Migrating existing Nextcloud user account to LDAP

ℹ️ Support
3

I found a more manual solution to my problem. It seems to have worked as expected, but I do not give any guarantees that this is a safe way.

In summary, I populated my LDAP DIT such that my account name according to LDAP was identical to my existint account name according to Nextcloud. Then I enabled LDAP in Nextcloud and fixed the Nextcloud tables which map Nextcloud accounts to LDAP accounts manually using raw SQL statements.

Detailed steps:

  1. Create the LDAP user, in my case it is : uid=<my-account>,ou=users,o=<my-domain.tld>,dc=<host name>,dc=<my-domain>,dc=<tld>. Important: account name is identical to my existing account name in NC.
  2. Enable and configure the “LDAP User and Group Backend” in NC.
    I used the following special settings:
    +-------------------------+-------------+
| Configuration           | s01         |
+-------------------------+-------------+
| ldapExperiencedAdmin    | 1           |
| ldapExpertUUIDGroupAttr | cn          |
| ldapExpertUUIDUserAttr  | uid         |
| ldapExpertUsernameAttr  | uid         |
| ldapGidNumber           | cn          |
| ldapGroupDisplayName    | displayName |
| ldapUserDisplayName     | displayName |
| ldapUserDisplayName2    | mail        |
+-------------------------+-------------+
    Eplaination: Normally, NC creates a UUID-based internal account name for each LDAP account and maps the NC account to the LDAP account. This also implies that the data directory becomes data/<UUID>. However, I wanted the (new) LDAP-based NC account to become the 1:1 direct successor of my existing NC account. Hence, I configured the “LDAP User and Group Backend” to use the uid-attribute as the UUID (for user accounts) and the cn-attribute as the UUID (for group accounts) such that LDAP-based accounts look the same as native NC accounts.
  3. After I enabled that LDAP configuration, NC automatically synced the LDAP accounts and created corresponding NC accounts. Of course, in case of my existing account there was an (intended) name conflict as the LDAP DIT defined an user account with the exact same name the already existing account. NC resolved this conflict by creating a new NC account with a random number as suffix. Hence, I ended up with
    • <my-account> the previously existing (old) local NC account
    • <my-account_1234> as the new local NC account mapping to <my-account> in LDAP
  4. Put NC into maintenance mode and fix the NC manually:
    1. Fix the table of all accounts:
      Remove the existing (old) NC account and rename the (freshly created) NC account to the old one
      DELETE FROM oc_accounts WHERE uid = '<my-account>';
UPDATE oc_accounts SET uid = '<my-account>' WHERE uid = '<my-account_1234>';
DELETE FROM oc_accounts_data WHERE uid = '<my-account>';
UPDATE oc_accounts_data SET uid = '<my-account>' WHERE uid = '<my-account_1234>';
    2. Fix the mapping table between NC and LDAP accounts
      Rename the (freshly created) NC account to the old one
      UPDATE oc_ldap_user_mapping SET owncloud_name = '<my-account>' WHERE owncloud_name = '<my-account_1234>';
    3. Fix the table of local NC accounts:
      Delete the old account which is not needed anymore
      DELETE FROM oc_users WHERE uid = '<my-account>';