nextcloud/server · critical · Sabre\DAV\Exception\ServiceUnavailable

$class: $msg

Error message

$class: $msg

What it means

Auth::check() lets NotAuthenticated pass through, but converts every other exception thrown inside the DAV authentication pipeline into ServiceUnavailable (HTTP 503) formatted "<exceptionClass>: <message>", after logging the original exception. The message therefore names the real failure inside auth (LDAP bind, token validation, custom backend); the request never authenticated. This is a server-side outage signature, not a client error.

Source

Thrown at apps/dav/lib/Connector/Sabre/Auth.php:122

		}
	}

	/**
	 * @return array{bool, string}
	 * @throws NotAuthenticated
	 * @throws ServiceUnavailable
	 */
	#[\Override]
	public function check(RequestInterface $request, ResponseInterface $response) {
		try {
			return $this->auth($request, $response);
		} catch (NotAuthenticated $e) {
			throw $e;
		} catch (Exception $e) {
			$class = get_class($e);
			$msg = $e->getMessage();
			Server::get(LoggerInterface::class)->error($e->getMessage(), ['exception' => $e]);
			throw new ServiceUnavailable("$class: $msg");
		}
	}

	/**
	 * Checks whether a CSRF check is required on the request
	 */
	private function requiresCSRFCheck(): bool {

		$methodsWithoutCsrf = ['GET', 'HEAD', 'OPTIONS'];
		if (in_array($this->request->getMethod(), $methodsWithoutCsrf)) {
			return false;
		}

		// Official Nextcloud clients require no checks
		if ($this->request->isUserAgent([
			IRequest::USER_AGENT_CLIENT_DESKTOP,
			IRequest::USER_AGENT_CLIENT_ANDROID,
			IRequest::USER_AGENT_CLIENT_IOS,

View on GitHub (pinned to ecdeb153ff)

Solutions

1. Open nextcloud.log: the original exception with trace is logged right before the 503; its class name identifies the failing component.
2. For LDAP backends, run occ ldap:test-config and verify server reachability, credentials, and certificates.
3. For auth apps, confirm version compatibility and that migrations ran (occ migrations:status).
4. Clients should treat the 503 as transient and retry with backoff once the backend is restored.

for ($attempt = 1; $attempt <= 3; $attempt++) {
    try {
        return $client->request('PROPFIND', '/remote.php/dav/comments/files/123/', []);
    } catch (ServiceUnavailable $e) { // 503 "<class>: <msg>" — auth backend failing
        error_log('DAV auth backend failing: ' . $e->getMessage());
        sleep(2 ** $attempt); // backoff; server-side outage, retry later
    }
}
throw new RuntimeException('DAV auth backend unavailable');

When it happens

Trigger: LDAP/AD backend unreachable or timing out during bind; user/session database errors inside token validation; exceptions thrown by a misconfigured or incompatible custom auth backend or SSO app; anything exploding during auth that is not a clean 'not authenticated' verdict.

Common situations: LDAP server down or certificate expired towards Active Directory; database locks during login storms; auth app updates that skip migrations or mismatch the server version.

Related errors

• File is not updatable: %1$s
• Cannot authenticate over ajax calls
• CSRF check not passed.
• Cannot authenticate over ajax calls
• filesystem not setup

AI-assisted analysis of nextcloud/server@ecdeb153ff (2026-08-17). Data as JSON: /api/errors/35cc9f4698f2bcb6. Report an issue: GitHub.