TOTP always shows 'not verified'

Christophorus_Reyhan · May 12, 2022, 8:39am

Steps to reproduce

Install app ( 2-Factor Authentication app | ownCloud Marketplace
Scan QR Code
Insert verification code (tried using google Authenticator and FreeOTP)
‘Not verified’

Expected behaviour

Tell us what should happen
TOTP should be verified

Actual behaviour

Tell us what happens instead
Not verified (even if I try multiple times using Authenticator & FreeOTP on all different users)

Server configuration

Operating system: Oracle Linux 8.4

Web server:

Database: 10.3.27-MariaDB

PHP version: PHP 7.4.6

ownCloud version: (see ownCloud admin page) ownCloud 10.9.1 (stable)

Updated from an older ownCloud or fresh install: fresh install

Where did you install ownCloud from: Download Server Packages - ownCloud

Signing status (ownCloud 9.0 and above):

The content of config/config.php:

gist.github.com

https://gist.github.com/ChristophorusReyhan/0842f797772d56dbefae831eb132e295

config_report_20220512.json

{
    "basic": {
        "license key": "***REMOVED SENSITIVE VALUE***",
        "date": "Thu, 12 May 2022 08:04:08 +0000",
        "ownCloud version": "10.9.1.2",
        "ownCloud version string": "10.9.1",
        "ownCloud edition": "Community",
        "server OS": "Linux",
        "server OS version": "Linux owncloud-svr 5.4.17-2102.201.3.el8uek.x86_64 #2 SMP Fri Apr 23 09:05:57 PDT 2021 x86_64",
        "server SAPI": "fpm-fcgi",

This file has been truncated. show original

List of activated apps:

gist.github.com

https://gist.github.com/ChristophorusReyhan/839558fba3e8937ab79112d9b491690b

activated_apps

Enabled:
  - comments:
    - Version: 0.3.0
    - Path: /var/www/owncloud/apps/comments
  - configreport:
    - Version: 0.2.0
    - Path: /var/www/owncloud/apps/configreport
  - dav:
    - Version: 0.7.0
    - Path: /var/www/owncloud/apps/dav

This file has been truncated. show original

Are you using external storage, if yes which one: nfs

Are you using encryption: no

Are you using an external user-backend, if yes which one: LDAP/ActiveDirectory/Webdav/…

Client configuration

Browser: Edge 101.0.1210.39 (Official build)

Operating system: Windows Version 10.0.19042 Build 19042

Logs

Web server error log

[Thu May 12 14:28:43.878629 2022] [mpm_event:notice] [pid 1583990:tid 139666520512832] AH00489: Apache/2.4.37 (Oracle Linux) configured -- resuming normal operations
[Thu May 12 14:28:43.878678 2022] [core:notice] [pid 1583990:tid 139666520512832] AH00094: Command line: '/usr/sbin/httpd -D FOREGROUND'
[Thu May 12 14:31:17.986764 2022] [mpm_event:notice] [pid 1583990:tid 139666520512832] AH00492: caught SIGWINCH, shutting down gracefully
[Thu May 12 14:32:00.440065 2022] [core:notice] [pid 1584457:tid 140527843670336] SELinux policy enabled; httpd running as context system_u:system_r:httpd_t:s0
[Thu May 12 14:32:00.441966 2022] [suexec:notice] [pid 1584457:tid 140527843670336] AH01232: suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
AH00558: httpd: Could not reliably determine the server's fully qualified domain name, using fe80::a00:27ff:fe94:4821. Set the 'ServerName' directive globally to suppress this message
[Thu May 12 14:32:00.481378 2022] [lbmethod_heartbeat:notice] [pid 1584457:tid 140527843670336] AH02282: No slotmem from mod_heartmonitor
[Thu May 12 14:32:00.483028 2022] [http2:warn] [pid 1584457:tid 140527843670336] AH02951: mod_ssl does not seem to be enabled
[Thu May 12 14:32:00.489037 2022] [mpm_event:notice] [pid 1584457:tid 140527843670336] AH00489: Apache/2.4.37 (Oracle Linux) configured -- resuming normal operations
[Thu May 12 14:32:00.489104 2022] [core:notice] [pid 1584457:tid 140527843670336] AH00094: Command line: '/usr/sbin/httpd -D FOREGROUND'

