Android: Unable to disable Device credentials

[ajostergaard]

Actual behaviour

Once the Lock setting has been set to Device credentials changing it to None has no effect, i.e. the app still requires Device credentials.

Expected behaviour

When Lock is set to None no credentials should be required to open it.

May seem like a trivial complaint but unless I can disable this I cannot take screenshots of the app.

Steps to reproduce

1. Set Lock to Device Credentials
2. Kill and re-open the app
3. Set Lock to None
4. Kill and re-open the app

Environment data

Android version: 9 (Pie) Oct patch level

Device model: Essential PH-1

Stock or customized system: Stock

Nextcloud app version: 3.3.0 (F-Droid)

Nextcloud server version: 14.0.3

Logs

If somebody could clarify where to get applicable logs am happy to provide.

[nextcloud-android-bot]

GitMate.io thinks possibly related issues are https://github.com/nextcloud/android/issues/569 (Unable to refresh), https://github.com/nextcloud/android/issues/1286 (Allow to use device credentials instead of PIN to unlock app), https://github.com/nextcloud/android/issues/3026 (The "Device credentials" feature doesn't work with fingerprints), https://github.com/nextcloud/android/issues/1270 (Remove "On device"), and https://github.com/nextcloud/android/issues/1758 (Device credentials and pincode / fingerprint).

[tobiasKaminsky]

After setting lock to "none" you should see a dialog to enter your device credentials to disable it.
Do you see this?

[ajostergaard]

Yes, and a sliding notice at the bottom of the screen saying 'Credentials disabled' and when I enable them again there's a sliding notice saying 'Device credentials enabled'.

[codingHahn]

I can reproduce this on LineageOS 15.1 Oreo .
Moreover when I restart my phone, there is a good chance that Nextcloud will refuse to unlock itself even with the right Credentials. Just a toast appears with "Zugangsdaten falsch" / "Credentials wrong"

[cbrace]

I'm seeing this behaviour on my Moto 4G phone running Android v7. I have tried all the lock settings to disable the nextcloud swipe-screen lock.

My major issue with the client lock is that it doesn't cache credentials for any period of time, which makes it extremely cumbersome to use when sharing a series of files through the client. A useful enhancement (in addition to fixing this bug) would IMO to offer a optional credential caching, ie, 15 mins, 1 hour, etc

[tobiasKaminsky]

We had a bug with fingerprint (un)lock mechansim. It affected only a few devices, e.g. Xiaomi, Motorola, …
As none of our test deices was affected, hunting this bug down took a while.

If any of you could download and install this apk (https://cloud.nextcloud.com/s/pCwRFo7rFF3MMjM) and test if it is now working better, I would appreciate it.
(the APK file is signed with the key for Google Play Store and is 3.3.2 Alpha 1, so this proves that it is an official version and can be easily upgraded. The up-to-come 3.3.2 version then can also just update this version).

[ajostergaard]

Very keen to try it, downloaded the apk but when I open it F-Droid offers to install it and then just says App not installed. When I select Open With it just open F-Droid... Any ideas?

Sorry - being a bit pathetic - no idea how to make my phone install it. Perhaps uninstall F-Droid?

[tobiasKaminsky]

@ajostergaard how did you installed the current app? via Gplay or via fdroid?

[ajostergaard]

F-Droid

[tobiasKaminsky]

@ajostergaard then please try this version: https://cloud.nextcloud.com/s/BDybFQ4CfQf9Jet

You can install it in parallel to your regular app, it will be called "Nextcloud dev". Only downside is that you have to setup an account to test it.
Afterwards you can simply remove it.

[ajostergaard]

Thanks! Can I login with my regular self-hosted account or do I need to setup a new account?

[ajostergaard]

Seems to be working! 👍 :)))

[tobiasKaminsky]

Glad to hear and thanks for testing :+1:

[cbrace]

I can confirm that the APK version fixed this issue on my Moto G4. Many thanks!

[LeoDJ]

I still have this exact issue on version 3.7.1 and a Oneplus 3T with Android 9

[tobiasKaminsky]

@LeoDJ which device credential do you use?
Can you try to enter your device pin when trying to disable?

[LeoDJ]

I tried it with both fingerprint and pin code using the same procedure from "steps to reproduce" above.
Both times the Nextcloud app showed a toast "Credentials disabled"

Can you clarify what you mean by "which device credentials"? I can say that it appears to me that the stock settings-overlay is used (I can see this in the application switcher) prompting me to "Re-enter your PIN", where I can either enter my PIN or use my fingerprint.

[LeoDJ]

I just tried to set it from "Device credentials" to "Passcode", but now I have to enter both Device credentials and the custom passcode. After setting it to "None", I'm back to only Device credentials.

I didn't have a look in the code, but it feels to me like it is somehow not correctly telling the Android system to stop protecting the app, but I'm just guessing

[tobiasKaminsky]

I just tried to set it from "Device credentials" to "Passcode", but now I have to enter both Device credentials and the custom passcode. After setting it to "None", I'm back to only Device credentials.

You should not be able to set both…

To not mess with your current app, can you try our dev version (you can install it in parallel):
https://github.com/nextcloud/android/blob/master/CONTRIBUTING.md#dev-release

Can you there test it again?

I fear that somehow the setting can not be removed, but I have no idea why and how to prevent this…

[LeoDJ]

Hm, using the dev version, disabling the device credentials worked as it should.

So it's probably a stuck setting in my Android system somehow, because I enabled Device Credentials for Nextcloud a long time ago and just now wanted to disable them again. I guess some update has broken the link that allows NC to disable it, or something like that, I don't really know.

I fear this will only be solved by an app re-install, although I'm not fond of it, I might try it later this week and report back.

[stale[bot]]

This request did not receive an update in the last 4 weeks. Please take a look again and update the issue with new details, otherwise the issue will be automatically closed in 2 weeks. Thank you!

[kopierschnitte]

I've re-installed the app and still can't disable biometric login on my Samsung Note8. Strange.

[ajostergaard]

I've re-installed the app and still can't disable biometric login on my Samsung Note8. Strange.

Have you tried leaving it uninstalled overnight before reinstalling? Have found this to help sometimes, seems Android cleans up overnight or something.

[kopierschnitte]

Great idea. Can't believe it really worked.
Thanks!