LDAP quota-sync does not work anymore

[mayerthomas]

Steps to reproduce

1. Nextcloud 13.0.6 on Debian 9
2. Samba 4.5 on Debian 9
3. Install and Configure Nextcloud-LDAP-Plugin to use the Samba-Server via LDAP und use as quota-field the samba-field postOfficeBox
4. Adding nextcloud-users via Samba with e. g. 1 GB in the field postOfficeBox

Expected behaviour

User gets the 1 GB as quota-limit

Actual behaviour

Everything works as expected (log in, group-association, ...) but when I look at the users as admin in nextcloud i can not see the quota from samba-server. This had been working for a long time but now seems to be broken.

Questions on that:

• Is there a special ldap-log?
• Ho often are these informations synced between ldap and nextcloud?
• Is there a way to manually reset/resync those informations?

Server configuration

Operating system: Debian 9

Web server: Apache

Database: MariaDB

PHP version: 7

Nextcloud version: 13.0.6

Updated from an older Nextcloud/ownCloud or fresh install: updated

Where did you install Nextcloud from: original files from nextcloud.com

Signing status:

Signing status

No errors have been found.

List of activated apps:

App list

Enabled:

• admin_audit: 1.3.0
• bruteforcesettings: 1.1.0
• dav: 1.4.7
• federatedfilesharing: 1.3.1
• files: 1.8.0
• files_pdfviewer: 1.2.1
• files_sharing: 1.5.0
• files_texteditor: 2.5.1
• files_trashbin: 1.3.0
• files_versions: 1.6.0
• files_videoplayer: 1.2.0
• gallery: 18.0.0
• logreader: 2.0.0
• lookup_server_connector: 1.1.0
• nextcloud_announcements: 1.2.0
• notifications: 2.1.2
• oauth2: 1.1.1
• password_policy: 1.3.0
• provisioning_api: 1.3.0
• richdocuments: 2.0.11
• serverinfo: 1.3.0
• survey_client: 1.1.0
• theming: 1.4.5
• twofactor_backupcodes: 1.2.3
• updatenotification: 1.3.0
• user_ldap: 1.3.1
• workflowengine: 1.3.0
  Disabled:
• activity
• comments
• encryption
• federation
• files_external
• firstrunwizard
• sharebymail
• spreed
• systemtags
• user_external

Nextcloud configuration:

Config report

{
"system": {
"passwordsalt": "REMOVED SENSITIVE VALUE",
"secret": "REMOVED SENSITIVE VALUE",
"trusted_domains": [
"nextcloud.rsarnstorf.de",
"www.nextcloud.rsarnstorf.de",
"10.1.1.6"
],
"datadirectory": "REMOVED SENSITIVE VALUE",
"overwrite.cli.url": "https://nextcloud.rsarnstorf.de",
"dbtype": "mysql",
"version": "13.0.6.1",
"dbname": "REMOVED SENSITIVE VALUE",
"dbhost": "REMOVED SENSITIVE VALUE",
"dbport": "",
"dbtableprefix": "oc_",
"dbuser": "REMOVED SENSITIVE VALUE",
"dbpassword": "REMOVED SENSITIVE VALUE",
"installed": true,
"htaccess.RewriteBase": "/",
"ldapUserCleanupInterval": 15,
"memcache.local": "\OC\Memcache\APCu",
"share_folder": "/Mit mir geteilt",
"ldapIgnoreNamingRules": false,
"ldapProviderFactory": "\OCA\User_LDAP\LDAPProviderFactory",
"loglevel": 2,
"maintenance": false,
"instanceid": "REMOVED SENSITIVE VALUE",
"mail_from_address": "REMOVED SENSITIVE VALUE",
"mail_smtpmode": "php",
"mail_smtpauthtype": "LOGIN",
"mail_domain": "REMOVED SENSITIVE VALUE",
"updater.release.channel": "stable",
"trusted_proxies": "REMOVED SENSITIVE VALUE",
"forwarded_for_headers": [
"HTTP_X_FORWARDED_FOR"
],
"updater.secret": "REMOVED SENSITIVE VALUE"
}
}

Are you using external storage, if yes which one: local/smb/sftp/...
no

Are you using encryption: yes/no
no

Are you using an external user-backend, if yes which one: LDAP/ActiveDirectory/Webdav/...
ldap / samba 4

LDAP configuration (delete this part if not used)

