Steps to reproduce
NC 18 installed on debian 9 latest patches, then upgrade OS to debian 10
Expected behaviour
NC should work
Actual behaviour
NC seem to have issues whenever interacting with anything related to LDAP/AD user backend.
Login with AD based user results in “Internal Server Error”.
I can still login with a local user, but some interfaces like Administration -> Overview or Support will end up with the “Internal Server Error” page
Server configuration detail
Operating system: Linux 5.5.10 #1 SMP Fri Mar 20 01:44:44 CET 2020 x86_64
Webserver: Apache/2.4.38 (Debian) (apache2handler)
Database: mysql 10.3.22
PHP version:
7.3.16-1+0~20200320.56+debian10~1.gbp370a75
Modules loaded: Core, date, libxml, openssl, pcre, zlib, filter, hash, Reflection, SPL, sodium, session, standard, apache2handler, mysqlnd, PDO, xml, apcu, bz2, calendar, ctype, curl, dom, mbstring, fileinfo, ftp, gd, gettext, iconv, igbinary, imagick, intl, json, ldap, exif, mysqli, pdo_mysql, apc, posix, readline, redis, shmop, SimpleXML, smbclient, sockets, sysvmsg, sysvsem, sysvshm, tokenizer, wddx, xmlreader, xmlwriter, xsl, zip, Phar, libsmbclient, Zend OPcache
Nextcloud version: 18.0.3 - 18.0.3.0
Updated from an older Nextcloud/ownCloud or fresh install: long upgrade history started with ~ 14.x or so
Where did you install Nextcloud from: downloaded from NC website
Signing status
Array
(
)
List of activated apps
Enabled:
- accessibility: 1.4.0
- activity: 2.11.0
- audioplayer: 2.9.0
- cloud_federation_api: 1.1.0
- comments: 1.8.0
- dav: 1.14.0
- federatedfilesharing: 1.8.0
- files: 1.13.1
- files_external: 1.9.0
- files_pdfviewer: 1.7.0
- files_rightclick: 0.15.2
- files_sharing: 1.10.1
- files_trashbin: 1.8.0
- files_versions: 1.11.0
- files_videoplayer: 1.7.0
- groupfolders: 6.0.3
- issuetemplate: 0.6.0
- logreader: 2.3.0
- lookup_server_connector: 1.6.0
- nextcloud_announcements: 1.7.0
- notes: 3.2.0
- notifications: 2.6.0
- oauth2: 1.6.0
- ocdownloader: 1.7.6
- password_policy: 1.8.0
- phonetrack: 0.6.2
- photos: 1.0.0
- previewgenerator: 2.2.0
- privacy: 1.2.0
- provisioning_api: 1.8.0
- recommendations: 0.6.0
- serverinfo: 1.8.0
- settings: 1.0.0
- sharebymail: 1.8.0
- spreed: 8.0.5
- support: 1.1.0
- survey_client: 1.6.0
- systemtags: 1.8.0
- text: 2.0.0
- theming: 1.9.0
- twofactor_admin: 2.0.0
- twofactor_backupcodes: 1.7.0
- twofactor_gateway: 0.15.1
- unsplash: 1.1.5
- updatenotification: 1.8.0
- user_ldap: 1.8.0
- viewer: 1.2.0
- workflowengine: 2.0.0
Disabled:
- admin_audit
- bookmarks
- encryption
- federation
- firstrunwizard
Configuration (config/config.php)
{
"instanceid": "***REMOVED SENSITIVE VALUE***",
"passwordsalt": "***REMOVED SENSITIVE VALUE***",
"secret": "***REMOVED SENSITIVE VALUE***",
"trusted_proxies": "***REMOVED SENSITIVE VALUE***",
"trusted_domains": [
"nc.local.lan",
"nc.domain.com",
"nc.domain.com:443"
],
"datadirectory": "***REMOVED SENSITIVE VALUE***",
"overwrite.cli.url": "http:\/\/nc.local.lan",
"dbtype": "mysql",
"version": "18.0.3.0",
"dbname": "***REMOVED SENSITIVE VALUE***",
"dbhost": "***REMOVED SENSITIVE VALUE***",
"dbport": "",
"dbtableprefix": "oc_",
"dbuser": "***REMOVED SENSITIVE VALUE***",
"dbpassword": "***REMOVED SENSITIVE VALUE***",
"dbdriveroptions": {
"1002": "SET wait_timeout = 28800"
