\n                    ),\n                    bumped AS (\n                        UPDATE storage.folders f\n                           SET tree_modified_at =\n                                   GREATEST(NOW(), f.tree_modified_at + interval '1 second')\n                          FROM victims v\n                         WHERE f.id = v.id\n                        RETURNING f.id\n                    )\n                    SELECT (SELECT COUNT(*) FROM drained)::bigint,\n                           (SELECT COUNT(*) FROM bumped)::bigint\n                    \n" rows_affected=1 rows_returned=1 elapsed=1.755633ms elapsed_secs=0.001755633
2026-06-22T09:17:04.098036Z DEBUG sqlx::query: summary="WITH drained AS ( …" db.statement="\n\n\n                    WITH drained AS (\n                        DELETE FROM storage.tree_etag_dirty\n                         WHERE id IN (SELECT id\n                                        FROM storage.tree_etag_dirty\n                                       ORDER BY id\n                                       LIMIT $1)\n                        RETURNING lpath, folder_id, drive_id\n                    ),\n                    targets AS (\n                        -- Captured chain: covers target folders deleted or\n                        -- moved away since enqueue (the old location's\n                        -- surviving ancestors still get their bump). drive_id\n                        -- comes along so the victims walk can enforce\n                        -- cross-drive isolation (D0-13).\n                        SELECT lpath, drive_id FROM drained\n                        UNION\n                        -- Flush-time resolution: a folder MOVED since\n                        -- enqueue had its subtree's lpaths rewritten, so\n                        -- the captured lpath no longer matches it — its id\n                        -- resolves to the CURRENT chain instead. Without\n                        -- this, a bump queued just before a move would be\n                        -- silently lost and sync clients would never\n                        -- discover the change.\n                        SELECT fo.lpath, fo.drive_id\n                          FROM storage.folders fo\n                          JOIN drained d ON fo.id = d.folder_id\n                    ),\n                    victims AS (\n                        -- `lpath @> target` = the target folder itself plus\n                        -- every ancestor (GiST-indexed). The `drive_id`\n                        -- predicate prevents a numerically-overlapping\n                        -- lpath in a SIBLING drive from spuriously matching\n                        -- (D0-13). Rows from old queue entries (pre-M4) have\n                        -- NULL `drive_id` — `IS NOT DISTINCT FROM` falls\n                        -- back to pure lpath matching for those, preserving\n                        -- the rollover semantics for any rows enqueued\n                        -- between this migration committing and the\n                        -- service restart.\n                        SELECT f.id\n                          FROM storage.folders f\n                         WHERE EXISTS (\n                             SELECT 1 FROM targets t\n                              WHERE f.lpath @> t.lpath\n                                AND (t.drive_id IS NULL\n                                     OR f.drive_id = t.drive_id)\n                         )\n                         ORDER BY f.id\n                           FOR NO KEY UPDATE\n                    ),\n                    bumped AS (\n                        UPDATE storage.folders f\n                           SET tree_modified_at =\n                                   GREATEST(NOW(), f.tree_modified_at + interval '1 second')\n                          FROM victims v\n                         WHERE f.id = v.id\n                        RETURNING f.id\n                    )\n                    SELECT (SELECT COUNT(*) FROM drained)::bigint,\n                           (SELECT COUNT(*) FROM bumped)::bigint\n                    \n" rows_affected=1 rows_returned=1 elapsed=1.687949ms elapsed_secs=0.001687949
2026-06-22T09:17:04.598701Z DEBUG sqlx::query: summary="WITH drained AS ( …" db.statement="\n\n\n                    WITH drained AS (\n                        DELETE FROM storage.tree_etag_dirty\n                         WHERE id IN (SELECT id\n                                        FROM storage.tree_etag_dirty\n                                       ORDER BY id\n                                       LIMIT $1)\n                        RETURNING lpath, folder_id, drive_id\n                    ),\n                    targets AS (\n                        -- Captured chain: covers target folders deleted or\n                        -- moved away since enqueue (the old location's\n                        -- surviving ancestors still get their bump). drive_id\n                        -- comes along so the victims walk can enforce\n                        -- cross-drive isolation (D0-13).\n                        SELECT lpath, drive_id FROM drained\n                        UNION\n                        -- Flush-time resolution: a folder MOVED since\n                        -- enqueue had its subtree's lpaths rewritten, so\n                        -- the captured lpath no longer matches it — its id\n                        -- resolves to the CURRENT chain instead. Without\n                        -- this, a bump queued just before a move would be\n                        -- silently lost and sync clients would never\n                        -- discover the change.\n                        SELECT fo.lpath, fo.drive_id\n                          FROM storage.folders fo\n                          JOIN drained d ON fo.id = d.folder_id\n                    ),\n                    victims AS (\n                        -- `lpath @> target` = the target folder itself plus\n                        -- every ancestor (GiST-indexed). The `drive_id`\n                        -- predicate prevents a numerically-overlapping\n                        -- lpath in a SIBLING drive from spuriously matching\n                        -- (D0-13). Rows from old queue entries (pre-M4) have\n                        -- NULL `drive_id` — `IS NOT DISTINCT FROM` falls\n                        -- back to pure lpath matching for those, preserving\n                        -- the rollover semantics for any rows enqueued\n                        -- between this migration committing and the\n                        -- service restart.\n                        SELECT f.id\n                          FROM storage.folders f\n                         WHERE EXISTS (\n                             SELECT 1 FROM targets t\n                              WHERE f.lpath @> t.lpath\n                                AND (t.drive_id IS NULL\n                                     OR f.drive_id = t.drive_id)\n                         )\n                         ORDER BY f.id\n                           FOR NO KEY UPDATE\n                    ),\n                    bumped AS (\n                        UPDATE storage.folders f\n                           SET tree_modified_at =\n                                   GREATEST(NOW(), f.tree_modified_at + interval '1 second')\n                          FROM victims v\n                         WHERE f.id = v.id\n                        RETURNING f.id\n                    )\n                    SELECT (SELECT COUNT(*) FROM drained)::bigint,\n                           (SELECT COUNT(*) FROM bumped)::bigint\n                    \n" rows_affected=1 rows_returned=1 elapsed=1.780059ms elapsed_secs=0.001780059

