Authenticated ciphertext could not be decoded.

[mdc-webdb]

Steps to reproduce

1. Enter the credentials via occ
2. when pop up of mattermost comes enter the user credentials.
3. click on an file and select send via mattoermost

Expected behaviour

That the file can be send via mattoermost

Actual behaviour

Only an message about an internal server problem.

Server configuration

Web server: Apache

Database: MariaDB

PHP version: 8.2

Nextcloud version: 30.0.13

List of activated apps

Enabled:                                                                                                                                                                                                           
  - app_api: 4.0.6                                                                                                                                                                                                 
  - bruteforcesettings: 3.0.0                                                                                                                                                                                      
  - checksum: 1.2.6                                                                                                                                                                                                
  - cloud_federation_api: 1.13.0                                                                                                                                                                                   
  - comments: 1.20.1                                                                                                                                                                                               
  - dav: 1.31.1                                                                                                                                                                                                    
  - deck: 1.14.6                                                                                                                                                                                                   
  - drawio: 3.0.9                                                                                                                                                                                                  
  - end_to_end_encryption: 1.16.2                                                                                                                                                                                  
  - federatedfilesharing: 1.20.0                                                                                                                                                                                   
  - files: 2.2.0                                                                                                                                                                                                   
  - files_downloadlimit: 3.0.0                                                                                                                                                                                     
  - files_external: 1.22.0                                                                                                                                                                                         
  - files_pdfviewer: 3.0.0                                                                                                                                                                                         
  - files_reminders: 1.3.0                                                                                                                                                                                         
  - files_sharing: 1.22.0                                                                                                                                                                                          
  - files_trashbin: 1.20.1                                                                                                                                                                                         
  - files_versions: 1.23.0                                                                                                                                                                                         
  - forms: 5.1.2                                                                                                                                                                                                   
  - groupfolders: 18.1.4                                                                                                                                                                                           
  - impersonate: 1.17.1                                                                                                                                                                                            
  - integration_mattermost: 2.1.1                                                                                                                                                                                  
  - integration_openproject: 2.9.1                                                                                                                                                                                 
  - lookup_server_connector: 1.18.0                                                                                                                                                                                
  - metadata: 0.22.0                                                                                                                                                                                               
  - notes: 4.12.2                                                                                                                                                                                                  
  - notifications: 3.0.0                                                                                                                                                                                           
  - oauth2: 1.18.1                                                                                                                                                                                                 
  - officeonline: 3.0.2                                                                                                                                                                                            
  - password_policy: 2.0.0                                                                                                                                                                                         
  - photos: 3.0.2                                                                                                                                                                                                  
  - privacy: 2.0.0
  - provisioning_api: 1.20.0
  - quicknotes: 0.8.30
  - quota_warning: 1.21.0
  - related_resources: 1.5.0
  - richdocuments: 8.5.9
  - serverinfo: 2.0.0
  - settings: 1.13.0
  - sharebymail: 1.20.0
  - side_menu: 4.1.1
  - support: 2.0.0
  - suspicious_login: 8.0.0
  - systemtags: 1.20.0
 - text: 4.1.0
  - theming: 2.6.0
  - twofactor_admin: 4.8.0
  - twofactor_backupcodes: 1.19.0
  - twofactor_totp: 12.0.0-dev
  - twofactor_webauthn: 2.2.0
  - updatenotification: 1.20.0
  - user_ldap: 1.21.0
  - user_oidc: 7.3.0
  - user_saml: 6.6.0
  - user_status: 1.10.0
  - viewer: 3.0.0
  - webapppassword: 25.3.0
  - webhook_listeners: 1.1.0-dev
  - workflowengine: 2.12.0
Disabled:
  - activity: 3.0.0 (installed 2.18.0)
  - admin_audit: 1.20.0
  - camerarawpreviews: 0.8.7 (installed 0.8.7)
  - carnet: 0.25.6 (installed 0.25.6)
  - circles: 30.0.0 (installed 22.1.1)
  - contactsinteraction: 1.11.0 (installed 1.2.0)
  - dashboard: 7.10.0 (installed 7.1.0)
  - encryption: 2.18.0 (installed 2.9.0)
  - federation: 1.20.0 (installed 1.11.0)
  - files_rightclick: 0.15.1 (installed 0.15.1)
  - firstrunwizard: 3.0.0 (installed 2.10.0)
  - guests: 4.3.0 (installed 4.3.0)
  - integration_deepl: 2.0.0 (installed 2.0.0)
  - logreader: 3.0.0 (installed 2.7.0)
  - nextcloud_announcements: 2.0.0 (installed 1.10.0)
  - recommendations: 3.0.0 (installed 2.1.0)
  - sharelisting: 1.2.0 (installed 1.2.0)
  - survey_client: 2.0.0 (installed 1.9.0)
  - tables: 0.9.5 (installed 0.9.5)
  - twofactor_nextcloud_notification: 4.0.0
  - weather_status: 1.10.0 (installed 1.1.0)
  - whiteboard: 1.1.2 (installed 1.1.2)
  - wopi: 3.5.11 (installed 3.5.11)