ownCloud log (data/owncloud.log)

gist.github.com

https://gist.github.com/ChristophorusReyhan/768e29783673a0df67d9c6cfd91820d4

owncloud.log

{"reqId":"YnzByrw7dBNROr5K9qx6jgAAAMs","level":0,"time":"2022-05-12T15:14:02+07:00","remoteAddr":"{IP ADDRESS}","user":"admin","app":"OC\\User\\Session::validateToken","method":"GET","url":"\/owncloud\/index.php\/settings\/personal\/authtokens","message":"token 1e050c609ce71985c9fe0812159100b057b76e94dd08dfad55bc8b6ccc56c0bf7a37939b82193fca2e81dd5ef73ca147c50602748b83fba4ae5dec0a061be66c with token id 99 found, validating"}
{"reqId":"YnzByrw7dBNROr5K9qx6jQAAAM0","level":0,"time":"2022-05-12T15:14:03+07:00","remoteAddr":"{IP ADDRESS}","user":"admin","app":"OC\\User\\Session::validateToken","method":"GET","url":"\/owncloud\/index.php\/apps\/twofactor_totp\/settings\/state","message":"token 1e050c609ce71985c9fe0812159100b057b76e94dd08dfad55bc8b6ccc56c0bf7a37939b82193fca2e81dd5ef73ca147c50602748b83fba4ae5dec0a061be66c with token id 99 found, validating"}
{"reqId":"YnzByrw7dBNROr5K9qx6jQAAAM0","level":0,"time":"2022-05-12T15:14:03+07:00","remoteAddr":"{IP ADDRESS}","user":"admin","app":"OC\\User\\Session::validateToken","method":"GET","url":"\/owncloud\/index.php\/apps\/twofactor_totp\/settings\/state","message":"token 1e050c609ce71985c9fe0812159100b057b76e94dd08dfad55bc8b6ccc56c0bf7a37939b82193fca2e81dd5ef73ca147c50602748b83fba4ae5dec0a061be66c with token id 99 found, validating"}
{"reqId":"YnzByrw7dBNROr5K9qx6jQAAAM0","level":0,"time":"2022-05-12T15:14:03+07:00","remoteAddr":"{IP ADDRESS}","user":"admin","app":"OC\\User\\Session::validateToken","method":"GET","url":"\/owncloud\/index.php\/apps\/twofactor_totp\/settings\/state","message":"token 1e050c609ce71985c9fe0812159100b057b76e94dd08dfad55bc8b6ccc56c0bf7a37939b82193fca2e81dd5ef73ca147c50602748b83fba4ae5dec0a061be66c with token id 99 found, validating"}
{"reqId":"YnzBzbw7dBNROr5K9qx6jwAAANA","level":0,"time":"2022-05-12T15:14:05+07:00","remoteAddr":"{IP ADDRESS}","user":"admin","app":"OC\\User\\Session::validateToken","method":"POST","url":"\/owncloud\/index.php\/apps\/twofactor_totp\/settings\/enable","message":"token 1e050c609ce71985c9fe0812159100b057b76e94dd08dfad55bc8b6ccc56c0bf7a37939b82193fca2e81dd5ef73ca147c50602748b83fba4ae5dec0a061be66c with token id 99 found, validating"}
{"reqId":"YnzBzbw7dBNROr5K9qx6jwAAANA","level":0,"time":"2022-05-12T15:14:05+07:00","remoteAddr":"{IP ADDRESS}","user":"admin","app":"OC\\User\\Session::validateToken","method":"POST","url":"\/owncloud\/index.php\/apps\/twofactor_totp\/settings\/enable","message":"token 1e050c609ce71985c9fe0812159100b057b76e94dd08dfad55bc8b6ccc56c0bf7a37939b82193fca2e81dd5ef73ca147c50602748b83fba4ae5dec0a061be66c with token id 99 found, validating"}
