[Python] Authenticating a user with NextCloud using oauth2 in flask fails at getting access...

I am writing a flask app that authenticates users via oauth2 with a NextCloud instance (and later will use file synchronisation). From what I read this should be fairly straightforward. For example authlib describes how to create a oauth2 client with flask: https://docs.authlib.org/en/latest/client/index.html

Here's the current implementation:

import requests
from flask import Flask, render_template, jsonify, request, session, url_for, redirect
from flask_session import Session
from authlib.integrations.flask_client import OAuth

app = Flask("webapp")

# app.config is set here, specifically settings:
# NEXTCLOUD_CLIENT_ID
# NEXTCLOUD_SECRET
# NEXTCLOUD_API_BASE_URL
# NEXTCLOUD_AUTHORIZE_URL
# NEXTCLOUD_ACCESS_TOKEN_URL

# set session to be managed server-side
Session(app)

# register NextCloud oauth
oauth = OAuth(app)
nextcloud = oauth.register('nextcloud')

@app.route("/", methods=["GET"])
def index():
return render_template("index.html"), 200

@app.route("/nextcloud_login", methods=["GET"])
def nextcloud_login():
redirect_uri = url_for("callback_nextcloud", _external=True)
return nextcloud.authorize_redirect(redirect_uri)

@app.route('/callback/nextcloud', methods=["GET"])
def callback_nextcloud():
token = nextcloud.authorize_access_token()
session["nextcloud_token"] = token
return redirect(url_for("index"))


The index route shows a page with a link to the login route. If clicked the user is sent to the NextCloud instance using the NEXTCLOUD_AUTHORIZE_URL and upon agreeing to the auth, is sent back to the route /callback/nextcloud (registered that way in NextCloud). I can confirm it is working up to this point and the request to the callback route looks like GET /callback/nextcloud?state=some-token&code=even-longer-token HTTP/1.1. However when the line token = nextcloud.authorize_access_token() is executed, authlib tries to get an access token in the background, but this fails with a 500 response and no error message. It took some digging to find an error message on the NextCloud server (see below). Now it is entirely possible that the issue is with NextCloud and has nothing to do with the code, but I find this very unlikely as I unsuccessfully spent hours trying to find a shred of useful information on the web and it's unlikely I'm the first to notice this issue. At the moment I'm assuming my implementation is at fault and I'm hopefully just overlooking something very simple.

NextCloud error message in the server log: OC\\Security\\Crypto::calculateHMAC(): Argument #1 ($message) must be of type string, null given, called in /var/www/nextcloud/apps/oauth2/lib/Controller/OauthApiController.php on line 142 in file '/var/www/nextcloud/lib/private/Security/Crypto.php' line 42

Continue reading...