Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

LDAP Users not mapped and authentication fails #272

Closed
ItalyPaleAle opened this issue Jul 1, 2016 · 12 comments
Closed

LDAP Users not mapped and authentication fails #272

ItalyPaleAle opened this issue Jul 1, 2016 · 12 comments

Comments

@ItalyPaleAle
Copy link

I'm setting up a new OC 9.0.51 server connected to LDAP. I was able to get LDAP to work and it sees two users in my Active Directory when pressing on the "test" buttons, as expected. There is nothing "fancy" about my LDAP setup: just adding basic settings.

All tests run fine:

  1. "Verify settings and count users" show me 2 users found in the only group that is allowed (Ok)
  2. Login is only with "LDAP / AD Username:". I tested with the usernames of both users (john and jane) and in both cases pressing on "Verify settings" reports "User found and settings verified." (Ok)

However, in the "Users" admin section I can only see 1 user imported from AD (the jane user). john was not imported, not even after pressing on "Clear Username-LDAP User Mapping".

When trying to log in as john (the user not imported), the UI reports: "An internal error occurred. Please try again or contact your administrator"). I then see the following 3 error messages in the log:

{"reqId":"1kqA\/gf7n2Vv05GiFFQR","remoteAddr":"172.17.0.4","app":"PHP","message":"iconv(): Wrong charset, conversion from `UTF-8' to `ASCII\/\/TRANSLIT' is not allowed at \/nextcloud\/apps\/user_ldap\/lib\/access.php#1101","level":3,"time":"2016-07-01T04:48:23+00:00","method":"POST","url":"\/","user":"--"}

{"reqId":"1kqA\/gf7n2Vv05GiFFQR","remoteAddr":"172.17.0.4","app":"core","message":"Exception when running cache gc: Attempted to initialize mount points for null user and no user in session","level":2,"time":"2016-07-01T04:48:23+00:00","method":"POST","url":"\/","user":"--"}

{"reqId":"1kqA\/gf7n2Vv05GiFFQR","remoteAddr":"172.17.0.4","app":"handleLogin","message":"Exception: {\"Exception\":\"OC\\\\User\\\\NoUserException\",\"Message\":\"Attempted to initialize mount points for null user and no user in session\",\"Code\":0,\"Trace\":\"#0 \\\/nextcloud\\\/lib\\\/private\\\/files\\\/node\\\/root.php(336): OC\\\\Files\\\\Filesystem::initMountPoints('')\\n#1 \\\/nextcloud\\\/lib\\\/private\\\/server.php(742): OC\\\\Files\\\\Node\\\\Root->getUserFolder('')\\n#2 \\\/nextcloud\\\/lib\\\/private\\\/user.php(170): OC\\\\Server->getUserFolder('')\\n#3 \\\/nextcloud\\\/lib\\\/base.php(1150): OC_User::login(*** username and password replaced ***)\\n#4 \\\/nextcloud\\\/lib\\\/base.php(1046): OC::tryFormLogin()\\n#5 \\\/nextcloud\\\/lib\\\/base.php(1008): OC::handleLogin()\\n#6 \\\/nextcloud\\\/index.php(39): OC::handleRequest()\\n#7 {main}\",\"File\":\"\\\/nextcloud\\\/lib\\\/private\\\/files\\\/filesystem.php\",\"Line\":377}","level":3,"time":"2016-07-01T04:48:23+00:00","method":"POST","url":"\/","user":"--"}

When trying to log in as jane (the user that was imported), instead, the authentication succeeds, but then I see a completely white page. On the logs, I see:

{"reqId":"wvelxJoRPN+nxRh3E21h","remoteAddr":"172.17.0.4","app":"PHP","message":"Error: Call to a member function getFileInfo() on null at \/nextcloud\/lib\/private\/files\/filesystem.php#874","level":3,"time":"2016-07-01T04:52:37+00:00","method":"GET","url":"\/index.php\/apps\/files\/","user":"--"}

I'm running OC using the Docker image by @Wonderfall : https://github.com/Wonderfall/dockerfiles/tree/master/nextcloud

Server configuration

Operating system:
Alpine Linux in Docker Container

Web server:
nginx

Database:
MariaDB 10.1

PHP version:
7.0.4

Nextcloud version: (see Nextcloud admin page)
9.0.51

Updated from an older Nextcloud/ownCloud or fresh install:
Fresh install

Where did you install Nextcloud from:
Docker: https://github.com/Wonderfall/dockerfiles/tree/master/nextcloud

Signing status (Nextcloud 9.0 and above):

No errors have been found.

