rc.1 external OIDC+LDAP setup, error on new user first login #5045

NexZhu · 2022-11-13T13:56:23Z

Describe the bug

I'm testing rc.1 with external OIDC+LDAP setup, when a new user try to login, /ocs/v1.php/cloud/user returned 500 error.

proxy service error log:

2022-11-13T13:51:24Z ERR Could not add default role error="{\"id\":\"ocis-settings\",\"code\":403,\"detail\":\"user has no role management permission\",\"status\":\"Forbidden\"}" service=proxy
2022-11-13T13:51:24Z ERR Could not get user by claim error="{\"id\":\"ocis-settings\",\"code\":403,\"detail\":\"user has no role management permission\",\"status\":\"Forbidden\"}" service=proxy

Seems like a bug, user shouldn't need a role management permission to be assigned the default role.

(The one user set in the helm chart adminUUID option can login as the admin role)

The text was updated successfully, but these errors were encountered:

NexZhu · 2022-11-13T14:11:22Z

Another problem which may be related. When I logined as the adminUUID user and go to User management, there is no group in the beginning, when I tried to create a group, the request ·/graph/v1.0/groups· returned 500 error:

{"error":{"code":"generalException","innererror":{"date":"2022-11-13T14:03:52Z","request-id":"78fac6ae-09f0-4ef4-824f-30aba4a7442b"},"message":"notSupported"}}

graph service error log:

2022-11-13T14:05:12Z DBG No roles in context, contacting settings service service=graph userid=xxx
2022-11-13T14:05:12Z INF calling post group request-id=84de7a53-2eba-4988-88b9-01cba452b8c8 service=graph
2022-11-13T14:05:12Z DBG could not create group: backend error group=null request-id=84de7a53-2eba-4988-88b9-01cba452b8c8 service=graph
2022-11-13T14:05:12Z DBG bytes=160 duration=16.86968 method=POST path=/graph/v1.0/groups proto=HTTP/1.1 request-id=84de7a53-2eba-4988-88b9-01cba452b8c8 service=graph status=500

wkloucek · 2022-11-15T13:08:06Z

I can confirm this happening on https://ocis.ocis-ldap.latest.owncloud.works.

If I add an user via the LDAP UI (not oC Web), the user can't log in because it doesn't get a default role.

If I login as the admin users, I can list all users in the oC Web accounts management UI but can't change any user roles.

wkloucek · 2022-11-15T13:10:40Z

probably introduce in #4890

ScharfViktor · 2022-11-15T19:55:10Z

If I login as the admin users, I can list all users in the oC Web accounts management UI but can't change any user roles.

should be GRAPH_LDAP_SERVER_WRITE_ENABLED false? when I tried to create users via webUI I got 500 error with message: "server is configured read-only". https://github.com/owncloud/ocis/blob/master/deployments/examples/ocis_ldap/docker-compose.yml#L75

After starting ocis_ldap with GRAPH_LDAP_SERVER_WRITE_ENABLED: "true" I could create users or groups.

NexZhu · 2022-11-16T03:35:30Z

But admin user cannot see users from external LDAP, cannot assign their roles either. Without a default role, they cannot login.

wkloucek · 2022-11-16T07:55:48Z

After starting ocis_ldap with GRAPH_LDAP_SERVER_WRITE_ENABLED: "true" I could create users or groups.

If you're using graph to provision users they will immediately have a role assigned. So you must do it via the external ldap (so that the user is just there)

NexZhu · 2022-11-16T08:08:46Z

After starting ocis_ldap with GRAPH_LDAP_SERVER_WRITE_ENABLED: "true" I could create users or groups.

If you're using graph to provision users they will immediately have a role assigned. So you must do it via the external ldap (so that the user is just there)

How to assign roles to users in the external LDAP? What's the role attribute read by OCIS? Is there any docs about the OCIS LDAP schema?

I thought OCIS will insert user data into its own database after checking external LDAP, and I can assign roles to users in OCIS after that. And I got the impression from: #4150 (comment) , that external users will get the default user assigned when loggin in for the first time. Please correct me if I was wrong.

When using an external user management we need to allow users to self-assign the default role. This adds an explicit check for that to the settings service. This also means we no longer need to fiddle with the account id in the proxy upon first login. Fixes: owncloud#5045

rhafer · 2022-11-17T09:56:37Z

But admin user cannot see users from external LDAP, cannot assign their roles either. Without a default role, they cannot login.

Actually exactly that should be possible. The user with the id matching adminUUID should be able to list the existing users from the external LDAP server in the ocis user-management. It should also be able to set the roles of those users in there. (Editing any other user attribute will not work however). If that doesn't work in your setup then there still seems to be something wrong in your setup. Can you share values.yaml (or any other means how you applied your overrides for the helm chart)?

What's the role attribute read by OCIS? Is there any docs about the OCIS LDAP schema?

When using an external LDAP server we don't require a specific schema. The roles and the role assignments are never, regardless for external or internal LDAP) stored in LDAP. We use a dedicated service for that which stores the data in the metadata storage.

I thought OCIS will insert user data into its own database after checking external LDAP, and I can assign roles to users in OCIS after that.

