{"record":{"id":"3d7357bce141eec1","repo":"nextcloud/server","slug":"principal-not-found-3d7357","errorCode":null,"errorMessage":"Principal not found","messagePattern":"Principal not found","errorType":"exception","errorClass":"Sabre\\DAV\\Exception","httpStatus":500,"severity":"error","filePath":"apps/dav/lib/DAV/RemoteUserPrincipalBackend.php","lineNumber":102,"sourceCode":"\t\t\tif ($principal !== null) {\n\t\t\t\treturn $principal['uri'];\n\t\t\t}\n\t\t}\n\n\t\treturn null;\n\t}\n\n\t#[\\Override]\n\tpublic function getGroupMemberSet($principal) {\n\t\treturn [];\n\t}\n\n\t#[\\Override]\n\tpublic function getGroupMembership($principal) {\n\t\t// TODO: for now the group principal has only one member, the user itself\n\t\t$principal = $this->getPrincipalByPath($principal);\n\t\tif (!$principal) {\n\t\t\tthrow new \\Sabre\\DAV\\Exception('Principal not found');\n\t\t}\n\n\t\treturn [$principal['uri']];\n\t}\n\n\t#[\\Override]\n\tpublic function setGroupMemberSet($principal, array $members) {\n\t\tthrow new \\Sabre\\DAV\\Exception('Adding members to remote user is not supported');\n\t}\n\n\t/**\n\t * @return array{'{DAV:}displayname': string, '{http://nextcloud.com/ns}cloud-id': ICloudId, uri: string}\n\t */\n\tprivate function principalUriToPrincipal(string $principalUri): array {\n\t\t[, $name] = \\Sabre\\Uri\\split($principalUri);\n\t\t$cloudId = $this->cloudIdManager->resolveCloudId(base64_decode($name));\n\t\treturn [\n\t\t\t'uri' => $principalUri,","sourceCodeStart":84,"sourceCodeEnd":120,"githubUrl":"https://github.com/nextcloud/server/blob/ecdeb153ffdf227235c9a7e2d13dbe0f9c817bc3/apps/dav/lib/DAV/RemoteUserPrincipalBackend.php#L84-L120","documentation":"RemoteUserPrincipalBackend::getGroupMembership() (apps/dav/lib/DAV/RemoteUserPrincipalBackend.php:102) throws \\Sabre\\DAV\\Exception('Principal not found') when getPrincipalByPath() cannot resolve the requested federated principal. Resolution goes through principalUriToPrincipal(), which base64-decodes the last path segment into a cloud ID via the CloudIdManager — if the decode/resolve fails (returns null), the lookup result is null and membership cannot be computed.","triggerScenarios":"Sabre asks for group membership of a principal like principals/system/<base64-cloud-id> where the base64 segment is malformed or does not resolve to a valid cloud id; stale principal URIs left in a client's cache; ACL checks on shares whose remote user entry was never or is no longer resolvable.","commonSituations":"Federated share accepted long ago whose remote user cannot be resolved anymore (remote server renamed/disappeared); hand-crafted or truncated base64 principal names; client caches from before a server migration.","solutions":["Verify the principal URI is the exact one the server hands out (principal-property-search or PROPFIND on the principal collection) rather than a reconstructed/stale one.","Re-establish the federated share so the remote user is resolvable again, or remove the stale share.","Check that the last path segment is valid base64 encoding of a cloud id (user@host).","Since Sabre surfaces this as a generic 500, check nextcloud.log to confirm RemoteUserPrincipalBackend as the source before debugging elsewhere."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// verify the principal exists before membership queries\n$principal = $backend->getPrincipalByPath($path);\nif ($principal === null) {\n    $this->skip('Unresolvable federated principal: ' . $path);\n    return [];\n}","typeGuard":"function isResolvablePrincipal(PrincipalBackendInterface $backend, string $uri): bool {\n    try {\n        return $backend->getPrincipalByPath($uri) !== null;\n    } catch (\\Exception) {\n        return false;\n    }\n}","tryCatchPattern":"try {\n    $membership = $backend->getGroupMembership($principalUri);\n} catch (\\Sabre\\DAV\\Exception $e) {\n    if (str_contains($e->getMessage(), 'Principal not found')) {\n        $membership = []; // treat stale federated principals as no membership\n    } else {\n        throw $e;\n    }\n}","preventionTips":["Always resolve principals via discovery (principal-property-search) instead of cached or constructed URIs.","Refresh or remove stale federated shares whose remote user no longer resolves.","Check nextcloud.log to confirm the source when a generic DAV 500 appears on principal lookups."],"tags":["dav","principal","federation","cloud-id","not-found"],"backgroundTag":"principal-not-found","analyzedSha":"ecdeb153ffdf227235c9a7e2d13dbe0f9c817bc3","analyzedAt":"2026-08-17T01:36:13.386Z","schemaVersion":2},"datasetVersion":"2026-08-17T04:17:16.089Z"}