that's why I can't really identify what's happening during the authentication. but I see a 401 being returned from oxicloud eventhough I was authenticated successfully by the idm.

my setup is the following:

podman run -d --replace --rm --name oxicloud_app \
  --pod oxicloud \
  --secret=lx-oxicloud-postgres-url,type=env,target=OXICLOUD_DB_CONNECTION_STRING \
  --secret=lx-oxicloud-jwt-secret,type=env,target=OXICLOUD_JWT_SECRET \
  --secret=lx-oxicloud-oidc-client-secret,type=env,target=OXICLOUD_OIDC_CLIENT_SECRET \
  -e RUST_LOG=debug \
  -e OXICLOUD_SERVER_HOST=0.0.0.0 \
  -e OXICLOUD_SERVER_PORT=8086 \
  -e OXICLOUD_BASE_URL=https://oxicloud.example.com \
  -e OXICLOUD_STORAGE_PATH=/app/storage \
  -e OXICLOUD_ENABLE_AUTH=true \
  -e OXICLOUD_OIDC_ENABLED=true \
  -e OXICLOUD_OIDC_PROVIDER_NAME=Kanidm \
  -e OXICLOUD_OIDC_ISSUER_URL=https://idm.example.com/oauth2/openid/oxicloud \
  -e OXICLOUD_OIDC_CLIENT_ID=oxicloud \
  -e OXICLOUD_OIDC_REDIRECT_URI=https://oxicloud.example.com/api/auth/oidc/callback \
  -e OXICLOUD_OIDC_SCOPES="openid profile email" \
  -e OXICLOUD_OIDC_FRONTEND_URL=https://oxicloud.example.com \
  -e OXICLOUD_OIDC_AUTO_PROVISION=true \
  -e OXICLOUD_OIDC_DISABLE_PASSWORD_LOGIN=false
...

