owncloud / core

:cloud: ownCloud web server core (Files, DAV, etc.)
https://owncloud.com
GNU Affero General Public License v3.0
8.38k stars 2.05k forks source link

LDAPs lost connection, LDAP works #20672

Closed colttt closed 8 years ago

colttt commented 8 years ago

Hello,

we would like to use LDAPS, but if we use that i got th efollowing error:

Request ID: mqpLihJgnoMn5PdwCbal
index   Exception: {"Exception":"OC\\ServerNotAvailableException","Message":"Lost connection to LDAP server.","Code":0,"Trace":"#0 \/var\/www\/owncloud\/apps\/user_ldap\/lib\/ldap.php(259): OCA\\user_ldap\\lib\\LDAP->postFunctionCall()\n#1 \/var\/www\/owncloud\/apps\/user_ldap\/lib\/ldap.php(42): OCA\\user_ldap\\lib\\LDAP->invokeLDAPMethod('bind', Resource id #37, '', '')\n#2 \/var\/www\/owncloud\/apps\/user_ldap\/lib\/connection.php(612): OCA\\user_ldap\\lib\\LDAP->bind(Resource id #37, '', '')\n#3 \/var\/www\/owncloud\/apps\/user_ldap\/lib\/connection.php(538): OCA\\user_ldap\\lib\\Connection->bind()\n#4 \/var\/www\/owncloud\/apps\/user_ldap\/lib\/connection.php(160): OCA\\user_ldap\\lib\\Connection->establishConnection()\n#5 \/var\/www\/owncloud\/apps\/user_ldap\/lib\/connection.php(168): OCA\\user_ldap\\lib\\Connection->init()\n#6 \/var\/www\/owncloud\/apps\/user_ldap\/lib\/access.php(830): OCA\\user_ldap\\lib\\Connection->getConnectionResource()\n#7 \/var\/www\/owncloud\/apps\/user_ldap\/lib\/access.php(978): OCA\\user_ldap\\lib\\Access->executeSearch('(&(|(objectclas...', Array, Array, '500', NULL)\n#8 \/var\/www\/owncloud\/apps\/user_ldap\/lib\/access.php(791): OCA\\user_ldap\\lib\\Access->search('(&(|(objectclas...', Array, Array, '500', NULL)\n#9 \/var\/www\/owncloud\/apps\/user_ldap\/lib\/access.php(729): OCA\\user_ldap\\lib\\Access->searchGroups('(&(|(objectclas...', Array, '500', NULL)\n#10 \/var\/www\/owncloud\/apps\/user_ldap\/group_ldap.php(713): OCA\\user_ldap\\lib\\Access->fetchListOfGroups('(&(|(objectclas...', Array, '500', NULL)\n#11 \/var\/www\/owncloud\/apps\/user_ldap\/group_ldap.php(753): OCA\\user_ldap\\GROUP_LDAP->getGroupsChunk('', '500', NULL)\n#12 \/var\/www\/owncloud\/apps\/user_ldap\/group_proxy.php(169): OCA\\user_ldap\\GROUP_LDAP->getGroups('', NULL, NULL)\n#13 \/var\/www\/owncloud\/lib\/private\/group\/manager.php(199): OCA\\user_ldap\\Group_Proxy->getGroups('', NULL, NULL)\n#14 \/var\/www\/owncloud\/lib\/private\/group\/metadata.php(195): OC\\Group\\Manager->search('')\n#15 \/var\/www\/owncloud\/lib\/private\/group\/metadata.php(97): OC\\Group\\MetaData->getGroups('')\n#16 \/var\/www\/owncloud\/settings\/users.php(62): OC\\Group\\MetaData->get()\n#17 \/var\/www\/owncloud\/lib\/private\/route\/route.php(154) : runtime-created function(1): require_once('\/var\/www\/ownclo...')\n#18 [internal function]: __lambda_func(Array)\n#19 \/var\/www\/owncloud\/lib\/private\/route\/router.php(282): call_user_func('?lambda_386', Array)\n#20 \/var\/www\/owncloud\/lib\/base.php(851): OC\\Route\\Router->match('\/settings\/users')\n#21 \/var\/www\/owncloud\/index.php(39): OC::handleRequest()\n#22 {main}","File":"\/var\/www\/owncloud\/apps\/user_ldap\/lib\/ldap.php","Line":289}

but if i test my config via occ, it is all fine:

./occ ldap:test-config s02
The configuration is valid and the connection could be established!

The same configuration with LDAP works fine.

