Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Bug]: user_ldap Attempt for Paging? in Logging #31175

Open
6 of 8 tasks
q-wertz opened this issue Feb 14, 2022 · 8 comments
Open
6 of 8 tasks

[Bug]: user_ldap Attempt for Paging? in Logging #31175

q-wertz opened this issue Feb 14, 2022 · 8 comments
Labels
0. Needs triage Pending check for reproducibility or if it fits our roadmap 25-feedback bug feature: ldap needs review Needs review to determine if still applicable

Comments

@q-wertz
Copy link

q-wertz commented Feb 14, 2022

⚠️ This issue respects the following points: ⚠️

  • This is a bug, not a question or a configuration/webserver/proxy issue.
  • This issue is not already reported on Github (I've searched it).
  • Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
  • I agree to follow Nextcloud's Code of Conduct.

Bug description

In the admin logging I get the Error "Attempt for Paging?" from the user_ldap app.

Not sure if related, but the LDAP/AD integration interface says Configuration incorrect and that The Base DN appears to be wrong but when checking on command line everything appears to be correct

root@machine01:/var/www/nextcloud# sudo -u www-data ./occ ldap:test-config s03
The configuration is valid and the connection could be established!

Using google I stumbled into this owncloud/user_ldap#423 which seems related.

Steps to reproduce

  1. Have a working LDAP config
  2. (Maybe due to update)
  3. Get error message in the Web interface

Expected behavior

  • Command line tool and Web interface return the self results from the config check
  • A more precise message why the base DN is wrong when everything appears to work fine

Installation method

Manual installation

Operating system

Debian/Ubuntu

PHP engine version

PHP 7.4

Web server

Nginx

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Updated to a major version (ex. 22.2.3 to 23.0.1)

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

  • Default user-backend (database)
  • LDAP/ Active Directory
  • SSO - SAML
  • Other

Configuration report

{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "nc.top.secret.de",
            "nc.topp.secret.de"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "22.2.3.0",
        "overwrite.cli.url": "https:\/\/nc.top.secret.de",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "mysql.utf8mb4": true,
        "maintenance": false,
        "session_lifetime": 604800,
        "session_keepalive": true,
        "mail_smtpmode": "smtp",
        "mail_sendmailmode": "smtp",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "25",
        "default_language": "de_DE",
        "default_locale": "de",
        "default_phone_region": "DE",
        "skeletondirectory": "",
        "loglevel": 2,
        "updater.release.channel": "stable",
        "app_install_overwrite": [
            "drawio"
        ],
        "mail_smtpsecure": "tls",
        "ldapIgnoreNamingRules": false,
        "ldapProviderFactory": "OCA\\User_LDAP\\LDAPProviderFactory",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 0,
            "password": "***REMOVED SENSITIVE VALUE***"
        }
    }
}

List of activated Apps

Enabled:
  - accessibility: 1.8.0
  - activity: 2.15.0
  - admin_audit: 1.12.0
  - appointments: 1.11.12
  - bruteforcesettings: 2.3.0
  - calendar: 3.0.5
  - calendar_resource_management: 0.1.0
  - circles: 22.1.1
  - cloud_federation_api: 1.5.0
  - comments: 1.12.0
  - contacts: 4.0.7
  - dashboard: 7.2.0
  - dav: 1.19.0
  - deck: 1.5.5
  - drawio: 1.0.2
  - federatedfilesharing: 1.12.0
  - federation: 1.12.0
  - files: 1.17.0
  - files_external: 1.13.0
  - files_pdfviewer: 2.3.1
  - files_rightclick: 1.1.0
  - files_sharing: 1.14.0
  - files_trashbin: 1.12.0
  - files_versions: 1.15.0
  - files_videoplayer: 1.11.0
  - firstrunwizard: 2.11.0
  - groupfolders: 10.0.2
  - integration_gitlab: 1.0.3
  - integration_openproject: 1.0.6
  - logreader: 2.7.0
  - lookup_server_connector: 1.10.0
  - news: 17.0.1
  - nextcloud_announcements: 1.11.0
  - notifications: 2.10.1
  - oauth2: 1.10.0
  - password_policy: 1.12.0
  - photos: 1.4.0
  - polls: 3.4.2
  - privacy: 1.6.0
  - provisioning_api: 1.12.0
  - quota_warning: 1.13.0
  - recommendations: 1.1.0
  - serverinfo: 1.12.0
  - settings: 1.4.0
  - sharebymail: 1.12.0
  - smb_test: 0.3.3
  - support: 1.5.0
  - systemtags: 1.12.0
  - tasks: 0.14.2
  - text: 3.3.0
  - theming: 1.13.0
  - twofactor_backupcodes: 1.11.0
  - updatenotification: 1.12.0
  - user_ldap: 1.12.1
  - user_status: 1.2.0
  - viewer: 1.6.0
  - weather_status: 1.2.0
  - workflowengine: 2.4.0
Disabled:
  - contactsinteraction
  - encryption
  - mail
  - ransomware_protection
  - survey_client