[devlux]

@DioCrafts I've created a new env from scratch. now I get the following logs when trying to authenticate:

2026-06-22T09:29:29.844264Z  INFO req{request_id="019eeea9-dbf4-7bf1-ac2e-13cede5c1b8c" client_ip=10.0.2.100:47794 method=GET uri=/api/auth/oidc/authorize}: oxicloud::infrastructure::services::oidc_service: Fetching OIDC discovery from: https://idm.example.com/oauth2/openid/oxicloud/.well-known/openid-configuration
2026-06-22T09:29:29.869509Z  INFO req{request_id="019eeea9-dbf4-7bf1-ac2e-13cede5c1b8c" client_ip=10.0.2.100:47794 method=GET uri=/api/auth/oidc/authorize}: oxicloud::application::services::auth_application_service: OIDC authorize flow prepared (state=42231ad3...)
2026-06-22T09:29:29.869548Z  INFO req{request_id="019eeea9-dbf4-7bf1-ac2e-13cede5c1b8c" client_ip=10.0.2.100:47794 method=GET uri=/api/auth/oidc/authorize}: oxicloud::interfaces::api::handlers::auth_handler: OIDC authorize redirect generated
2026-06-22T09:29:29.913336Z  INFO req{request_id="019eeea9-dc39-7123-b4ef-49e1ff6aeb81" client_ip=10.0.2.100:47794 method=GET uri=/api/auth/oidc/callback}: oxicloud::interfaces::api::handlers::auth_handler: OIDC callback received with code
2026-06-22T09:29:29.962002Z  INFO req{request_id="019eeea9-dc39-7123-b4ef-49e1ff6aeb81" client_ip=10.0.2.100:47794 method=GET uri=/api/auth/oidc/callback}: audit: event="user.created" user_id=35cc1058-f119-4849-9814-422cc1da2f36 username=XXX is_external=false
2026-06-22T09:29:29.985747Z  INFO req{request_id="019eeea9-dc39-7123-b4ef-49e1ff6aeb81" client_ip=10.0.2.100:47794 method=GET uri=/api/auth/oidc/callback}: user_lifecycle: Default personal drive + root folder + owner grant provisioned (atomic CTE) hook="personal_drive" user_id=35cc1058-f119-4849-9814-422cc1da2f36 drive_id=5a1d6019-9e59-4019-9aad-05aae9349a07 root_folder_id=aea87bff-85c8-4303-a05b-d93401d39bde
2026-06-22T09:29:29.985804Z  INFO req{request_id="019eeea9-dc39-7123-b4ef-49e1ff6aeb81" client_ip=10.0.2.100:47794 method=GET uri=/api/auth/oidc/callback}: audit: event="user.login" user_id=35cc1058-f119-4849-9814-422cc1da2f36 username=XXX is_external=false first_login=true
2026-06-22T09:29:30.008896Z  INFO req{request_id="019eeea9-dc39-7123-b4ef-49e1ff6aeb81" client_ip=10.0.2.100:47794 method=GET uri=/api/auth/oidc/callback}: oxicloud::application::services::auth_application_service: OIDC user provisioned: 35cc1058-f119-4849-9814-422cc1da2f36 (provider: Kanidm, sub: fcaa2a81-ab05-4aee-b6d6-626a1203de40)
2026-06-22T09:29:30.021161Z  INFO req{request_id="019eeea9-dc39-7123-b4ef-49e1ff6aeb81" client_ip=10.0.2.100:47794 method=GET uri=/api/auth/oidc/callback}: oxicloud::application::services::auth_application_service: OIDC login successful, one-time exchange code generated
2026-06-22T09:29:30.021213Z  INFO req{request_id="019eeea9-dc39-7123-b4ef-49e1ff6aeb81" client_ip=10.0.2.100:47794 method=GET uri=/api/auth/oidc/callback}: oxicloud::interfaces::api::handlers::auth_handler: OIDC login successful, redirecting with exchange code
2026-06-22T09:29:30.241094Z  WARN req{request_id="019eeea9-dd80-7f70-a531-b30550128527" client_ip=10.0.2.100:47794 method=GET uri=/api/auth/me}: http::api::auth: client_error status=401 latency_ms=0 content_length=0 content_type="application/json" user_agent="Mozilla/5.0 (X11; Linux x86_64; rv:152.0) Gecko/20100101 Firefox/152.0"
2026-06-22T09:29:30.271694Z  INFO req{request_id="019eeea9-dd9f-7242-8d01-7a77185ea2b8" client_ip=10.0.2.100:47794 method=POST uri=/api/auth/refresh}: oxicloud::interfaces::api::handlers::auth_handler: Token refresh requested
2026-06-22T09:29:30.271766Z  WARN req{request_id="019eeea9-dd9f-7242-8d01-7a77185ea2b8" client_ip=10.0.2.100:47794 method=POST uri=/api/auth/refresh}: http::api::auth: client_error status=401 latency_ms=0 content_length=0 content_type="application/json" user_agent="Mozilla/5.0 (X11; Linux x86_64; rv:152.0) Gecko/20100101 Firefox/152.0"
2026-06-22T09:29:30.394236Z  WARN req{request_id="019eeea9-de1a-7213-b9f7-4e18b8c67bf5" client_ip=10.0.2.100:47794 method=GET uri=/api/auth/me}: http::api::auth: client_error status=401 latency_ms=0 content_length=0 content_type="application/json" user_agent="Mozilla/5.0 (X11; Linux x86_64; rv:152.0) Gecko/20100101 Firefox/152.0"
2026-06-22T09:29:30.488211Z  INFO req{request_id="019eeea9-de6a-73e3-9b6e-d82c278fd9cd" client_ip=10.0.2.100:47794 method=GET uri=/api/auth/status}: oxicloud::interfaces::api::handlers::auth_handler: System status check: initialized=true, admin_count=1

