[6.0.3] LDAP Wizard hangs, users cannot login

[ser72]

Environment
[]$ cat /etc/redhat-release
Red Hat Enterprise Linux Server release 6.5 (Santiago)
[]$ rpm -qa | grep php
php-5.3.3-27.el6_5.x86_64

Issue
User attempts to configure LDAP -- the LDAP wizard spins and spins and is not usable in this setup.

Configure LDAP via raw filters is possible, however, shows no users found and no groups found. This is using the same configuration as in oC5.

Error message

An exception occurred while executing ' INSERT INTO "oc_ldap_user_mapping" ("ldap_dn", "owncloud_name", "directory_uuid") SELECT ?,?,? WHERE NOT EXISTS ( SELECT 1 FROM "oc_ldap_user_mapping" WHERE "ldap_dn" = ? OR "owncloud_name" = ?) ': ORA-00923: FROM keyword not found where expected

The hourly cronjob is reporting (which is why I increased the memory limit in php)

PHP Fatal error:  Allowed memory size of 134217728 bytes exhausted (tried to allocate 71 bytes) in /var/www/html/owncloud-enterprise/apps/user_ldap/lib/ldap.php on line 141
Unexpected error!

Logs
Complete logs and configuration can be found on S3 under
Support/customer-tickets-history/LDAP WIZARD

@blizzz

[karlitschek]

@blizzz

[blizzz]

which ownCloud version? Sounds like an issue that was fixed in 6.0.3.

[ser72]

@blizzz

Is there a git hub for the issue you mention?

[blizzz]

Yes: #7530

The stuff is running in the background and blocking further LDAP access. You could wait or restart the web server.

[Elethiomel]

We are experiencing the same difficulty here and are running 6.0.3 from the supplied Debian repository. When I hit continue from the first screen, I get the second screen (User Filter), there's a burst of queries sent to the LDAP server which takes approximately 2 seconds. A single Apache process then pegs the CPU to 100% indefinitely with no progress.

I'm stuck on the User Filter screen with spinning icons beside "only those object classes" and "only from those groups"

[blizzz]

@Elethiomel could you set the logging to Everything, try again and provide the owncloud.log, please?

[Elethiomel]

I could only recover from this by restoring the oc_appconfig table from a mysql backup dump. If I use the admin view to config LDAP it ruins the config. Unfortunately this is a production system so breaking the config again is not possibility. I'll see what I can do though. I may be able to clone the system and reproduce the error.

[blizzz]

Would be very much appreciated, thank you.

[ser72]

