Summary
The WebView used for the Login Flow v2 is a WKWebView, which cannot complete cross-domain OIDC redirects. When a Nextcloud server uses an external identity provider (e.g. Authentik, Keycloak) via the user_oidc app, the login flow redirects to the IdP domain, but after successful authentication the redirect back to the Nextcloud server is silently dropped by the WKWebView. The login never completes.
This affects all apps using the SwiftNextcloudUI package for login (e.g. Nextcloud Notes iOS).
Steps to reproduce
- Configure Nextcloud with
user_oidc and an external OIDC provider (e.g. Authentik)
- Set
allow_multiple_user_backends=0 (auto-redirect to OIDC)
- Open an app using
SwiftNextcloudUI for login (e.g. Nextcloud Notes iOS 4.4.0)
- Enter the server address and proceed through Login Flow v2
- The WKWebView redirects to the OIDC provider — user authenticates successfully
- The OIDC provider redirects back to
cloud.example.com/apps/user_oidc/code?code=...
Expected behaviour
The redirect completes, the Login Flow v2 grant page loads, and the app receives its app password.
Actual behaviour
The redirect from the OIDC provider back to Nextcloud is dropped. The /login/v2/poll keeps returning 404 indefinitely. The login never completes.
Root cause
Sources/SwiftNextcloudUI/Views/WebView.swift uses WKWebView, which has known limitations with cross-domain redirects, deep links, and passkeys. This is a documented WKWebView limitation.
Suggested fix
Replace the WKWebView with ASWebAuthenticationSession for the login flow, as was done in the main Nextcloud iOS app:
ASWebAuthenticationSession handles cross-domain redirects, supports passkeys/WebAuthn, and is Apple's recommended approach for authentication flows. The WKWebView can remain as a fallback for mTLS certificate scenarios (as done in the main app).
Environment
- Nextcloud server: 33.0.2
- Nextcloud Notes iOS: 4.4.0
- SwiftNextcloudUI: main branch (91bf43d)
- OIDC provider: Authentik 2026.2
- iOS: 18.7
- user_oidc setting:
allow_multiple_user_backends=0
Note: The main Nextcloud iOS app (33.0.2) completes the same OIDC login flow successfully after PR #3996.
Summary
The
WebViewused for the Login Flow v2 is aWKWebView, which cannot complete cross-domain OIDC redirects. When a Nextcloud server uses an external identity provider (e.g. Authentik, Keycloak) via theuser_oidcapp, the login flow redirects to the IdP domain, but after successful authentication the redirect back to the Nextcloud server is silently dropped by the WKWebView. The login never completes.This affects all apps using the
SwiftNextcloudUIpackage for login (e.g. Nextcloud Notes iOS).Steps to reproduce
user_oidcand an external OIDC provider (e.g. Authentik)allow_multiple_user_backends=0(auto-redirect to OIDC)SwiftNextcloudUIfor login (e.g. Nextcloud Notes iOS 4.4.0)cloud.example.com/apps/user_oidc/code?code=...Expected behaviour
The redirect completes, the Login Flow v2 grant page loads, and the app receives its app password.
Actual behaviour
The redirect from the OIDC provider back to Nextcloud is dropped. The
/login/v2/pollkeeps returning 404 indefinitely. The login never completes.Root cause
Sources/SwiftNextcloudUI/Views/WebView.swiftusesWKWebView, which has known limitations with cross-domain redirects, deep links, and passkeys. This is a documented WKWebView limitation.Suggested fix
Replace the
WKWebViewwithASWebAuthenticationSessionfor the login flow, as was done in the main Nextcloud iOS app:nextcloud/ios: Add support for passkeys on login (merged Feb 21, 2026)ASWebAuthenticationSessionhandles cross-domain redirects, supports passkeys/WebAuthn, and is Apple's recommended approach for authentication flows. TheWKWebViewcan remain as a fallback for mTLS certificate scenarios (as done in the main app).Environment
allow_multiple_user_backends=0Note: The main Nextcloud iOS app (33.0.2) completes the same OIDC login flow successfully after PR #3996.