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

{"reqId":"xM6hlC9vjtmWFGEx5Lpo","level":3,"time":"2022-02-14T16:18:33+00:00","remoteAddr":"123.456.789.123","user":"admin.sonn","app":"user_ldap","method":"POST","url":"/apps/user_ldap/ajax/wizard.php","message":"Attempt for Paging?  ","userAgent":"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0","version":"22.2.3.0","id":"620a80d9cb9ae"}

Additional info

We are using Global Catalog (port 3269)

@q-wertz q-wertz added 0. Needs triage Pending check for reproducibility or if it fits our roadmap bug labels Feb 14, 2022
@szaimen

This comment was marked as resolved.

@q-wertz
Copy link
Author

q-wertz commented Jan 23, 2023

Yes, still on 25.0.3. Not sure if this is important: the user "admin_user" is not on LDAP but a local one

{
   "reqId":"4yeOsXJoq1oWMFMpCPkx",
   "level":3,
   "time":"2023-01-23T15:54:19+00:00",
   "remoteAddr":"141.58.121.86",
   "user":"admin_user",
   "app":"user_ldap",
   "method":"POST",
   "url":"/apps/user_ldap/ajax/wizard.php",
   "message":"Attempt for Paging?  ",
   "userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/109.0",
   "version":"25.0.3.2",
   "data":{
      "app":"user_ldap"
   },
   "id":"63ceae53bc7ac"
}

@joshtrichards
Copy link
Member

joshtrichards commented Jun 6, 2023

Just to confirm I understand: the error is logged and those errors appear in the UI, but everything functions normally? 🤔

Can you provide the output of occ ldap:show-config? Feel free to sensor out your domain/identifying info - just make sure any matching entries are the same/etc.

EDIT: I also just noted you're using NGINX. Can you confirm the following two lines exist in your nginx config:

https://github.com/nextcloud/documentation/blob/32559abb2d9995d9de094747b754d0eea5c0af60/admin_manual/installation/nginx-root.conf.sample#L145-L146

I suspect the telltale sign is that CLI test works, but not the web UI...

@nextcloud-command

This comment was marked as resolved.

@nextcloud-command nextcloud-command added the stale Ticket or PR with no recent activity label Nov 11, 2023
@q-wertz
Copy link
Author

q-wertz commented Nov 15, 2023

Sorry, forgot to answer.

  • I'm now on NC 27.1.3. The error messages about Attempt for Paging only show up rarely (last time2023-09-05) and while I was now doing these checks (but not sure at which point exactly).

  • I can confirm that the NGINX line exists.

  • The output of the command line check apparently got an update and the Web and Command line shows an error

    root@asterix:~# sudo -u www-data /var/www/nextcloud/occ ldap:test-config s03
    The configuration is valid and the bind passed, but a simple search on the base fails. Please check the server base setting.
    

