[Bug]: For subadmins, the accounts page does not list the groups.

[joergmschulz]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

All users are synchronized from LDAP, including group information.
There is one user who should be sub-admin and be able to review the group membership of the users of his group:

<subadmin>
   <element>FDS_Riesklasse</element>
 </subadmin>

on the accounts page, the users belonging to that group are listed correctly.
But the list of groups remains empty.

The JAVA console displays the following error:

response: "{\"ocs\":{\"meta\":{\"status\":\"failure\",\"statuscode\":403,\"message\":\"Das angemeldete Konto muss ein Administrator, ein Unteradministrator sei…"

responseText: "{\"ocs\":{\"meta\":{\"status\":\"failure\",\"statuscode\":403,\"message\":\"Das angemeldete Konto muss ein Administrator, ein Unteradministrator sei…"

consequently:

Also, the group in question cannot be found in the search box.

Steps to reproduce

1. Grant subadmin privileges to a ldap user on a ldap group
2. login using this credential

Expected behavior

the user should see the correct groups

Nextcloud Server version

31

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.4

Web server

Nginx

Database engine version

PostgreSQL

Is this bug present after an update or on a fresh install?

Upgraded to a MAJOR version (ex. 31 to 32)

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "apps_paths": [
            {
                "path": "\/www\/nextcloud\/apps",
                "url": "\/apps",
                "writable": false
            },
            {
                "path": "\/data\/apps\/",
                "url": "\/custom-apps",
                "writable": true
            }
        ],
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "cloud.freie-dorfschule.de"
        ],
        "dbtype": "pgsql",
        "version": "31.0.4.1",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "lost_password_link": "https:\/\/ssp.faudin.de\/?action=sendtoken",
        "enabledPreviewProviders": [
            "OC\\Preview\\TXT",
            "OC\\Preview\\MarkDown",
            "OC\\Preview\\PDF",
            "OC\\Preview\\MSOfficeDoc",
            "OC\\Preview\\JPEG",
            "OC\\Preview\\PNG",
            "OC\\Preview\\GIF",
            "OC\\Preview\\BMP",
            "OC\\Preview\\XBitmap",
            "OC\\Preview\\MP3",
            "OC\\Preview\\HEIC",
            "OC\\Preview\\Movie",
            "OC\\Preview\\MKV",
            "OC\\Preview\\MOV",
            "OC\\Preview\\MP4",
            "OC\\Preview\\AVI",
            "OC\\Preview\\PNG",
            "OC\\Preview\\TIFF"
        ],
        "maintenance_window_start": 1,
        "htaccess.RewriteBase": "\/",
        "forwarded_for_headers": [
            "HTTP_X_FORWARDED",
            "HTTP_FORWARDED_FOR",
            "HTTP_X_FORWARDED_FOR",
            "X-Forwarded-For"
        ],
        "htaccess.IgnoreFrontController": true,
        "default_phone_region": "DE",
        "overwrite.cli.url": "https:\/\/cloud.freie-dorfschule.de",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "password": "***REMOVED SENSITIVE VALUE***"
        },
        "maintenance": false,
        "memcache.local": "\\OC\\Memcache\\Redis",
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpmode": "smtp",
        "mail_sendmailmode": "smtp",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "2587",
        "mail_smtpauth": 1,
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "defaultapp": "",
        "ldapProviderFactory": "OCA\\User_LDAP\\LDAPProviderFactory",
        "loglevel": 2,
        "app_install_overwrite": [
            "snappymail"
        ]
    }
}

List of activated Apps

Enabled:
  - activity: 4.0.0
  - app_api: 5.0.2
  - bruteforcesettings: 4.0.0
  - calendar: 5.2.2
  - circles: 31.0.0
  - cloud_federation_api: 1.14.0
  - comments: 1.21.0
  - contacts: 7.0.6
  - contactsinteraction: 1.12.0
  - dashboard: 7.11.0
  - dav: 1.33.0
  - deck: 1.15.1
  - federatedfilesharing: 1.21.0
  - federation: 1.21.0
  - files: 2.3.1
  - files_downloadlimit: 4.0.0
  - files_pdfviewer: 4.0.0
  - files_reminders: 1.4.0
  - files_sharing: 1.23.1
  - files_trashbin: 1.21.0
  - files_versions: 1.24.0
  - groupfolders: 19.0.4
  - logreader: 4.0.0
  - lookup_server_connector: 1.19.0
  - mail: 5.0.3
  - nextcloud_announcements: 3.0.0
  - notifications: 4.0.0
  - notify_push: 1.0.0
  - oauth2: 1.19.1
  - password_policy: 3.0.0
  - photos: 4.0.0-dev.1
  - polls: 7.4.2
  - privacy: 3.0.0
  - profile: 1.0.0
  - provisioning_api: 1.21.0
  - recommendations: 4.0.0
  - related_resources: 2.0.0
  - richdocuments: 8.6.4
  - serverinfo: 3.0.0
  - settings: 1.14.0
  - sharebymail: 1.21.0
  - snappymail: 2.38.2
  - socialsharing_email: 3.3.0
  - support: 3.0.0
  - survey_client: 3.0.0
  - systemtags: 1.21.1
  - tables: 0.9.2
  - text: 5.0.0
  - theming: 2.6.1
  - twofactor_backupcodes: 1.20.0
  - updatenotification: 1.21.0
  - user_ldap: 1.22.0
  - user_status: 1.11.0
  - viewer: 4.0.0
  - weather_status: 1.11.0
  - webhook_listeners: 1.2.0
  - workflowengine: 2.13.0
Disabled:
  - admin_audit: 1.21.0
  - calendar_news: 1.1.15 (installed 1.1.15)
  - collectives: 2.16.3 (installed 2.16.3)
  - encryption: 2.19.0
  - files_external: 1.23.0
  - firstrunwizard: 4.0.0 (installed 3.0.0)
  - spreed: 21.0.4 (installed 21.0.4)
  - suspicious_login: 9.0.1
  - twofactor_nextcloud_notification: 5.0.0
  - twofactor_totp: 13.0.0-dev.0

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

nothing interesting

Additional info

members of the admin group are also fed via ldap - in NC it has the name admin_2

[susnux]

Should be fixed with #52417 to be released in May

[seanmahrt]

Should be fixed with #52417 to be released in May

Is there a workaround? Seems like a pretty critical bug in the production release to wait 2 weeks. (running 31.0.4)

[susnux]

Is there a workaround?

Not really - only to promote them to (delegated) admins or let admins to the work for the next 2 weeks.

[joergmschulz]

not so sure this is really fixed in [Nextcloud Hub 10] (31.0.5) : I have a subadmin who still doesn't see the groups where he's member of:

[susnux]

Oh yes its still shown, confused it with #52170

[joergmschulz]

Is there a workaround?

Not really - only to promote them to (delegated) admins or let admins to the work for the next 2 weeks.

if some people only need an overview of all users and groups, you might provide them with a users and groups documentation https://github.com/joergmschulz/ldapUsersGroupsToNC/tree/master

[cdammanintopix]

Would it be possible to merge the fix #52776 asap?
We currently have promoted many users as admin, and would like to keep this promotion as short as possible...
So it would be nice to have this fix in the next release

[susnux]

@cdammanintopix we cannot make any promises here, but it sounds like you are talking about enterprise. In this case please open a ticket on the portal.

[EelcoA]

We are implementing Nextcloud for the first time for a (volunteering) organisation and ran into this bug. It blocks further implementation. It's a bit of a bummer after all flashy promotions of Nextcloud that we are blocked by such a critical bug.