nextcloud/server · error · BadRequestException

RESOURCE_NOT_FOUND

RESOURCE_NOT_FOUND

Error message

Parameters missing in order to complete the request. Missing Parameters: sharedSecret

What it means

BadRequestException with message 'Parameters missing in order to complete the request. Missing Parameters: sharedSecret', raised in RequestHandlerController::resolveNotificationIdentity when an incoming OCM notification array has an empty/missing 'sharedSecret' key. receiveNotification() calls this before signature verification when signed federation is not disabled, so a remote server posting a federation notification without a sharedSecret is rejected. It surfaces (with the recorded RESOURCE_NOT_FOUND code) as a failed federated request rather than being processed.

Source

Thrown at apps/cloud_federation_api/lib/Controller/RequestHandlerController.php:466

			$entry = trim($value, '@');
		}
		$this->ocmDiscoveryService->confirmRequestOrigin($signedRequest?->getOrigin(), $entry);
	}

	/**
	 * Resolve the sender identity from a notification's sharedSecret.
	 * Returns '' when the provider does not implement signed federation.
	 *
	 * @param string $resourceType
	 * @param array<string, mixed> $notification
	 *
	 * @throws IncomingRequestException
	 * @throws BadRequestException
	 */
	private function resolveNotificationIdentity(string $resourceType, array $notification): string {
		$sharedSecret = $notification['sharedSecret'] ?? '';
		if ($sharedSecret === '') {
			throw new BadRequestException(['sharedSecret']);
		}

		try {
			$provider = $this->cloudFederationProviderManager->getCloudFederationProvider($resourceType);
			if ($provider instanceof ISignedCloudFederationProvider || $provider instanceof \NCU\Federation\ISignedCloudFederationProvider) {
				$identity = $provider->getFederationIdFromSharedSecret($sharedSecret, $notification);
				if ($identity === '') {
					$tokenProvider = Server::get(PublicKeyTokenProvider::class);
					$accessTokenDb = $tokenProvider->getToken($sharedSecret);
					$mapping = Server::get(OcmTokenMapMapper::class)->getByAccessTokenId($accessTokenDb->getId());
					$identity = $provider->getFederationIdFromSharedSecret($mapping->getRefreshToken(), $notification);
				}
				return $identity;
			}
			$this->logger->debug('cloud federation provider {provider} does not implement ISignedCloudFederationProvider', ['provider' => $provider::class]);
		} catch (\Exception $e) {
			throw new IncomingRequestException($e->getMessage(), previous: $e);
		}

View on GitHub (pinned to ecdeb153ff)

Solutions

1. On the sending side, include a non-empty 'sharedSecret' in the notification payload (it is the share token shared out-of-band at share creation)
2. Upgrade the remote Nextcloud so federation notifications carry the sharedSecret
3. Verify the request body is intact JSON with the expected OCM notification schema (correct Content-Type, no proxy rewriting)
4. If interoperability with a legacy peer is required temporarily, check the signed-federation appconfig toggle (OCMSignatoryManager::APPCONFIG_SIGN_DISABLED) — disabling signed federation skips this check

Example fix

// sending side (remote server / OCM client)
// before
await post(receiveNotificationUrl, {
	notificationType: 'SHARE_ACCEPTED',
	resourceType: 'file',
	providerId: shareId,
	notification: { message: 'share accepted' }, // no sharedSecret -> rejected
})

// after
await post(receiveNotificationUrl, {
	notificationType: 'SHARE_ACCEPTED',
	resourceType: 'file',
	providerId: shareId,
	notification: { message: 'share accepted', sharedSecret: share.sharedSecret },
})

// Sending side: validate the notification payload before POSTing
function buildOcmNotification(array $payload): array {
	if (empty($payload['sharedSecret']) || !is_string($payload['sharedSecret'])) {
		throw new InvalidArgumentException('OCM notification requires a non-empty sharedSecret');
	}
	return $payload;
}

When it happens

Trigger: A remote Nextcloud (or OCM client) POSTs a notification to the cloud_federation_api receiveNotification endpoint (e.g. SHARE_ACCEPTED for a federated share) with no 'sharedSecret' in the notification payload — older remote versions that do not implement signed federation, third-party OCM implementations omitting the field, or a payload mangled/proxied before delivery.

Common situations: Federated sharing between a new server (expecting sharedSecret for identity resolution) and an older/other implementation; custom OCM clients; payload re-encoding that drops the secret; after an upgrade where signing support changed on one side only.

Related errors

• Calendar is not shared with the sharee
• could not enable app
• could not disable app
• could not remove app
• could not update app

AI-assisted analysis of nextcloud/server@ecdeb153ff (2026-08-17). Data as JSON: /api/errors/2e90554e8b3d3808. Report an issue: GitHub.