OCIS does currently not maintain it's own database when an external LDAP server is used. If correctly setup you should be able to assign roles even before the first login (see above).

And I got the impression from: #4150 (comment) , that external users will get the default user assigned when loggin in for the first time. Please correct me if I was wrong.

You are right. But there was a bug in rc1 that prevented that from working. It should be fixed once #5065 is merged.

hth

NexZhu · 2022-11-17T10:07:15Z

Actually exactly that should be possible. The user with the id matching adminUUID should be able to list the existing users from the external LDAP server in the ocis user-management. It should also be able to set the roles of those users in there.
If correctly setup you should be able to assign roles even before the first login (see above).

Wait, how does OCIS list the existing users from the external LDAP before they login for the first time? Will OCIS search with LDAP filter and get all the matching users from external LDAP?

My user management is empty, I though it's normal because they had not logged in yet, but they cannot login without the default role, causing circular dependencies. #5065 should solve this situation.

rhafer · 2022-11-17T10:46:40Z

Wait, how does OCIS list the existing users from the external LDAP before they login for the first time? Will OCIS search with LDAP filter and get all the matching users from external LDAP?

Exactly. If you don't see them it might be a configuration issue. (That's why I asked for your helm config)

NexZhu · 2022-11-17T12:47:45Z

My values.yaml: (I've search-and-replaced the urls and deleted some obviously inrrelavent parts)

# -- Domain where oCIS is reachable for the outside world
externalDomain: owncloud.example.com

# Feature options.
# Enable or disable features of oCIS.
features:
  # -- Enable basic authentication.
  # Not recommended for production installations.
  # basicAuthentication: false
  # -- Create demo users on the first startup.
  # Not recommended for production installations.
  # demoUsers: false
  # External user management
  externalUserManagement:
    # -- Enables external user management (and disables internal user management).
    # Needs an external OpenID Connect Identity Provider and an external LDAP server.
    # Need to set it to `false` temporarily so I can login as the initial admin account for the first time
    # See: https://github.com/owncloud/ocis/issues/4150
    # Also `PROXY_AUTOPROVISION_ACCOUNTS` must be set to `true` to automatically provision users that do not yet exist in the users service on-demand upon first sign-in.
    enabled: true #false
    # -- UUID of the initial admin user.
    # If the given value matches a user's value from `features.externalUserManagement.oidc.userIDClaim`, the admin role will be assigned.
    adminUUID: admin
    # OpenID Connect Identity provider related settings.
    oidc:
      # -- Issuer URI of the OpenID Connect Identity Provider.
      # If the IDP doesn't have valid / trusted SSL certificates, certificate validation can be disabled with the `insecure.oidcIdpInsecure` option.
      issuerURI: https://auth.example.com

      # -- Claim to take an unique user identifier from. It will be used to look up the user on the LDAP server.
      userIDClaim: "preferred_username" # "sub"
      # -- Attribute mapping of for the userIDClaim.
      # Set to `userid` if the claim specified in `...oidc.userIDClaim` holds the value of the ldap user attribute specified in `...ldap.user.schema.id`.
      # Set to `mail` if the claim specified in `...oidc.userIDClaim` holds the value of the ldap user attribute specified in  `...ldap.user.schema.mail`.
      # Set to `username` if the claim specified in `...oidc.userIDClaim` holds the value of the ldap user attribute specified in `...ldap.user.schema.id`.
      userIDClaimAttributeMapping: userid

    # LDAP related settings.
    ldap:
      # -- URI to connect to the LDAP secure server.
      uri: ldaps://ldap.example.com
      # -- Set only to false, if the certificate of your LDAP secure service is not trusted.
      # If set to false, you need to put the CA cert of the LDAP secure server into the secret referenced by "ldapCaRef"
      # certTrusted: true
      # -- Disables SSL certificate checking for connections to the LDAP server.
      # -- For self signed certificates, consider to put the CA cert of the LDAP secure server into the secret referenced by "ldapCaRef"
      # Not recommended for production installations.
      # insecure: false
      # -- DN of the user to use to bind to the LDAP server.
      # The password for the user needs to be set in the secret referenced by `secretRefs.ldapSecretRef` as `reva-ldap-bind-password`.
      # The user needs to have permission to list users and groups.
      bindDN: uid=owncloud,ou=people,dc=example,dc=com
      user:
        schema:
          # -- LDAP Attribute to use as the unique id for users. This should be a stable globally unique id like a UUID.
          id: uid
          # -- Set this to true if the defined `id` attribute for users is of the `OCTETSTRING` syntax. This is e.g. required when using the `objectGUID` attribute of Active Directory for the user ID`s.
          idIsOctetString: false
          # -- LDAP Attribute to use for the email address of users.
          mail: mail
          # -- LDAP Attribute to use for the displayname of users.
          displayName: cn
          # -- LDAP Attribute to use for username of users.
          userName: uid
        # -- Search base DN for looking up LDAP users.
        baseDN: ou=people,dc=example,dc=com
        # -- LDAP search scope to use when looking up users. Supported values are `base`, `one` and `sub`.
        scope: sub
        # -- Type of substring search filter to use for substring searches for users. Possible values: `initial` for doing prefix only searches, `final` for doing suffix only searches or `any` for doing full substring searches
        substringFilterType: any
        # -- LDAP filter to add to the default filters for user search like `(objectclass=ownCloud)`.
        # filter:
        # -- The object class to use for users in the default user search filter like `inetOrgPerson`.
        objectClass: inetOrgPerson
      group:
        schema:
          # -- LDAP Attribute to use as the unique ID for groups. This should be a stable globally unique ID like a UUID.
          id: cn
          # -- Set this to true if the defined `id` attribute for groups is of the `OCTETSTRING` syntax. This is e.g. required when using the `objectGUID` attribute of Active Directory for the group ID`s.
          idIsOctetString: false
          # -- LDAP Attribute to use for the email address of groups (can be empty).
          mail: mail
          # -- LDAP Attribute to use for the displayname of groups (often the same as groupname attribute).
          displayName: description
          # -- LDAP Attribute to use for the name of groups.
          groupName: cn
          # -- LDAP Attribute that is used for group members.
          member: member
        # -- Search base DN for looking up LDAP groups.
        baseDN: ou=groups,dc=example,dc=com
        # -- LDAP search scope to use when looking up groups. Supported values are `base`, `one` and `sub`.
        scope: sub
        # -- LDAP filter to add to the default filters for group searches.
        filter:
        # -- The object class to use for groups in the default group search filter like `groupOfNames`.
        objectClass: groupOfNames

