LDAP Users not mapped and authentication fails #272

ItalyPaleAle · 2016-07-01T05:02:44Z

I'm setting up a new OC 9.0.51 server connected to LDAP. I was able to get LDAP to work and it sees two users in my Active Directory when pressing on the "test" buttons, as expected. There is nothing "fancy" about my LDAP setup: just adding basic settings.

All tests run fine:

"Verify settings and count users" show me 2 users found in the only group that is allowed (Ok)
Login is only with "LDAP / AD Username:". I tested with the usernames of both users (john and jane) and in both cases pressing on "Verify settings" reports "User found and settings verified." (Ok)

However, in the "Users" admin section I can only see 1 user imported from AD (the jane user). john was not imported, not even after pressing on "Clear Username-LDAP User Mapping".

When trying to log in as john (the user not imported), the UI reports: "An internal error occurred. Please try again or contact your administrator"). I then see the following 3 error messages in the log:

{"reqId":"1kqA\/gf7n2Vv05GiFFQR","remoteAddr":"172.17.0.4","app":"PHP","message":"iconv(): Wrong charset, conversion from `UTF-8' to `ASCII\/\/TRANSLIT' is not allowed at \/nextcloud\/apps\/user_ldap\/lib\/access.php#1101","level":3,"time":"2016-07-01T04:48:23+00:00","method":"POST","url":"\/","user":"--"}

{"reqId":"1kqA\/gf7n2Vv05GiFFQR","remoteAddr":"172.17.0.4","app":"core","message":"Exception when running cache gc: Attempted to initialize mount points for null user and no user in session","level":2,"time":"2016-07-01T04:48:23+00:00","method":"POST","url":"\/","user":"--"}

{"reqId":"1kqA\/gf7n2Vv05GiFFQR","remoteAddr":"172.17.0.4","app":"handleLogin","message":"Exception: {\"Exception\":\"OC\\\\User\\\\NoUserException\",\"Message\":\"Attempted to initialize mount points for null user and no user in session\",\"Code\":0,\"Trace\":\"#0 \\\/nextcloud\\\/lib\\\/private\\\/files\\\/node\\\/root.php(336): OC\\\\Files\\\\Filesystem::initMountPoints('')\\n#1 \\\/nextcloud\\\/lib\\\/private\\\/server.php(742): OC\\\\Files\\\\Node\\\\Root->getUserFolder('')\\n#2 \\\/nextcloud\\\/lib\\\/private\\\/user.php(170): OC\\\\Server->getUserFolder('')\\n#3 \\\/nextcloud\\\/lib\\\/base.php(1150): OC_User::login(*** username and password replaced ***)\\n#4 \\\/nextcloud\\\/lib\\\/base.php(1046): OC::tryFormLogin()\\n#5 \\\/nextcloud\\\/lib\\\/base.php(1008): OC::handleLogin()\\n#6 \\\/nextcloud\\\/index.php(39): OC::handleRequest()\\n#7 {main}\",\"File\":\"\\\/nextcloud\\\/lib\\\/private\\\/files\\\/filesystem.php\",\"Line\":377}","level":3,"time":"2016-07-01T04:48:23+00:00","method":"POST","url":"\/","user":"--"}

When trying to log in as jane (the user that was imported), instead, the authentication succeeds, but then I see a completely white page. On the logs, I see:

{"reqId":"wvelxJoRPN+nxRh3E21h","remoteAddr":"172.17.0.4","app":"PHP","message":"Error: Call to a member function getFileInfo() on null at \/nextcloud\/lib\/private\/files\/filesystem.php#874","level":3,"time":"2016-07-01T04:52:37+00:00","method":"GET","url":"\/index.php\/apps\/files\/","user":"--"}

I'm running OC using the Docker image by @Wonderfall : https://github.com/Wonderfall/dockerfiles/tree/master/nextcloud

Server configuration

Operating system:
Alpine Linux in Docker Container

Web server:
nginx

Database:
MariaDB 10.1

PHP version:
7.0.4

Nextcloud version: (see Nextcloud admin page)
9.0.51

Updated from an older Nextcloud/ownCloud or fresh install:
Fresh install

Where did you install Nextcloud from:
Docker: https://github.com/Wonderfall/dockerfiles/tree/master/nextcloud

Signing status (Nextcloud 9.0 and above):

No errors have been found.

