[Bug]: LDAP backend generally cannot handle sharing to large groups
Open
Nobody has claimed this yet.
0. Needs triage
25-feedback
bug
feature: ldap
feature: sharing
feature: users and groups
- Dominant language
- PHP
- Stars
- 36.9k
- Forks
- 5.2k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 713
Description
⚠️ This issue respects the following points: ⚠️
- This is a bug, not a question or a configuration/webserver/proxy issue.
- This issue is not already reported on Github (I've searched it).
- Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
- Nextcloud Server is running on 64bit capable CPU, PHP and OS.
- I agree to follow Nextcloud's Code of Conduct.
Bug description
There are various issues about LDAP bugs and group sync but I haven't found a matching one; please merge if you think this duplicates one despite my efforts.
I have LDAP users, about 400 of them, and a few groups. Almost all users are a member of "AllPeople" group.
/settings/users/AllPeopleonly show the first ~50 people, and some random- sharing to the group seems to share internally only to those ~50 people, others get 404 for clicking on the pending share
occ group:listgives all the 400 of them- the table
oc_ldap_group_memberssometimes contain 50 people, sometimes all the 400, probably depending on which function triggered update last
Steps to reproduce
- share to a group with many users
- users get notification
- most of them get error (pending/id -> 404)
Expected behavior
Group should be able use consistently more than 50 people.
Installation method
Community Manual installation with Archive
Operating system
Debian/Ubuntu
PHP engine version
PHP 7.4
Web server
Nginx
Database engine version
MariaDB
Is this bug present after an update or on a fresh install?
Updated to a major version (ex. 22.2.3 to 23.0.1)
Are you using the Nextcloud Server Encryption module?
None
What user-backends are you using?
- Default user-backend (database)
- LDAP/ Active Directory
- SSO - SAML
- Other
Configuration report
{
"system": {
"instanceid": "***REMOVED SENSITIVE VALUE***",
"passwordsalt": "***REMOVED SENSITIVE VALUE***",
"secret": "***REMOVED SENSITIVE VALUE***",
"trusted_domains": [
"***REMOVED SENSITIVE VALUE***"
],
"datadirectory": "***REMOVED SENSITIVE VALUE***",
"dbtype": "mysql",
"version": "25.0.1.1",
"overwrite.cli.url": "***REMOVED SENSITIVE VALUE***",
"dbname": "***REMOVED SENSITIVE VALUE***",
"dbhost": "***REMOVED SENSITIVE VALUE***",
"dbport": "",
"dbtableprefix": "oc_",
"mysql.utf8mb4": true,
"dbuser": "***REMOVED SENSITIVE VALUE***",
"dbpassword": "***REMOVED SENSITIVE VALUE***",
"installed": true,
"app_install_overwrite": [
"whiteboard",
"issuetemplate"
],
"memcache.local": "\\OC\\Memcache\\Redis",
"memcache.locking": "\\OC\\Memcache\\Redis",
"memcache.distributed": "\\OC\\Memcache\\Redis",
"redis": {
"host": "***REMOVED SENSITIVE VALUE***",
"port": 6379,
"password": "***REMOVED SENSITIVE VALUE***"
},
"default_phone_region": "HU",
"filelocking.enabled": true,
"maintenance": false,
"loglevel": 2,
"mail_smtpmode": "smtp",
"mail_sendmailmode": "smtp",
"mail_from_address": "***REMOVED SENSITIVE VALUE***",
"mail_domain": "***REMOVED SENSITIVE VALUE***",
"mail_smtphost": "***REMOVED SENSITIVE VALUE***",
"mail_smtpport": "587",
"trusted_proxies": "***REMOVED SENSITIVE VALUE***",
"ldapProviderFactory": "OCA\\User_LDAP\\LDAPProviderFactory"
}
}
List of activated Apps
Enabled: [12/18584]
- activity: 2.17.0
- admin_audit: 1.15.0
- bbb: 2.4.0
- bruteforcesettings: 2.5.0
- calendar: 4.1.0
- circles: 25.0.0
- cloud_federation_api: 1.8.0
- comments: 1.15.0
- contacts: 5.0.1
- contactsinteraction: 1.6.0
- dashboard: 7.5.0
- dav: 1.24.0
- deck: 1.8.2
- drawio: 1.0.5
- event_update_notification: 2.0.0
- federatedfilesharing: 1.15.0