# per-service configuration.
services:

  # STORAGE-SYSTEM service.
  storageSystem:
    persistence:
      # -- Enables persistence.
      # Needs to be enabled on production installations.
      # If not enabled, pod restarts will lead to data loss.
      # Also scaling this service beyond one instance is not possible if the service instances don't share the same storage.
      enabled: true
      # -- Enables a initContainer to chown the volume.
      # The initContainer is run as root.
      # This is not needed if the driver applies the fsGroup from the securityContext.
      chownInitContainer: true #false
      # -- Storage class to use.
      # Uses the default storage class if not set.
      # Aliyun CNFS NAS doesn't support `xattrs` which is required
      # See: https://github.com/owncloud/ocis/issues/4961#issuecomment-1301994318
      # storageClassName: alibabacloud-cnfs-nas
      storageClassName: alicloud-disk-topology
      # -- Persistent volume access modes. Needs to be `["ReadWriteMany"]` when scaling this service beyond one instance.
      accessModes:
        - ReadWriteMany
      # -- Size of the persistent volume.
      size: 20Gi # Require at least 20Gi
      # -- Persistent volume annotations.
      annotations: {
        "helm.sh/resource-policy": keep
      }
      # # -- Persistent volume finalizers.
      # finalizers:
      #   - kubernetes.io/pvc-protection
      # # -- Persistent volume selector labels.
      # selectorLabels: {}
      # # -- Use an existing PersistentVolumeClaim for persistence.
      # existingClaim:

  # STORAGE-USERS service.
  storageUsers:
    storageBackend:
      # -- Configures the storage driver. Possible values are "ocis" and "s3ng".
      # The oCIS driver stores all data in the persistent volume if persistence is enabled.
      # The S3NG driver stores all metadata in the persistent volume and uploads blobs to s3 if persistence is enabled.
      driver: s3ng
      driverConfig:
        s3ng:
          # https://blog.csdn.net/wwwwwwgame/article/details/120896339
          # https://developer.aliyun.com/ask/321872?spm=a2c6h.13706215.ask-content.15.46086d124SyO7e
          # -- S3 endpoint to use for the S3NG driver. Only used if driver is set to "s3ng".
          # Use "https" to workaround Aliyun incompatibility error: Aws MultiChunkedEncoding is not supported, see:
          endpoint: https://oss-cn-zhangjiakou-internal.aliyuncs.com
          # -- S3 region to use for the S3NG driver. Only used if driver is set to "s3ng".
          region: oss-cn-zhangjiakou
          # -- S3 bucket to use for the S3NG driver. Only used if driver is set to "s3ng".
          bucket: fusiongalaxy-owncloud
          # -- S3 access key to use for the S3NG driver. Only used if driver is set to "s3ng".
          # accessKey: lorem-ipsum # From .secret-values.yml
          # -- S3 secret key to use for the S3NG driver. Only used if driver is set to "s3ng".
          # secretKey: lorem-ipsum # From .secret-values.yml
    maintenance:
      # Expired uploads can be cleaned up automatically by enabling the clean up job.
      cleanUpExpiredUploads:
        # -- Enables a job, that cleans up expired uploads. Requires persistence to be enabled and RWX storage.
        enabled: true
        # -- Cron pattern for the job to be run. Defaults to every minute.
        # schedule: "* * * * *"
    persistence:
      # -- Enables persistence.
      # Needs to be enabled on production installations.
      # If not enabled, pod restarts will lead to data loss.
      # Also scaling this service beyond one instance is not possible if the service instances don't share the same storage.
      enabled: true
      # # -- Enables a initContainer to chown the volume.
      # # The initContainer is run as root.
      # # This is not needed if the driver applies the fsGroup from the securityContext.
      chownInitContainer: true #false
      # # -- Storage class to use.
      # # Uses the default storage class if not set.
      # storageClassName: alibabacloud-cnfs-nas
      storageClassName: alicloud-disk-topology
      # # -- Persistent volume access modes. Needs to be `["ReadWriteMany"]` when scaling this service beyond one instance.
      # accessModes:
      #   - ReadWriteMany
      # # -- Size of the persistent volume.
      size: 100Gi
      # -- Persistent volume annotations.
      annotations: {
        "helm.sh/resource-policy": keep
      }
      # # -- Persistent volume finalizers.
      # finalizers:
      #   - kubernetes.io/pvc-protection
      # # -- Persistent volume selector labels.
      # selectorLabels: {}
      # # -- Use an existing PersistentVolumeClaim for persistence.
      # existingClaim:

  # store service.
  store:
    persistence:
      # -- Enables persistence.
      # Needs to be enabled on production installations.
      # If not enabled, pod restarts will lead to data loss.
      # Also scaling this service beyond one instance is not possible if the service instances don't share the same storage.
      enabled: true
      # -- Enables a initContainer to chown the volume.
      # The initContainer is run as root.
      # This is not needed if the driver applies the fsGroup from the securityContext.
      chownInitContainer: true #false
      # -- Storage class to use.
      # Uses the default storage class if not set.
      # storageClassName: alibabacloud-cnfs-nas
      storageClassName: alicloud-disk-topology # Require at least 20Gi
      # -- Persistent volume access modes. Needs to be `["ReadWriteMany"]` when scaling this service beyond one instance.
      # accessModes:
      #   - ReadWriteMany
      # -- Size of the persistent volume.
      size: 20Gi
      # -- Persistent volume annotations.
      annotations: {
        "helm.sh/resource-policy": keep
      }
      # # -- Persistent volume finalizers.
      # finalizers:
      #   - kubernetes.io/pvc-protection
      # # -- Persistent volume selector labels.
      # selectorLabels: {}
      # # -- Use an existing PersistentVolumeClaim for persistence.
      # existingClaim:

  # IDM service.
  idm:
    persistence:
      # -- Enables persistence.
      # Needs to be enabled on production installations.
      # If not enabled, pod restarts will lead to data loss.
      # Also scaling this service beyond one instance is not possible if the service instances don't share the same storage.
      enabled: true
      # -- Enables a initContainer to chown the volume.
      # The initContainer is run as root.
      # This is not needed if the driver applies the fsGroup from the securityContext.
      chownInitContainer: true #false
      # -- Storage class to use.
      # Uses the default storage class if not set.
      # storageClassName: alibabacloud-cnfs-nas
      storageClassName: alicloud-disk-topology
      # -- Persistent volume access modes. Needs to be `["ReadWriteMany"]` when scaling this service beyond one instance.
      # accessModes:
      #   - ReadWriteMany
      # -- Size of the persistent volume.
      size: 20Gi
      # -- Persistent volume annotations.
      annotations: {
        "helm.sh/resource-policy": keep
      }
      # # -- Persistent volume finalizers.
      # finalizers:
      #   - kubernetes.io/pvc-protection
      # # -- Persistent volume selector labels.
      # selectorLabels: {}
      # # -- Use an existing PersistentVolumeClaim for persistence.
      # existingClaim:

commonEnvOverride:
  ACCOUNTS_DEMO_USERS_AND_GROUPS: false
  # TODO: remove OCIS_URL in favor of NOTIFICATIONS_WEB_UI_URL
  #   after https://github.com/owncloud/ocis/pull/4998 was released
  OCIS_URL: https://owncloud.example.com
  NOTIFICATIONS_WEB_UI_URL: https://owncloud.example.com
  # OIDC
  ## PROXY_OIDC_ISSUER: https://auth.example.com
  ## WEB_OIDC_AUTHORITY: https://auth.example.com
  WEB_OIDC_CLIENT_ID: owncloud
  # WEB_OIDC_METADATA_URL: https://auth.example.com/.well-known/openid-configuration
  ## STORAGE_OIDC_ISSUER: https://auth.example.com
  # Need this because Authelia doesn't issue JWT based access tokens
  # See: https://github.com/owncloud/ocis/issues/4895#issuecomment-1293136653
  PROXY_OIDC_ACCESS_TOKEN_VERIFY_METHOD: none
  # Set this to 'true' to automatically provision users that do not yet exist in the users service on-demand upon first sign-in.
  # Need for external LDAP to work?
  # PROXY_AUTOPROVISION_ACCOUNTS: true
  # GRAPH_LDAP_SERVER_WRITE_ENABLED: true
  # STORAGE_LDAP_IDP: https://ldap.example.com
  # Defaults to `OCIS_URL`, causing problem when oCIS pod request itself
  # because of `externalTrafficPolicy`=`Local`
  STORAGE_FRONTEND_PUBLIC_URL: http://proxy:9200
  # STORAGE_FRONTEND_PUBLIC_URL: http://localhost:9200
  STORAGE_HOME_DRIVER: s3ng # This doesn't seems useful: https://github.com/search?q=org%3Aowncloud+%22storage_home_driver%22&type=code
  # STORAGE_METADATA_DRIVER: ocis # keep metadata on ocis storage since this are only small files atm
  # App registry
  # STORAGE_APP_REGISTRY_MIMETYPES_JSON: /config/mimetypes.json
  # Theme
  # WEB_UI_THEME_SERVER: https://public.example.com
  # WEB_UI_THEME_PATH: /internal/ocis-theme.json