},
"logtimezone": "UTC",
"installed": true,
"memcache.local": "\\OC\\Memcache\\APCu",
"filelocking.enabled": "true",
"memcache.locking": "\\OC\\Memcache\\Redis",
"redis": {
"host": "***REMOVED SENSITIVE VALUE***",
"port": 6379
},
"mail_smtpmode": "smtp",
"mail_from_address": "***REMOVED SENSITIVE VALUE***",
"mail_domain": "***REMOVED SENSITIVE VALUE***",
"mail_smtphost": "***REMOVED SENSITIVE VALUE***",
"htaccess.RewriteBase": "\/",
"preview_libreoffice_path": "\/usr\/bin\/libreoffice",
"filesystem_check_changes": 0,
"asset-pipeline.enabled": true,
"ldapIgnoreNamingRules": false,
"ldapProviderFactory": "\\OCA\\User_LDAP\\LDAPProviderFactory",
"updater.release.channel": "stable",
"maintenance": false,
"loglevel": 0,
"skeletondirectory": "",
"auth.bruteforce.protection.enabled": false,
"theme": "",
"enable_previews": true,
"mysql.utf8mb4": true
}
Are you using external storage, if yes which one: smb
Are you using encryption:
Are you using an external user-backend, if yes which one: ActiveDirectory
LDAP configuration (delete this par if not used)
root@nc:~# sudo -u www-data php /var/www/nextcloud/occ ldap:show-config
+-------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Configuration | |
+-------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------+
| hasMemberOfFilterSupport | 1 |
| homeFolderNamingRule | attr:unixHomeDirectory |
| lastJpegPhotoLookup | 0 |
| ldapAgentName | CN=nc ldap user,OU=accounts,DC=ad,DC=domain,DC=com |
| ldapAgentPassword | *** |
| ldapAttributesFcomroupSearch | |
| ldapAttributesForUserSearch | |
| ldapBackupHost | |
| ldapBackupPort | |
| ldapBase | DC=ad,DC=domain,DC=com |
| ldapBaseGroups | DC=ad,DC=domain,DC=com |
| ldapBaseUsers | DC=ad,DC=domain,DC=com |
| ldapCacheTTL | 600 |
| ldapConfigurationActive | 1 |
| ldapDefaultPPolicyDN | |
| ldapDynamicGroupMemberURL | |
| ldapEmailAttribute | mail |
| ldapExperiencedAdmin | 0 |
| ldapExpertUUIDGroupAttr | samaccountname |
| ldapExpertUUIDUserAttr | samaccountname |
| ldapExpertUsernameAttr | samaccountname |
| ldapExtStorageHomeAttribute | |
| ldapGidNumber | gidNumber |
| ldapGroupDisplayName | cn |
| ldapGroupFilter | (&(|(objectclass=group))(|(cn=NextCloud)(cn=Group1)(cn=Group2))) |
| ldapGroupFilterGroups | NextCloud;Group1;Group2 |
| ldapGroupFilterMode | 0 |
| ldapGroupFilterObjectclass | group |
| ldapGroupMemberAssocAttr | gidNumber |
| ldapHost | ldaps://dc.ad.domain.com |
| ldapIgnoreNamingRules | |
| ldapLoginFilter | (&(&(|(objectclass=person))(|(|(memberof=CN=NextCloud,DC=ad,DC=domain,DC=com)(primaryGroupID=1234))))(samaccountname=%uid)) |
| ldapLoginFilterAttributes | |
| ldapLoginFilterEmail | 0 |
| ldapLoginFilterMode | 0 |
| ldapLoginFilterUsername | 1 |
| ldapNestedGroups | 1 |
| ldapOverrideMainServer | |
| ldapPagingSize | 500 |
| ldapPort | 636 |
| ldapQuotaAttribute | |
| ldapQuotaDefault | |
| ldapTLS | 0 |
| ldapUserAvatarRule | default |
| ldapUserDisplayName | displayname |
| ldapUserDisplayName2 | |
| ldapUserFilter | (&(|(objectclass=person))(|(|(memberof=CN=NextCloud,DC=ad,DC=domain,DC=com)(primaryGroupID=1234)))) |
| ldapUserFilterGroups | NextCloud |
| ldapUserFilterMode | 0 |
| ldapUserFilterObjectclass | person |
| ldapUuidGroupAttribute | auto |
| ldapUuidUserAttribute | auto |