@blizzz

Same issue in 6.0.3

May  9 14:59:40 owntest1 ownCloud[13274]: {PHP} file_put_contents(/tmp/owncloud-oc37871d9bc9/LDAP-user_ldap-s01-ef039b186a13396c9f089faac77d2488): failed to open stream: Permission denied at /var/www/html/owncloud-enterprise/lib/private/cache/fileglobal.php#36
May  9 14:59:40 owntest1 ownCloud[13274]: {PHP} mkdir(): File exists at /var/www/html/owncloud-enterprise/lib/private/cache/fileglobal.php#15
May  9 14:59:40 owntest1 ownCloud[13274]: {PHP} mkdir(): File exists at /var/www/html/owncloud-enterprise/lib/private/cache/fileglobal.php#15
May  9 14:59:40 owntest1 ownCloud[13274]: {user_ldap} Setting entryuuid as ldapUuidUserAttribute
May  9 14:59:40 owntest1 ownCloud[13274]: {user_ldap} No DN found for df4dd136-fcb8-45a4-b13e-036cd34d2148 on ldaptest.XXX.ca
May  9 14:59:40 owntest1 ownCloud[13274]: {index} Doctrine\DBAL\DBALException: An exception occurred while executing '#012#011#011#011INSERT INTO "oc_ldap_user_mapping" ("ldap_dn", "owncloud_name", "directory_uuid")#012#011#011#011#011SELECT ?,?,?#012#011#011#011#011#012#011#011#011#011WHERE NOT EXISTS (#012#011#011#011#011#011SELECT 1#012#011#011#011#011#011FROM "oc_ldap_user_mapping"#012#011#011#011#011#011WHERE "ldap_dn" = ?#012#011#011#011#011#011#011OR "owncloud_name" = ?)#012#011#011':#012#012ORA-00923: FROM keyword not found where expected
May  9 14:59:41 owntest1 ownCloud[13272]: {PHP} mkdir(): File exists at /var/www/html/owncloud-enterprise/lib/private/cache/fileglobal.php#15
May  9 14:59:41 owntest1 ownCloud[13272]: {PHP} mkdir(): File exists at /var/www/html/owncloud-enterprise/lib/private/cache/fileglobal.php#15
May  9 14:59:41 owntest1 ownCloud[13272]: {PHP} file_put_contents(/tmp/owncloud-oc37871d9bc9/LDAP-user_ldap-s01-ef039b186a13396c9f089faac77d2488): failed to open stream: Permission denied at /var/www/html/owncloud-enterprise/lib/private/cache/fileglobal.php#36
May  9 15:00:01 owntest1 ownCloud[13382]: {user_ldap} Run background job "updateGroups"
May  9 15:00:01 owntest1 ownCloud[13382]: {user_ldap} getGroups getGroups---1-0
May  9 15:00:01 owntest1 ownCloud[13382]: {user_ldap} getGroups Filter (&(objectClass=groupOfNames)(cn=*))
May  9 15:00:13 owntest1 ownCloud[13382]: {user_ldap} Setting entryuuid as ldapUuidGroupAttribute
May  9 15:00:13 owntest1 ownCloud[13382]: {no app in context} Error while running background job: An exception occurred while executing '#012#011#011#011INSERT INTO "oc_ldap_group_mapping" ("ldap_dn", "owncloud_name", "directory_uuid")#012#011#011#011#011SELECT ?,?,?#012#011#011#011#011#012#011#011#011#011WHERE NOT EXISTS (#012#011#011#011#011#011SELECT 1#012#011#011#011#011#011FROM "oc_ldap_group_mapping"#012#011#011#011#011#011WHERE "ldap_dn" = ?#012#011#011#011#011#011#011OR "owncloud_name" = ?)#012#011#011':#012#012ORA-00923: FROM keyword not found where expected
May  9 15:14:41 owntest1 ownCloud[13271]: {PHP} mkdir(): File exists at /var/www/html/owncloud-enterprise/lib/private/cache/fileglobal.php#15
May  9 15:14:41 owntest1 ownCloud[13271]: {PHP} mkdir(): File exists at /var/www/html/owncloud-enterprise/lib/private/cache/fileglobal.php#15
May  9 15:14:41 owntest1 ownCloud[13271]: {PHP} file_put_contents(/tmp/owncloud-oc37871d9bc9/LDAP-user_ldap-s01-ef039b186a13396c9f089faac77d2488): failed to open stream: Permission denied at /var/www/html/owncloud-enterprise/lib/private/cache/fileglobal.php#36
May  9 15:15:01 owntest1 ownCloud[13414]: {user_ldap} Run background job "updateGroups"
May  9 15:15:01 owntest1 ownCloud[13414]: {user_ldap} getGroups getGroups---1-0
May  9 15:15:01 owntest1 ownCloud[13414]: {user_ldap} getGroups Filter (&(objectClass=groupOfNames)(cn=*))
May  9 15:15:11 owntest1 ownCloud[13414]: {user_ldap} Setting entryuuid as ldapUuidGroupAttribute
May  9 15:15:12 owntest1 ownCloud[13414]: {no app in context} Error while running background job: An exception occurred while executing '#012#011#011#011INSERT INTO "oc_ldap_group_mapping" ("ldap_dn", "owncloud_name", "directory_uuid")#012#011#011#011#011SELECT ?,?,?#012#011#011#011#011#012#011#011#011#011WHERE NOT EXISTS (#012#011#011#011#011#011SELECT 1#012#011#011#011#011#011FROM "oc_ldap_group_mapping"#012#011#011#011#011#011WHERE "ldap_dn" = ?#012#011#011#011#011#011#011OR "owncloud_name" = ?)#012#011#011':#012#012ORA-00923: FROM keyword not found where expected

[blizzz]

@ser72 which Charset and which LDAP server is used? Since following entry looks suspicious.