individual-it · 2022-11-18T09:14:48Z

maybe related to #5085 & owncloud/web#7986

NexZhu · 2022-11-18T09:56:40Z

OpenLDAP logs printed when I clicked User management:

openldap  | 63775677 conn=1615 op=19226 SRCH base="ou=people,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=inetOrgPerson)(uid=admin))"
openldap  | 63775677 conn=1615 op=19226 SRCH attr=cn uid mail uid uidNumber gidNumber
openldap  | 63775677 conn=1615 op=19226 SEARCH RESULT tag=101 err=0 nentries=1 text=
openldap  | 63775677 conn=1615 op=19227 SRCH base="ou=groups,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=groupOfNames)(member=uid=admin,ou=people,dc=example,dc=com))"
openldap  | 63775677 conn=1615 op=19227 SRCH attr=cn
openldap  | 63775677 <= mdb_equality_candidates: (member) not indexed
openldap  | 63775677 conn=1615 op=19227 SEARCH RESULT tag=101 err=0 nentries=7 text=
openldap  | 63775677 conn=1615 op=19228 SRCH base="ou=people,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=inetOrgPerson)(|(?=undefined)(?=undefined)(?=undefined)(?uid=)))"
openldap  | 63775677 conn=1615 op=19228 SRCH attr=uid uid mail cn uidNumber gidNumber
openldap  | 63775677 conn=1615 op=19228 SEARCH RESULT tag=101 err=0 nentries=0 text=
openldap  | 63775677 conn=1615 op=19229 SRCH base="ou=people,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=inetOrgPerson)(uid=admin))"
openldap  | 63775677 conn=1615 op=19229 SRCH attr=cn uid mail uid uidNumber gidNumber
openldap  | 63775677 conn=1615 op=19229 SEARCH RESULT tag=101 err=0 nentries=1 text=
openldap  | 63775677 conn=1615 op=19230 SRCH base="ou=groups,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=groupOfNames)(member=uid=admin,ou=people,dc=example,dc=com))"
openldap  | 63775677 conn=1615 op=19230 SRCH attr=cn
openldap  | 63775677 <= mdb_equality_candidates: (member) not indexed
openldap  | 63775677 conn=1615 op=19230 SEARCH RESULT tag=101 err=0 nentries=7 text=
openldap  | 63775677 conn=1616 op=8 SRCH base="ou=groups,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=groupOfNames)(|(?=undefined)(?=undefined)(?=undefined)(?cn=)))"
openldap  | 63775677 conn=1616 op=8 SRCH attr=description cn mail cn gidNumber
openldap  | 63775677 conn=1616 op=8 SEARCH RESULT tag=101 err=0 nentries=0 text=
openldap  | 63775677 conn=1615 op=19231 SRCH base="ou=people,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=inetOrgPerson)(uid=admin))"
openldap  | 63775677 conn=1615 op=19231 SRCH attr=cn uid mail uid uidNumber gidNumber
openldap  | 63775677 conn=1615 op=19231 SEARCH RESULT tag=101 err=0 nentries=1 text=
openldap  | 63775677 conn=1615 op=19232 SRCH base="ou=groups,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=groupOfNames)(member=uid=admin,ou=people,dc=example,dc=com))"
openldap  | 63775677 conn=1615 op=19232 SRCH attr=cn
openldap  | 63775677 <= mdb_equality_candidates: (member) not indexed
openldap  | 63775677 conn=1615 op=19232 SEARCH RESULT tag=101 err=0 nentries=7 text=

These two queries seems to be problematic and are finding 0 result:

openldap  | 63775677 conn=1615 op=19228 SRCH base="ou=people,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=inetOrgPerson)(|(?=undefined)(?=undefined)(?=undefined)(?uid=)))"
openldap  | 63775677 conn=1615 op=19228 SRCH attr=uid uid mail cn uidNumber gidNumber
openldap  | 63775677 conn=1615 op=19228 SEARCH RESULT tag=101 err=0 nentries=0 text=

openldap  | 63775677 conn=1616 op=8 SRCH base="ou=groups,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=groupOfNames)(|(?=undefined)(?=undefined)(?=undefined)(?cn=)))"
openldap  | 63775677 conn=1616 op=8 SRCH attr=description cn mail cn gidNumber
openldap  | 63775677 conn=1616 op=8 SEARCH RESULT tag=101 err=0 nentries=0 text=

xoxys · 2022-11-21T12:10:22Z

@rhafer @micbar What about the "If I login as the admin users, I can list all users in the oC Web accounts management UI but can't change any user roles." part? Was that fixed in the linked PR as well?

micbar · 2022-11-21T12:31:59Z

Should be, yes. Needs re testing in the next qa cycle.

