nextcloud/server · error · Sabre\DAV\Exception

Principal not found

Error message

Principal not found

What it means

RemoteUserPrincipalBackend::getGroupMembership() (apps/dav/lib/DAV/RemoteUserPrincipalBackend.php:102) throws \Sabre\DAV\Exception('Principal not found') when getPrincipalByPath() cannot resolve the requested federated principal. Resolution goes through principalUriToPrincipal(), which base64-decodes the last path segment into a cloud ID via the CloudIdManager — if the decode/resolve fails (returns null), the lookup result is null and membership cannot be computed.

Source

Thrown at apps/dav/lib/DAV/RemoteUserPrincipalBackend.php:102

			if ($principal !== null) {
				return $principal['uri'];
			}
		}

		return null;
	}

	#[\Override]
	public function getGroupMemberSet($principal) {
		return [];
	}

	#[\Override]
	public function getGroupMembership($principal) {
		// TODO: for now the group principal has only one member, the user itself
		$principal = $this->getPrincipalByPath($principal);
		if (!$principal) {
			throw new \Sabre\DAV\Exception('Principal not found');
		}

		return [$principal['uri']];
	}

	#[\Override]
	public function setGroupMemberSet($principal, array $members) {
		throw new \Sabre\DAV\Exception('Adding members to remote user is not supported');
	}

	/**
	 * @return array{'{DAV:}displayname': string, '{http://nextcloud.com/ns}cloud-id': ICloudId, uri: string}
	 */
	private function principalUriToPrincipal(string $principalUri): array {
		[, $name] = \Sabre\Uri\split($principalUri);
		$cloudId = $this->cloudIdManager->resolveCloudId(base64_decode($name));
		return [
			'uri' => $principalUri,

View on GitHub (pinned to ecdeb153ff)

Solutions

1. Verify the principal URI is the exact one the server hands out (principal-property-search or PROPFIND on the principal collection) rather than a reconstructed/stale one.
2. Re-establish the federated share so the remote user is resolvable again, or remove the stale share.
3. Check that the last path segment is valid base64 encoding of a cloud id (user@host).
4. Since Sabre surfaces this as a generic 500, check nextcloud.log to confirm RemoteUserPrincipalBackend as the source before debugging elsewhere.

// verify the principal exists before membership queries
$principal = $backend->getPrincipalByPath($path);
if ($principal === null) {
    $this->skip('Unresolvable federated principal: ' . $path);
    return [];
}

function isResolvablePrincipal(PrincipalBackendInterface $backend, string $uri): bool {
    try {
        return $backend->getPrincipalByPath($uri) !== null;
    } catch (\Exception) {
        return false;
    }
}

try {
    $membership = $backend->getGroupMembership($principalUri);
} catch (\Sabre\DAV\Exception $e) {
    if (str_contains($e->getMessage(), 'Principal not found')) {
        $membership = []; // treat stale federated principals as no membership
    } else {
        throw $e;
    }
}

When it happens

Trigger: Sabre asks for group membership of a principal like principals/system/<base64-cloud-id> where the base64 segment is malformed or does not resolve to a valid cloud id; stale principal URIs left in a client's cache; ACL checks on shares whose remote user entry was never or is no longer resolvable.

Common situations: Federated share accepted long ago whose remote user cannot be resolved anymore (remote server renamed/disappeared); hand-crafted or truncated base64 principal names; client caches from before a server migration.

Related errors

• Node with name $name was not found
• Updating remote user principal is not supported
• Adding members to remote user is not supported
• Principal not found
• Invalid sharee cloud id

AI-assisted analysis of nextcloud/server@ecdeb153ff (2026-08-17). Data as JSON: /api/errors/3d7357bce141eec1. Report an issue: GitHub.