Nixpkgs: nextcloud-client asks to connect accounts after each reboot

[caugner]

Issue description

Since the upgrade to NixOS 19.03 (and nextcloud-client 2.5.0), the nextcloud-client tells me You have been logged out of ***@*** as user ***. Please login again and asks me to Connect to your account after each reboot, even if I entered the login data during the last session.

Steps to reproduce

1. Install nextcloud-client (in my case, globally).
2. Add one or more accounts (in my case, 4 accounts on 3 servers).
3. Reboot
   

   Technical details

Please run nix-shell -p nix-info --run "nix-info -m" and paste the
results.

$ nix-shell -p nix-info --run "nix-info -m"
these paths will be fetched (0.05 MiB download, 0.28 MiB unpacked):
  /nix/store/9z1b1ldrhxh7brsi6fxnyjm7gk8kiynv-bash-interactive-4.4-p23-dev
copying path '/nix/store/9z1b1ldrhxh7brsi6fxnyjm7gk8kiynv-bash-interactive-4.4-p23-dev' from 'https://cache.nixos.org'...
 - system: `"x86_64-linux"`
 - host os: `Linux 4.19.35, NixOS, 19.03.172312.330b9fac600 (Koi)`
 - multi-user?: `yes`
 - sandbox: `yes`
 - version: `nix-env (Nix) 2.2.2`
 - channels(root): `"nixos-19.03.172312.330b9fac600"`
 - channels(hobby): `""`
 - nixpkgs: `/nix/var/nix/profiles/per-user/root/channels/nixos`

--
Potential causes: #52355 #53881 #54484 #55673
Cc: @flokli @averelld @Ma27

[flokli]

@caugner this might be due to how nextcloud-client gets its keyring.

Anything interesting shown on the console on nextcloud-client startup?
How does your desktop environment look like?

Also see
https://github.com/nextcloud/desktop/issues/427
https://help.nextcloud.com/t/nextcloud-client-asks-for-password-every-time-it-starts/28591

[Ma27]

I'm probably missing something, but which keyring (i.e. Kwallet, gnome keyring or none) is used to remember the credentials?

[teto]

on login, I have a keyring unblock prompt triggered by nextcloud client (installed via home-manager)/Kwallet.

[caugner]

@flokli

Anything interesting shown on the console on nextcloud-client startup?

$ nextcloud
Warning: Ignoring XDG_SESSION_TYPE=wayland on Gnome. Use QT_QPA_PLATFORM=wayland to run on Wayland anyway.
[20892:20956:0424/024244.635185:ERROR:nss_util.cc(748)] After loading Root Certs, loaded==false: NSS error code: -8018

$ .nextcloud-wrapped --logwindow

[OCC::WebFlowCredentials::fetchFromKeychain     Fetch from keyhchain!
[OCC::AccountState::slotCredentialsFetched  Fetched credentials for "https://***" attempting to connect
[OCC::WebFlowCredentials::createQNAM    Get QNAM
// ...
[OCC::AccountState::slotConnectionValidatorResult   AccountState connection status change:  
OCC::ConnectionValidator::Undefined -> OCC::ConnectionValidator::CredentialsNotReady
[OCC::AccountState::slotInvalidCredentials  Invalid credentials for "https://***" asking user
[OCC::AccountState::setState    AccountState state change:  "Disconnected" -> "Asking Credentials"
[OCC::FolderMan::slotAccountStateChanged    Account "***@***" disconnected or paused, terminating or descheduling sync folders

How does your desktop environment look like?

Here are some extracts from my configuration.nix that look like they could be relevant:

{ config, pkgs, ... }:

{
# ...
hardware.opengl.driSupport32Bit = true;
# ...
nix.useSandbox = true;
# ...
environment.systemPackages = with pkgs; [
  # ...
  gnome3.gnome_keyring
  gnome3.gnome-packagekit
  gnome3.gnome_session
  gnome3.gnome-disk-utility
  gnome3.gnome-tweak-tool
  gnome3.mutter
  # ...
  libgnome_keyring
  # ...
];
# ...
services.gnome3 = {
  gnome-keyring.enable = true;
  tracker.enable = false;
  tracker-miners.enable = false;
};
# ...
  services.xserver = {
    enable = true;

    config = ''
      Section "InputClass"
      Identifier "Ignore Touchscreen"
      MatchIsTouchscreen "on"
      Option "Ignore" "on"
      EndSection
    '';


    layout = "de";