May  9 15:00:13 owntest1 ownCloud[13382]: {no app in context} Error while running background job: An exception occurred while executing '#012#011#011#011INSERT INTO "oc_ldap_group_mapping" ("ldap_dn", "owncloud_name", "directory_uuid")#012#011#011#011#011SELECT ?,?,?#012#011#011#011#011#012#011#011#011#011WHERE NOT EXISTS (#012#011#011#011#011#011SELECT 1#012#011#011#011#011#011FROM "oc_ldap_group_mapping"#012#011#011#011#011#011WHERE "ldap_dn" = ?#012#011#011#011#011#011#011OR "owncloud_name" = ?)#012#011#011':#012#012ORA-00923: FROM keyword not found where expected

What also looks strange is that there are errors about permission issues with the global file cache, e.g.

May  9 15:14:41 owntest1 ownCloud[13271]: {PHP} file_put_contents(/tmp/owncloud-oc37871d9bc9/LDAP-user_ldap-s01-ef039b186a13396c9f089faac77d2488): failed to open stream: Permission denied at /var/www/html/owncloud-enterprise/lib/private/cache/fileglobal.php#36

Could you check whether there are other users than the web user running ownCloud? Might also be a cron job running as different user.

[ser72]

@blizzz

1. Which Charset is being used?

If you are asking about Apache's config, it is set for the default UTF-8

2. What type of LDAP server are you using?

Openldap, but we also have an Active Directory server on campus, so I'm no sure why the decision was made to use openldap

3. Are there any other users running ownCloud other than the web user? ie do you have any >cron jobs running as a different user?

I set up the owncloud crontab entry to run as apache, so no.

[blizzz]

Charset on the OpenLDAP, or better question, are exclusively special characters used (other than base set of latin)?

Oh, personally i would choose OpenLDAP, too :)

Could you run ls -l /tmp/owncloud-oc37871d9bc9? Try it before and after trying, to see whether something is not as we expect.

Could you also post the LDAP configuration from the database (table oc_appconfig, appid = 'user_ldap')? Leave out the password row(s) :)

[blizzz]

Now i see similar behaviour on an UCS instance, which also runs PHP 5.3.3. I wonder whether this is to blame? Getting no log output, yet, but will do some debugging.

[blizzz]

Happens with 5.3.8 and 5.4, too, so not an incompatibility.

[blizzz]

stupid infinite loop under bad luck circumstances. The chance it happens with a not too small number of users (say, >15) is rather small, but I can happen.

[tps800]

Same here. About 2000 Users in LDAP, ~1000 Groups. Configuring LDAP using the wizard leads to an infinit spinning wheel on LDAP-Wizard second page. It is impossible to configure ldap to a working state, because reading the server to generate next configuration page for the wizard never finishes.

[blizzz]

@ser72 @Elethiomel @tps800 please test the solution in #8623

[ser72]

@blizzz Is this fix based off 6.0.3?

[blizzz]

current stable6, but compared to 6.0.3 there are no other changes in the affected files iirc

[blizzz]

P.S.: works for me directly patching against stock 6.0.3

[ser72]

@blizzz

Same problem, and when I accidentaly deleted the ldap configuration by hitting return on the webpage twice, I'm now no longer able to enter the information.

logs:

May 16 15:00:10 owntest1 ownCloud[26932]: {PHP} Class 'PHPUnit_Framework_TestCase' not found at /var/www/html/owncloud-enterprise/apps/user_ldap/lib/wizard.php#32
May 16 15:00:23 owntest1 ownCloud[26935]: {PHP} Class 'PHPUnit_Framework_TestCase' not found at /var/www/html/owncloud-enterprise/apps/user_ldap/lib/wizard.php#32
May 16 15:00:35 owntest1 ownCloud[26934]: {PHP} Class 'PHPUnit_Framework_TestCase' not found at /var/www/html/owncloud-enterprise/apps/user_ldap/lib/wizard.php#32
May 16 15:00:43 owntest1 ownCloud[26937]: {PHP} Class 'PHPUnit_Framework_TestCase' not found at /var/www/html/owncloud-enterprise/apps/user_ldap/lib/wizard.php#32
May 16 15:00:51 owntest1 ownCloud[26938]: {PHP} Class 'PHPUnit_Framework_TestCase' not found at /var/www/html/owncloud-enterprise/apps/user_ldap/lib/wizard.php#32
May 16 15:01:35 owntest1 ownCloud[27018]: {PHP} Class 'PHPUnit_Framework_TestCase' not found at /var/www/html/owncloud-enterprise/apps/user_ldap/lib/wizard.php#32
May 16 15:01:40 owntest1 ownCloud[27019]: {PHP} Class 'PHPUnit_Framework_TestCase' not found at /var/www/html/owncloud-enterprise/apps/user_ldap/lib/wizard.php#32
May 16 15:01:54 owntest1 ownCloud[27020]: {PHP} Class 'PHPUnit_Framework_TestCase' not found at /var/www/html/owncloud-enterprise/apps/user_ldap/lib/wizard.php#32
May 16 15:02:00 owntest1 ownCloud[27021]: {PHP} Class 'PHPUnit_Framework_TestCase' not found at /var/www/html/owncloud-enterprise/apps/user_ldap/lib/wizard.php#32
May 16 15:02:08 owntest1 ownCloud[27022]: {PHP} Class 'PHPUnit_Framework_TestCase' not found at /var/www/html/owncloud-enterprise/apps/user_ldap/lib/wizard.php#32

[blizzz]

@ser72 You copied the wizard.php from the tests (apps/user_ldap/tests/wizard.php
) directory into the lib ( apps/user_ldap/lib/wizard.php ) directory.

[ser72]

aha -- ok let me verify.

[ser72]

Same issue, spinning indicator on any of the ldap filter assists, users who should have access are unable to logon, receives the following error:

An exception occurred while executing ' INSERT INTO "oc_ldap_user_mapping" ("ldap_dn", "owncloud_name", "directory_uuid") SELECT ?,?,? WHERE NOT EXISTS ( SELECT 1 FROM "oc_ldap_user_mapping" WHERE "ldap_dn" = ? OR "owncloud_name" = ?) ': ORA-00923: FROM keyword not found where expected

Excerpt from logs, let me know if you want them all

May 20 14:53:58 owntest1 ownCloud[9449]: {PHP} ldap_search(): Partial search results returned: Sizelimit exceeded at /var/www/html/owncloud-enterprise/apps/user_ldap/lib/ldap.php#141
May 20 14:53:58 owntest1 ownCloud[9449]: {user_ldap} LDAP error Size limit exceeded (4) after calling ldap_search
May 20 14:53:58 owntest1 ownCloud[9449]: {user_ldap} LDAP error Size limit exceeded (4) after calling ldap_count_entries
May 20 14:54:36 owntest1 ownCloud[9447]: {user_ldap} Setting entryuuid as ldapUuidUserAttribute
May 20 14:54:36 owntest1 ownCloud[9447]: {user_ldap} No DN found for df4dd136-fcb8-45a4-b13e-036cd34d2148 on ldaptest.usask.ca
May 20 14:54:36 owntest1 ownCloud[9447]: {index} Doctrine\DBAL\DBALException: An exception occurred while executing '#012#011#011#011INSERT INTO "oc_ldap_user_mapping" ("ldap_dn", "owncloud_name", "directory_uuid")#012#011#011#011#011SELECT ?,?,?#012#011#011#011#011#012#011#011#011#011WHERE NOT EXISTS (#012#011#011#011#011#011SELECT 1#012#011#011#011#011#011FROM "oc_ldap_user_mapping"#012#011#011#011#011#011WHERE "ldap_dn" = ?#012#011#011#011#011#011#011OR "owncloud_name" = ?)#012#011#011':#012#012ORA-00923: FROM keyword not found where expected

[blizzz]

Can you post the contents of database table oc_ldap_user_mapping and your LDAP configuration? (table oc_appconfig, appid = 'user_ldap')?

