I did a new test, this time with two pristine virtual machines.
###server1.example.lan (green: 192.168.0.11)
- Unattended install from NethServer v7-rc2b ISO
- Install updates
- First configuration wizard
- Install nethserver-directory (nethserver-directory-3.1.0.-1.ns7.noarch)
- create users and groups
###server2.example.lan (green: 192.168.0.12)
- Unattended install from NethServer v7-rc2b ISO
- Install updates
- First configuration wizard
- LDAP bind to first server: Configuration > Users and Groups → LDAP provider: 192.168.0.11
- Users and groups are populated correctly
- Install nextcloud module (nethserver-nextcloud-1.0.3-1.ns7.noarch, nextcloud-10.0.0-1.ns7.noarch)
- Open nextcloud with default admin user; access to the Users section:
Internal Server Error
The server encountered an internal error and was unable to complete your request.
Please contact the server administrator if this error reappears multiple times, please include the technical details below in your report.
More details can be found in the server log.
From nextcloud.log:
{“reqId”:“WDCiIJelnRyZ6ZYoBwZEIQAAAAI”,“remoteAddr”:“192.168.0.128”,“app”:“user_ldap”,“message”:“Configuration Error (prefix s01): either no password is given for theuser agent or a password is given, but not anLDAP agent.”,“level”:2,“time”:“2016-11-19T19:04:00+00:00”,“method”:“GET”,“url”:“/nextcloud/”,“user”:“–”}
nextcloud ldap config
[root@server2 ~]# sudo -u apache /usr/bin/php /var/www/html/nextcloud/occ ldap:show-config
+-------------------------------+--------------------------------------------------------------+
| Configuration | s01 |
+-------------------------------+--------------------------------------------------------------+
| hasMemberOfFilterSupport | 0 |
| hasPagedResultSupport | |
| homeFolderNamingRule | |
| lastJpegPhotoLookup | 0 |
| ldapAgentName | cn=ldapservice,dc=example,dc=lan |
| ldapAgentPassword | *** |
| ldapAttributesForGroupSearch | |
| ldapAttributesForUserSearch | |
| ldapBackupHost | |
| ldapBackupPort | |
| ldapBase | dc=directory,dc=nh |
| ldapBaseGroups | |
| ldapBaseUsers | |
| ldapCacheTTL | 600 |
| ldapConfigurationActive | 1 |
| ldapDynamicGroupMemberURL | |
| ldapEmailAttribute | |
| ldapExperiencedAdmin | 0 |
| ldapExpertUUIDGroupAttr | |
| ldapExpertUUIDUserAttr | |
| ldapExpertUsernameAttr | |
| ldapGroupDisplayName | cn |
| ldapGroupFilter | (&(|(objectclass=posixGroup))) |
| ldapGroupFilterGroups | |
| ldapGroupFilterMode | 0 |
| ldapGroupFilterObjectclass | posixGroup |
| ldapGroupMemberAssocAttr | memberUid |
| ldapHost | 192.168.0.11 |
| ldapIgnoreNamingRules | |
| ldapLoginFilter | (&(|(objectclass=inetOrgPerson))(|(uid=%uid)(|(mail=%uid)))) |
| ldapLoginFilterAttributes | |
| ldapLoginFilterEmail | 1 |
| ldapLoginFilterMode | 0 |
| ldapLoginFilterUsername | 1 |
| ldapNestedGroups | 0 |
| ldapOverrideMainServer | |
| ldapPagingSize | 500 |
| ldapPort | 389 |
| ldapQuotaAttribute | |
| ldapQuotaDefault | |
| ldapTLS | 0 |
| ldapUserDisplayName | cn |
| ldapUserDisplayName2 | |
| ldapUserFilter | (|(objectclass=inetOrgPerson)) |
| ldapUserFilterGroups | |
| ldapUserFilterMode | 0 |
| ldapUserFilterObjectclass | inetOrgPerson |
| ldapUuidGroupAttribute | auto |
| ldapUuidUserAttribute | auto |
| turnOffCertCheck | 0 |
| useMemberOfToDetectMembership | 0 |
+-------------------------------+--------------------------------------------------------------+
In this case no packages from testing repo were used. But installing them at this stage will lock you out of nextcloud as explained in the first post.
