[Bug]: LDAP auth for FreeIPA not working but in configuration wizard show no problem #43021
Open
Description
⚠️ This issue respects the following points: ⚠️
- This is a bug, not a question or a configuration/webserver/proxy issue.
- This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
- Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
- I agree to follow Nextcloud's Code of Conduct.
Bug description
I've configured NC for auth from my own FreeIPA LDAP server inspired by https://www.freeipa.org/page/Owncloud_Authentication_against_FreeIPA
In configuration wizard I test config by test button in every step and Configuration is OK, users is found, Settings is Verified, group is found.
But in Expert page Test says:
Valid configuration, but binding failed. Please check the server settings and credentials."
and occ commands writes:
php occ ldap:test-config s02
The configuration is valid, but the bind failed. Please check the server settings and credentials.
php occ ldap:check-user nextcloud@pavkamlc.cz
The given user is not a recognized LDAP user.
In nextcloud.log I can't found any ldap errors.
Steps to reproduce
- Update NC to latest Stable version (28.0.1)
- Configure LDAP/AD integration like in https://www.freeipa.org/page/Owncloud_Authentication_against_FreeIPA
- Test login by LDAP user and test by working by occ
Expected behavior
Login to NC by valid LDAP user
Installation method
Community Manual installation with Archive
Nextcloud Server version
28
Operating system
RHEL/CentOS
PHP engine version
PHP 8.0
Web server
Apache (supported)
Database engine version
MariaDB
Is this bug present after an update or on a fresh install?
Upgraded to a MAJOR version (ex. 22 to 23)
Are you using the Nextcloud Server Encryption module?
None
What user-backends are you using?
- Default user-backend (database)
- LDAP/ Active Directory
- SSO - SAML
- Other
Configuration report
{
"system": {
"instanceid": "***REMOVED SENSITIVE VALUE***",
"passwordsalt": "***REMOVED SENSITIVE VALUE***",
"secret": "***REMOVED SENSITIVE VALUE***",
"trusted_domains": [
"nextcloud3.pavkamlc.cz",
"nextcloud.pavkamlc.cz",
"cloud.pavkamlc.cz"
],
"datadirectory": "***REMOVED SENSITIVE VALUE***",
"dbtype": "mysql",
"version": "28.0.1.1",
"overwrite.cli.url": "https:\/\/cloud.pavkamlc.cz",
"dbname": "***REMOVED SENSITIVE VALUE***",
"dbhost": "***REMOVED SENSITIVE VALUE***",
"dbport": "",
"dbtableprefix": "oc_",
"mysql.utf8mb4": true,
"dbuser": "***REMOVED SENSITIVE VALUE***",
"dbpassword": "***REMOVED SENSITIVE VALUE***",
"installed": true,
"theme": "",
"loglevel": 0,
"maintenance": false,
"default_phone_region": "CZ",
"mail_from_address": "***REMOVED SENSITIVE VALUE***",
"mail_smtpmode": "smtp",
"mail_sendmailmode": "smtp",
"mail_domain": "***REMOVED SENSITIVE VALUE***",
"mail_smtphost": "***REMOVED SENSITIVE VALUE***",
"overwritehost": "cloud.pavkamlc.cz",
"overwriteprotocol": "https",
"memcache.local": "\\OC\\Memcache\\Redis",
"redis": {
"host": "***REMOVED SENSITIVE VALUE***",
"port": 6379,
"dbindex": 0,
"password": "***REMOVED SENSITIVE VALUE***",
"timeout": 1.5
},
"app_install_overwrite": [
"ocsms",
"mail_roundcube"
],
"trusted_proxies": "***REMOVED SENSITIVE VALUE***",
"data-fingerprint": "3b03b536c35507fef61bc641a393f97a",
"ldapProviderFactory": "OCA\\User_LDAP\\LDAPProviderFactory"
}
}List of activated Apps
Enabled:
- activity: 2.20.0
- audioplayer: 3.4.1
- bruteforcesettings: 2.8.0
- calendar: 4.6.4
- camerarawpreviews: 0.8.4
- circles: 28.0.0-dev
- cloud_federation_api: 1.11.0
- comments: 1.18.0
- contacts: 5.5.1
- contactsinteraction: 1.9.0
- dashboard: 7.8.0
- dav: 1.29.1
- drawio: 3.0.2
- event_update_notification: 2.3.0
- federatedfilesharing: 1.18.0
- federation: 1.18.0
- files: 2.0.0
- files_automatedtagging: 1.18.0
- files_pdfviewer: 2.9.0
- files_photospheres: 1.28.0
- files_reminders: 1.1.0
- files_sharing: 1.20.0
- files_trashbin: 1.18.0
