LDAP groups sync half broken

Steps to reproduce

Not sure

Expected behaviour

Correct mapping of users-> groups

Actual behaviour

Via web interface, the groups don’t show any user (or almost any), even some groups are missing. But if I use occ then it is different.

[root@app13 owncloud]# occ group:list-members "IT Services"
  - 135D4DCA3C9CD89CE040010A7D016DCF: R L
  - 135D4DCA3CF0D89CE040010A7D016DCF: E S
  - 152C357808E6D2D0E0500B0A7D041A97: L M
  - 915AEF2132CBA06CE040010A7D0115E9: M C
  - 270062F99AEAD9B0E0500B0A7D041F5E: T K

But when quering a user, he is not listing this group:

[root@app13 owncloud]# occ user:list-groups 270062F99AEAD9B0E0500B0A7D041F5E
  - IT Department

So you can see that I list IT Services group, and pick up a user (that belongs to multiple groups), and when I try to list this user’s group then I only find him in a group that we manually created.

Server configuration

Operating system: CentOS 7

Web server: Apache 2.4.6

Database: Mysql

PHP version: mod_php 7.4.16

ownCloud version: 10.9.1

Updated from an older ownCloud or fresh install: older instance

Where did you install ownCloud from: sources

Signing status (ownCloud 9.0 and above):

Login as admin user into your ownCloud and access 
http://example.com/index.php/settings/integrity/failed 
paste the results into https://gist.github.com/ and puth the link here.

No errors have been found.

The content of config/config.php:

Log in to the web-UI with an administrator account and click on
'admin' -> 'Generate Config Report' -> 'Download ownCloud config report'
This report includes the config.php settings, the list of activated apps
and other details in a well sanitized form.

or 

If you have access to your command line run e.g.:
sudo -u www-data php occ config:list system
from within your ownCloud installation folder

[root@app13 owncloud]# occ config:list system
{
    "system": {
        "instanceid": "516d71bc38a74",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "datadirectory": "\/mnt\/owncloud\/data",
        "tempdirectory": "\/mnt\/owncloud\/data\/owncloud_tempdirectory",
        "dbtype": "mysql",
        "version": "10.9.1.2",
        "installed": true,
        "ldapIgnoreNamingRules": false,
        "forcessl": true,
        "loglevel": 0,
        "dbname": "oc",
        "dbhost": "localhost",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "theme": "",
        "maintenance": false,
        "session_lifetime": 32400,
        "trusted_domains": [
            "oc.domain.de"
        ],
        "accounts.enable_medial_search": true,
        "updatechecker": true,
        "check_for_working_htaccess": true,
        "secret": "***REMOVED SENSITIVE VALUE***",
        "share_folder": "\/Shared",
        "mail_smtpmode": "smtp",
        "mail_smtpdebug": true,
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "25",
        "trashbin_retention_obligation": "auto, 30",
        "versions_retention_obligation": "auto, 30",
        "ldapUserCleanupInterval": 5,
        "lost_password_link": "disabled",
        "singleuser": false,
        "log_type": "owncloud",
        "logfile": "\/mnt\/owncloud\/data\/owncloud.log",
        "log_rotate_size": 104857600,
        "overwrite.cli.url": "https:\/\/oc.domain.de\/",
        "integrity.excluded.files": [
            ".DS_Store",
            "Thumbs.db",
            ".htaccess"
        ],
        "allow_user_to_change_mail_address": ""
    }
}

List of activated apps:

If you have access to your command line run e.g.:
sudo -u www-data php occ app:list
from within your ownCloud installation folder.

Are you using external storage, if yes which one: NFS

Are you using encryption: no

Are you using an external user-backend, if yes which one: LDAP

LDAP configuration (delete this part if not used)

[root@app13 owncloud]# occ ldap:show-config
+-------------------------------+-----------------------------------------------------------------------+
| Configuration                 |                                                                       |
+-------------------------------+-----------------------------------------------------------------------+
| hasMemberOfFilterSupport      | 1                                                                     |
| hasPagedResultSupport         |                                                                       |
| homeFolderNamingRule          |                                                                       |
| lastJpegPhotoLookup           | 0                                                                     |
| ldapAgentName                 | cn=account_view_only,cn=Admins,dc=domain,dc=org                         |
| ldapAgentPassword             | ***                                                                   |
| ldapAttributesForGroupSearch  |                                                                       |
| ldapAttributesForUserSearch   |                                                                       |
| ldapBackupHost                |                                                                       |
| ldapBackupPort                | 389                                                                   |
| ldapBase                      | dc=domain,dc=org                                                        |
| ldapBaseGroups                | cn=Groups,dc=domain,dc=org                                              |
| ldapBaseUsers                 | cn=Users,dc=domain,dc=org                                               |
| ldapCacheTTL                  | 600                                                                   |
| ldapConfigurationActive       | 1                                                                     |
| ldapDynamicGroupMemberURL     |                                                                       |
| ldapEmailAttribute            | mail                                                                  |
| ldapExperiencedAdmin          | 0                                                                     |
| ldapExpertUUIDGroupAttr       |                                                                       |
| ldapExpertUUIDUserAttr        | emblowncloudid                                                        |
| ldapExpertUsernameAttr        |                                                                       |
| ldapGroupDisplayName          | cn                                                                    |
| ldapGroupFilter               | (objectclass=groupOfUniqueNames)                                      |
| ldapGroupFilterGroups         |                                                                       |
| ldapGroupFilterMode           | 1                                                                     |
| ldapGroupFilterObjectclass    |                                                                       |
| ldapGroupMemberAlgo           | groupScan                                                             |
| ldapGroupMemberAssocAttr      | uniqueMember                                                          |
| ldapHost                      | ldaps://ldap1.domain.de                                                 |
| ldapIgnoreNamingRules         |                                                                       |
| ldapLoginFilter               | (|(uid=%uid)(mail=%uid))                                              |
| ldapLoginFilterAttributes     |                                                                       |
| ldapLoginFilterEmail          | 1                                                                     |
| ldapLoginFilterMode           | 1                                                                     |
| ldapLoginFilterUsername       | 1                                                                     |
| ldapNestedGroups              | 0                                                                     |
| ldapNetworkTimeout            | 10                                                                    |
| ldapOverrideMainServer        | 0                                                                     |
| ldapPagingSize                | 500                                                                   |
| ldapPort                      | 636                                                                   |
| ldapQuotaAttribute            | emblOwncloudQuota                                                     |
| ldapQuotaDefault              | 53687091200                                                           |
| ldapTLS                       | 0                                                                     |
| ldapUserDisplayName           | displayname                                                           |
| ldapUserDisplayName2          |                                                                       |
| ldapUserFilter                | (&(|(objectclass=EMBLSAPPerson)(objectclass=emblTechAccount))(uid=*)) |
| ldapUserFilterGroups          |                                                                       |
| ldapUserFilterMode            | 1                                                                     |
| ldapUserFilterObjectclass     |                                                                       |
| ldapUserName                  | samaccountname                                                        |
| ldapUuidGroupAttribute        | auto                                                                  |
| ldapUuidUserAttribute         | auto                                                                  |
| turnOffCertCheck              | 0                                                                     |
| useMemberOfToDetectMembership | 1                                                                     |
+-------------------------------+-----------------------------------------------------------------------+

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.