    Just not sure to which field this relates... The Base DN, Base User Tree, Base Group Tree, ...
    (or it might come from the fact that we use LDAP Global Catalog?)

  • The config is:

    +-------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
    | Configuration                 | s03                                                                                                                                                                                   |
    +-------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
    | hasMemberOfFilterSupport      | 1                                                                                                                                                                                     |
    | homeFolderNamingRule          |                                                                                                                                                                                       |
    | lastJpegPhotoLookup           | 0                                                                                                                                                                                     |
    | ldapAgentName                 | CN=65574F13-674G-HF68-80F2-0050569B202E,OU=FuncUsers,OU=SIAM,DC=university,DC=de                                                                                                   |
    | ldapAgentPassword             | ***                                                                                                                                                                                   |
    | ldapAttributeAddress          |                                                                                                                                                                                       |
    | ldapAttributeBiography        |                                                                                                                                                                                       |
    | ldapAttributeFediverse        |                                                                                                                                                                                       |
    | ldapAttributeHeadline         |                                                                                                                                                                                       |
    | ldapAttributeOrganisation     |                                                                                                                                                                                       |
    | ldapAttributePhone            |                                                                                                                                                                                       |
    | ldapAttributeRole             |                                                                                                                                                                                       |
    | ldapAttributeTwitter          |                                                                                                                                                                                       |
    | ldapAttributeWebsite          |                                                                                                                                                                                       |
    | ldapAttributesForGroupSearch  | cn                                                                                                                                                                                    |
    | ldapAttributesForUserSearch   | displayName;mail                                                                                                                                                                      |
    | ldapBackgroundHost            |                                                                                                                                                                                       |
    | ldapBackgroundPort            |                                                                                                                                                                                       |
    | ldapBackupHost                |                                                                                                                                                                                       |
    | ldapBackupPort                |                                                                                                                                                                                       |
    | ldapBase                      | DC=university,DC=de                                                                                                                                                                |
    | ldapBaseGroups                | DC=university,DC=de                                                                                                                                                                |
    | ldapBaseUsers                 | DC=university,DC=de;DC=stud,DC=university,DC=de                                                                                                                                 |
    | ldapCacheTTL                  | 600                                                                                                                                                                                   |
    | ldapConfigurationActive       | 1                                                                                                                                                                                     |
    | ldapConnectionTimeout         | 15                                                                                                                                                                                    |
    | ldapDefaultPPolicyDN          |                                                                                                                                                                                       |
    | ldapDynamicGroupMemberURL     |                                                                                                                                                                                       |
    | ldapEmailAttribute            | mail                                                                                                                                                                                  |
    | ldapExperiencedAdmin          | 1                                                                                                                                                                                     |
    | ldapExpertUUIDGroupAttr       |                                                                                                                                                                                       |
    | ldapExpertUUIDUserAttr        |                                                                                                                                                                                       |
    | ldapExpertUsernameAttr        |                                                                                                                                                                                       |
    | ldapExtStorageHomeAttribute   |                                                                                                                                                                                       |
    | ldapGidNumber                 | gidNumber                                                                                                                                                                             |
    | ldapGroupDisplayName          | cn                                                                                                                                                                                    |
    | ldapGroupFilter               | (&(objectClass=group)(CN=ABC-*)(!(|(CN=ABC-CIFS*)(CN=ABC-OU*)(CN=ABC-DNS*)(CN=ABC-Administratoren))))                                                                                 |
    | ldapGroupFilterGroups         |                                                                                                                                                                                       |
    | ldapGroupFilterMode           | 0                                                                                                                                                                                     |
    | ldapGroupFilterObjectclass    |                                                                                                                                                                                       |
    | ldapGroupMemberAssocAttr      | member                                                                                                                                                                                |
    | ldapHost                      | ldaps://adserv17.university.de                                                                                                                                                     |
    | ldapIgnoreNamingRules         |                                                                                                                                                                                       |
    | ldapLoginFilter               | (&(objectClass=InetOrgPerson)(memberof:1.2.840.113556.1.4.1941:=CN=ABC-service-nextcloud,OU=ABC-services,OU=ABC,OU=Fak-42,DC=university,DC=de)(|(sAMAccountName=%uid)(mail=%uid))) |
    | ldapLoginFilterAttributes     |                                                                                                                                                                                       |
    | ldapLoginFilterEmail          | 0                                                                                                                                                                                     |
    | ldapLoginFilterMode           | 0                                                                                                                                                                                     |
    | ldapLoginFilterUsername       | 1                                                                                                                                                                                     |
    | ldapMatchingRuleInChainState  | available                                                                                                                                                                             |
    | ldapNestedGroups              | 1                                                                                                                                                                                     |
    | ldapOverrideMainServer        |                                                                                                                                                                                       |
    | ldapPagingSize                | 0                                                                                                                                                                                     |
    | ldapPort                      | 3269                                                                                                                                                                                  |
    | ldapQuotaAttribute            |                                                                                                                                                                                       |
    | ldapQuotaDefault              |                                                                                                                                                                                       |
    | ldapTLS                       | 0                                                                                                                                                                                     |
    | ldapUserAvatarRule            | none                                                                                                                                                                                  |
    | ldapUserDisplayName           | displayname                                                                                                                                                                           |
    | ldapUserDisplayName2          | mail                                                                                                                                                                                  |
    | ldapUserFilter                | (&(objectclass=InetOrgPerson)(memberof:1.2.840.113556.1.4.1941:=CN=ABC-service-nextcloud,OU=ABC-services,OU=ABC,OU=Fak-42,DC=university,DC=de))                                    |
    | ldapUserFilterGroups          | Domänen-Admins                                                                                                                                                                        |
    | ldapUserFilterMode            | 0                                                                                                                                                                                     |
    | ldapUserFilterObjectclass     | inetOrgPerson                                                                                                                                                                         |
    | ldapUuidGroupAttribute        | auto                                                                                                                                                                                  |
    | ldapUuidUserAttribute         | auto                                                                                                                                                                                  |
    | turnOffCertCheck              | 0                                                                                                                                                                                     |
    | turnOnPasswordChange          | 0                                                                                                                                                                                     |
    | useMemberOfToDetectMembership | 1                                                                                                                                                                                     |
    +-------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
    