Nextcloud configuration

{                                                                                                                                                                                                                  
    "system": {                                                                                                                                                                                                    
        "instanceid": "***REMOVED SENSITIVE VALUE***",                                                                                                                                                             
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",                                                                                                                                                           
        "secret": "***REMOVED SENSITIVE VALUE***",                                                                                                                                                                 
        "trusted_domains": [                                                                                                                                                                                       
            "localhost",                                                                                                                                                                                           
            "***REMOVED SENSITIVE VALUE***"                                                                                                                                                                         
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "30.0.13.1",
        "overwrite.cli.url": "https:\/\/***REMOVED SENSITIVE VALUE***,
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "dbtableprefix": "oc_",
        "dbdriveroptions": {
            "1014": true,
            "1009": "\/etc\/pki\/tls\/certs\/ca-bundle.crt"
        },
        "mysql.utf8mb4": true,
        "installed": true,
        "proxy": "***REMOVED SENSITIVE VALUE***",
        "proxyexclude": [
            "***REMOVED SENSITIVE VALUE***",
            "127.0.0.1"
        ],
        "default_phone_region": "DE",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.local": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": "6379",
            "password": "***REMOVED SENSITIVE VALUE***",
            "user": "nextcloud"
        },
        "mail_smtpstreamoptions": {        
       "ssl": {
                "allow_self_signed": true,
                "verify_peer": false,
                "verify_peer_name": false
            }
        },
        "ldapProviderFactory": "OCA\\User_LDAP\\LDAPProviderFactory",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpmode": "smtp",
        "mail_sendmailmode": "smtp",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "25",
        "updater.release.channel": "enterprise",
        "default_locale": "de_DE",
        "default_language": "en",
        "logfile": "none",
        "loglevel": 2,
        "maintenance": false,
        "ldapUserCleanupInterval": 20,
        "lost_password_link": "disabled",
        "auth.webauthn.enabled": false,
        "app_install_overwrite": [
            "end_to_end_encryption",
            "files_antivirus",
            "files_rightclick",
            "wopi"
        ],
        "skeletondirectory": "\/mnt\/nextcloud\/***REMOVED SENSITIVE VALUE***",
        "trashbin_retention_obligation": "auto, 14",
        "versions_retention_obligation": "auto, 365",
        "session_lifetime": 28800,
        "auto_logout": true,
        "tempdirectory": "\/var\/tmp",
        "allow_local_remote_servers": true,
        "has_rebuilt_cache": true,
        "log_type": "syslog",
        "syslog_tag": "Nextcloud",
        "maintenance_window_start": 1,
        "twofactor_enforced": "false",
        "twofactor_enforced_groups": [],
        "twofactor_enforced_excluded_groups": []
    }
}

Browser

Browser name: Firefox

Browser version: 124/125/…

Operating system: Fedora-41

Log of nextcloud:

{"reqId":"aJCncgofVwpG@KEFBlmmdAABFgM","level":3,"time":"2025-08-04T12:28:34+00:00","remoteAddr":"<ClientIP>","user":"<UserID>","app":"index","method":"GET","url":"/index.php/settings/user/connected-accounts","message":"{\"Exception\":\"Exception\",\"Message\":\"Authenticated ciphertext could not be decoded.\",\"Code\":0,\"Trace\":[{\"file\":\"/var/www/nextcloud/lib/private/Security/Crypto.php\",\"line\":102,\"function\":\"decryptWithoutSecret\",\"class\":\"OC\\\\Security\\\\Crypto\",\"type\":\"->\",\"args\":[\"*** sensitive parameters replaced ***\"]},{\"file\":\"/var/www/nextcloud/apps/integration_mattermost/lib/Settings/Personal.php\",\"line\":40,\"function\":\"decrypt\",\"class\":\"OC\\\\Security\\\\Crypto\",\"type\":\"->\",\"args\":[\"*** sensitive parameters replaced ***\"]},{\"file\":\"/var/www/nextcloud/apps/settings/lib/Controller/CommonSettingsTrait.php\",\"line\":118,\"function\":\"getForm\",\"class\":\"OCA\\\\Mattermost\\\\Settings\\\\Personal\",\"type\":\"->\"},{\"file\":\"/var/www/nextcloud/apps/settings/lib/Controller/PersonalSettingsController.php\",\"line\":64,\"function\":\"formatSettings\",\"class\":\"OCA\\\\Settings\\\\Controller\\\\PersonalSettingsController\",\"type\":\"->\"},{\"file\":\"/var/www/nextcloud/apps/settings/lib/Controller/CommonSettingsTrait.php\",\"line\":143,\"function\":\"getSettings\",\"class\":\"OCA\\\\Settings\\\\Controller\\\\PersonalSettingsController\",\"type\":\"->\"},{\"file\":\"/var/www/nextcloud/apps/settings/lib/Controller/PersonalSettingsController.php\",\"line\":55,\"function\":\"getIndexResponse\",\"class\":\"OCA\\\\Settings\\\\Controller\\\\PersonalSettingsController\",\"type\":\"->\"},{\"file\":\"/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php\",\"line\":208,\"function\":\"index\",\"class\":\"OCA\\\\Settings\\\\Controller\\\\PersonalSettingsController\",\"type\":\"->\"},{\"file\":\"/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php\",\"line\":114,\"function\":\"executeController\",\"class\":\"OC\\\\AppFramework\\\\Http\\\\Dispatcher\",\"type\":\"->\"},{\"file\":\"/var/www/nextcloud/lib/private/AppFramework/App.php\",\"line\":161,\"function\":\"dispatch\",\"class\":\"OC\\\\AppFramework\\\\Http\\\\Dispatcher\",\"type\":\"->\"},{\"file\":\"/var/www/nextcloud/lib/private/Route/Router.php\",\"line\":303,\"function\":\"main\",\"class\":\"OC\\\\AppFramework\\\\App\",\"type\":\"::\"},{\"file\":\"/var/www/nextcloud/lib/base.php\",\"line\":1010,\"function\":\"match\",\"class\":\"OC\\\\Route\\\\Router\",\"type\":\"->\"},{\"file\":\"/var/www/nextcloud/index.php\",\"line\":24,\"function\":\"handleRequest\",\"class\":\"OC\",\"type\":\"::\"}],\"File\":\"/var/www/nextcloud/lib/private/Security/Crypto.php\",\"Line\":114,\"message\":\"Authenticated ciphertext could not be decoded.\",\"exception\":{},\"CustomMessage\":\"Authenticated ciphertext could not be decoded.\"}","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:141.0) Gecko/20100101 Firefox/141.0","version":"30.0.13.1"}

[janepie]

Thanks for reporting this! Did you install the app fpr the first time or did this happen randomly or after an upgrade of something?

[mdc-webdb]

Hi, I simple add this the first time.

[janepie]

Does it work if you enter your credentials via UI?

[mdc-webdb]

I first tried it via the UI. The message that the data was incorrect always appeared on the Mattermost server.
Then I set it via occ.
If I now want to call up the UI point, only ‘Internet error’ appears. And in the log file the decryption error.
Exactly the same as when I want to send a file.

[janepie]

What occ command did you use for this?

[mdc-webdb]

sudo -u apache -- scl enable php82 "./occ config:app:set --value=<VALUE> integration_mattermost client_secret"

[janepie]

Ah, the client secret is encrypted before saving via the UI, so when retrieving it from the db the server tries to decrypt it, but you saved it unencrypted. Please try it again with the --sensitive option

[mdc-webdb]

For both (client_secret and client_id)? Or only client_secret?

[janepie]

Good question! I just checked, both of them :)

[mdc-webdb]