List of activated apps:

Enabled:
  - activity: 2.2.1
  - admin_audit: 1.0.0
  - comments: 0.2
  - dav: 0.1.6
  - federatedfilesharing: 0.1.0
  - files: 1.4.4
  - files_pdfviewer: 0.8.1
  - files_sharing: 0.9.1
  - files_texteditor: 2.1
  - files_trashbin: 0.8.0
  - files_versions: 1.2.0
  - files_videoplayer: 0.9.8
  - firstrunwizard: 1.1
  - gallery: 14.5.0
  - notifications: 0.2.3
  - provisioning_api: 0.4.1
  - systemtags: 0.2
  - templateeditor: 0.1
  - updatenotification: 0.1.0
  - user_ldap: 0.8.0
Disabled:
  - encryption
  - external
  - federation
  - files_external
  - user_external

The content of config/config.php:

{
    "system": {
        "instanceid": "ocqua46unikg",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "10.1.2.2",
            "some.domain"
        ],
        "datadirectory": "\/nextcloud\/data",
        "overwrite.cli.url": "http:\/\/10.1.2.2",
        "dbtype": "mysql",
        "version": "9.0.51.0",
        "dbname": "owncloud",
        "dbhost": "mariadb",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "logtimezone": "UTC",
        "installed": true,
        "mail_smtpmode": "smtp",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "sendgrid.net",
        "mail_smtpauthtype": "LOGIN",
        "mail_smtpsecure": "tls",
        "mail_smtphost": "smtp.sendgrid.net",
        "mail_smtpport": "587",
        "mail_smtpauth": 1,
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "ldapIgnoreNamingRules": false
    }
}

Are you using external storage, if yes which one: Local

Are you using encryption: No

Are you using an external user-backend, if yes which one: Active Directory (LDAP)

LDAP configuration (delete this part if not used)

