Failed to set avatar for user

[dtyugaev]

How to use GitHub

• Please use the 👍 reaction to show that you are affected by the same issue.
• Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
• Subscribe to receive notifications on status change and new comments.

---

user_oidc works fine, but the avatar from Keycloak doesn't load.

Steps to reproduce

1. set up additional user attributes in Keycloak (displayName and thumbnailPhoto)
2. user authorization in Nextcloud
3. authorization is successful, displayName loaded successfully, but the avatar from the thumbnailPhoto is not loading

Expected behaviour

Avatar should load into the user profile

Actual behaviour

Avatar didn't load and there is an error "Failed to set avatar for user" in the logs.
The base64 string from thumbnailPhoto is successfully converted in any online converter.

{"reqId":"6KXC5OmRWD7d3CIrj31R","level":2,"time":"2026-04-22T14:34:18+00:00","remoteAddr":"172.17.32.226","user":"--","app":"user_oidc","method":"GET","url":"/index.php/apps/user_oidc/code?state=2YZCYINAYVHM6J7480JMHAO2TPFRJJQ5&session_state=iA_zbnRXUFyxxXmK-DH-ff5e&iss=https%3A%2F%2Fauth.mydomain.com%2Frealms%2Fdisk.mydomain.com&code=6924839d-76ab-bcf5-20ad-a13239587714.iA_zbnRXUFyxxXmK-DH-ff5e.7d04eb80-b6b8-4d9c-a32d-5ad0c706e614","scriptName":"/index.php","message":"Failed to set avatar for user dtyugaev","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36","version":"33.0.2.2","data":{"app":"user_oidc","avatar_attribute":"/9j/4AAQSkZJRgABAQEAYABgAAD/2wBDAAgGBgcGBQgHBwcJCQgKDBQNDAsLDBkSEw8UHRofHh0aHBwgJC4nICIsIxwcKDcpLDAxNDQ0Hyc5PTgyPC4zNDL/2wBDAQkJCQwLDBgNDRgyIRwhMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjL/wAARCABAAEADASIAAhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQAAAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWmp6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEAAwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSExBhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElKU1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwDxfHFHYU8jigL0oKGMKsRlUiBZlA96bHA9xcxQRjLyMFH413Y+EOoTWazfbYlkK52yA/06VMpKO5UYOWxxkUsT8LIh9BmpCnt+laN58N9ft2Ym3i8tf4xKMH3FZ6QT2sjWlyp82PnJ7ikpJ7MHCUd0AUgdKaF7mrRUdKhaSOOURnk1RJnDn8qcBTVqQUwNrwjAJ/EtqrRsys4QNjhSfX8Aa9mvPEz2N59h/su5lUDG+KRc445x+Irh/hXNFIdTsCEMwMd0oIGWC5Bx9ODXqbzQyXB2R+YyLu5HA9K5ar97U66Mfd0OU8Qa7b6c/wBjaG6kk2hn2gYQHpkkivJtZuWfWJLgo3IICEcgV63I4uvE1409u0cbwovz4Ksw649v8K8/8SJBNrl3PGoCqViTAwvA5x9OBSpNKRddNxOXmvPLgB2/O3SobCB7iczSHnqK1bm1jng2YAI5BFM06ERIynOeDn2rpOEx0GakwBSRfd5qezsbzUrkw2NrNcP6RKTj6noPxqhEEVzJZ3cV1C7LJE4dSDjoc19HxiyvreG4nRVkaMSIHPK7hn8etcR4Q+GUEKrf68FlnJXZaggrHyOW/vN+g969D1O0sHVbS8hXYV/dHtgenpis61N2UjahUSlY4fXLyx027kupJU+0bDFGFAAUHqQB1OPWuAnJkkaRifncttz0zXQ65ploLu5+zKTGqqqE9SxP+ArlpJ2inSOaMq+7G0jt61nTj1Lrzu7FuNB1I6VDHbmOdi7ZXoAKT+0baNz+86dcjpSDUYGY7ZVbB5xWxznd6V8LtO08gapI97MMEgEpH0zwByfxNdfbWVvZwi2tYkihUcLGu0D8BWlqG5pduD80YKnHcAH+WajeJ/KjmCsAR6V0pJHM22ALCF+5Vd2PpzSa9qFrcgabEDJcnDGRTgW/oSfX/Z/OpIo5GSQbGyUOOPam2ltGLZQIAFddxwvU9apRT3FzNbHCarjTprhHgkvJmj2s8fSIsNu8/hgAelXLDSor7R7R5IY2kaNd4kHQjg/yrpY9OaNDLJGWaSUHBGcL2Gae1sIZ1SOMqjLwAPemoRhGyCU5TldnmHiDwJLcCWbTZQjuOYZun4MK4y1juPD9+Yb60xI6j5CPfqD3Fe9tGwtsshwBzkV554+jtfM0a6uo9qMHBOOxwR+g/WsakVa5rTk72P/Z"}}