{"reqId":"YnzBzbw7dBNROr5K9qx6jwAAANA","level":0,"time":"2022-05-12T15:14:05+07:00","remoteAddr":"{IP ADDRESS}","user":"admin","app":"OC\\User\\Session::validateToken","method":"POST","url":"\/owncloud\/index.php\/apps\/twofactor_totp\/settings\/enable","message":"token 1e050c609ce71985c9fe0812159100b057b76e94dd08dfad55bc8b6ccc56c0bf7a37939b82193fca2e81dd5ef73ca147c50602748b83fba4ae5dec0a061be66c with token id 99 found, validating"}
{"reqId":"YnzB3Lw7dBNROr5K9qx6kAAAANE","level":0,"time":"2022-05-12T15:14:20+07:00","remoteAddr":"{IP ADDRESS}","user":"admin","app":"OC\\User\\Session::validateToken","method":"POST","url":"\/owncloud\/index.php\/apps\/twofactor_totp\/settings\/verifyNewSecret","message":"token 1e050c609ce71985c9fe0812159100b057b76e94dd08dfad55bc8b6ccc56c0bf7a37939b82193fca2e81dd5ef73ca147c50602748b83fba4ae5dec0a061be66c with token id 99 found, validating"}
{"reqId":"YnzB3Lw7dBNROr5K9qx6kAAAANE","level":0,"time":"2022-05-12T15:14:20+07:00","remoteAddr":"{IP ADDRESS}","user":"admin","app":"OC\\User\\Session::validateToken","method":"POST","url":"\/owncloud\/index.php\/apps\/twofactor_totp\/settings\/verifyNewSecret","message":"token 1e050c609ce71985c9fe0812159100b057b76e94dd08dfad55bc8b6ccc56c0bf7a37939b82193fca2e81dd5ef73ca147c50602748b83fba4ae5dec0a061be66c with token id 99 found, validating"}
{"reqId":"YnzB3Lw7dBNROr5K9qx6kAAAANE","level":0,"time":"2022-05-12T15:14:20+07:00","remoteAddr":"{IP ADDRESS}","user":"admin","app":"OC\\User\\Session::validateToken","method":"POST","url":"\/owncloud\/index.php\/apps\/twofactor_totp\/settings\/verifyNewSecret","message":"token 1e050c609ce71985c9fe0812159100b057b76e94dd08dfad55bc8b6ccc56c0bf7a37939b82193fca2e81dd5ef73ca147c50602748b83fba4ae5dec0a061be66c with token id 99 found, validating"}

This file has been truncated. show original

Browser log

jquery-migrate.min.js?v=843b0499ae125a84ca945b3adef4d2d9:2 JQMIGRATE: Migrate is installed, version 1.4.0

dmitry · May 12, 2022, 9:12am

We don’t recommend running fpm with ownCloud.

dmitry · May 12, 2022, 9:13am

what web server are you running?

Christophorus_Reyhan · May 12, 2022, 9:40am

I’m using Apache 2.4.37

alfredb · May 12, 2022, 11:46am

Maybe this might help:
I’ve never scanned the dot matrix code, always transferred the secret manually. To verify your issue, I tried scanning with my app (bitwarden). At the first try, it didn’t work, same as you wrote. But after I saved the inserted URL in the app, the authentication code is verified as expected.

Christophorus_Reyhan · May 31, 2022, 1:58am

I’m not a premium member of bitwarden, so I can’t use their TOTP feature, any other suggestion?

Could datetime be the culprit since my server are not synced by ntp (it’s not connected to the internet)?

Christophorus_Reyhan · May 31, 2022, 3:59am

Whoops, turns out it was a problem with datetime. After I fix the time to match current time it works fine and it’s verified now. Thank you for the help @alfredb @dmitry.

system · August 29, 2022, 3:59am

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.