List of activated apps:

Enabled:
  - activity: 2.2.1
  - admin_audit: 1.0.0
  - comments: 0.2
  - dav: 0.1.6
  - federatedfilesharing: 0.1.0
  - files: 1.4.4
  - files_pdfviewer: 0.8.1
  - files_sharing: 0.9.1
  - files_texteditor: 2.1
  - files_trashbin: 0.8.0
  - files_versions: 1.2.0
  - files_videoplayer: 0.9.8
  - firstrunwizard: 1.1
  - gallery: 14.5.0
  - notifications: 0.2.3
  - provisioning_api: 0.4.1
  - systemtags: 0.2
  - templateeditor: 0.1
  - updatenotification: 0.1.0
  - user_ldap: 0.8.0
Disabled:
  - encryption
  - external
  - federation
  - files_external
  - user_external

The content of config/config.php:

{
    "system": {
        "instanceid": "ocqua46unikg",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "10.1.2.2",
            "some.domain"
        ],
        "datadirectory": "\/nextcloud\/data",
        "overwrite.cli.url": "http:\/\/10.1.2.2",
        "dbtype": "mysql",
        "version": "9.0.51.0",
        "dbname": "owncloud",
        "dbhost": "mariadb",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "logtimezone": "UTC",
        "installed": true,
        "mail_smtpmode": "smtp",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "sendgrid.net",
        "mail_smtpauthtype": "LOGIN",
        "mail_smtpsecure": "tls",
        "mail_smtphost": "smtp.sendgrid.net",
        "mail_smtpport": "587",
        "mail_smtpauth": 1,
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "ldapIgnoreNamingRules": false
    }
}

Are you using external storage, if yes which one: Local

Are you using encryption: No

Are you using an external user-backend, if yes which one: Active Directory (LDAP)

LDAP configuration (delete this part if not used)

+-------------------------------+------------------------------------------------------------------------------------------------------------------------------------+
| Configuration                 |                                                                                                                                    |
+-------------------------------+------------------------------------------------------------------------------------------------------------------------------------+
| hasMemberOfFilterSupport      | 1                                                                                                                                  |
| hasPagedResultSupport         |                                                                                                                                    |
| homeFolderNamingRule          |                                                                                                                                    |
| lastJpegPhotoLookup           | 0                                                                                                                                  |
| ldapAgentName                 | CN=LDAP User,CN=Users,DC=domain,DC=com                                                                                          |
| ldapAgentPassword             | ***                                                                                                                                |
| ldapAttributesForGroupSearch  |                                                                                                                                    |
| ldapAttributesForUserSearch   |                                                                                                                                    |
| ldapBackupHost                |                                                                                                                                    |
| ldapBackupPort                |                                                                                                                                    |
| ldapBase                      | CN=Users,DC=domain,DC=com                                                                                                       |
| ldapBaseGroups                | CN=Users,DC=domain,DC=com                                                                                                       |
| ldapBaseUsers                 | CN=Users,DC=domain,DC=com                                                                                                       |
| ldapCacheTTL                  | 600                                                                                                                                |
| ldapConfigurationActive       | 1                                                                                                                                  |
| ldapDynamicGroupMemberURL     |                                                                                                                                    |
| ldapEmailAttribute            |                                                                                                                                    |
| ldapExperiencedAdmin          | 0                                                                                                                                  |
| ldapExpertUUIDGroupAttr       |                                                                                                                                    |
| ldapExpertUUIDUserAttr        |                                                                                                                                    |
| ldapExpertUsernameAttr        |                                                                                                                                    |
| ldapGroupDisplayName          | cn                                                                                                                                 |
| ldapGroupFilter               | (&(|(objectclass=group))(|(cn=Home Users)))                                                                                        |
| ldapGroupFilterGroups         | Home Users                                                                                                                         |
| ldapGroupFilterMode           | 0                                                                                                                                  |
| ldapGroupFilterObjectclass    | group                                                                                                                              |
| ldapGroupMemberAssocAttr      | uniqueMember                                                                                                                       |
| ldapHost                      | dc01.domain.com                                                                                                               |
| ldapIgnoreNamingRules         |                                                                                                                                    |
| ldapLoginFilter               | (&(&(|(objectclass=person))(|(|(memberof=CN=Home Users,CN=Users,DC=domain,DC=com)(primaryGroupID=1106))))(samaccountname=%uid)) |
| ldapLoginFilterAttributes     |                                                                                                                                    |
| ldapLoginFilterEmail          | 0                                                                                                                                  |
| ldapLoginFilterMode           | 0                                                                                                                                  |
| ldapLoginFilterUsername       | 1                                                                                                                                  |
| ldapNestedGroups              | 0                                                                                                                                  |
| ldapOverrideMainServer        |                                                                                                                                    |
| ldapPagingSize                | 500                                                                                                                                |
| ldapPort                      | 389                                                                                                                                |
| ldapQuotaAttribute            |                                                                                                                                    |
| ldapQuotaDefault              |                                                                                                                                    |
| ldapTLS                       | 0                                                                                                                                  |
| ldapUserDisplayName           | displayName                                                                                                                        |
| ldapUserDisplayName2          |                                                                                                                                    |
| ldapUserFilter                | (&(|(objectclass=person))(|(|(memberof=CN=Home Users,CN=Users,DC=domain,DC=com)(primaryGroupID=1106))))                         |
| ldapUserFilterGroups          | Home Users                                                                                                                         |
| ldapUserFilterMode            | 0                                                                                                                                  |
| ldapUserFilterObjectclass     | person                                                                                                                             |
| ldapUuidGroupAttribute        | auto                                                                                                                               |
| ldapUuidUserAttribute         | auto                                                                                                                               |
| turnOffCertCheck              | 0                                                                                                                                  |
| useMemberOfToDetectMembership | 1                                                                                                                                  |
+-------------------------------+------------------------------------------------------------------------------------------------------------------------------------+

