IONOS(user_oidc): switch to IONOS fork with Bearer-scheme guard (HDNEXT-2218) [v31]

[printminion-co]

Summary

Switches apps-external/user_oidc from vanilla nextcloud/user_oidc to the IONOS fork
IONOS-Productivity/nc-user_oidc at the same version (8.6.1), so we can carry one backported
upstream fix. No version change, no configuration change.

	Before	After
URL	git@github.com:nextcloud/user_oidc.git	git@github.com:IONOS-Productivity/nc-user_oidc.git
Gitlink	b5a67c7c6454ec6f3872ed424283b788cbbae86b (v8.6.1)	d65e3f16cb27912cbe4b8669249c6d6e42c4f5cd (v8.6.1-d65e3f1)
App version	8.6.1	8.6.1 (unchanged)
NC compatibility	min 29, max 34	min 29, max 34 (unchanged)

Why

Backend::getCurrentUserId() strips a Bearer prefix from the Authorization header without
checking the header actually uses the Bearer scheme. A WebDAV client authenticating with an app
password sends Authorization: Basic …; that value passes through unmodified and is forwarded to
the IdP as Authorization: Bearer Basic …, which the IdP rejects with 400. The request then
succeeds via the app-password backend, so the defect is invisible from the client side.

DAV requests carry no session, so Nextcloud re-runs the full auth chain per request
(apps/dav/lib/Connector/Sabre/Auth.php → OC_User::handleApacheAuth() →
Backend::getCurrentUserId()) — this fires on every PROPFIND, PUT and MKCOL from every
non-browser client.

Measured live 2026-09-09, 08:00–09:00 UTC: 92,617 /userinfo calls/hour estate-wide
(~2.2M/day), of which 9 in three hours were legitimate. A single rclone client produced 3,492
of these events in one minute (~29 /userinfo calls/second from one host), more than the
estate-wide hourly average from one machine.

Upstream fixed this in nextcloud/user_oidc#1386,
which landed after v8.6.1 — the version we must stay on. Hence the fork.

The delta

The fork's ionos-stable8.6 branch is vanilla v8.6.1 plus exactly one commit: an unmodified
cherry-pick -x of upstream 2aa104a380f597e4f9088b9d46758480b9bd4a5c, four added lines in
lib/User/Backend.php. Because it is the unmodified upstream commit, the IONOS delta disappears
by itself once we upgrade to an upstream release that already contains nextcloud#1386.

Fork PR: IONOS-Productivity/nc-user_oidc#3
Tag: https://github.com/IONOS-Productivity/nc-user_oidc/releases/tag/v8.6.1-d65e3f1 (pre-release)

No configuration change

userinfo_bearer_validation stays true and must not be flipped to false: IONOS access tokens
carry no userId claim, so SelfEncodedValidator cannot resolve a uid and UserInfoValidator is
the only validator that works — disabling it would break HiDriveNext login in every market.

Scope

v8.6.1 declares NC min 29 / max 34, and all four release branches pinned the same commit, so a
single fork branch and a single prerelease tag serve ionos-dev-v30 … ionos-dev-v33. The
companion PRs move the identical two-line change on the other three branches:

• ionos-dev-v30 — IONOS(user_oidc): switch to IONOS fork with Bearer-scheme guard (HDNEXT-2218) [v30] #331
• ionos-dev-v31 — IONOS(user_oidc): switch to IONOS fork with Bearer-scheme guard (HDNEXT-2218) [v31] #332 ← this PR
• ionos-dev-v32 — IONOS(user_oidc): switch to IONOS fork with Bearer-scheme guard (HDNEXT-2218) [v32] #333
• ionos-dev-v33 — IONOS(user_oidc): switch to IONOS fork with Bearer-scheme guard (HDNEXT-2218) [v33] #334

Nothing else in the superproject needed touching: IONOS/Makefile drives the build off the generic
EXTERNAL_FULL_APPS list, .github/workflows/sbom-matrix.yaml keys on the submodule path, and
there is no submodule URL allowlist anywhere. The fork is public, so CI needs no new access grant.

Verify

git submodule status apps-external/user_oidc
grep -n 'str_starts_with($headerToken' apps-external/user_oidc/lib/User/Backend.php
grep -A1 '<nextcloud' apps-external/user_oidc/appinfo/info.xml

Post-deploy, per the ticket's AC: Fetching user info endpoint on DAV requests drops to zero,
LFv2 login end to end still succeeds with Token validated with …UserInfoValidator, browser login
unaffected, existing sync clients keep working with no re-link, and the /userinfo rate on the
patched shard falls to single digits/hour in Kibana.

Commit hashes are written unformatted (no backticks) so GitHub auto-links them.

Jira: HDNEXT-2218

TODO

• Review / merge into ionos-dev-v31
• Push to rc/web-v31-1 — cherry-pick onto the RC branch after merge, the way
  HDNEXT-2216 reached it (PR IONOS(dav): fix file overwrite via chunked upload without update permission #330 merged to ionos-dev-v30, then cherry-picked as 331a2ed)