Server configuration

Web server: Apache

Database: Maria

PHP version: 8.3

Nextcloud version: 33.0.2

List of activated apps

Enabled:
  - activity: 6.0.0
  - admin_audit: 1.23.0
  - bruteforcesettings: 6.0.0
  - cloud_federation_api: 1.17.0
  - comments: 1.23.0
  - contactsinteraction: 1.14.1
  - dav: 1.36.0
  - drawio: 4.2.3
  - federatedfilesharing: 1.23.0
  - federation: 1.23.0
  - files: 2.5.0
  - files_downloadlimit: 5.1.0
  - files_pdfviewer: 6.0.0
  - files_reminders: 1.6.0
  - files_sharing: 1.25.2
  - files_trashbin: 1.23.0
  - files_versions: 1.26.0
  - firstrunwizard: 6.0.0
  - impersonate: 4.0.0
  - logreader: 6.0.0
  - lookup_server_connector: 1.21.0
  - nextcloud_announcements: 5.0.0
  - notifications: 6.0.0
  - oauth2: 1.21.0
  - onlyoffice: 10.0.0
  - password_policy: 5.0.0
  - photos: 6.0.0
  - privacy: 5.0.0
  - profile: 1.2.0
  - provisioning_api: 1.23.0
  - related_resources: 4.0.0
  - serverinfo: 5.0.0
  - settings: 1.16.0
  - sharebymail: 1.23.0
  - survey_client: 5.0.0
  - suspicious_login: 11.0.0
  - systemtags: 1.23.0
  - text: 7.0.0
  - theming: 2.8.0
  - twofactor_backupcodes: 1.22.0
  - twofactor_totp: 15.0.0
  - updatenotification: 1.23.0
  - user_ldap: 1.24.0
  - user_oidc: 8.8.0
  - user_status: 1.13.0
  - user_usage_report: 4.0.0
  - viewer: 6.0.0
  - webhook_listeners: 1.5.0
  - workflowengine: 2.15.0

Nextcloud configuration

{
            "con",
            "prn",
            "aux",
            "nul",
            "com0",
            "com1",
            "com2",
            "com3",
            "com4",
            "com5",
            "com6",
            "com7",
            "com8",
            "com9",
            "com\u00b9",
            "com\u00b2",
            "com\u00b3",
            "lpt0",
            "lpt1",
            "lpt2",
            "lpt3",
            "lpt4",
            "lpt5",
            "lpt6",
            "lpt7",
            "lpt8",
            "lpt9",
            "lpt\u00b9",
            "lpt\u00b2",
            "lpt\u00b3"
        ],
        "forbidden_filename_characters": [
            "<",
            ">",
            ":",
            "\"",
            "|",
            "?",
            "*",
            "\\",
            "\/"
        ],
        "forbidden_filename_extensions": [
            " ",
            ".",
            ".filepart",
            ".part"
        ],
        "app_install_overwrite": [
            "files_rightclick",
            "gluusso"
        ],
        "updater.release.channel": "stable",
        "ldapUserCleanupInterval": "5",
        "allow_local_remote_servers": true,
        "debug": true
    }
}

Browser

Browser name: Chrome

Browser version: 147

Operating system: Windows

[julien-nc]

Hi, are you sure the avatar attribute value is well formed?
It should start with data:image/jpeg;base64, or data:image/png;base64, followed by the base64 image payload.
I just tried with this attribute value and it worked with user_oidc v8.10.1 .

data:image/jpeg;base64,/9j/4AAQSkZJRgABAQIAHAAcAAD//gATQ3JlYXRlZCB3aXRoIEdJTVD/2wBDAAMCAgICAgMCAgIDAwMDBAYEBAQEBAgGBgUGCQgKCgkICQkKDA8MCgsOCwkJDRENDg8QEBEQCgwSExIQEw8QEBD/2wBDAQMDAwQDBAgEBAgQCwkLEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBD/wAARCAAQABADASIAAhEBAxEB/8QAFwAAAwEAAAAAAAAAAAAAAAAABAUHCP/EACIQAAIBBAIDAAMAAAAAAAAAAAECAwQFBhEABxMhMRIiUf/EABUBAQEAAAAAAAAAAAAAAAAAAAUG/8QAIREAAAUCBwAAAAAAAAAAAAAAAAECERIDBBQVITEyobH/2gAMAwEAAhEDEQA/AN1V3drY1mtyx/Pb1a7FSNXvT2tpPHHJJEANO5eQkg7GtKCd/Ne+A1fd5pO4cSw4Zbb56G+NNTtRiBPLKzRkwyq+9qoZdH+ltca919MT9gXGivdrpbTNNDC0NXDWQB/Mv1CPn5MN/GYAj0fXJL190h2VnPZ65B2Va6nHrNi8lEtHHDHFBHXNTOxCwIsjvHC2kd/2ALAAA+zyVqZkV5BLxlpuxl4wXRhDoyVybsf/2Q==

If there is no other warning log before Failed to set avatar for user, I suspect that your attribute value does not start with data:....
The avatar provisioning logic is pretty straightforward:

• Check if the attr value is a URL, if so, try to download the avatar from there
• else, check if the value starts with data:image/png;base64,, if so, decode it
• else, check if the value starts with data:image/jpeg;base64,, if so, decode it

Each of those 3 steps should write a warning log if they fail. It seems like none of those 3 "if" blocks were entered.

[dtyugaev]

Yes, you're right. I get the attribute value from Keycloak without "data:image/jpeg;base64," but unfortunately I do not know how to change it. Keycloak receives a binary image data from AD and sends it in this form. There is no "data:image/jpeg;base64,"

[julien-nc]

Can you try #1433?

It should make it work with non-prefixed base64 payloads.

Here is how to apply the patch:

wget https://github.com/nextcloud/user_oidc/pull/1433.patch -O /tmp/1433.patch
cd /var/www/blabla/nextcloud/apps/user_oidc
patch -p1 < /tmp/1433.patch

[dtyugaev]

Yes, it works perfectly! Thanks for the patch!