+-------------------------------+------------------------------------------------------------------------------------------------------------------------------------+
| Configuration                 |                                                                                                                                    |
+-------------------------------+------------------------------------------------------------------------------------------------------------------------------------+
| hasMemberOfFilterSupport      | 1                                                                                                                                  |
| hasPagedResultSupport         |                                                                                                                                    |
| homeFolderNamingRule          |                                                                                                                                    |
| lastJpegPhotoLookup           | 0                                                                                                                                  |
| ldapAgentName                 | CN=LDAP User,CN=Users,DC=domain,DC=com                                                                                          |
| ldapAgentPassword             | ***                                                                                                                                |
| ldapAttributesForGroupSearch  |                                                                                                                                    |
| ldapAttributesForUserSearch   |                                                                                                                                    |
| ldapBackupHost                |                                                                                                                                    |
| ldapBackupPort                |                                                                                                                                    |
| ldapBase                      | CN=Users,DC=domain,DC=com                                                                                                       |
| ldapBaseGroups                | CN=Users,DC=domain,DC=com                                                                                                       |
| ldapBaseUsers                 | CN=Users,DC=domain,DC=com                                                                                                       |
| ldapCacheTTL                  | 600                                                                                                                                |
| ldapConfigurationActive       | 1                                                                                                                                  |
| ldapDynamicGroupMemberURL     |                                                                                                                                    |
| ldapEmailAttribute            |                                                                                                                                    |
| ldapExperiencedAdmin          | 0                                                                                                                                  |
| ldapExpertUUIDGroupAttr       |                                                                                                                                    |
| ldapExpertUUIDUserAttr        |                                                                                                                                    |
| ldapExpertUsernameAttr        |                                                                                                                                    |
| ldapGroupDisplayName          | cn                                                                                                                                 |
| ldapGroupFilter               | (&(|(objectclass=group))(|(cn=Home Users)))                                                                                        |
| ldapGroupFilterGroups         | Home Users                                                                                                                         |
| ldapGroupFilterMode           | 0                                                                                                                                  |
| ldapGroupFilterObjectclass    | group                                                                                                                              |
| ldapGroupMemberAssocAttr      | uniqueMember                                                                                                                       |
| ldapHost                      | dc01.domain.com                                                                                                               |
| ldapIgnoreNamingRules         |                                                                                                                                    |
| ldapLoginFilter               | (&(&(|(objectclass=person))(|(|(memberof=CN=Home Users,CN=Users,DC=domain,DC=com)(primaryGroupID=1106))))(samaccountname=%uid)) |
| ldapLoginFilterAttributes     |                                                                                                                                    |
| ldapLoginFilterEmail          | 0                                                                                                                                  |
| ldapLoginFilterMode           | 0                                                                                                                                  |
| ldapLoginFilterUsername       | 1                                                                                                                                  |
| ldapNestedGroups              | 0                                                                                                                                  |
| ldapOverrideMainServer        |                                                                                                                                    |
| ldapPagingSize                | 500                                                                                                                                |
| ldapPort                      | 389                                                                                                                                |
| ldapQuotaAttribute            |                                                                                                                                    |
| ldapQuotaDefault              |                                                                                                                                    |
| ldapTLS                       | 0                                                                                                                                  |
| ldapUserDisplayName           | displayName                                                                                                                        |
| ldapUserDisplayName2          |                                                                                                                                    |
| ldapUserFilter                | (&(|(objectclass=person))(|(|(memberof=CN=Home Users,CN=Users,DC=domain,DC=com)(primaryGroupID=1106))))                         |
| ldapUserFilterGroups          | Home Users                                                                                                                         |
| ldapUserFilterMode            | 0                                                                                                                                  |
| ldapUserFilterObjectclass     | person                                                                                                                             |
| ldapUuidGroupAttribute        | auto                                                                                                                               |
| ldapUuidUserAttribute         | auto                                                                                                                               |
| turnOffCertCheck              | 0                                                                                                                                  |
| useMemberOfToDetectMembership | 1                                                                                                                                  |
+-------------------------------+------------------------------------------------------------------------------------------------------------------------------------+

Client configuration

Browser: Tested with multiple evergreen browsers

Operating system: Windows 10, OSX

Logs

Web server error log

Not available (and not applicable!)

Nextcloud log (data/owncloud.log)

See above

The text was updated successfully, but these errors were encountered:

ItalyPaleAle · 2016-07-01T05:03:17Z

I forgot to mention: an almost identical setup was working fine with ownCloud 9.0

ItalyPaleAle · 2016-07-01T05:07:13Z

PS: using iconv like that for transliteration may not be the best approach. See http://stackoverflow.com/a/26514376/192024

schiessle · 2016-07-05T10:12:17Z

@blizzz can you have a look? Thanks!

jokoso · 2016-07-18T11:17:46Z

I have a similar problem running from the same docker image.

Details:

I have two AD users that are identified in the LDAP wizard (e.g., "Jon" and "Lou").
Only Lou shows up under "Users".
Lou can log in.
When Jon attempts to log in, he gets the "An internal error occurred..." message.
Any users trying to immediately log in after the error message is shown gets the white page mentioned above.
The only way to get past the white page is resetting the browser cache.

Here's the log output:

{"reqId":"VOEfsrck0nRL1jreHq4o","remoteAddr":"1.2.3.4","app":"admin_audit","message":"Login attempt: \"jon\"","level":1,"time":"2016-07-18T10:37:40+00:00","method":"POST","url":"\/","user":"--"}
{"reqId":"VOEfsrck0nRL1jreHq4o","remoteAddr":"1.2.3.4","app":"admin_audit","message":"Login successful: \"\"","level":1,"time":"2016-07-18T10:37:41+00:00","method":"POST","url":"\/","user":"--"}
{"reqId":"VOEfsrck0nRL1jreHq4o","remoteAddr":"1.2.3.4","app":"core","message":"Exception when running cache gc: Attempted to initialize mount points for null user and no user in session","level":2,"time":"2016-07-18T10:37:41+00:00","method":"POST","url":"\/","user":"--"}
{"reqId":"VOEfsrck0nRL1jreHq4o","remoteAddr":"1.2.3.4","app":"handleLogin","message":"Exception: {\"Exception\":\"OC\\\\User\\\\NoUserException\",\"Message\":\"Attempted to initialize mount points for null user and no user in session\",\"Code\":0,\"Trace\":\"#0 \\\/nextcloud\\\/lib\\\/private\\\/files\\\/node\\\/root.php(336): OC\\\\Files\\\\Filesystem::initMountPoints('')\\n#1 \\\/nextcloud\\\/lib\\\/private\\\/server.php(756): OC\\\\Files\\\\Node\\\\Root->getUserFolder('')\\n#2 \\\/nextcloud\\\/lib\\\/private\\\/user.php(170): OC\\\\Server->getUserFolder('')\\n#3 \\\/nextcloud\\\/lib\\\/base.php(1167): OC_User::login(*** username and password replaced ***)\\n#4 \\\/nextcloud\\\/lib\\\/base.php(1063): OC::tryFormLogin()\\n#5 \\\/nextcloud\\\/lib\\\/base.php(1025): OC::handleLogin()\\n#6 \\\/nextcloud\\\/index.php(39): OC::handleRequest()\\n#7 {main}\",\"File\":\"\\\/nextcloud\\\/lib\\\/private\\\/files\\\/filesystem.php\",\"Line\":377}","level":3,"time":"2016-07-18T10:37:41+00:00","method":"POST","url":"\/","user":"--"}
{"reqId":"VOEfsrck0nRL1jreHq4o","remoteAddr":"1.2.3.4","app":"user_ldap","message":"No DN found for jon on mydomain.com","level":0,"time":"2016-07-18T10:37:41+00:00","method":"POST","url":"\/","user":"--"}

Scott-St · 2016-08-08T18:56:24Z

Same issue here as you describe on version 9.0.53

blizzz · 2016-08-09T08:56:41Z

php config issue? conversion from utf8 to ascii/translit is not allowed but should be

Scott-St · 2016-08-09T10:48:18Z

Any ideas on what I should check in the php config that could be incorrect?

Scott-St · 2016-08-09T13:04:21Z

On the users page, I see it doing a search for users, its finding both users. But its only displaying 1.