My enviroment: Ubuntu 14.04 LTS Apache 2.4.7 MySQL 5.5.46

I upgraded from 8.0.2 to 8.1 to 8.2.1

MorrisJobke commented 8 years ago

Could this be a temporal problem? Maybe some network hiccups that cause the connection error. Or is this reproducible very often?

colttt commented 8 years ago

Hello MorrisJobke, it is reproducible. If i use LDAP it works fine without any problems if i use LDAPS it dont work and if i use 8.0.2 it works too. So i think that is a problem with 8.2.1 maybe. It is a VM, both server (owncloud and openldap) are on the same physical server

MorrisJobke commented 8 years ago

Ah ... okay, got it now. Thanks for clarification.

cc @blizzz

blizzz commented 8 years ago

@colttt Please provide configuration data, preferably use the issue template, thank you.

colttt commented 8 years ago

Steps to reproduce

  1. install a owncloud 8.0.2 with ldaps backend
  2. upgrade to 8.1
  3. upgrade to 8.2

Expected behaviour

that owncloud works with ldaps

Actual behaviour

with ldaps it lost every second the connection

Server configuration

Operating system: Ubuntu 14.04 LTS

Web server: Apacge 2,4,7

Database: MySQL 5.5.46

PHP version: 5.5.9

ownCloud version: 8.2.1

Updated from an older ownCloud: 8.0.2

List of activated apps:

Enabled:
  - activity: 2.1.3
  - files: 1.2.0
  - files_external: 0.3.0
  - files_pdfviewer: 0.7
  - files_sharing: 0.7.0
  - files_texteditor: 2.0
  - files_trashbin: 0.7.0
  - files_versions: 1.1.0
  - files_videoviewer: 0.1.3
  - firstrunwizard: 1.1
  - gallery: 14.2.0
  - user_external: 0.4
  - user_ldap: 0.7.0

The content of config/config.php:

{
    "system": {
        "instanceid": "ocae9ffe3733",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "datadirectory": "\/cloud_storage\/wolke\/owncloud\/data",
        "dbtype": "mysql",
        "version": "8.2.1.4",
        "dbname": "wolke",
        "dbhost": "localhost",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "forcessl": true,
        "ldapIgnoreNamingRules": false,
        "loglevel": 0,
        "trashbin_retention_obligation": "1, auto",
        "theme": "",
        "maintenance": false,
        "trusted_domains": [
            "***REMOVED SENSITIVE VALUE***",
            "***REMOVED SENSITIVE VALUE***"
        ],
        "secret": "***REMOVED SENSITIVE VALUE***",
        "share_folder": "\/Shared",
        "mail_smtpmode": "smtp",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "25"
    }
}

Are you using external storage, if yes which one: no

Are you using encryption: no

Are you using an external user-backend, if yes which one: openLDAP (Univention Corporate Server 3)

LDAP configuration (delete this part if not used)

+-------------------------------+--------------------------------------------------------------------------------+
| Configuration                 | s02                                                                            |
+-------------------------------+--------------------------------------------------------------------------------+
| hasMemberOfFilterSupport      | 0                                                                              |
| hasPagedResultSupport         |                                                                                |
| homeFolderNamingRule          |                                                                                |
| lastJpegPhotoLookup           | 0                                                                              |
| ldapAgentName                 |                                                                                |
| ldapAgentPassword             | ***                                                                            |
| ldapAttributesForGroupSearch  |                                                                                |
| ldapAttributesForUserSearch   |                                                                                |
| ldapBackupHost                |                                                                                |
| ldapBackupPort                |                                                                                |
| ldapBase                      | dc=my,dc=domain,dc=de                                                            |
| ldapBaseGroups                | cn=groups,dc=my,dc=domain,dc=de                                                  |
| ldapBaseUsers                 | cn=users,dc=my,dc=domain,dc=de                                                   |
| ldapCacheTTL                  | 600                                                                            |
| ldapConfigurationActive       | 1                                                                              |
| ldapEmailAttribute            |                                                                                |
| ldapExperiencedAdmin          | 0                                                                              |
| ldapExpertUUIDGroupAttr       |                                                                                |
| ldapExpertUUIDUserAttr        |                                                                                |
| ldapExpertUsernameAttr        |                                                                                |
| ldapGroupDisplayName          | cn                                                                             |
| ldapGroupFilter               | (|(objectclass=memberUid))                                                     |
| ldapGroupFilterGroups         |                                                                                |
| ldapGroupFilterMode           | 1                                                                              |
| ldapGroupFilterObjectclass    |                                                                                |
| ldapGroupMemberAssocAttr      | uniqueMember                                                                   |
| ldapHost                      | ldaps://ucs.my.domain.de                                                         |
| ldapIgnoreNamingRules         |                                                                                |
| ldapLoginFilter               | (&(|(objectclass=person))(|(uid=%uid)(|(mailPrimaryAddress=%uid)(mail=%uid)))) |
| ldapLoginFilterAttributes     |                                                                                |
| ldapLoginFilterEmail          | 1                                                                              |
| ldapLoginFilterMode           | 0                                                                              |
| ldapLoginFilterUsername       | 1                                                                              |
| ldapNestedGroups              | 0                                                                              |
| ldapOverrideMainServer        | 0                                                                              |
| ldapPagingSize                | 500                                                                            |
| ldapPort                      | 7636                                                                           |
| ldapQuotaAttribute            |                                                                                |
| ldapQuotaDefault              |                                                                                |
| ldapTLS                       | 0                                                                              |
| ldapUserDisplayName           | displayname                                                                    |
| ldapUserFilter                | (|(objectclass=person))                                                        |
| ldapUserFilterGroups          |                                                                                |
| ldapUserFilterMode            | 0                                                                              |
| ldapUserFilterObjectclass     | person                                                                         |
| ldapUuidGroupAttribute        | auto                                                                           |
| ldapUuidUserAttribute         | auto                                                                           |
| turnOffCertCheck              | 1                                                                              |
| useMemberOfToDetectMembership | 1                                                                              |
+-------------------------------+--------------------------------------------------------------------------------+