| turnOffCertCheck | 0 |
| turnOnPasswordChange | 0 |
| useMemberOfToDetectMembership | 1 |
+-------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------+
Client configuration
Browser: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0
Operating system: Win10 1909
Logs
Web server error log
No smoking gun from apache logs
Nextcloud log
This one is logged when trying to log in as an AD user:
{"reqId":"71gMXeNqy8wJ1TBGPvoW","level":3,"time":"2020-04-03T15:40:44+00:00","remoteAddr":"10.11.11.1","user":"--","app":"index","method":"POST","url":"/login","message":{"Exception":"OC\\ServerNotAvailableException","Message":"Lost connection to LDAP server.","Code":0,"Trace":[{"file":"/var/www/nextcloud/apps/user_ldap/lib/LDAP.php","line":389,"function":"processLDAPError","class":"OCA\\User_LDAP\\LDAP","type":"->","args":["*** sensitive parameter replaced ***"]},{"file":"/var/www/nextcloud/apps/user_ldap/lib/LDAP.php","line":312,"function":"postFunctionCall","class":"OCA\\User_LDAP\\LDAP","type":"->","args":[]},{"file":"/var/www/nextcloud/apps/user_ldap/lib/LDAP.php","line":47,"function":"invokeLDAPMethod","class":"OCA\\User_LDAP\\LDAP","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/nextcloud/apps/user_ldap/lib/Connection.php","line":662,"function":"bind","class":"OCA\\User_LDAP\\LDAP","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/nextcloud/apps/user_ldap/lib/Connection.php","line":576,"function":"bind","class":"OCA\\User_LDAP\\Connection","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/nextcloud/apps/user_ldap/lib/Connection.php","line":195,"function":"establishConnection","class":"OCA\\User_LDAP\\Connection","type":"->","args":[]},{"file":"/var/www/nextcloud/apps/user_ldap/lib/Connection.php","line":203,"function":"init","class":"OCA\\User_LDAP\\Connection","type":"->","args":[]},{"file":"/var/www/nextcloud/apps/user_ldap/lib/Access.php","line":195,"function":"getConnectionResource","class":"OCA\\User_LDAP\\Connection","type":"->","args":[]},{"file":"/var/www/nextcloud/apps/user_ldap/lib/User_LDAP.php","line":309,"function":"readAttribute","class":"OCA\\User_LDAP\\Access","type":"->","args":["cn=first last,ou=users,dc=ad,dc=domain,dc=org","","(&(|(objectclass=person))(|(|(memberof=CN=NextCloud,OU=groups,DC=ad,DC=domain,DC=org)(primaryGroupID=1122))))"]},{"function":"userExistsOnLDAP","class":"OCA\\User_LDAP\\User_LDAP","type":"->","args":[{"__class__":"OCA\\User_LDAP\\User\\User"}]},{"file":"/var/www/nextcloud/apps/user_ldap/lib/User_Proxy.php","line":114,"function":"call_user_func_array","args":[[{"__class__":"OCA\\User_LDAP\\User_LDAP"},"userExistsOnLDAP"],["*** sensitive parameter replaced ***"]]},{"file":"/var/www/nextcloud/apps/user_ldap/lib/Proxy.php","line":150,"function":"callOnLastSeenOn","class":"OCA\\User_LDAP\\User_Proxy","type":"->","args":["*** sensitive parameter replaced ***","userExistsOnLDAP",["*** sensitive parameter replaced ***"],false]},{"file":"/var/www/nextcloud/apps/user_ldap/lib/User_Proxy.php","line":205,"function":"handleRequest","class":"OCA\\User_LDAP\\Proxy","type":"->","args":["*** sensitive parameter replaced ***","userExistsOnLDAP",["*** sensitive parameter replaced ***"]]},{"file":"/var/www/nextcloud/apps/user_ldap/lib/User_Proxy.php","line":182,"function":"userExistsOnLDAP","class":"OCA\\User_LDAP\\User_Proxy","type":"->","args":["*** sensitive parameter replaced ***"]},{"file":"/var/www/nextcloud/lib/private/User/Manager.php","line":152,"function":"userExists","class":"OCA\\User_LDAP\\User_Proxy","type":"->","args":["*** sensitive parameter replaced ***"]},{"file":"/var/www/nextcloud/lib/private/Authentication/Login/UserDisabledCheckCommand.php","line":47,"function":"get","class":"OC\\User\\Manager","type":"->","args":["*** sensitive parameter replaced ***"]},{"file":"/var/www/nextcloud/lib/private/Authentication/Login/ALoginCommand.php","line":40,"function":"process","class":"OC\\Authentication\\Login\\UserDisabledCheckCommand","type":"->","args":[{"__class__":"OC\\Authentication\\Login\\LoginData"}]},{"file":"/var/www/nextcloud/lib/private/Authentication/Login/PreLoginHookCommand.php","line":53,"function":"processNextOrFinishSuccessfully","class":"OC\\Authentication\\Login\\ALoginCommand","type":"->","args":[{"__class__":"OC\\Authentication\\Login\\LoginData"}]},{"file":"/var/www/nextcloud/lib/private/Authentication/Login/Chain.php","line":108,"function":"process","class":"OC\\Authentication\\Login\\PreLoginHookCommand","type":"->","args":[{"__class__":"OC\\Authentication\\Login\\LoginData"}]},{"file":"/var/www/nextcloud/core/Controller/LoginController.php","line":300,"function":"process","class":"OC\\Authentication\\Login\\Chain","type":"->","args":[{"__class__":"OC\\Authentication\\Login\\LoginData"}]},{"file":"/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php","line":170,"function":"tryLogin","class":"OC\\Core\\Controller\\LoginController","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php","line":99,"function":"executeController","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->","args":[{"__class__":"OC\\Core\\Controller\\LoginController"},"tryLogin"]},{"file":"/var/www/nextcloud/lib/private/AppFramework/App.php","line":125,"function":"dispatch","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->","args":[{"__class__":"OC\\Core\\Controller\\LoginController"},"tryLogin"]},{"file":"/var/www/nextcloud/lib/private/AppFramework/Routing/RouteActionHandler.php","line":47,"function":"main","class":"OC\\AppFramework\\App","type":"::","args":["OC\\Core\\Controller\\LoginController","tryLogin",{"__class__":"OC\\AppFramework\\DependencyInjection\\DIContainer"},{"_route":"core.login.tryLogin"}]},{"function":"__invoke","class":"OC\\AppFramework\\Routing\\RouteActionHandler","type":"->","args":[{"_route":"core.login.tryLogin"}]},{"file":"/var/www/nextcloud/lib/private/Route/Router.php","line":299,"function":"call_user_func","args":[{"__class__":"OC\\AppFramework\\Routing\\RouteActionHandler"},{"_route":"core.login.tryLogin"}]},{"file":"/var/www/nextcloud/lib/base.php","line":1008,"function":"match","class":"OC\\Route\\Router","type":"->","args":["/login"]},{"file":"/var/www/nextcloud/index.php","line":38,"function":"handleRequest","class":"OC","type":"::","args":[]}],"File":"/var/www/nextcloud/apps/user_ldap/lib/LDAP.php","Line":350,"CustomMessage":"--"},"userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0","version":"18.0.3.0","id":"5e875901c145e"}
This one is logged when navigating to the Administration -> Overview page as a admin user:
