Configuration of LDAP / AD Integration, can't get no Base DN

No Base DN whil configuration of LDAP / AD Integration

Sorry to hear you’re facing problems :slightly_frowning_face:

help.nextcloud.com is for home/non-enterprise users. If you’re running a business, paid support can be accessed via portal.nextcloud.com where we can ensure your business keeps running smoothly.

In order to help you as quickly as possible, before clicking Create Topic please provide as much of the below as you can. Feel free to use a pastebin service for logs, otherwise either indent short log examples with four spaces:

example

Or for longer, use three backticks above and below the code snippet:

longer
example
here

Some or all of the below information will be requested if it isn’t supplied; for fastest response please provide as much as you can :heart:

Nextcloud version: 21.0.0
Operating system and version: ? running on QNAP in ContainerStation as Docker container
Apache or nginx version (eg, Apache 2.4.25): ? sry, no info as well :slightly_frowning_face:
PHP version (eg, 7.4): ?

The issue you are facing:
I’m trying to configure LDAP / AD Integration. But unfortunately I stuck on the frist dialog, 'cause I can’t get the Base DN to be recognized nor a sucessful test of Base DN if i fill it by hand.

Is this the first time you’ve seen this error? (Y/N):
Yes. It’s the first time i try using this.

The output of your Nextcloud log in Admin > Logging:

{"reqId":"cBmc6ZQYJkWvnXzrvMgH","level":2,"time":"2021-03-23T20:42:07+00:00","remoteAddr":"192.168.1.208","user":"nc-admin","app":"user_ldap","method":"POST","url":"/apps/user_ldap/ajax/wizard.php","message":"Configuration Error (prefix s01): login filter does not contain %uid place holder.","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:86.0) Gecko/20100101 Firefox/86.0","version":"21.0.0.18","id":"605a556de7988"}
{"reqId":"cBmc6ZQYJkWvnXzrvMgH","level":2,"time":"2021-03-23T20:42:07+00:00","remoteAddr":"192.168.1.208","user":"nc-admin","app":"user_ldap","method":"POST","url":"/apps/user_ldap/ajax/wizard.php","message":"Configuration Error (prefix s01): No LDAP Login Filter given!","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:86.0) Gecko/20100101 Firefox/86.0","version":"21.0.0.18","id":"605a556de799a"}
{"reqId":"WblUZO9MeOGlvUGuhodj","level":2,"time":"2021-03-23T20:29:22+00:00","remoteAddr":"192.168.1.208","user":"nc-admin","app":"user_ldap","method":"POST","url":"/apps/user_ldap/ajax/wizard.php","message":"Bind failed: 8: Strong(er) authentication required","userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:86.0) Gecko/20100101 Firefox/86.0","version":"21.0.0.18","id":"605a556de79cf"}

The output of your config.php file in /path/to/nextcloud (make sure you remove any identifiable information!):

<?php
$CONFIG = array (
  'htaccess.RewriteBase' => '/',
  'memcache.local' => '\\OC\\Memcache\\APCu',
  'apps_paths' => 
  array (
    0 => 
    array (
      'path' => '/var/www/html/apps',
      'url' => '/apps',
      'writable' => false,
    ),
    1 => 
    array (
      'path' => '/var/www/html/custom_apps',
      'url' => '/custom_apps',
      'writable' => true,
    ),
  ),
  'instanceid' => 'ocdk4vy77s4v',
  'passwordsalt' => ********
  'secret' => ********
  'trusted_domains' => 
  array (
    0 => '192.168.1.128:49162',
  ),
  'datadirectory' => '/var/www/html/data',
  'dbtype' => 'mysql',
  'version' => '21.0.0.18',
  'overwrite.cli.url' => 'http://192.168.1.128:49162',
  'dbname' => 'NextCloudDB',
  'dbhost' => '192.168.1.128:3306',
  'dbport' => '',
  'dbtableprefix' => 'oc_',
  'dbuser' => 'oc_nc-admin',
  'dbpassword' => '******',
  'installed' => true,
  'ldapProviderFactory' => 'OCA\\User_LDAP\\LDAPProviderFactory',
);

The output of your Apache/nginx/system log in /var/log/____:

Sorry again, I don't find it on my system.

I hope I’ve provided all necessary information.

Best Regards
Michael

Hello Michael,

can you share with us, what Base DN you are using? Did you enter the correct Bind User information and password?

i.e.: uid=admin,dc=ldap,dc=domain,dc=tld

uid = The (admin) user on the LDAP server, who has permissions to browse for Users/Groups
dc = This composes of the FQDN to your LDAP server (above example can be translated into ldap.domain.tld)

If all the above is given, the Base DN could look like this:

dc=ldap,dc=domain,dc=tld (should match your environment)

Hello Felix,

I’m using the following:
Server:
192.168.1.128 Port 389 (Port auto detected)
Login:
nc=ITAdmin, nc=administrators, dc=MYSWS, dc=local
Base DN:
dc=MYSWS,dc=local

The Domain Controler I’m using is a QNAP. I’m able to log in on Win10 clients at the Domain so it seems to work so far.

EDIT: I also tried: uid=ITAdmin,dc=MYSWS,dc=local but no luck as well.

EDIT2: I found the following information in the nextcloud Log:
[user_ldap] Warning: Bind failed: 8: Strong(er) authentication required
POST /index.php/apps/user_ldap/ajax/wizard.php
from 80.147.30.204 by admin at 2021-04-04T23:14:36+00:00
[user_ldap] Warning: Configuration Error (prefix s01): login filter does not contain %uid place holder.
POST /index.php/apps/user_ldap/ajax/wizard.php
from 80.147.30.204 by admin at 2021-04-04T23:14:36+00:00
[user_ldap] Warning: Configuration Error (prefix s01): No LDAP Login Filter given!
POST /index.php/apps/user_ldap/ajax/wizard.php
from 80.147.30.204 by admin at 2021-04-04T23:14:36+00:00

Not sure if this will help,

But if you go into your Domain Controller, then to ‘Active Directory - Users and Computers’
Locate both your DC Server [in the Domain Controllers Container] and the User you are using to log in:
Properties → ‘Attribute Editor’ Tab → ‘distinguishedName’

This has the exact nomenclature that Nextcloud is looking for.

Have you tried [domain name]\administrator in the User DN field…?

I’m getting the same problem with an OpenLDAP server. My configuration seems to be mostly working; I can log in one of my user accounts successfully, but another account is failing, so I want to check my config, but I can’t get past that first screen since upgrading to Nextcloud 21.0.3. It definitely seems to be an issue with the LDAP / AD Integration settings screen.?

None of the previous configuration data is being pre-filled, apart from what seems to be four tabs in the base dn field.