Client configuration

Browser: Chrome 46

Operating system: Debian Jessie

Logs

Web server error log

[Sun Nov 22 06:54:40.242075 2015] [core:notice] [pid 20386] AH00094: Command line: '/usr/sbin/apache2'
[Mon Nov 23 08:46:38.930655 2015] [negotiation:error] [pid 22621] [client 194.xxx.xxx.200:60361] AH00687: Negotiation: discovered file(s) matching request: /var/www/owncloud/settings/admin (None could be negotiated)., referer: https://wolke.my.domain.de/index.php/apps/files/
[Mon Nov 23 08:46:45.996037 2015] [negotiation:error] [pid 22623] [client 194.xxx.xxx.200:60364] AH00687: Negotiation: discovered file(s) matching request: /var/www/owncloud/settings/admin (None could be negotiated)., referer: https://wolke.my.domain.de/index.php?redirect_url=%2Findex.php%2Fsettings%2Fadmin
[Mon Nov 23 08:48:26.438648 2015] [negotiation:error] [pid 22687] [client 194.xxx.xxx.200:60371] AH00687: Negotiation: discovered file(s) matching request: /var/www/owncloud/settings/admin (None could be negotiated)., referer: https://wolke.my.domain.de/index.php?redirect_url=%2Findex.php%2Fsettings%2Fadmin
[Mon Nov 23 08:48:31.494936 2015] [negotiation:error] [pid 23578] [client 194.xxx.xxx.200:60373] AH00687: Negotiation: discovered file(s) matching request: /var/www/owncloud/settings/users (None could be negotiated)., referer: https://wolke.my.domain.de/index.php/settings/admin
[Mon Nov 23 08:48:32.177652 2015] [negotiation:error] [pid 23578] [client 194.xxx.xxx.200:60373] AH00687: Negotiation: discovered file(s) matching request: /var/www/owncloud/settings/users (None could be negotiated)., referer: https://wolke.my.domain.de/index.php/settings/users
[Mon Nov 23 08:48:36.010558 2015] [negotiation:error] [pid 23578] [client 194.xxx.xxx.200:60373] AH00687: Negotiation: discovered file(s) matching request: /var/www/owncloud/settings/admin (None could be negotiated)., referer: https://wolke.my.domain.de/index.php/settings/users
[Mon Nov 23 08:49:02.694083 2015] [negotiation:error] [pid 23583] [client 194.xxx.xxx.200:60381] AH00687: Negotiation: discovered file(s) matching request: /var/www/owncloud/settings/users (None could be negotiated)., referer: https://wolke.my.domain.de/index.php/settings/admin
[Mon Nov 23 08:49:35.681164 2015] [negotiation:error] [pid 22620] [client 194.xxx.xxx.200:60389] AH00687: Negotiation: discovered file(s) matching request: /var/www/owncloud/settings/admin (None could be negotiated).
[Mon Nov 23 08:49:38.634717 2015] [negotiation:error] [pid 23581] [client 194.xxx.xxx.200:60388] AH00687: Negotiation: discovered file(s) matching request: /var/www/owncloud/settings/admin (None could be negotiated).
[Mon Nov 23 08:49:41.994364 2015] [negotiation:error] [pid 22688] [client 194.xxx.xxx.200:60392] AH00687: Negotiation: discovered file(s) matching request: /var/www/owncloud/settings/admin (None could be negotiated)., referer: https://wolke.my.domain.de/index.php/settings/admin
[Mon Nov 23 08:49:44.062421 2015] [negotiation:error] [pid 22688] [client 194.xxx.xxx.200:60392] AH00687: Negotiation: discovered file(s) matching request: /var/www/owncloud/settings/admin (None could be negotiated)., referer: https://wolke.my.domain.de/index.php/settings/admin

ownCloud log (data/owncloud.log)