Client configuration

Browser: Tested with multiple evergreen browsers

Operating system: Windows 10, OSX

Logs

Web server error log

Not available (and not applicable!)

Nextcloud log (data/owncloud.log)

See above

@ItalyPaleAle
Copy link
Author

I forgot to mention: an almost identical setup was working fine with ownCloud 9.0

@ItalyPaleAle
Copy link
Author

PS: using iconv like that for transliteration may not be the best approach. See http://stackoverflow.com/a/26514376/192024

@schiessle
Copy link
Member

@blizzz can you have a look? Thanks!

@jokoso
Copy link

jokoso commented Jul 18, 2016

I have a similar problem running from the same docker image.

Details:

  • I have two AD users that are identified in the LDAP wizard (e.g., "Jon" and "Lou").
  • Only Lou shows up under "Users".
  • Lou can log in.
  • When Jon attempts to log in, he gets the "An internal error occurred..." message.
  • Any users trying to immediately log in after the error message is shown gets the white page mentioned above.
  • The only way to get past the white page is resetting the browser cache.

Here's the log output:

{"reqId":"VOEfsrck0nRL1jreHq4o","remoteAddr":"1.2.3.4","app":"admin_audit","message":"Login attempt: \"jon\"","level":1,"time":"2016-07-18T10:37:40+00:00","method":"POST","url":"\/","user":"--"}
{"reqId":"VOEfsrck0nRL1jreHq4o","remoteAddr":"1.2.3.4","app":"admin_audit","message":"Login successful: \"\"","level":1,"time":"2016-07-18T10:37:41+00:00","method":"POST","url":"\/","user":"--"}
{"reqId":"VOEfsrck0nRL1jreHq4o","remoteAddr":"1.2.3.4","app":"core","message":"Exception when running cache gc: Attempted to initialize mount points for null user and no user in session","level":2,"time":"2016-07-18T10:37:41+00:00","method":"POST","url":"\/","user":"--"}
{"reqId":"VOEfsrck0nRL1jreHq4o","remoteAddr":"1.2.3.4","app":"handleLogin","message":"Exception: {\"Exception\":\"OC\\\\User\\\\NoUserException\",\"Message\":\"Attempted to initialize mount points for null user and no user in session\",\"Code\":0,\"Trace\":\"#0 \\\/nextcloud\\\/lib\\\/private\\\/files\\\/node\\\/root.php(336): OC\\\\Files\\\\Filesystem::initMountPoints('')\\n#1 \\\/nextcloud\\\/lib\\\/private\\\/server.php(756): OC\\\\Files\\\\Node\\\\Root->getUserFolder('')\\n#2 \\\/nextcloud\\\/lib\\\/private\\\/user.php(170): OC\\\\Server->getUserFolder('')\\n#3 \\\/nextcloud\\\/lib\\\/base.php(1167): OC_User::login(*** username and password replaced ***)\\n#4 \\\/nextcloud\\\/lib\\\/base.php(1063): OC::tryFormLogin()\\n#5 \\\/nextcloud\\\/lib\\\/base.php(1025): OC::handleLogin()\\n#6 \\\/nextcloud\\\/index.php(39): OC::handleRequest()\\n#7 {main}\",\"File\":\"\\\/nextcloud\\\/lib\\\/private\\\/files\\\/filesystem.php\",\"Line\":377}","level":3,"time":"2016-07-18T10:37:41+00:00","method":"POST","url":"\/","user":"--"}
{"reqId":"VOEfsrck0nRL1jreHq4o","remoteAddr":"1.2.3.4","app":"user_ldap","message":"No DN found for jon on mydomain.com","level":0,"time":"2016-07-18T10:37:41+00:00","method":"POST","url":"\/","user":"--"}

