[Bug]: LDAP exception after update to 32.0.1

[pbuergi]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

LDAP is broken after updateing from 31.0.9. I tried to update twice. Same error. On other NC instance with other NC version or with NC version 31 it works fine. No config changed.

Steps to reproduce

1. Update from 31.0.9 to 31.0.10
2. Update from 31.0.10 to 32.0.1
3. Error occurs in LDAP

Expected behavior

LDAP works as before

Nextcloud Server version

32

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.3

Web server

Apache (supported)

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Upgraded to a MAJOR version (ex. 31 to 32)

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "portal.domain.ch",
            "10.10.2.111",
            "pi.mattig.ch"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "overwrite.cli.url": "https:\/\/portal.domain.ch\/nextcloud",
        "dbtype": "mysql",
        "version": "32.0.1.2",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "logtimezone": "UTC",
        "installed": true,
        "mail_smtpmode": "smtp",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "25",
        "mail_smtpstreamoptions": {
            "ssl": {
                "allow_self_signed": true,
                "verify_peer": false,
                "verify_peer_name": false
            }
        },
        "appstore.experimental.enabled": false,
        "enable_previews": false,
        "preview_concurrency_all": 1,
        "preview_concurrency_new": 1,
        "enabledPreviewProviders": [
            "OC\\Preview\\BMP"
        ],
        "maintenance": false,
        "ldapIgnoreNamingRules": false,
        "ldapProviderFactory": "\\OCA\\User_LDAP\\LDAPProviderFactory",
        "filelocking.enabled": "true",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 6379
        },
        "updater.release.channel": "stable",
        "theme": "",
        "log_type": "file",
        "logfile": "\/var\/log\/nextcloud\/nextcloud.log",
        "loglevel": "3",
        "logdateformat": "F d, Y H:i:s",
        "skeletondirectory": "",
        "mail_smtpauthtype": "PLAIN",
        "mysql.utf8mb4": true,
        "auth.webauthn.enabled": false,
        "mail_sendmailmode": "smtp",
        "default_phone_region": "CH",
        "maintenance_window_start": 1,
        "remember_login_cookie_lifetime": 1296000,
        "session_lifetime": 3600,
        "session_keepalive": false,
        "auto_logout": true,
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "app_install_overwrite": []
    }
}

List of activated Apps

Enabled:
  - activity: 5.0.0-dev.0
  - admin_audit: 1.22.0
  - app_api: 32.0.0
  - cloud_federation_api: 1.16.0
  - comments: 1.22.0
  - contactsinteraction: 1.13.1
  - dav: 1.34.2
  - federatedfilesharing: 1.22.0
  - files: 2.4.0
  - files_antivirus: 6.1.0
  - files_downloadlimit: 5.0.0-dev.0
  - files_external: 1.24.0
  - files_reminders: 1.5.0
  - files_sharing: 1.24.0
  - files_trashbin: 1.22.0
  - files_versions: 1.25.0
  - logreader: 5.0.0-dev.0
  - lookup_server_connector: 1.20.0
  - notifications: 5.0.0-dev.0
  - notify_push: 1.2.0
  - oauth2: 1.20.0
  - password_policy: 4.0.0-dev.0
  - photos: 5.0.0-dev.1
  - privacy: 4.0.0-dev.0
  - profile: 1.1.0
  - provisioning_api: 1.22.0
  - related_resources: 3.0.0-dev.0
  - serverinfo: 4.0.0-dev.0
  - settings: 1.15.1
  - text: 6.0.1
  - theming: 2.7.0
  - twofactor_backupcodes: 1.21.0
  - updatenotification: 1.22.0
  - user_ldap: 1.23.0
  - viewer: 5.0.0-dev.0
  - webhook_listeners: 1.3.0
  - workflowengine: 2.14.0
Disabled:
  - bruteforcesettings: 5.0.0-dev.0 (installed 1.2.0)
  - circles: 32.0.0 (installed 25.0.0)
  - dashboard: 7.12.0 (installed 7.0.0)
  - encryption: 2.20.0
  - federation: 1.22.0 (installed 1.0.1)
  - files_pdfviewer: 5.0.0-dev.0 (installed 2.0.1)
  - files_rightclick: 0.15.1 (installed 1.6.0)
  - firstrunwizard: 5.0.0-dev.0 (installed 2.3.0)
  - nextcloud_announcements: 4.0.0-dev.0 (installed 1.3.0)
  - ransomware_protection: 1.14.0 (installed 1.14.0)
  - recommendations: 5.0.0-dev.0 (installed 1.1.0)
  - sharebymail: 1.22.0 (installed 1.4.0)
  - support: 4.0.0-dev.0 (installed 1.0.0)
  - survey_client: 4.0.0-dev.0 (installed 0.1.5)
  - suspicious_login: 10.0.0-dev.0
  - systemtags: 1.22.0 (installed 1.4.0)
  - twofactor_nextcloud_notification: 6.0.0-dev.0
  - twofactor_totp: 14.0.0 (installed 3.0.1)
  - user_status: 1.12.0 (installed 1.0.1)
  - weather_status: 1.12.0 (installed 1.0.0)

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

ServerNotAvailableException
Lost connection to LDAP server.

