[Bug]: Error executing `ldap:show-remnants` command with encryption enabled

[hweihwang]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

When executing the occ ldap:show-remnants command with server-side encryption enabled, an error occurs during the share cleanup process. The command fails while attempting to handle expired shares from deleted LDAP users.

This issue appears to be related to the interaction between the LDAP cleanup process and the encryption system's hook manager when dealing with share cleanup operations.

Steps to reproduce

1. Enable server-side encryption
2. Have LDAP user A and arbitrary user B
3. LDAP user A shares a file with user B that will expire soon
4. Wait for the share to expire
5. Delete user A from LDAP (or adjust the configuration to not match user filter)
6. Execute occ ldap:check-user A
7. Execute occ ldap:show-remnants

Expected behavior

• The ldap:show-remnants command should execute successfully
• Should display list of LDAP users marked for deletion (matching records from oc_preferences table where appid="user_ldap" and configkey="isDeleted")

Nextcloud Server version

28

Are you using the Nextcloud Server Encryption module?

Encryption is Enabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Nextcloud Logs

An unhandled exception has been thrown:
Error: Call to a member function getPath() on null in /opt/oss/nextcloud/lib/private/Files/Filesystem.php:747
Stack trace:
#0 /opt/oss/nextcloud/lib/private/Encryption/HookManager.php(40): OC\Files\Filesystem::getPath()
#1 /opt/oss/nextcloud/lib/private/legacy/OC_Hook.php(105): OC\Encryption\HookManager::postUnshared()
#2 /opt/oss/nextcloud/lib/private/Share20/LegacyHooks.php(76): OC_Hook::emit()
#3 /opt/oss/nextcloud/lib/private/Share20/LegacyHooks.php(50): OC\Share20\LegacyHooks->postUnshare()
#4 /opt/oss/nextcloud/3rdparty/symfony/event-dispatcher/EventDispatcher.php(230): OC\Share20\LegacyHooks->OC\Share20\{closure}()
#5 /opt/oss/nextcloud/3rdparty/symfony/event-dispatcher/EventDispatcher.php(59): Symfony\Component\EventDispatcher\EventDispatcher->callListeners()
#6 /opt/oss/nextcloud/lib/private/EventDispatcher/EventDispatcher.php(94): Symfony\Component\EventDispatcher\EventDispatcher->dispatch()
#7 /opt/oss/nextcloud/lib/private/EventDispatcher/EventDispatcher.php(106): OC\EventDispatcher\EventDispatcher->dispatch()
#8 /opt/oss/nextcloud/lib/private/Share20/Manager.php(1253): OC\EventDispatcher\EventDispatcher->dispatchTyped()
#9 /opt/oss/nextcloud/lib/private/Share20/Manager.php(1566): OC\Share20\Manager->deleteShare()
#10 /opt/oss/nextcloud/lib/private/Share20/Manager.php(1357): OC\Share20\Manager->checkShare()
#11 /opt/oss/nextcloud/apps/user_ldap/lib/User/OfflineUser.php(261): OC\Share20\Manager->getSharesBy()
#12 /opt/oss/nextcloud/apps/user_ldap/lib/User/OfflineUser.php(224): OCA\User_LDAP\User\OfflineUser->determineShares()
#13 /opt/oss/nextcloud/apps/user_ldap/lib/Command/ShowRemnants.php(96): OCA\User_LDAP\User\OfflineUser->getHasActiveShares()
#14 /opt/oss/nextcloud/3rdparty/symfony/console/Command/Command.php(298): OCA\User_LDAP\Command\ShowRemnants->execute()
#15 /opt/oss/nextcloud/3rdparty/symfony/console/Application.php(1040): Symfony\Component\Console\Command\Command->run()
#16 /opt/oss/nextcloud/3rdparty/symfony/console/Application.php(301): Symfony\Component\Console\Application->doRunCommand()
#17 /opt/oss/nextcloud/3rdparty/symfony/console/Application.php(171): Symfony\Component\Console\Application->doRun()
#18 /opt/oss/nextcloud/lib/private/Console/Application.php(213): Symfony\Component\Console\Application->run()
#19 /opt/oss/nextcloud/console.php(100): OC\Console\Application->run()
#20 /opt/oss/nextcloud/occ(11): require_once('...')
#21 {main}

Impact

While the underlying cleanup operation appears to complete successfully despite the error, the command failure prevents administrators from easily identifying remnant LDAP users through the CLI interface.

Workaround

Users can directly query the database to identify removable LDAP users:

SELECT * FROM oc_preferences WHERE appid="user_ldap" AND configkey="isDeleted" AND configvalue=1;

Additional info

• Issue only occurs with encryption enabled. Without encryption, the command works as expected
• Only happen once first time running command, next time seems fine
• The error appears related to the encryption system's HookManager processing share-related events during cleanup