@Scott-St
Copy link

Scott-St commented Aug 8, 2016

Same issue here as you describe on version 9.0.53

@blizzz
Copy link
Member

blizzz commented Aug 9, 2016

php config issue? conversion from utf8 to ascii/translit is not allowed but should be

@Scott-St
Copy link

Scott-St commented Aug 9, 2016

Any ideas on what I should check in the php config that could be incorrect?

@Scott-St
Copy link

Scott-St commented Aug 9, 2016

On the users page, I see it doing a search for users, its finding both users. But its only displaying 1.

{"reqId":"GRUMPWbJWi0p9H43EzDg","remoteAddr":"192.168.254.254","app":"user_ldap","message":"initializing paged search for  Filter (&(&(|(objectclass=person))(|(|(memberof=CN=NextCloud-Users,CN=Users,DC=AD,DC=STEVENSONONTHE,DC=NET))))(displayname=*)(displayname=*)) base Array\n(\n    [0] => dc=AD,dc=STEVENSONONTHE,dc=NET\n)\n attr Array\n(\n    [0] => dn\n    [1] => uid\n    [2] => samaccountname\n    [3] => memberof\n    [4] => \n    [5] => mail\n    [6] => displayname\n    [7] => mail\n)\n limit 50 offset 0","level":0,"time":"2016-08-09T12:56:41+00:00","method":"GET","url":"\/index.php\/settings\/users\/users?offset=0&limit=50&gid=&pattern=","user":"Admin"}
{"reqId":"GRUMPWbJWi0p9H43EzDg","remoteAddr":"192.168.254.254","app":"user_ldap","message":"Ready for a paged search","level":0,"time":"2016-08-09T12:56:41+00:00","method":"GET","url":"\/index.php\/settings\/users\/users?offset=0&limit=50&gid=&pattern=","user":"Admin"}
{"reqId":"GRUMPWbJWi0p9H43EzDg","remoteAddr":"192.168.254.254","app":"user_ldap","message":"initializing paged search for  Filter objectClass=* base Array\n(\n    [0] => cn=scott stevenson,cn=users,dc=ad,dc=stevensononthe,dc=net\n)\n attr Array\n(\n    [0] => mail\n)\n limit 500 offset 0","level":0,"time":"2016-08-09T12:56:41+00:00","method":"GET","url":"\/index.php\/settings\/users\/users?offset=0&limit=50&gid=&pattern=","user":"Admin"}
{"reqId":"GRUMPWbJWi0p9H43EzDg","remoteAddr":"192.168.254.254","app":"user_ldap","message":"Ready for a paged search","level":0,"time":"2016-08-09T12:56:41+00:00","method":"GET","url":"\/index.php\/settings\/users\/users?offset=0&limit=50&gid=&pattern=","user":"Admin"}
{"reqId":"GRUMPWbJWi0p9H43EzDg","remoteAddr":"192.168.254.254","app":"user_ldap","message":"initializing paged search for  Filter objectClass=* base Array\n(\n    [0] => cn=scott stevenson,cn=users,dc=ad,dc=stevensononthe,dc=net\n)\n attr Array\n(\n    [0] => displayname\n)\n limit 500 offset 0","level":0,"time":"2016-08-09T12:56:41+00:00","method":"GET","url":"\/index.php\/settings\/users\/users?offset=0&limit=50&gid=&pattern=","user":"Admin"}
{"reqId":"GRUMPWbJWi0p9H43EzDg","remoteAddr":"192.168.254.254","app":"user_ldap","message":"Ready for a paged search","level":0,"time":"2016-08-09T12:56:41+00:00","method":"GET","url":"\/index.php\/settings\/users\/users?offset=0&limit=50&gid=&pattern=","user":"Admin"}
{"reqId":"GRUMPWbJWi0p9H43EzDg","remoteAddr":"192.168.254.254","app":"user_ldap","message":"initializing paged search for  Filter objectClass=* base Array\n(\n    [0] => cn=jonelyn c. mahilum,cn=users,dc=ad,dc=stevensononthe,dc=net\n)\n attr Array\n(\n    [0] => mail\n)\n limit 500 offset 0","level":0,"time":"2016-08-09T12:56:41+00:00","method":"GET","url":"\/index.php\/settings\/users\/users?offset=0&limit=50&gid=&pattern=","user":"Admin"}