LDAP config

+-------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | Configuration | s01 | +-------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | hasMemberOfFilterSupport | 1 | | hasPagedResultSupport | | | homeFolderNamingRule | | | lastJpegPhotoLookup | 0 | | ldapAgentName | CN=Administrator,CN=Users,DC=XXX,DC=intra | | ldapAgentPassword | *** | | ldapAttributesForGroupSearch | | | ldapAttributesForUserSearch | | | ldapBackupHost | | | ldapBackupPort | | | ldapBase | DC=XXX,DC=intra | | ldapBaseGroups | OU=Groups,OU=School,DC=XXX,DC=intra | | ldapBaseUsers | OU=Users,OU=School,DC=XXX,DC=intra | | ldapCacheTTL | 600 | | ldapConfigurationActive | 1 | | ldapDefaultPPolicyDN | | | ldapDynamicGroupMemberURL | | | ldapEmailAttribute | mail | | ldapExperiencedAdmin | 1 | | ldapExpertUUIDGroupAttr | | | ldapExpertUUIDUserAttr | | | ldapExpertUsernameAttr | userPrincipalName | | ldapGidNumber | gidNumber | | ldapGroupDisplayName | cn | | ldapGroupFilter | (&(|(objectclass=group))(|(cn=5a)(cn=5b)(cn=5c)(cn=5d)(cn=5e)(cn=5f)(cn=6a)(cn=6b)(cn=6c)(cn=6d)(cn=6e)(cn=6f)(cn=7a)(cn=7b)(cn=7c)(cn=7d)(cn=7e)(cn=7f)(cn=8a)(cn=8b)(cn=8c)(cn=8d)(cn=8e)(cn=8f)(cn=9a)(cn=9b)(cn=9c)(cn=9d)(cn=9e)(cn=9f)(cn=10a)(cn=10b)(cn=10c)(cn=10d)(cn=10e)(cn=10f)(cn=lehrer)(cn=schueler)(cn=schulleitung)(cn=erweiterte-schulleitung))) | | ldapGroupFilterGroups | 5a;5b;5c;5d;5e;5f;6a;6b;6c;6d;6e;6f;7a;7b;7c;7d;7e;7f;8a;8b;8c;8d;8e;8f;9a;9b;9c;9d;9e;9f;10a;10b;10c;10d;10e;10f;lehrer;schueler;schulleitung;erweiterte-schulleitung | | ldapGroupFilterMode | 0 | | ldapGroupFilterObjectclass | group | | ldapGroupMemberAssocAttr | member | | ldapHost | 10.1.1.5 | | ldapIgnoreNamingRules | | | ldapLoginFilter | (&(&(|(objectclass=person)))(samaccountname=%uid)) | | ldapLoginFilterAttributes | | | ldapLoginFilterEmail | 0 | | ldapLoginFilterMode | 0 | | ldapLoginFilterUsername | 1 | | ldapNestedGroups | 0 | | ldapOverrideMainServer | | | ldapPagingSize | 0 | | ldapPort | 389 | | ldapQuotaAttribute | postOfficeBox | | ldapQuotaDefault | 500 MB | | ldapTLS | 0 | | ldapUserAvatarRule | default | | ldapUserDisplayName | displayname | | ldapUserDisplayName2 | | | ldapUserFilter | (&(|(objectclass=person))) | | ldapUserFilterGroups | | | ldapUserFilterMode | 0 | | ldapUserFilterObjectclass | person | | ldapUuidGroupAttribute | auto | | ldapUuidUserAttribute | auto | | turnOffCertCheck | 0 | | turnOnPasswordChange | 0 | | useMemberOfToDetectMembership | 1 | +-------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+

[nextcloud-bot]

GitMate.io thinks possibly related issues are #10446 (Unable to unshare link if ldap user does not exist anymore), #7135 (LDAP password change not always working), #2017 (quota), #3068 (LDAP: Quota issues), and #10242 (LDAP backend does not force password policy).

[blizzz]

Is there a special ldap-log?

just the nextcloud.log.

Ho often are these informations synced between ldap and nextcloud?

Initially, on login, and regularly per background job

Is there a way to manually reset/resync those informations?

Nope, only by logging in.

[mayerthomas]

What I did not know is, that the users have to log in to see their synced/correct ldap-quota as admin on the user-site. So the sync of ldap-quota works correctly - sorry...

But another problem - situation:

1. User logs in to nextcloud website.
2. User downloads e. g. windows-sync-client.
3. From now on user never logs in to website and only uses sync-client.
4. The quota of the user is full and admin gives him via ldap a bigger quota.

--> Will the new quota for this user be synced without logging into nextcloud-website - just by using the sync-client?

[blizzz]

The sync client also needs to login. The question is how regularly this happens. Latest with the background job this would be synced.

However, on initial fetch this should be picked up, too. But there were other reports about the email not being available after first sync. Might be connected, still need to look into it.

[skjnldsv]

Hi @mayerthomas
Is this still occurring? :)
Please make sure to update to latest nextcloud before reporting back. 🤗

[mayerthomas]

Hi @mayerthomas
Is this still occurring? :)
Please make sure to update to latest nextcloud before reporting back. 🤗

Hey @skjnldsv
As I mentioned above, the ldap-quota-sync works correctly.
If the quota-sync also works, when a user exclusively uses the windows-sync-client still has to be tested. The problem for testing is, that the windows-client doesn't show the current quota. There is only an error message when the quota is exceeded.

[skjnldsv]

cc @blizzz :)

[blizzz]

If the quota-sync also works, when a user exclusively uses the windows-sync-client still has to be tested. The problem for testing is, that the windows-client doesn't show the current quota. There is only an error message when the quota is exceeded.

for verification you can check indirectly on the users page as admin.

[mayerthomas]

for verification you can check indirectly on the users page as admin.

Thats right, but only after the quota is updated on the users page. This only happens when the corresponding users logs in.
My problem/question: what, when a user only uses the sync-client? There he only logs in once after installation.

[blizzz]

@mayerthomas there's a sync in a background happening that attempts to update every user twice a day

[mayerthomas]

This does not seem to happen in my case. Is there a possibility to log the results of the background-job?

[blizzz]

Is the background job set to cron or ajax?

[mayerthomas]

It is set to cron and seems to be working. (Last time run 7 minutes ago ;-) )

[blizzz]

If anything is written then to the regular log file, nextcloud.log. Setting the loglevel to 0 (=debug) in the config.php increases verbosity.

[ghost]

This issue has been automatically marked as stale because it has not had recent activity and seems to be missing some essential information. It will be closed if no further activity occurs. Thank you for your contributions.