Cannot add WebAuthn-device in NC 19

How to use GitHub

• Please use the 👍 reaction to show that you are affected by the same issue.
• Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
• Subscribe to receive notifications on status change and new comments.

Steps to reproduce

Hello everyone,

after successfully upgrading to NC19, I am facing the problem that I cannot add a WebAuthn-device (Nitrokey FIDO2) to use the integrated passwordless login. Once I click on the button, nothing happens - this depends on my user though as the Nextcloud-Administrator doesn’t have this problem.

I used WebAuth via the separate app “Two-Factor WebAuthn” (https://apps.nextcloud.com/apps/twofactor_webauthn 6) before with NC 18 and hadn’t any problems. The app wasn’t compatible but could be activated nevertheless so I removed my Nitrokey, removed the app and am still stuck as I cannot add the key with the new, integrated feature in NC 19.

I also took a test system, complete new installation with NC 19 in the meantime. I cannot add WebAuthn as a standard user, being the Nextcloud-Administrator it works as it should.

Is this issue possibly already known? Affected systems are Debian 10 and Ubuntu 20 Server, Nextcloud is running with latest Apache and PHP 7.4 and MariaDB.

[kesselb]

cc @rullzer @ChristophWurst

[Borega]

I have the same issue. Nextcloud 19 on Ubuntu 20 server with ngnix. and php7.4 and MariaDB

[thgoebel]

With my Docker installation, the dev console shows a 403 on the /settings/api/personal/webauthn/registration endpoint when a normal user hits the Add WebAuthn device button, if that's any help.
I failed to find anything useful in the nextcloud.log though :(

[derHSE]

Same for Yubikey 5 NFC (...ok, it is FIDO2 :-) )

[kesselb]

Index: apps/settings/lib/Controller/WebAuthnController.php
IDEA additional info:
Subsystem: com.intellij.openapi.diff.impl.patch.CharsetEP
<+>UTF-8
===================================================================
--- apps/settings/lib/Controller/WebAuthnController.php	(revision dba76c04bba910c3c6f1dec4f3eba6416ec3378d)
+++ apps/settings/lib/Controller/WebAuthnController.php	(revision 761a7bf6a2815855ef8d0c92f657979a847cf577)
@@ -65,6 +65,7 @@
 
 	/**
 	 * @NoAdminRequired
+	 * @NoSubadminRequired
 	 * @PasswordConfirmationRequired
 	 * @UseSession
 	 * @NoCSRFRequired
@@ -82,6 +83,7 @@
 
 	/**
 	 * @NoAdminRequired
+	 * @NoSubadminRequired
 	 * @PasswordConfirmationRequired
 	 * @UseSession
 	 */
@@ -103,6 +105,7 @@
 
 	/**
 	 * @NoAdminRequired
+	 * @NoSubadminRequired
 	 * @PasswordConfirmationRequired
 	 */
 	public function deleteRegistration(int $id): JSONResponse {

Should do the trick ;)