{"reqId":"GRUMPWbJWi0p9H43EzDg","remoteAddr":"192.168.254.254","app":"user_ldap","message":"initializing paged search for  Filter (&(&(|(objectclass=person))(|(|(memberof=CN=NextCloud-Users,CN=Users,DC=AD,DC=STEVENSONONTHE,DC=NET))))(displayname=*)(displayname=*)) base Array\n(\n    [0] => dc=AD,dc=STEVENSONONTHE,dc=NET\n)\n attr Array\n(\n    [0] => dn\n    [1] => uid\n    [2] => samaccountname\n    [3] => memberof\n    [4] => \n    [5] => mail\n    [6] => displayname\n    [7] => mail\n)\n limit 50 offset 0","level":0,"time":"2016-08-09T12:56:41+00:00","method":"GET","url":"\/index.php\/settings\/users\/users?offset=0&limit=50&gid=&pattern=","user":"Admin"}
{"reqId":"GRUMPWbJWi0p9H43EzDg","remoteAddr":"192.168.254.254","app":"user_ldap","message":"Ready for a paged search","level":0,"time":"2016-08-09T12:56:41+00:00","method":"GET","url":"\/index.php\/settings\/users\/users?offset=0&limit=50&gid=&pattern=","user":"Admin"}
{"reqId":"GRUMPWbJWi0p9H43EzDg","remoteAddr":"192.168.254.254","app":"user_ldap","message":"initializing paged search for  Filter objectClass=* base Array\n(\n    [0] => cn=scott stevenson,cn=users,dc=ad,dc=stevensononthe,dc=net\n)\n attr Array\n(\n    [0] => mail\n)\n limit 500 offset 0","level":0,"time":"2016-08-09T12:56:41+00:00","method":"GET","url":"\/index.php\/settings\/users\/users?offset=0&limit=50&gid=&pattern=","user":"Admin"}
{"reqId":"GRUMPWbJWi0p9H43EzDg","remoteAddr":"192.168.254.254","app":"user_ldap","message":"Ready for a paged search","level":0,"time":"2016-08-09T12:56:41+00:00","method":"GET","url":"\/index.php\/settings\/users\/users?offset=0&limit=50&gid=&pattern=","user":"Admin"}
{"reqId":"GRUMPWbJWi0p9H43EzDg","remoteAddr":"192.168.254.254","app":"user_ldap","message":"initializing paged search for  Filter objectClass=* base Array\n(\n    [0] => cn=scott stevenson,cn=users,dc=ad,dc=stevensononthe,dc=net\n)\n attr Array\n(\n    [0] => displayname\n)\n limit 500 offset 0","level":0,"time":"2016-08-09T12:56:41+00:00","method":"GET","url":"\/index.php\/settings\/users\/users?offset=0&limit=50&gid=&pattern=","user":"Admin"}
{"reqId":"GRUMPWbJWi0p9H43EzDg","remoteAddr":"192.168.254.254","app":"user_ldap","message":"Ready for a paged search","level":0,"time":"2016-08-09T12:56:41+00:00","method":"GET","url":"\/index.php\/settings\/users\/users?offset=0&limit=50&gid=&pattern=","user":"Admin"}
{"reqId":"GRUMPWbJWi0p9H43EzDg","remoteAddr":"192.168.254.254","app":"user_ldap","message":"initializing paged search for  Filter objectClass=* base Array\n(\n    [0] => cn=jonelyn c. mahilum,cn=users,dc=ad,dc=stevensononthe,dc=net\n)\n attr Array\n(\n    [0] => mail\n)\n limit 500 offset 0","level":0,"time":"2016-08-09T12:56:41+00:00","method":"GET","url":"\/index.php\/settings\/users\/users?offset=0&limit=50&gid=&pattern=","user":"Admin"}
{"reqId":"GRUMPWbJWi0p9H43EzDg","remoteAddr":"192.168.254.254","app":"user_ldap","message":"Ready for a paged search","level":0,"time":"2016-08-09T12:56:41+00:00","method":"GET","url":"\/index.php\/settings\/users\/users?offset=0&limit=50&gid=&pattern=","user":"Admin"}
{"reqId":"GRUMPWbJWi0p9H43EzDg","remoteAddr":"192.168.254.254","app":"user_ldap","message":"initializing paged search for  Filter objectClass=* base Array\n(\n    [0] => cn=jonelyn c. mahilum,cn=users,dc=ad,dc=stevensononthe,dc=net\n)\n attr Array\n(\n    [0] => displayname\n)\n limit 500 offset 0","level":0,"time":"2016-08-09T12:56:41+00:00","method":"GET","url":"\/index.php\/settings\/users\/users?offset=0&limit=50&gid=&pattern=","user":"Admin"}
{"reqId":"GRUMPWbJWi0p9H43EzDg","remoteAddr":"192.168.254.254","app":"user_ldap","message":"Ready for a paged search","level":0,"time":"2016-08-09T12:56:41+00:00","method":"GET","url":"\/index.php\/settings\/users\/users?offset=0&limit=50&gid=&pattern=","user":"Admin"}
{"reqId":"GRUMPWbJWi0p9H43EzDg","remoteAddr":"192.168.254.254","app":"user_ldap","message":"getUsers: 1 Users found","level":0,"time":"2016-08-09T12:56:41+00:00","method":"GET","url":"\/index.php\/settings\/users\/users?offset=0&limit=50&gid=&pattern=","user":"Admin"}
{"reqId":"lnMUzWNrRPLww7088zZH","remoteAddr":"192.168.254.254","app":"user_ldap","message":"Count filter:  objectclass=*","level":0,"time":"2016-08-09T12:56:52+00:00","method":"POST","url":"\/index.php\/apps\/user_ldap\/ajax\/wizard.php","user":"Admin"}
{"reqId":"lnMUzWNrRPLww7088zZH","remoteAddr":"192.168.254.254","app":"user_ldap","message":"initializing paged search for  Filter objectclass=* base Array\n(\n    [0] => dc=AD,dc=STEVENSONONTHE,dc=NET\n)\n attr Array\n(\n    [0] => dn\n)\n limit 500 offset 0","level":0,"time":"2016-08-09T12:56:52+00:00","method":"POST","url":"\/index.php\/apps\/user_ldap\/ajax\/wizard.php","user":"Admin"}
{"reqId":"lnMUzWNrRPLww7088zZH","remoteAddr":"192.168.254.254","app":"user_ldap","message":"Ready for a paged search","level":0,"time":"2016-08-09T12:56:52+00:00","method":"POST","url":"\/index.php\/apps\/user_ldap\/ajax\/wizard.php","user":"Admin"}