{"reqId":"BSVNQVYRAUT+Y85lf7hO","remoteAddr":"194.94.224.250","app":"user_ldap","message":"Ready for a paged search","level":0,"time":"2015-11-23T11:14:14+00:00","method":"PROPFIND","url":"\/remote.php\/webdav\/"}
{"reqId":"BSVNQVYRAUT+Y85lf7hO","remoteAddr":"194.94.224.250","app":"user_ldap","message":"readAttribute: uid=support,cn=users,dc=my,dc=domain,dc=de found","level":0,"time":"2015-11-23T11:14:14+00:00","method":"PROPFIND","url":"\/remote.php\/webdav\/"}
{"reqId":"BSVNQVYRAUT+Y85lf7hO","remoteAddr":"194.94.224.250","app":"user_ldap","message":"Turned off SSL certificate validation successfully.","level":0,"time":"2015-11-23T11:14:14+00:00","method":"PROPFIND","url":"\/remote.php\/webdav\/"}
{"reqId":"BSVNQVYRAUT+Y85lf7hO","remoteAddr":"194.94.224.250","app":"webdav","message":"Exception: {\"Message\":\"HTTP\\\/1.1 503 OC\\\\ServerNotAvailableException: Lost connection to LDAP server.\",\"Exception\":\"Sabre\\\\DAV\\\\Exception\\\\ServiceUnavailable\",\"Code\":0,\"Trace\":\"#0 \\\/var\\\/www\\\/owncloud\\\/3rdparty\\\/sabre\\\/dav\\\/lib\\\/DAV\\\/Auth\\\/Plugin.php(118): OC\\\\Connector\\\\Sabre\\\\Auth->authenticate(Object(OC\\\\Connector\\\\Sabre\\\\Server), 'ownCloud')\\n#1 [internal function]: Sabre\\\\DAV\\\\Auth\\\\Plugin->beforeMethod(Object(Sabre\\\\HTTP\\\\Request), Object(Sabre\\\\HTTP\\\\Response))\\n#2 \\\/var\\\/www\\\/owncloud\\\/3rdparty\\\/sabre\\\/event\\\/lib\\\/EventEmitterTrait.php(105): call_user_func_array(Array, Array)\\n#3 \\\/var\\\/www\\\/owncloud\\\/3rdparty\\\/sabre\\\/dav\\\/lib\\\/DAV\\\/Server.php(456): Sabre\\\\Event\\\\EventEmitter->emit('beforeMethod', Array)\\n#4 \\\/var\\\/www\\\/owncloud\\\/3rdparty\\\/sabre\\\/dav\\\/lib\\\/DAV\\\/Server.php(254): Sabre\\\\DAV\\\\Server->invokeMethod(Object(Sabre\\\\HTTP\\\\Request), Object(Sabre\\\\HTTP\\\\Response))\\n#5 \\\/var\\\/www\\\/owncloud\\\/apps\\\/files\\\/appinfo\\\/remote.php(55): Sabre\\\\DAV\\\\Server->exec()\\n#6 \\\/var\\\/www\\\/owncloud\\\/remote.php(137): require_once('\\\/var\\\/www\\\/ownclo...')\\n#7 {main}\",\"File\":\"\\\/var\\\/www\\\/owncloud\\\/lib\\\/private\\\/connector\\\/sabre\\\/auth.php\",\"Line\":134}","level":4,"time":"2015-11-23T11:14:14+00:00","method":"PROPFIND","url":"\/remote.php\/webdav\/"}
{"reqId":"HPgFNywGodABn4U9F+9H","remoteAddr":"","app":"user_ldap","message":"No DN found for  on ldap:\/\/194.xxx.xxx.ab","level":0,"time":"2015-11-23T11:17:15+00:00","method":"--","url":"--"}
{"reqId":"HPgFNywGodABn4U9F+9H","remoteAddr":"","app":"user_ldap","message":"No DN found for  on ldaps:\/\/ucs.my.domain.de","level":0,"time":"2015-11-23T11:17:15+00:00","method":"--","url":"--"}
blizzz commented 8 years ago

Nothing that leaves a suspicious impression. Anything odd in the OpenLDAP log?

colttt commented 8 years ago

so i solved it now, i delete all LDAP-Server and add a new one, after this, everything work fine

lock[bot] commented 5 years ago

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.