{"reqId":"fijzXUGDlDs81uRXb4qu","level":3,"time":"2020-04-03T15:33:37+00:00","remoteAddr":"10.11.11.34","user":"root","app":"index","method":"GET","url":"/settings/admin/overview","message":{"Exception":"OC\\ServerNotAvailableException","Message":"Lost connection to LDAP server.","Code":0,"Trace":[{"file":"/var/www/nextcloud/apps/user_ldap/lib/LDAP.php","line":389,"function":"processLDAPError","class":"OCA\\User_LDAP\\LDAP","type":"->","args":["*** sensitive parameter replaced ***"]},{"file":"/var/www/nextcloud/apps/user_ldap/lib/LDAP.php","line":312,"function":"postFunctionCall","class":"OCA\\User_LDAP\\LDAP","type":"->","args":[]},{"file":"/var/www/nextcloud/apps/user_ldap/lib/LDAP.php","line":47,"function":"invokeLDAPMethod","class":"OCA\\User_LDAP\\LDAP","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/nextcloud/apps/user_ldap/lib/Connection.php","line":662,"function":"bind","class":"OCA\\User_LDAP\\LDAP","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/nextcloud/apps/user_ldap/lib/Connection.php","line":576,"function":"bind","class":"OCA\\User_LDAP\\Connection","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/nextcloud/apps/user_ldap/lib/Connection.php","line":195,"function":"establishConnection","class":"OCA\\User_LDAP\\Connection","type":"->","args":[]},{"file":"/var/www/nextcloud/apps/user_ldap/lib/Connection.php","line":203,"function":"init","class":"OCA\\User_LDAP\\Connection","type":"->","args":[]},{"file":"/var/www/nextcloud/apps/user_ldap/lib/Access.php","line":1267,"function":"getConnectionResource","class":"OCA\\User_LDAP\\Connection","type":"->","args":[]},{"file":"/var/www/nextcloud/apps/user_ldap/lib/Access.php","line":1039,"function":"count","class":"OCA\\User_LDAP\\Access","type":"->","args":["(&(&(|(objectclass=person))(|(|(memberof=CN=NextCloud,OU=groups,OU=accounts,OU=objects,DC=ad,DC=domain,DC=com)(primaryGroupID=1122))))(displayname=*))",["DC=ad,DC=domain,DC=com"],["dn"],null,null]},{"file":"/var/www/nextcloud/apps/user_ldap/lib/User_LDAP.php","line":564,"function":"countUsers","class":"OCA\\User_LDAP\\Access","type":"->","args":["(&(&(|(objectclass=person))(|(|(memberof=CN=NextCloud,OU=groups,OU=accounts,OU=objects,DC=ad,DC=domain,DC=com)(primaryGroupID=1122))))(displayname=*))"]},{"file":"/var/www/nextcloud/apps/user_ldap/lib/User_Proxy.php","line":335,"function":"countUsers","class":"OCA\\User_LDAP\\User_LDAP","type":"->","args":[]},{"file":"/var/www/nextcloud/apps/support/lib/Service/SubscriptionService.php","line":128,"function":"countUsers","class":"OCA\\User_LDAP\\User_Proxy","type":"->","args":[]},{"file":"/var/www/nextcloud/apps/support/lib/Service/SubscriptionService.php","line":249,"function":"getUserCount","class":"OCA\\Support\\Service\\SubscriptionService","type":"->","args":[]},{"file":"/var/www/nextcloud/apps/support/lib/Subscription/SubscriptionAdapter.php","line":51,"function":"getSubscriptionInfo","class":"OCA\\Support\\Service\\SubscriptionService","type":"->","args":[]},{"file":"/var/www/nextcloud/lib/private/Support/Subscription/Registry.php","line":75,"function":"hasValidSubscription","class":"OCA\\Support\\Subscription\\SubscriptionAdapter","type":"->","args":[]},{"file":"/var/www/nextcloud/apps/updatenotification/lib/Settings/Admin.