ScharfViktor · 2022-11-21T13:36:50Z

re-tested.

admin creates new user via ldap (user is without role)
user can login in ocis - fixed
admin cannot edit the user role in User management oC Web. he get 500 with message: "server is configured read-only" - still relevant

xoxys · 2022-11-21T13:39:11Z

Thanks. Should I create a new issue or re-open this one?

micbar · 2022-11-21T13:49:18Z

admin cannot edit the user role in User management oC Web. he get 500 with message: "server is configured read-only" - still relevant

Hmm, this is on a different level. IdK where this error message comes from. Needs investigation. I only see this error in the LDAP code, but assigning a role to a user is not an LDAP operation.

micbar · 2022-11-21T13:49:42Z

@ScharfViktor Which request shows this error message?

micbar · 2022-11-21T13:57:23Z

Found it:

curl 'https://ocis.ocis-ldap.latest.owncloud.works/graph/v1.0/users/4c510ada-c86b-4815-8820-42cdf82c3d51' \
  -X 'PATCH' \
  -H 'authority: ocis.ocis-ldap.latest.owncloud.works' \
  -H 'accept: application/json, text/plain, */*' \
  -H 'accept-language: de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7' \
  -H 'authorization: Bearer eyJhbGciOiJQUzI1NiIsImtpZCI6InByaXZhdGUta2V5IiwidHlwIjoiSldUIn0.eyJhdWQiOiJ3ZWIiLCJleHAiOjE2NjkxMjAxMzIsImp0aSI6InNxMzdVbEhZUm1pTGJiRGdENV9seDJNQjdKSFR4Q1lGIiwiaWF0IjoxNjY5MDMzNzMyLCJpc3MiOiJodHRwczovL29jaXMub2Npcy1sZGFwLmxhdGVzdC5vd25jbG91ZC53b3JrcyIsInN1YiI6InpEUUxQRnlWU3BfWW1Zb1RAOHk1Wk5makZld3NnRGp1OXIxZFBCTDJhQl9QWmF2X0hzd19XV1c4U0w4OFpSbjljcXJBOUtMdmpPXy1EeVdiTTFuRHh6QSIsImxnLnQiOiIxIiwic2NwIjoib3BlbmlkIHByb2ZpbGUgZW1haWwiLCJsZy5pIjp7ImRuIjoiQWRtaW4iLCJpZCI6InVpZD1hZG1pbixvdT11c2VycyxkYz1vd25jbG91ZCxkYz1jb20iLCJ1biI6ImFkbWluIn0sImxnLnAiOiJpZGVudGlmaWVyLWxkYXAifQ.TdrxcoerB_fCcvcglOrezsKKy_zcnB3-ZxT3Qb2Jh2lCzbcZ6YMj37BlOVC5iNpnB5MIuGa9lfzgoiaQ405q-5ge9StwxZ3cyi9PGq9dR804OndaRoS8FGMbAuse02Y6g-lGHMnneRooBZvytxJ1GmCn6iCX-r4k6Q1uyo6rFTIntQ7FupHWzMXM6ena2mDkw_g5iq1_tUT1LFHUT3PE6g6XxRNYTrsp-DLrbG7g2OO9Q4VGwrzPJCPCKEKp5KYP3tcKQbutGEX2TlHL1m0oE9MYndP6krVbGgNQ3D042RvYik3BC-lpv6WlX--XmRdP9kMf0vzbxy6ZRWfpvV5AT-M0xHXLWjfTlj8BvKFKrBci-gV5mhvjTT_fNpdXjemSQWVwDvwQ1hkjh12kB56Ec3Zp3e44q9VKpwdhWgdEF1BQHQMX3AVU4wrIl3oLb-d_amQYkCo9UBdicGvU4HnjK_zQKLzRC_tlWAVGT5l46CUcy0g-VGqUYtzvNxe1Xf10LUbOfR-s73ubUZf45Z98MxRuDlqsNNUFG3nrwbe2u1sOzKffOZEC1KM6guEAOia_tE02rz7vv8RWj1734lHTOBBrsVSXsGSpwbDVjnkBWrBz8mLTnnlr5dVUcN22SyyDjO9Pt9yQmpOtc4PRdRjQn2sEQdg9uru0JB4Cuh7iTs0' \
  -H 'content-type: application/x-www-form-urlencoded' \
  -H 'origin: https://ocis.ocis-ldap.latest.owncloud.works' \
  -H 'referer: https://ocis.ocis-ldap.latest.owncloud.works/user-management/users' \
  -H 'sec-ch-ua: "Google Chrome";v="107", "Chromium";v="107", "Not=A?Brand";v="24"' \
  -H 'sec-ch-ua-mobile: ?0' \
  -H 'sec-ch-ua-platform: "macOS"' \
  -H 'sec-fetch-dest: empty' \
  -H 'sec-fetch-mode: cors' \
  -H 'sec-fetch-site: same-origin' \
  -H 'user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36' \
  -H 'x-request-id: 2b0c3c33-46db-4635-9ead-83990c3a49fa' \
  -H 'x-requested-with: XMLHttpRequest' \
  --data-raw '{"displayName":"Albert Einstein","id":"4c510ada-c86b-4815-8820-42cdf82c3d51","mail":"einstein@example.org","onPremisesSamAccountName":"einstein","memberOf":[],"passwordProfile":{"password":""}}' \
  --compressed

This is weird. Why do we use the GraphAPI for Role Assignments? @kulmann @janackermann I thought we need to use the settings API for that purpose

ScharfViktor · 2022-11-21T14:32:56Z

@ScharfViktor Which request shows this error message?
PATCH request.