@nextcloud-command nextcloud-command removed stale Ticket or PR with no recent activity needs info labels Nov 16, 2023
@seal61
Copy link

seal61 commented Jun 4, 2024

I have the same issue, but running on apache2. Described it in the nextcloud forums, not solved (yet).

https://help.nextcloud.com/t/attempt-for-paging-bad-search-filter/185970

@lwt-pressy
Copy link

still present in 29.0.3, seems to be related if LDAP - server has a inactivity timeout set.

@joshtrichards joshtrichards added the needs review Needs review to determine if still applicable label Sep 6, 2024
@q-wertz
Copy link
Author

q-wertz commented Nov 20, 2024

Also in v30.0.2

[user_ldap] Error: Attempt for Paging?  
	GET /settings/ajax/checksetup
	from XX.XXX.XX.XXX by admin.user at 20.11.2024, 21:15:47

Raw entry:

{"reqId":"W4RIktcS5Z7xYHAkoqU3","level":3,"time":"2024-11-20T20:15:47+00:00","remoteAddr":"XX.XXX.XX.XXX","user":"admin.user","app":"user_ldap","method":"GET","url":"/settings/ajax/checksetup","message":"Attempt for Paging?  ","userAgent":"Mozilla/5.0 (X11; Linux x86_64; rv:131.0) Gecko/20100101 Firefox/131.0","version":"30.0.2.2","data":{"app":"user_ldap"},"id":"673e4438c5b75"}

I think it happens when accessing the LDAP config page.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
0. Needs triage Pending check for reproducibility or if it fits our roadmap 25-feedback bug feature: ldap needs review Needs review to determine if still applicable
Projects
None yet
Development

No branches or pull requests

6 participants