Additional info

An exception occured while running the setup check: OC\ServerNotAvailableException: Lost connection to LDAP server. in /var/www/nextcloud/apps/user_ldap/lib/LDAP.php:367 
Stack trace: 
#0 /var/www/nextcloud/apps/user_ldap/lib/LDAP.php(405): OCA\User_LDAP\LDAP->processLDAPError() 
#1 /var/www/nextcloud/apps/user_ldap/lib/LDAP.php(287): OCA\User_LDAP\LDAP->postFunctionCall() 
#2 /var/www/nextcloud/apps/user_ldap/lib/LDAP.php(44): OCA\User_LDAP\LDAP->invokeLDAPMethod() 
#3 /var/www/nextcloud/apps/user_ldap/lib/Connection.php(752): OCA\User_LDAP\LDAP->bind() 
#4 /var/www/nextcloud/apps/user_ldap/lib/Connection.php(644): OCA\User_LDAP\Connection->bind() 
#5 /var/www/nextcloud/apps/user_ldap/lib/Connection.php(234): OCA\User_LDAP\Connection->establishConnection() 
#6 /var/www/nextcloud/apps/user_ldap/lib/Connection.php(242): OCA\User_LDAP\Connection->init() 
#7 /var/www/nextcloud/apps/user_ldap/lib/Connection.php(739): OCA\User_LDAP\Connection->getConnectionResource() 
#8 /var/www/nextcloud/apps/user_ldap/lib/SetupChecks/LdapConnection.php(47): OCA\User_LDAP\Connection->bind() 
#9 /var/www/nextcloud/lib/private/SetupCheck/SetupCheckManager.php(34): OCA\User_LDAP\SetupChecks\LdapConnection->run() 
#10 /var/www/nextcloud/apps/settings/lib/Controller/CheckSetupController.php(132): OC\SetupCheck\SetupCheckManager->runAll() 
#11 /var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php(204): OCA\Settings\Controller\CheckSetupController->check() 
#12 /var/www/nextcloud/lib/private/AppFramework/Http/Dispatcher.php(118): OC\AppFramework\Http\Dispatcher->executeController() 
#13 /var/www/nextcloud/lib/private/AppFramework/App.php(153): OC\AppFramework\Http\Dispatcher->dispatch() 
#14 /var/www/nextcloud/lib/private/Route/Router.php(321): OC\AppFramework\App::main() 
#15 /var/www/nextcloud/lib/base.php(1061): OC\Route\Router->match() 
#16 /var/www/nextcloud/index.php(25): OC::handleRequest() 
#17 {main}

[PMNexhorizons]

This Issue has impact on LDAP and non LDAP User and goes in an internal server error when you want to login.
Version Update from 32.0.0 to 32.0.1

[mlinaresalvaro]

I have the same problem. any solution?

[vbrodel]

I have the same problem. Any solution?

[zoddog]

I managed to restore my instance without errors. I updated from 32.0.0 to 32.0.1
By some reason Nextcloud told me that all of my plugins are outdated and turned them off. I reenabled them with OCC and now everything works perfectly.

LDAP works!
SAML works!

[mlinaresalvaro]

A possible solution is posted at #55613, I'm going to try it.

[provokateurin]

CC @come-nc

[waja]

In our setup, we didn't activate to turn off certificate check. Looks like there was a code change to handle this different and we had to disable the check to prevent "Lost connection to LDAP server."

[come-nc]

@blizzz Looks like this is what you tried to fix in #55736 ?
But it looks like this was included in 32.0.1 already, so not sure what’s happening here.

[come-nc]

@blizzz I think the issue is from the $this->ldap->setOption(null, LDAP_OPT_X_TLS_REQUIRE_CERT, LDAP_OPT_X_TLS_DEMAND); that was added.
Before, if turnOffCertCheck was false, nothing was done, so maybe it was dependent on the openldap configuration file or something. Now, when the option is off, we force the cert check.

So, @vbrodel @mlinaresalvaro @pbuergi can you check the state of this option, and either turn it on or fix your LDAP server to correctly send the certificate? The option is named 'Turn off SSL certificate validation.' in the UI.
If this does not work or does not match your situation please give more details.