Role assignment works. Sorry for the confusion.
I assigned the user role through the api

curl --location --request POST 'https://ocis.owncloud.test/api/v0/settings/assignments-add' \
--data-raw '{"account_uuid": "dbc3dadf-5bc9-4b9d-9205-ea0bfa5bca8c", "role_id": "d7beeea8-8ff4-406b-8fb6-ab2dd81e6b11"}'

the PATCH request remains to be solved

NexZhu · 2022-11-21T14:49:29Z

These two queries seems to be problematic and are finding 0 result:

openldap  | 63775677 conn=1615 op=19228 SRCH base="ou=people,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=inetOrgPerson)(|(?=undefined)(?=undefined)(?=undefined)(?uid=)))"
openldap  | 63775677 conn=1615 op=19228 SRCH attr=uid uid mail cn uidNumber gidNumber
openldap  | 63775677 conn=1615 op=19228 SEARCH RESULT tag=101 err=0 nentries=0 text=

openldap  | 63775677 conn=1616 op=8 SRCH base="ou=groups,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=groupOfNames)(|(?=undefined)(?=undefined)(?=undefined)(?cn=)))"
openldap  | 63775677 conn=1616 op=8 SRCH attr=description cn mail cn gidNumber
openldap  | 63775677 conn=1616 op=8 SEARCH RESULT tag=101 err=0 nentries=0 text=

@micbar User management failing to list any external LDAP users is not solved yet.

micbar · 2022-11-21T15:41:56Z

These two queries seems to be problematic and are finding 0 result:

openldap  | 63775677 conn=1615 op=19228 SRCH base="ou=people,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=inetOrgPerson)(|(?=undefined)(?=undefined)(?=undefined)(?uid=)))"
openldap  | 63775677 conn=1615 op=19228 SRCH attr=uid uid mail cn uidNumber gidNumber
openldap  | 63775677 conn=1615 op=19228 SEARCH RESULT tag=101 err=0 nentries=0 text=

openldap  | 63775677 conn=1616 op=8 SRCH base="ou=groups,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=groupOfNames)(|(?=undefined)(?=undefined)(?=undefined)(?cn=)))"
openldap  | 63775677 conn=1616 op=8 SRCH attr=description cn mail cn gidNumber
openldap  | 63775677 conn=1616 op=8 SEARCH RESULT tag=101 err=0 nentries=0 text=

@micbar User management failing to list any external LDAP users is not solved yet.

Works on ocis.ocis-ldap.latest.owncloud.works where this patch is already deployed

xoxys · 2022-11-21T15:52:37Z

Now I'm confused again... #5065 is deployed on ocis.ocis-ldap.latest.owncloud.works already? Because in this case, admins can not change user roles via UI on this deployment.

This doesn't match

Role assignment works. Sorry for the confusion.

If it works through the API, that's fine, but this has worked through the UI in the past and should work again.

micbar · 2022-11-21T16:54:59Z

If it works through the API, that's fine, but this has worked through the UI in the past and should work again.

That is weird to me too. Needs some frontend changes.

@kulmann Extra ticket in web?

kulmann · 2022-11-21T17:01:22Z

If it works through the API, that's fine, but this has worked through the UI in the past and should work again.

That is weird to me too. Needs some frontend changes.

@kulmann Extra ticket in web?

Yes please, thank you

micbar · 2022-11-22T13:10:17Z

Web Ticket owncloud/web#8011

rhafer · 2022-11-23T14:12:01Z

These two queries seems to be problematic and are finding 0 result:

openldap  | 63775677 conn=1615 op=19228 SRCH base="ou=people,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=inetOrgPerson)(|(?=undefined)(?=undefined)(?=undefined)(?uid=)))"
openldap  | 63775677 conn=1615 op=19228 SRCH attr=uid uid mail cn uidNumber gidNumber
openldap  | 63775677 conn=1615 op=19228 SEARCH RESULT tag=101 err=0 nentries=0 text=

openldap  | 63775677 conn=1616 op=8 SRCH base="ou=groups,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=groupOfNames)(|(?=undefined)(?=undefined)(?=undefined)(?cn=)))"
openldap  | 63775677 conn=1616 op=8 SRCH attr=description cn mail cn gidNumber
openldap  | 63775677 conn=1616 op=8 SEARCH RESULT tag=101 err=0 nentries=0 text=

This is indeed weird. Looks a bit like a mis-configuration, but it might also be an issue with the helm charts. I need to take a deeper look.

rhafer · 2022-11-28T16:18:01Z

These two queries seems to be problematic and are finding 0 result:

openldap  | 63775677 conn=1615 op=19228 SRCH base="ou=people,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=inetOrgPerson)(|(?=undefined)(?=undefined)(?=undefined)(?uid=)))"
openldap  | 63775677 conn=1615 op=19228 SRCH attr=uid uid mail cn uidNumber gidNumber
openldap  | 63775677 conn=1615 op=19228 SEARCH RESULT tag=101 err=0 nentries=0 text=

openldap  | 63775677 conn=1616 op=8 SRCH base="ou=groups,dc=example,dc=com" scope=2 deref=0 filter="(&(objectClass=groupOfNames)(|(?=undefined)(?=undefined)(?=undefined)(?cn=)))"
openldap  | 63775677 conn=1616 op=8 SRCH attr=description cn mail cn gidNumber
openldap  | 63775677 conn=1616 op=8 SEARCH RESULT tag=101 err=0 nentries=0 text=

This is indeed weird. Looks a bit like a mis-configuration, but it might also be an issue with the helm charts. I need to take a deeper look.