[Morethanevil]

And I thought it was me misconfiguring something. I started yesterday with a fresh install and Authentik as provider. Login does not work, same error message (401 - unauthicated). The user gets created and the OIDC discovery shows all green in the admin panel.

Logs:

oxicloud  | 2026-06-22T13:45:48.735854Z  WARN req{request_id="019eef94-85bf-71f3-9b27-d7bac9491314" client_ip=IP-REDACTED method=GET uri=/api/auth/me}: http::api::auth: client_error status=401 latency_ms=0 content_length=0 content_type="application/json" user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:152.0) Gecko/20100101 Firefox/152.0"
oxicloud  | 2026-06-22T13:45:48.766952Z  INFO req{request_id="019eef94-85de-70a1-9ec9-275adc91b9f6" client_ip=IP-REDACTED method=POST uri=/api/auth/refresh}: oxicloud::interfaces::api::handlers::auth_handler: Token refresh requested
oxicloud  | 2026-06-22T13:45:48.767006Z  WARN req{request_id="019eef94-85de-70a1-9ec9-275adc91b9f6" client_ip=IP-REDACTED method=POST uri=/api/auth/refresh}: http::api::auth: client_error status=401 latency_ms=0 content_length=0 content_type="application/json" user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:152.0) Gecko/20100101 Firefox/152.0"
oxicloud  | 2026-06-22T13:45:48.874218Z  WARN req{request_id="019eef94-864a-7641-ba56-adddbaf12191" client_ip=IP-REDACTED method=GET uri=/api/auth/me}: http::api::auth: client_error status=401 latency_ms=0 content_length=0 content_type="application/json" user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:152.0) Gecko/20100101 Firefox/152.0"
oxicloud  | 2026-06-22T13:45:48.923091Z  INFO req{request_id="019eef94-8670-7392-88a0-f2e4e06b0dc5" client_ip=IP-REDACTED method=GET uri=/api/auth/status}: oxicloud::interfaces::api::handlers::auth_handler: System status check: initialized=true, admin_count=3
oxicloud  | 2026-06-22T13:45:50.033574Z  INFO req{request_id="019eef94-8ad1-72a2-a015-871f0d071786" client_ip=IP-REDACTED method=GET uri=/api/auth/oidc/authorize}: oxicloud::infrastructure::services::oidc_service: Fetching OIDC discovery from: https://sso.storagemte.eu/application/o/oxicloud/.well-known/openid-configuration
oxicloud  | 2026-06-22T13:45:50.113167Z  INFO req{request_id="019eef94-8ad1-72a2-a015-871f0d071786" client_ip=IP-REDACTED method=GET uri=/api/auth/oidc/authorize}: oxicloud::application::services::auth_application_service: OIDC authorize flow prepared (state=fbefa2f1...)
oxicloud  | 2026-06-22T13:45:50.113209Z  INFO req{request_id="019eef94-8ad1-72a2-a015-871f0d071786" client_ip=IP-REDACTED method=GET uri=/api/auth/oidc/authorize}: oxicloud::interfaces::api::handlers::auth_handler: OIDC authorize redirect generated