{"reqId":"GRUMPWbJWi0p9H43EzDg","remoteAddr":"192.168.254.254","app":"user_ldap","message":"Ready for a paged search","level":0,"time":"2016-08-09T12:56:41+00:00","method":"GET","url":"\/index.php\/settings\/users\/users?offset=0&limit=50&gid=&pattern=","user":"Admin"}
{"reqId":"GRUMPWbJWi0p9H43EzDg","remoteAddr":"192.168.254.254","app":"user_ldap","message":"initializing paged search for  Filter objectClass=* base Array\n(\n    [0] => cn=jonelyn c. mahilum,cn=users,dc=ad,dc=stevensononthe,dc=net\n)\n attr Array\n(\n    [0] => displayname\n)\n limit 500 offset 0","level":0,"time":"2016-08-09T12:56:41+00:00","method":"GET","url":"\/index.php\/settings\/users\/users?offset=0&limit=50&gid=&pattern=","user":"Admin"}
{"reqId":"GRUMPWbJWi0p9H43EzDg","remoteAddr":"192.168.254.254","app":"user_ldap","message":"Ready for a paged search","level":0,"time":"2016-08-09T12:56:41+00:00","method":"GET","url":"\/index.php\/settings\/users\/users?offset=0&limit=50&gid=&pattern=","user":"Admin"}
{"reqId":"GRUMPWbJWi0p9H43EzDg","remoteAddr":"192.168.254.254","app":"user_ldap","message":"getUsers: 1 Users found","level":0,"time":"2016-08-09T12:56:41+00:00","method":"GET","url":"\/index.php\/settings\/users\/users?offset=0&limit=50&gid=&pattern=","user":"Admin"}
{"reqId":"lnMUzWNrRPLww7088zZH","remoteAddr":"192.168.254.254","app":"user_ldap","message":"Count filter:  objectclass=*","level":0,"time":"2016-08-09T12:56:52+00:00","method":"POST","url":"\/index.php\/apps\/user_ldap\/ajax\/wizard.php","user":"Admin"}
{"reqId":"lnMUzWNrRPLww7088zZH","remoteAddr":"192.168.254.254","app":"user_ldap","message":"initializing paged search for  Filter objectclass=* base Array\n(\n    [0] => dc=AD,dc=STEVENSONONTHE,dc=NET\n)\n attr Array\n(\n    [0] => dn\n)\n limit 500 offset 0","level":0,"time":"2016-08-09T12:56:52+00:00","method":"POST","url":"\/index.php\/apps\/user_ldap\/ajax\/wizard.php","user":"Admin"}
{"reqId":"lnMUzWNrRPLww7088zZH","remoteAddr":"192.168.254.254","app":"user_ldap","message":"Ready for a paged search","level":0,"time":"2016-08-09T12:56:52+00:00","method":"POST","url":"\/index.php\/apps\/user_ldap\/ajax\/wizard.php","user":"Admin"}

@blizzz
Copy link
Member

blizzz commented Aug 9, 2016

So there's a bug open against PHP: https://bugs.php.net/bug.php?id=44096 Basically, this also points at system configuration. If you compiled PHP yourself, this might help: https://bugs.php.net/bug.php?id=47507 If on docker, maybe this helps docker-library/php#240

@MorrisJobke
Copy link
Member

So there's a bug open against PHP: https://bugs.php.net/bug.php?id=44096 Basically, this also points at system configuration. If you compiled PHP yourself, this might help: https://bugs.php.net/bug.php?id=47507 If on docker, maybe this helps docker-library/php#240

@Scott-St @EgoAleSum Has this solved your issue?

I will close this for now. If this still is not fixed, please comment and I will reopen

@olekole
Copy link

olekole commented Jul 28, 2017

The problem still exist.
On LDAP Users > 1000 any User dosn't found in Usersearch same as the Starter of this post
Version 12.0

@dl5rcw
Copy link

dl5rcw commented Dec 19, 2017

Yepp,experienced such thing today in 12.0.4

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

8 participants