blizzz · 2016-08-09T15:16:13Z

So there's a bug open against PHP: https://bugs.php.net/bug.php?id=44096 Basically, this also points at system configuration. If you compiled PHP yourself, this might help: https://bugs.php.net/bug.php?id=47507 If on docker, maybe this helps docker-library/php#240

MorrisJobke · 2017-03-20T20:53:45Z

So there's a bug open against PHP: https://bugs.php.net/bug.php?id=44096 Basically, this also points at system configuration. If you compiled PHP yourself, this might help: https://bugs.php.net/bug.php?id=47507 If on docker, maybe this helps docker-library/php#240

@Scott-St @EgoAleSum Has this solved your issue?

I will close this for now. If this still is not fixed, please comment and I will reopen

olekole · 2017-07-28T06:03:05Z

The problem still exist.
On LDAP Users > 1000 any User dosn't found in Usersearch same as the Starter of this post
Version 12.0

dl5rcw · 2017-12-19T19:58:09Z

Yepp,experienced such thing today in 12.0.4

schiessle added bug feature: ldap labels Jul 5, 2016

MorrisJobke closed this as completed Mar 20, 2017

nextcloud-bot mentioned this issue Jul 9, 2018

LDAP backup server not called when LDAP main server fails #10160

Closed

nextcloud-bot mentioned this issue Aug 28, 2018

LDAP configuration. Duplicate user with different UUID. #10899

Closed

This was referenced Sep 5, 2018

Can't rename users full name - Authentication error #11057

Closed

LDAP authentication assumes passwords are reusable #11113

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

LDAP Users not mapped and authentication fails #272

LDAP Users not mapped and authentication fails #272

ItalyPaleAle commented Jul 1, 2016

ItalyPaleAle commented Jul 1, 2016

ItalyPaleAle commented Jul 1, 2016

schiessle commented Jul 5, 2016

jokoso commented Jul 18, 2016

Scott-St commented Aug 8, 2016

blizzz commented Aug 9, 2016

Scott-St commented Aug 9, 2016

Scott-St commented Aug 9, 2016

blizzz commented Aug 9, 2016

MorrisJobke commented Mar 20, 2017

olekole commented Jul 28, 2017

dl5rcw commented Dec 19, 2017

LDAP Users not mapped and authentication fails #272

LDAP Users not mapped and authentication fails #272

Comments

ItalyPaleAle commented Jul 1, 2016

Server configuration

LDAP configuration (delete this part if not used)

Client configuration

Logs

Web server error log

Nextcloud log (data/owncloud.log)

ItalyPaleAle commented Jul 1, 2016

ItalyPaleAle commented Jul 1, 2016

schiessle commented Jul 5, 2016

jokoso commented Jul 18, 2016

Scott-St commented Aug 8, 2016

blizzz commented Aug 9, 2016

Scott-St commented Aug 9, 2016

Scott-St commented Aug 9, 2016

blizzz commented Aug 9, 2016

MorrisJobke commented Mar 20, 2017

olekole commented Jul 28, 2017

dl5rcw commented Dec 19, 2017