Some additional notes after installing packages from testing:
-
nextcloud’s dav app files seem up to date, but occ shows the previous version number (1.0.0)
-
occ ldap commands are not available (due to failed upgrade)
-
disabling nextcloud’s user_ldap app allows the upgrade process to finish successfully, dav app version is corrected, and admin has access to nextcloud:
sudo -u apache php /var/www/html/nextcloud/occ app:disable user_ldap
sudo -u apache php /var/www/html/nextcloud/occ upgrade
sudo -u apache php /var/www/html/nextcloud/occ maintenance:mode --off
-
re-enabling user_ldap app (LDAP user and group backend 1.0.1) ends with nextcloud’s Internal Server Error, as before, but enables the occ ldap commands and access to ldap settings.
Further tests:
[root@server2 ~]# sudo -u apache php /var/www/html/nextcloud/occ ldap:test-config s01
The configuration is invalid. Please have a look at the logs for further details.
[root@server2 ~]# sudo -u apache php /var/www/html/nextcloud/occ ldap:set-config s01 ldapAgentPassword "CA3cDM6f65Vsg2Op"
[root@server2 ~]# sudo -u apache php /var/www/html/nextcloud/occ ldap:test-config s01
The configuration is valid, but the Bind failed. Please check the server settings and credentials.
[root@server2 ~]# sudo -u apache php /var/www/html/nextcloud/occ ldap:set-config s01 ldapTLS 1
[root@server2 ~]# sudo -u apache php /var/www/html/nextcloud/occ ldap:test-config s01
[OC\ServerNotAvailableException]
Lost connection to LDAP server.
ldap:test-config <configID>
Anonymous bind works
[root@server2 ~]# sudo -u apache php /var/www/html/nextcloud/occ -vvvv ldap:test-config s01
The configuration is valid and the connection could be established!
[root@server2 ~]# sudo -u apache php /var/www/html/nextcloud/occ ldap:show-config
+-------------------------------+--------------------------------------------------------------+
| Configuration | s01 |
+-------------------------------+--------------------------------------------------------------+
| hasMemberOfFilterSupport | |
| hasPagedResultSupport | |
| homeFolderNamingRule | |
| lastJpegPhotoLookup | 0 |
| ldapAgentName | |
| ldapAgentPassword | *** |
| ldapAttributesForGroupSearch | |
| ldapAttributesForUserSearch | |
| ldapBackupHost | |
| ldapBackupPort | |
| ldapBase | dc=directory,dc=nh |
| ldapBaseGroups | dc=directory,dc=nh |
| ldapBaseUsers | dc=directory,dc=nh |
| ldapCacheTTL | 600 |
| ldapConfigurationActive | 1 |
| ldapDynamicGroupMemberURL | |
| ldapEmailAttribute | |
| ldapExperiencedAdmin | 0 |
| ldapExpertUUIDGroupAttr | |
| ldapExpertUUIDUserAttr | |
| ldapExpertUsernameAttr | |
| ldapGroupDisplayName | cn |
| ldapGroupFilter | (&(|(objectclass=posixGroup))) |
| ldapGroupFilterGroups | |
| ldapGroupFilterMode | 0 |
| ldapGroupFilterObjectclass | posixGroup |
| ldapGroupMemberAssocAttr | memberUid |
| ldapHost | 192.168.0.11 |
| ldapIgnoreNamingRules | |
| ldapLoginFilter | (&(|(objectclass=inetOrgPerson))(|(uid=%uid)(|(mail=%uid)))) |
| ldapLoginFilterAttributes | |
| ldapLoginFilterEmail | 1 |
| ldapLoginFilterMode | 0 |
| ldapLoginFilterUsername | 1 |
| ldapNestedGroups | 0 |
| ldapOverrideMainServer | |
| ldapPagingSize | 500 |
| ldapPort | 389 |
| ldapQuotaAttribute | |
| ldapQuotaDefault | |
| ldapTLS | 0 |
| ldapUserDisplayName | cn |
| ldapUserDisplayName2 | |
| ldapUserFilter | (|(objectclass=inetOrgPerson)) |
| ldapUserFilterGroups | |
| ldapUserFilterMode | 0 |
| ldapUserFilterObjectclass | inetOrgPerson |
| ldapUuidGroupAttribute | auto |
| ldapUuidUserAttribute | auto |
| turnOffCertCheck | 0 |
| useMemberOfToDetectMembership | 0 |
+-------------------------------+--------------------------------------------------------------+
Tried a few noob things but was unable to make an authenticated bind and use TLS.
PS: Sorry for the long post.
I changed its value at some point but surely with other settings wrong at that time.