    desktopManager.gnome3 = {
      enable = true;
      extraGSettingsOverrides = ''
[org.gnome.desktop.background]
show-desktop-icons=true
[org.gnome.desktop.calendar]
show-weekdate=true
[org.gnome.desktop.input-sources]
sources=[('xkb','de')]
[org.gnome.desktop.interface]
clock-show-date=true
clock-show-seconds=true
scaling-factor=2
show-battery-percentage=true
[org.gnome.desktop.privacy]
hide-identity=true
report-technical-problems=true
[org.gnome.desktop.sound]
event-sounds=false
[org.gnome.mutter]
experimental-features=['scale-monitor-framebuffer']
[org.gnome.nautilus.icon-view]
defualt-zoom-level=small
[org.gnome.nautilus.list-view]
use-tree-view=true
[org.gnome.nautilus.preferences]
always-use-location-entry=true
automatic-decompressoin=false
default-folder-viewer='list-view'
executable-text-activation='ask'
show-hidden-files=true
'';
    };

    displayManager.gdm = {
      enable = true;
    };
};

# ...

}

[Ma27]

Thanks a lot for this! Unless @flokli is faster I'll try to reproduce the issue in a VM tonight :)

[Ma27]

So, I managed to reproduce the problem in a VM, but I'm not entirely sure if I didn't screw up the keyrig somehow as I'm not a GNOME user.

IIRC we had similar issues in the past, so it would be awesome if @jtojnar could have a look at this :)

[jtojnar]

Do you have a VM config?

[Ma27]

I checked this with the following VM:

{
  gnome3vm = { pkgs, ... }: {
    virtualisation.memorySize = 8192;
    users.extraUsers.vm = {
      password = "vm";
      isNormalUser = true;
    };
    environment.systemPackages = with pkgs; [
      gnome3.gnome_keyring
      gnome3.gnome-packagekit
      gnome3.gnome_session
      gnome3.gnome-disk-utility
      gnome3.gnome-tweak-tool
      gnome3.mutter
      libgnome_keyring
      nextcloud-client
    ];
    services.gnome3 = {
      gnome-keyring.enable = true;
      tracker.enable = false;
      tracker-miners.enable = false;
    };
    services.xserver = {
      enable = true;
      desktopManager.gnome3 = {
        enable = true;
        extraGSettingsOverrides = ''
          [org.gnome.desktop.background]
          show-desktop-icons=true
          [org.gnome.desktop.calendar]
          show-weekdate=true
          [org.gnome.desktop.interface]
          clock-show-date=true
          clock-show-seconds=true
          show-battery-percentage=true
          [org.gnome.desktop.privacy]
          hide-identity=true
          report-technical-problems=true
          [org.gnome.desktop.sound]
          event-sounds=false
          [org.gnome.mutter]
          experimental-features=['scale-monitor-framebuffer']
          [org.gnome.nautilus.icon-view]
          defualt-zoom-level=small
          [org.gnome.nautilus.list-view]
          use-tree-view=true
          [org.gnome.nautilus.preferences]
          always-use-location-entry=true
          automatic-decompressoin=false
          default-folder-viewer='list-view'
          executable-text-activation='ask'
          show-hidden-files=true
        '';
      };

      displayManager.gdm = {
        enable = true;
      };
    };
  };
}

It's based on the GNOME3 config from @caugner and can be built by running NIX_PATH=nixpkgs/path/to/nixpkgs nixos-build-vms vmtest.nix.

[jtojnar]

I had to add

  services.nextcloud = {
    enable = true;
    nginx.enable = true;
    hostName = "nextcloud";
    config = {
      adminuser = "admin";
      adminpass = "password";
    };
  };

I run strace on nextcloud and can confirm that it does not try to load libsecret.so, only libgnome-keyring.so. Which is weird, as we seem to compile qtkeychain with libsecret support.

I am not very familiar with Qt ecosystem but at a glance, nothing looks like it is choosing which backends to use in:

https://github.com/nextcloud/desktop/blob/68983c54bbdb522df5c12dea321e57508d1b49ab/src/libsync/creds/httpcredentials.cpp

[jtojnar]

Hmm, apparently qtkeychain builds libsecret.cpp.o even when libsecret is not supported:

https://github.com/frankosterfeld/qtkeychain/blob/e7118623a44485c173cc43e7386725c8cfec0842/CMakeLists.txt#L150-L166

Will open a PR soon.

[flokli]

I was a bit busy recently, thanks a lot @jtojnar for tracing this down!

[jtojnar]

Fixed in https://github.com/NixOS/nixpkgs/pull/60327.

[caugner]

Thanks a lot!