I have set both on occ using --sensitive.
Now I see another error:
{"reqId":"aJRW1GkrrezY9DlXq4e2PAAAAA4","level":3,"time":"2025-08-07T07:33:41+00:00","remoteAddr":"<ClientIP>","user":"<User>","app":"index","method":"GET","url":"/index.php/settings/admin/connected-accounts","message":"{\"Exception\":\"RuntimeException\",\"Message\":\"String contains non hex chars: $AppConfigEncryption$<CharWorm>\",\"Code\":0,\"Trace\":[{\"file\":\"/var/www/nextcloud/lib/private/Security/Crypto.php\",\"line\":136,\"function\":\"hex2bin\",\"class\":\"OC\\\\Security\\\\Crypto\",\"type\":\"->\"},{\"file\":\"/var/www/nextcloud/lib/private/Security/Crypto.php\",\"line\":102,\"function\":\"decryptWithoutSecret\",\"class\":\"OC\\\\Security\\\\Crypto\",\"type\":\"->\",\"args\":[\"*** sensitive parameters replaced ***\"]},{\"file\":\"/var/www/nextcloud/apps/integration_mattermost/lib/Settings/Admin.php\",\"line\":26,\"function\":\"decrypt\",\"class\":\"OC\\\\Security\\\\Crypto\",\"type\":\"->\",\"args\":[\"*** sensitive parameters replaced ***\"]},{\"file\":\"/var/www/nextcloud/apps/settings/lib/Controller/CommonSettingsTrait.php\",\"line\":118,\"function\":\"getForm\",\"class\":\"OCA\\\\Mattermost\\\\Settings\\\\Admin\",\"type\":\"->\"},{\"file\":\"/var/www/nextcloud/apps/settings/lib/Controller/AdminSettingsController.php\",\"line\":75,\"function\":\"formatSettings\",\"class\":\"OCA\\\\Settings\\\\Controller\\\\AdminSettingsController\",\"type\":\"->\"},{\"file\":\"/var/www/nextcloud/apps/settings/lib/Controller/CommonSettingsTrait.php\",\"line\":143,\"function\":\"getSettings\",\"class\":\"OCA\\\\Settings\\\\Controller\\\\AdminSettingsController\",\"type\":\"->\"},{\"file\":\"/var/www/nextcloud/apps/settings/lib/Controller/AdminSettingsController.php\",\"line\":59,\"function\":\"getIndexResponse\",\"class\":\"OCA\\\\Settings\\\\Controller\\\\AdminSettingsController\",\"type\":\"->\"},{\"file\":\"/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php\",\"line\":208,\"function\":\"index\",\"class\":\"OCA\\\\Settings\\\\Controller\\\\AdminSettingsController\",\"type\":\"->\"},{\"file\":\"/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php\",\"line\":114,\"function\":\"executeController\",\"class\":\"OC\\\\AppFramework\\\\Http\\\\Dispatcher\",\"type\":\"->\"},{\"file\":\"/var/www/nextcloud/lib/private/AppFramework/App.php\",\"line\":161,\"function\":\"dispatch\",\"class\":\"OC\\\\AppFramework\\\\Http\\\\Dispatcher\",\"type\":\"->\"},{\"file\":\"/var/www/nextcloud/lib/private/Route/Router.php\",\"line\":303,\"function\":\"main\",\"class\":\"OC\\\\AppFramework\\\\App\",\"type\":\"::\"},{\"file\":\"/var/www/nextcloud/lib/base.php\",\"line\":1010,\"function\":\"match\",\"class\":\"OC\\\\Route\\\\Router\",\"type\":\"->\"},{\"file\":\"/var/www/nextcloud/index.php\",\"line\":24,\"function\":\"handleRequest\",\"class\":\"OC\",\"type\":\"::\"}],\"File\":\"/var/www/nextcloud/lib/private/Security/Crypto.php\",\"Line\":176,\"message\":\"String contains non hex chars: $AppConfigEncryption$<CharWorm>\",\"exception\":{},\"CustomMessage\":\"String contains non hex chars: $AppConfigEncryption$<CharWorm>\"}","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:141.0) Gecko/20100101 Firefox/141.0","version":"30.0.13.1"}

[janepie]

Sorry for taking so long to come back to you. That's weird, this is related to the Client ID. Can you check if you put the correct string there or if there was something added that shouldn't be in there?

[mdc-webdb]

I have checked it with the admin of the mattermost server. The credentials are correct.

[mdc-webdb]

In the database it looks also normal:
select * from oc_appconfig where appid like 'integration_mattermost';

+------------------------+--------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+------+------+
| appid                  | configkey          | configvalue                                                                                                                                                                                                                                               | type | lazy |
+------------------------+--------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+------+------+
| integration_mattermost | client_id          | $AppConfigEncryption$<Value>|    3 |    0 |
| integration_mattermost | client_secret      | $AppConfigEncryption$<Value>|    3 |    0 |
| integration_mattermost | enabled            | yes                                                                                                                                                                                                                                                       |    2 |    0 |
| integration_mattermost | installed_version  | 2.1.1                                                                                                                                                                                                                                                     |    2 |    0 |
| integration_mattermost | navlink_default    | 1                                                                                                                                                                                                                                                         |    2 |    0 |
| integration_mattermost | oauth_instance_url | https://<Server>                                                                                                                                                                                                                             |    2 |    0 |
| integration_mattermost | types              |                                                                                                                                                                                                                                                           |    2 |    0 |
| integration_mattermost | use_popup          | 1                                                                                                                                                                                                                                                         |    2 |    0 |
+------------------------+--------------------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+------+------+
8 rows in set (0.001 sec)