[GH-ISSUE #130] Webdav sync fails: "password login forbidden" #40

New issue

Closed

opened 2026-02-26 05:32:38 +03:00 by kerem · 1 comment

kerem commented

2026-02-26 05:32:38 +03:00

Owner

Originally created by @onny on GitHub (Oct 5, 2018).
Original GitHub issue: https://github.com/nextcloud/twofactor_gateway/issues/130

Hey,
thank you for this nice app, it is already working great with the Signal gateway on my server.
After enabling 2FA I noticed that my Android phone stopped syncing contacts and calendar events with Nextcloud. I'm using Davdroid for this which relies on Webdav.
So somehow the username + password authentication doesn't work anymore. Which does makes sense but maybe we can add an exception to disable 2FA on Webdav so that the syncing clients still can do their job.

So the relevant part of the debug log looks like this:

2018-10-04 21:44:40 2781 [HttpClient] <?xml version="1.0" encoding="utf-8"?>
<d:error xmlns:d="DAV:" xmlns:s="http://sabredav.org/ns" xmlns:o="http://owncloud.org/ns">
  <s:exception>OCA\DAV\Connector\Sabre\Exception\PasswordLoginForbidden</s:exception>
  <s:message/>
  <o:hint xmlns:o="o:">password login forbidden</o:hint>
</d:error>

2018-10-04 21:44:40 2781 [HttpClient] <-- END HTTP (299-byte body)
2018-10-04 21:44:40 2796 [okhttp3.internal.http2.Http2Writer] >> 0x00000000     8 GOAWAY        
2018-10-04 21:44:40 2781 [syncadapter.SyncManager] Not authorized anymore
EXCEPTION at.bitfire.dav4android.exception.UnauthorizedException: HTTP 401

Here's the full log: https://git.project-insanity.org/snippets/44

Best regards,
Jonas

Originally created by @onny on GitHub (Oct 5, 2018). Original GitHub issue: https://github.com/nextcloud/twofactor_gateway/issues/130 Hey, thank you for this nice app, it is already working great with the Signal gateway on my server. After enabling 2FA I noticed that my Android phone stopped syncing contacts and calendar events with Nextcloud. I'm using Davdroid for this which relies on Webdav. So somehow the username + password authentication doesn't work anymore. Which does makes sense but maybe we can add an exception to disable 2FA on Webdav so that the syncing clients still can do their job. So the relevant part of the debug log looks like this: ``` 2018-10-04 21:44:40 2781 [HttpClient] <?xml version="1.0" encoding="utf-8"?> <d:error xmlns:d="DAV:" xmlns:s="http://sabredav.org/ns" xmlns:o="http://owncloud.org/ns"> <s:exception>OCA\DAV\Connector\Sabre\Exception\PasswordLoginForbidden</s:exception> <s:message/> <o:hint xmlns:o="o:">password login forbidden</o:hint> </d:error> 2018-10-04 21:44:40 2781 [HttpClient] <-- END HTTP (299-byte body) 2018-10-04 21:44:40 2796 [okhttp3.internal.http2.Http2Writer] >> 0x00000000 8 GOAWAY 2018-10-04 21:44:40 2781 [syncadapter.SyncManager] Not authorized anymore EXCEPTION at.bitfire.dav4android.exception.UnauthorizedException: HTTP 401 ``` Here's the full log: https://git.project-insanity.org/snippets/44 Best regards, Jonas

kerem closed this issue

2026-02-26 05:32:38 +03:00

kerem commented

2026-02-26 05:32:39 +03:00

Author

Owner

@ChristophWurst commented on GitHub (Oct 5, 2018):

So somehow the username + password authentication doesn't work anymore.

It's not a bug but a feature 😉

2FA would be quite useless if it just made logging in harder for you while an attacker could still access the data via the API, wouldn't it?

Just create app password: https://docs.nextcloud.com/server/14/user_manual/user_2fa.html#using-client-applications-with-two-factor-authentication

@ChristophWurst commented on GitHub (Oct 5, 2018): > So somehow the username + password authentication doesn't work anymore. It's not a bug but a feature :wink: 2FA would be quite useless if it just made logging in harder for you while an attacker could still access the data via the API, wouldn't it? Just create app password: https://docs.nextcloud.com/server/14/user_manual/user_2fa.html#using-client-applications-with-two-factor-authentication

kerem referenced this issue

2026-02-26 05:33:46 +03:00

[PR #40] [MERGED] Add Krankerl support #162

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/twofactor_gateway-nextcloud#40

No description provided.

Rows
Columns