{"record":{"id":"2e90554e8b3d3808","repo":"nextcloud/server","slug":"resource-not-found","errorCode":"RESOURCE_NOT_FOUND","errorMessage":"Parameters missing in order to complete the request. Missing Parameters: sharedSecret","messagePattern":"Parameters missing in order to complete the request\\. Missing Parameters: sharedSecret","errorType":"exception","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"apps/cloud_federation_api/lib/Controller/RequestHandlerController.php","lineNumber":466,"sourceCode":"\t\t\t$entry = trim($value, '@');\n\t\t}\n\t\t$this->ocmDiscoveryService->confirmRequestOrigin($signedRequest?->getOrigin(), $entry);\n\t}\n\n\t/**\n\t * Resolve the sender identity from a notification's sharedSecret.\n\t * Returns '' when the provider does not implement signed federation.\n\t *\n\t * @param string $resourceType\n\t * @param array<string, mixed> $notification\n\t *\n\t * @throws IncomingRequestException\n\t * @throws BadRequestException\n\t */\n\tprivate function resolveNotificationIdentity(string $resourceType, array $notification): string {\n\t\t$sharedSecret = $notification['sharedSecret'] ?? '';\n\t\tif ($sharedSecret === '') {\n\t\t\tthrow new BadRequestException(['sharedSecret']);\n\t\t}\n\n\t\ttry {\n\t\t\t$provider = $this->cloudFederationProviderManager->getCloudFederationProvider($resourceType);\n\t\t\tif ($provider instanceof ISignedCloudFederationProvider || $provider instanceof \\NCU\\Federation\\ISignedCloudFederationProvider) {\n\t\t\t\t$identity = $provider->getFederationIdFromSharedSecret($sharedSecret, $notification);\n\t\t\t\tif ($identity === '') {\n\t\t\t\t\t$tokenProvider = Server::get(PublicKeyTokenProvider::class);\n\t\t\t\t\t$accessTokenDb = $tokenProvider->getToken($sharedSecret);\n\t\t\t\t\t$mapping = Server::get(OcmTokenMapMapper::class)->getByAccessTokenId($accessTokenDb->getId());\n\t\t\t\t\t$identity = $provider->getFederationIdFromSharedSecret($mapping->getRefreshToken(), $notification);\n\t\t\t\t}\n\t\t\t\treturn $identity;\n\t\t\t}\n\t\t\t$this->logger->debug('cloud federation provider {provider} does not implement ISignedCloudFederationProvider', ['provider' => $provider::class]);\n\t\t} catch (\\Exception $e) {\n\t\t\tthrow new IncomingRequestException($e->getMessage(), previous: $e);\n\t\t}","sourceCodeStart":448,"sourceCodeEnd":484,"githubUrl":"https://github.com/nextcloud/server/blob/ecdeb153ffdf227235c9a7e2d13dbe0f9c817bc3/apps/cloud_federation_api/lib/Controller/RequestHandlerController.php#L448-L484","documentation":"BadRequestException with message 'Parameters missing in order to complete the request. Missing Parameters: sharedSecret', raised in RequestHandlerController::resolveNotificationIdentity when an incoming OCM notification array has an empty/missing 'sharedSecret' key. receiveNotification() calls this before signature verification when signed federation is not disabled, so a remote server posting a federation notification without a sharedSecret is rejected. It surfaces (with the recorded RESOURCE_NOT_FOUND code) as a failed federated request rather than being processed.","triggerScenarios":"A remote Nextcloud (or OCM client) POSTs a notification to the cloud_federation_api receiveNotification endpoint (e.g. SHARE_ACCEPTED for a federated share) with no 'sharedSecret' in the notification payload — older remote versions that do not implement signed federation, third-party OCM implementations omitting the field, or a payload mangled/proxied before delivery.","commonSituations":"Federated sharing between a new server (expecting sharedSecret for identity resolution) and an older/other implementation; custom OCM clients; payload re-encoding that drops the secret; after an upgrade where signing support changed on one side only.","solutions":["On the sending side, include a non-empty 'sharedSecret' in the notification payload (it is the share token shared out-of-band at share creation)","Upgrade the remote Nextcloud so federation notifications carry the sharedSecret","Verify the request body is intact JSON with the expected OCM notification schema (correct Content-Type, no proxy rewriting)","If interoperability with a legacy peer is required temporarily, check the signed-federation appconfig toggle (OCMSignatoryManager::APPCONFIG_SIGN_DISABLED) — disabling signed federation skips this check"],"exampleFix":"// sending side (remote server / OCM client)\n// before\nawait post(receiveNotificationUrl, {\n\tnotificationType: 'SHARE_ACCEPTED',\n\tresourceType: 'file',\n\tproviderId: shareId,\n\tnotification: { message: 'share accepted' }, // no sharedSecret -> rejected\n})\n\n// after\nawait post(receiveNotificationUrl, {\n\tnotificationType: 'SHARE_ACCEPTED',\n\tresourceType: 'file',\n\tproviderId: shareId,\n\tnotification: { message: 'share accepted', sharedSecret: share.sharedSecret },\n})","handlingStrategy":"validation","validationCode":"// Sending side: validate the notification payload before POSTing\nfunction buildOcmNotification(array $payload): array {\n\tif (empty($payload['sharedSecret']) || !is_string($payload['sharedSecret'])) {\n\t\tthrow new InvalidArgumentException('OCM notification requires a non-empty sharedSecret');\n\t}\n\treturn $payload;\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always populate sharedSecret with the token exchanged when the share was created","Keep both federated peers on Nextcloud versions that send/expect the sharedSecret","Validate OCM notification payloads against the schema before sending (notificationType, resourceType, providerId, notification.sharedSecret)"],"tags":["federation","ocm","cloud-federation-api","shared-secret","php"],"backgroundTag":"missing-required-parameter","analyzedSha":"ecdeb153ffdf227235c9a7e2d13dbe0f9c817bc3","analyzedAt":"2026-08-17T01:36:13.386Z","schemaVersion":2},"datasetVersion":"2026-08-17T04:17:16.089Z"}