- files: 1.20.1
- files_accesscontrol: 1.15.0
- files_antivirus: 4.0.1
- files_automatedtagging: 1.15.0
- files_downloadactivity: 1.15.0
- files_mindmap: 0.0.27
- files_pdfviewer: 2.6.0
- files_rightclick: 1.4.0
- files_sharing: 1.17.0
- files_trashbin: 1.15.0
- files_versions: 1.18.0
- forms: 3.0.1
- groupfolders: 13.1.0
- groupquota: 0.1.9
- issuetemplate: 0.7.0
- ldap_contacts_backend: 1.5.0
- logreader: 2.10.0
- lookup_server_connector: 1.13.0
- maps: 0.2.1
- nextcloud_announcements: 1.14.0
- notes: 4.6.0
- notifications: 2.13.1
- notify_push: 0.5.0
- oauth2: 1.13.0
- onlyoffice: 7.6.8
- password_policy: 1.15.0
- photos: 2.0.0
- polls: 4.0.0
- privacy: 1.9.0
- provisioning_api: 1.15.0
- quota_warning: 1.15.0
- recommendations: 1.4.0
- registration: 2.0.0
- related_resources: 1.0.3
- serverinfo: 1.15.0
- settings: 1.7.0
- sharebymail: 1.15.0
- sharelisting: 1.1.1
- spreed: 15.0.2
- support: 1.8.0
- survey_client: 1.13.0
- systemtags: 1.15.0
- tasks: 0.14.5
- text: 3.6.0
- theming: 2.0.1
- twofactor_backupcodes: 1.14.0
- twofactor_totp: 7.0.0
- updatenotification: 1.15.0
- user_ldap: 1.15.0
- user_status: 1.5.0
- user_usage_report: 1.9.0
- viewer: 1.9.0
- weather_status: 1.5.0
- whiteboard: 0.0.3
- workflow_script: 1.10.0
- workflowengine: 2.7.0
Disabled:
- announcementcenter: 6.4.0
- apporder: 0.15.0
- duplicatefinder: 0.0.15
- encryption
- federation: 1.13.0
- files_external
- firstrunwizard: 2.12.0
- gpxpod: 5.0.4
- group_default_quota: 0.1.4
- impersonate: 1.11.0
- integration_google: 1.0.8
- sharepermissions: 1.0.1
- suspicious_login
- user_saml: 5.1.0
Nextcloud Signing status
No errors have been found.
Nextcloud Logs
No related logs.
I don't think this is related:
Error files OC\User\NoUserException: Backends provided no user object at lib/private/Files/Node/Root.php line 368 2022-12-06T18:45:46+00:00
0. <<closure>>
OC\Files\Node\Root->getUserFolder(
)
1. lib/private/Files/Node/LazyFolder.php line 72
call_user_func_array(
)
2. lib/private/Files/Node/LazyRoot.php line 40
OC\Files\Node\LazyFolder->__call(
)
3. apps/files_sharing/lib/SharedStorage.php line 146
OC\Files\Node\LazyRoot->getUserFolder(
)
4. apps/files_sharing/lib/SharedStorage.php line 529
OCA\Files_Sharing\SharedStorage->init(
)
5. <<closure>>
OCA\Files_Sharing\SharedStorage->getSourceStorage(
)
6. lib/private/Files/Storage/Wrapper/Wrapper.php line 527
call_user_func_array(
)
7. apps/files_sharing/lib/Cache.php line 97
OC\Files\Storage\Wrapper\Wrapper->__call(
)
8. lib/private/Files/Cache/Wrapper/CacheWrapper.php line 76
OCA\Files_Sharing\Cache->getCache(
)
9. lib/private/Files/Cache/Wrapper/CacheJail.php line 125
OC\Files\Cache\Wrapper\CacheWrapper->get(
)
10. apps/files_sharing/lib/Cache.php line 120
OC\Files\Cache\Wrapper\CacheJail->get(
)
11. lib/private/Files/Node/Root.php line 468
OCA\Files_Sharing\Cache->get(
)
12. <<closure>>
OC\Files\Node\Root->OC\Files\Node\{closure}("*** sensitive parameters replaced ***")
13. lib/private/Files/Node/Root.php line 466
array_map(
)
14. lib/private/Files/Node/LazyUserFolder.php line 67
OC\Files\Node\Root->getByIdInPath(
)
15. apps/files_antivirus/lib/BackgroundJob/BackgroundScanner.php line 198
OC\Files\Node\LazyUserFolder->getById(
Additional info
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce sharing to an LDAP group with more than 50 users, then inspect apps/files_sharing/lib/SharedStorage.php and the LDAP group-sync paths implicated by the inconsistent oc_ldap_group_members data. Compare the affected users with occ group:list and verify that every group member can open the pending share without a 404.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- authentication, backend-api-design
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 32/100