php","line":101,"function":"delegateHasValidSubscription","class":"OC\\Support\\Subscription\\Registry","type":"->","args":[]},{"file":"/var/www/nextcloud/apps/settings/lib/Controller/CommonSettingsTrait.php","line":141,"function":"getForm","class":"OCA\\UpdateNotification\\Settings\\Admin","type":"->","args":[]},{"file":"/var/www/nextcloud/apps/settings/lib/Controller/AdminSettingsController.php","line":83,"function":"formatSettings","class":"OCA\\Settings\\Controller\\AdminSettingsController","type":"->","args":[{"10":[{"__class__":"OCA\\Settings\\Admin\\Overview"}],"11":[{"__class__":"OCA\\UpdateNotification\\Settings\\Admin"}]}]},{"file":"/var/www/nextcloud/apps/settings/lib/Controller/CommonSettingsTrait.php","line":152,"function":"getSettings","class":"OCA\\Settings\\Controller\\AdminSettingsController","type":"->","args":["overview"]},{"file":"/var/www/nextcloud/apps/settings/lib/Controller/AdminSettingsController.php","line":68,"function":"getIndexResponse","class":"OCA\\Settings\\Controller\\AdminSettingsController","type":"->","args":["admin","overview"]},{"file":"/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php","line":170,"function":"index","class":"OCA\\Settings\\Controller\\AdminSettingsController","type":"->","args":["overview"]},{"file":"/var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php","line":99,"function":"executeController","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->","args":[{"__class__":"OCA\\Settings\\Controller\\AdminSettingsController"},"index"]},{"file":"/var/www/nextcloud/lib/private/AppFramework/App.php","line":125,"function":"dispatch","class":"OC\\AppFramework\\Http\\Dispatcher","type":"->","args":[{"__class__":"OCA\\Settings\\Controller\\AdminSettingsController"},"index"]},{"file":"/var/www/nextcloud/lib/private/AppFramework/Routing/RouteActionHandler.php","line":47,"function":"main","class":"OC\\AppFramework\\App","type":"::","args":["OCA\\Settings\\Controller\\AdminSettingsController","index",{"__class__":"OC\\AppFramework\\DependencyInjection\\DIContainer"},{"section":"overview","_route":"settings.AdminSettings.index"}]},{"function":"__invoke","class":"OC\\AppFramework\\Routing\\RouteActionHandler","type":"->","args":[{"section":"overview","_route":"settings.AdminSettings.index"}]},{"file":"/var/www/nextcloud/lib/private/Route/Router.php","line":299,"function":"call_user_func","args":[{"__class__":"OC\\AppFramework\\Routing\\RouteActionHandler"},{"section":"overview","_route":"settings.AdminSettings.index"}]},{"file":"/var/www/nextcloud/lib/base.php","line":1008,"function":"match","class":"OC\\Route\\Router","type":"->","args":["/settings/admin/overview"]},{"file":"/var/www/nextcloud/index.php","line":38,"function":"handleRequest","class":"OC","type":"::","args":[]}],"File":"/var/www/nextcloud/apps/user_ldap/lib/LDAP.php","Line":350,"CustomMessage":"--"},"userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0","version":"18.0.3.0","id":"5e87576c7ce95"}
SAMBA log
SAMBA does not log anything on standard logging level, but on log level 10 it shows this 3x for each failed login in Nextcloud:
ldb: ldb_asprintf/set_errstring: NULL Base DN invalid for a base search
msg: NULL Base DN invalid for a base search
Yet it might be a red herring though.