oxicloud  | 2026-06-22T13:45:50.369237Z  INFO req{request_id="019eef94-8c21-7a42-a694-14a813308a5e" client_ip=IP-REDACTED method=GET uri=/api/auth/oidc/callback}: oxicloud::interfaces::api::handlers::auth_handler: OIDC callback received with code
oxicloud  | 2026-06-22T13:45:50.507207Z  INFO req{request_id="019eef94-8c21-7a42-a694-14a813308a5e" client_ip=IP-REDACTED method=GET uri=/api/auth/oidc/callback}: audit: event="user.login" user_id=7e612aa3-9b6e-417f-a534-bef544dac5c4 username=Morethanevil is_external=false first_login=false
oxicloud  | 2026-06-22T13:45:50.530996Z  INFO req{request_id="019eef94-8c21-7a42-a694-14a813308a5e" client_ip=IP-REDACTED method=GET uri=/api/auth/oidc/callback}: oxicloud::application::services::auth_application_service: OIDC login successful, one-time exchange code generated
oxicloud  | 2026-06-22T13:45:50.531039Z  INFO req{request_id="019eef94-8c21-7a42-a694-14a813308a5e" client_ip=IP-REDACTED method=GET uri=/api/auth/oidc/callback}: oxicloud::interfaces::api::handlers::auth_handler: OIDC login successful, redirecting with exchange code
oxicloud  | 2026-06-22T13:45:50.755630Z  WARN req{request_id="019eef94-8da3-7541-9595-3fe40841901a" client_ip=IP-REDACTED method=GET uri=/api/auth/me}: http::api::auth: client_error status=401 latency_ms=0 content_length=0 content_type="application/json" user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:152.0) Gecko/20100101 Firefox/152.0"
oxicloud  | 2026-06-22T13:45:50.787269Z  INFO req{request_id="019eef94-8dc3-7131-9af5-9e386244d139" client_ip=IP-REDACTED method=POST uri=/api/auth/refresh}: oxicloud::interfaces::api::handlers::auth_handler: Token refresh requested
oxicloud  | 2026-06-22T13:45:50.787324Z  WARN req{request_id="019eef94-8dc3-7131-9af5-9e386244d139" client_ip=IP-REDACTED method=POST uri=/api/auth/refresh}: http::api::auth: client_error status=401 latency_ms=0 content_length=0 content_type="application/json" user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:152.0) Gecko/20100101 Firefox/152.0"
oxicloud  | 2026-06-22T13:45:50.853365Z  WARN req{request_id="019eef94-8e05-7b72-9d10-dce16d39f616" client_ip=IP-REDACTED method=GET uri=/api/auth/me}: http::api::auth: client_error status=401 latency_ms=0 content_length=0 content_type="application/json" user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:152.0) Gecko/20100101 Firefox/152.0"
oxicloud  | 2026-06-22T13:45:50.890343Z  INFO req{request_id="019eef94-8e25-7fb3-8cd8-0db3ea6bc154" client_ip=IP-REDACTED method=GET uri=/api/auth/status}: oxicloud::interfaces::api::handlers::auth_handler: System status check: initialized=true, admin_count=3

[jdietz02]

I too am seing the exact same thing.