- files_versions: 1.21.0
- fileslibreofficeedit: 1.1.0
- firstrunwizard: 2.17.0
- forms: 4.0.0
- gpxpod: 5.0.14
- integration_google: 2.1.0
- logreader: 2.13.0
- lookup_server_connector: 1.16.0
- mail: 3.5.4
- mail_roundcube: 1.0.2
- nextcloud_announcements: 1.17.0
- notifications: 2.16.0
- notify_push: 0.6.7
- oauth2: 1.16.3
- onlyoffice: 9.0.0
- openhab: 0.13.3
- password_policy: 1.18.0
- phonetrack: 0.7.7
- photos: 2.4.0
- previewgenerator: 5.4.0
- privacy: 1.12.0
- provisioning_api: 1.18.0
- recognize: 6.0.1
- recommendations: 2.0.0
- related_resources: 1.3.0
- richdocuments: 8.3.1
- root_cache_cleaner: 0.1.6
- serverinfo: 1.18.0
- settings: 1.10.1
- sharebymail: 1.18.0
- spreed: 18.0.1
- support: 1.11.0
- survey_client: 1.16.0
- systemtags: 1.18.0
- tasks: 0.15.0
- text: 3.9.1
- theming: 2.3.0
- twofactor_backupcodes: 1.17.0
- twofactor_nextcloud_notification: 3.8.0
- updatenotification: 1.18.0
- uppush: 1.4.2
- user_ldap: 1.19.0
- user_status: 1.8.1
- viewer: 2.2.0
- weather_status: 1.8.0
- welcome: 1.0.10
- workflowengine: 2.10.0
Disabled:
- admin_audit: 1.18.0 (installed 1.15.0)
- apporder: 0.15.0 (installed 0.15.0)
- backup: 1.4.0 (installed 1.4.0)
- breezedark: 27.0.0 (installed 26.0.1)
- duplicatefinder: 1.1.4 (installed 1.1.4)
- electronicsignatures: 2.0.3 (installed 2.0.3)
- encryption: 2.16.0
- extract: 1.3.6 (installed 1.3.6)
- files_external: 1.20.0
- files_fulltextsearch: 26.0.1 (installed 26.0.1)
- files_fulltextsearch_tesseract: 27.0.0 (installed 27.0.0)
- files_mindmap: 0.0.30 (installed 0.0.30)
- files_rightclick: 0.15.1 (installed 1.6.0)
- files_texteditor: 2.15.1 (installed 2.15.1)
- gpxedit: 0.0.14 (installed 0.0.14)
- maps: 1.0.2 (installed 1.0.2)
- metadata: 0.19.0 (installed 0.19.0)
- news: 24.0.0 (installed 24.0.0)
- ocsms: 2.2.0 (installed 2.2.0)
- richdocumentscode: 23.5.702 (installed 23.5.702)
- sip_trip_phone: 1.1.3 (installed 1.1.3)
- suspicious_login: 6.0.0
- talked: 0.5.0 (installed 0.5.0)
- twofactor_totp: 10.0.0-beta.2
- unsplash: 2.2.1 (installed 2.2.1)
- video_converter: 1.0.6 (installed 1.0.6)
- workflow_ocr: 1.26.1 (installed 1.26.1)Nextcloud Signing status
Technical information
=====================
The following list covers which files have failed the integrity check. Please read
the previous linked documentation to learn more about the errors and how to fix
them.
Results
=======
- core
- INVALID_HASH
- core/js/mimetypelist.js
- EXTRA_FILE
- core/img/filetypes/drawio.svg
- core/img/filetypes/dwb.svg
Raw output
==========
Array
(
[core] => Array
(
[INVALID_HASH] => Array
(
[core/js/mimetypelist.js] => Array
(
[expected] => 550ab566d30693bfa24ec4b15d9df87731ae8a3be8f79dabf94757e5b8b20eec6e4b678f17af1718297f2872f6b04519eeb024d1dff11947f29da431c7f11201
[current] => 301654cbbe168b8723530db88fd2e40ad688f4e6b0bdaeade5b4fe34bd94d9d3cfe760821e97dc792e585d4b6ccff838597bfd46466bb07d30ff84df4cb79518
)
)
[EXTRA_FILE] => Array
(
[core/img/filetypes/drawio.svg] => Array
(
[expected] =>
[current] => 92e0974cf869bf8ab969c3442dc2b80d55fde36441d22924db74916a06b407520aa2a9dc39336f9157195ebede697ffac0e639360879255ab91932d406e1897d
)
[core/img/filetypes/dwb.svg] => Array
(
[expected] =>
[current] => 43731dd5f17a048112ea5109b40b02ec019b3ee2324385a0f448e3bd2264cb13dc160ab018d893f92f8e2f168fd09009b51578c8c6b97a02a1617c67ac087701
)
)
)
)Nextcloud Logs
[apache@websrv2 nextcloud]$ tail -n 300 /misc/cloud/nextclouddata/nextcloud.log | grep ldap
{"reqId":"Za5rXKIWx4jZdV1GRkMUsgAAABA","level":0,"time":"2024-01-22T13:19:24+00:00","remoteAddr":"192.168.88.105","user":"adminlocal","app":"user_ldap","method":"GET","url":"/index.php/settings/admin/logging","message":"Calling LDAP function ldap_explode_dn with parameters [\"adminlocal\",0]","userAgent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36","version":"28.0.1.1","data":{"app":"user_ldap"}}Additional info
No response
Activity