[ser72]

@blizzz

Data on S3 under:

Support\customer-tickets-history\LDAP WIZARD\LDAP_INFO.txt

[blizzz]

@ser72 it looks a bit messed up…

An exception occurred while executing ' INSERT INTO "oc_ldap_user_mapping" ("ldap_dn", "owncloud_name", "directory_uuid") SELECT ?,?,? WHERE NOT EXISTS ( SELECT 1 FROM "oc_ldap_user_mapping" WHERE "ldap_dn" = ? OR "owncloud_name" = ?) ': ORA-00923: FROM keyword not found where expected

does not happen in the LDAP Wizard. I.e. inserting into 'oc_ldap_user_mapping' does not happen in this stage. It smells like a different issue. That's also why I asked for the oc_ldap_user_mapping table. Probably a small set of it will do.

I reproduced the other error messages about partial results or size exceeding, and will have a closer look on why they occur, but they do not any harm to me. Well, for size exceeding i actually have an explanation, and this would be nothing to worry about.

So, why is the wizard still hanging for you? Since your attempts, i assume the web server has been restarted? Because that's required as the infinite loop causes the server to use 100% CPU.

[ser72]

@blizzz My understanding is as you state, apache is restarted when it hangs otherwise it causes 100% cpu.

[blizzz]

Ah, no, Apache needs to be restarted manually.

[ser72]

@blizzz Yes -- my bad for the misunderstanding. The user has told me that apache is restarted (manually) when the CPU hits 100%

[ser72]

@blizzz

1. Please provide about 10-15 lines from the oc_ldap_users_mapping table

the "oc_ldap_user_mapping" table is empty.

2. Run the following test
   Delete LDAP config
   Clear owncloud.log (mv owncloud.log owncloud_old.log)
   reconfigure LDAP
   Supply all owncloud.log to me for analysis

I've deleted and filled in all the options again, but configuration is marked as incomplete.

In the past when I tried deleting/reconfigured, after restarting httpd the the configuration would be marked as complete and test configuration was sucessful.

[blizzz]

@ser72

reg 1) how can there be an error message complaining on a duplicate row while the table is empty? does not make sense at all.

reg 2) odd, i have not seen this. Does it happen always for you? Could you open a new issue for this? Thank you.

The other thing is that since you completed it, the Wizard does not hang anymore, does it?

[ser72]

@blizzz

The wizard still hangs.

And yes agree with your theory on 1). Odd...

Would you like a screen share???

[blizzz]

Yes, if possible tomorrow. I am off the rest of the week and on the meeting the whole next week (might nevertheless be possible, though not ideal).

[ser72]

@blizzz She is on the west coast. Just emailed asking if she is free this morning (her time)...

WIll let you know

[ser72]

@blizzz Patch was applied. Same issues exist.

Please work with @cdamken on this issue after your holiday as I am on vacation for the next week.

[blizzz]

@ser72 @cdamken details? Logs?

[ser72]

All I currently have is:

"I'm now able to see the ldap configuration, but still am having the
same problems:

• user unable to log on
• spinning wheels ldap wizard"

Requested logs.

[karlitschek]

Guys. What about getting on the phone and debugging this together? :-)

[blizzz]

We did it, which was useful so the latest patch could be done.

[PVince81]

So... where is the patch ? 😄

[blizzz]

@ser72 do you remember what the state was here?

[ser72]

@blizzz Looking back at the case, it seems this was fixed in 6.0.4 and the customer was all set.

[blizzz]

Very well. I close this issue then.