@NexZhu I was able to reproduce the problem. It seems to be caused by a bug in the user provider, which constructs a broken LDAP filter under certain circumstances. I'll open a new issue for this with some background and a possible workaround.

NexZhu added the Type:Bug label Nov 13, 2022

micbar added this to the 2.0.0 General Availability milestone Nov 15, 2022

micbar added the Priority:p2-high Escalation, on top of current planning, release blocker label Nov 15, 2022

rhafer self-assigned this Nov 16, 2022

rhafer mentioned this issue Nov 16, 2022

Allow initial self-assignemnt of UserRole #5065

Merged

ScharfViktor mentioned this issue Nov 21, 2022

In LDAP, Number of member in Group is 0 #5085

Closed

micbar closed this as completed in #5065 Nov 21, 2022

micbar closed this as completed in 07a7828 Nov 21, 2022

micbar added the Status:Needs-Info label Nov 21, 2022

micbar mentioned this issue Nov 25, 2022

Release 2.0.0 General Availability RC1 #4986

Closed

73 tasks

ScharfViktor mentioned this issue Nov 28, 2022

Release 2.0.0 General Availability #5140

Closed

49 tasks

rhafer mentioned this issue Nov 28, 2022

Users service creates invalid LDAP filter when listing all users. #5142

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

rc.1 external OIDC+LDAP setup, error on new user first login #5045

rc.1 external OIDC+LDAP setup, error on new user first login #5045

NexZhu commented Nov 13, 2022 •

edited

Loading

NexZhu commented Nov 13, 2022

wkloucek commented Nov 15, 2022

wkloucek commented Nov 15, 2022

ScharfViktor commented Nov 15, 2022

NexZhu commented Nov 16, 2022

wkloucek commented Nov 16, 2022

NexZhu commented Nov 16, 2022 •

edited

Loading

rhafer commented Nov 17, 2022

NexZhu commented Nov 17, 2022 •

edited

Loading

rhafer commented Nov 17, 2022

NexZhu commented Nov 17, 2022 •

edited

Loading

individual-it commented Nov 18, 2022

NexZhu commented Nov 18, 2022 •

edited

Loading

xoxys commented Nov 21, 2022

micbar commented Nov 21, 2022

ScharfViktor commented Nov 21, 2022

xoxys commented Nov 21, 2022

micbar commented Nov 21, 2022

micbar commented Nov 21, 2022

micbar commented Nov 21, 2022

ScharfViktor commented Nov 21, 2022

NexZhu commented Nov 21, 2022

micbar commented Nov 21, 2022

xoxys commented Nov 21, 2022 •

edited

Loading

micbar commented Nov 21, 2022

kulmann commented Nov 21, 2022

micbar commented Nov 22, 2022

rhafer commented Nov 23, 2022

rhafer commented Nov 28, 2022

rc.1 external OIDC+LDAP setup, error on new user first login #5045

rc.1 external OIDC+LDAP setup, error on new user first login #5045

Comments

NexZhu commented Nov 13, 2022 • edited Loading

Describe the bug

NexZhu commented Nov 13, 2022

wkloucek commented Nov 15, 2022

wkloucek commented Nov 15, 2022

ScharfViktor commented Nov 15, 2022

NexZhu commented Nov 16, 2022

wkloucek commented Nov 16, 2022

NexZhu commented Nov 16, 2022 • edited Loading

rhafer commented Nov 17, 2022

NexZhu commented Nov 17, 2022 • edited Loading

rhafer commented Nov 17, 2022

NexZhu commented Nov 17, 2022 • edited Loading

individual-it commented Nov 18, 2022

NexZhu commented Nov 18, 2022 • edited Loading

xoxys commented Nov 21, 2022

micbar commented Nov 21, 2022

ScharfViktor commented Nov 21, 2022

xoxys commented Nov 21, 2022

micbar commented Nov 21, 2022

micbar commented Nov 21, 2022

micbar commented Nov 21, 2022

ScharfViktor commented Nov 21, 2022

NexZhu commented Nov 21, 2022

micbar commented Nov 21, 2022

xoxys commented Nov 21, 2022 • edited Loading

micbar commented Nov 21, 2022

kulmann commented Nov 21, 2022

micbar commented Nov 22, 2022

rhafer commented Nov 23, 2022

rhafer commented Nov 28, 2022

NexZhu commented Nov 13, 2022 •

edited

Loading

NexZhu commented Nov 16, 2022 •

edited

Loading

NexZhu commented Nov 17, 2022 •

edited

Loading

NexZhu commented Nov 17, 2022 •

edited

Loading

NexZhu commented Nov 18, 2022 •

edited

Loading

xoxys commented Nov 21, 2022 •

edited

Loading