[Bug]: Error occurred while checking server setup using an account with delegated admin privileges

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

I upgraded from 29.0.9 to 30.0.2. and Admin/Overview only shows “Error occurred while checking server setup”. Everything appears to actually be working properly. After testing I determined that the error is only seen when using an account with delegated admin privileges. If the same account is added to the Admin Group, it works. Admin/Overview worked fine with delegated admin privileges in 29.0.9 and this is the first problem I've seen since delegated admin privileges were introduced.

Steps to reproduce

1. Log in to Nextcloud 30.0.2 with Account1, which has delegated admin privileges
2. Visit Admin/Overview, note big red error.
3. Log in with Account2, which is in the Admin Group
4. Visit Admin/Overview, note that there is no big red error.
5. Edit Account1 to be in the Admin Group.
6. Go back to the window from Step 2 and reload.
7. Note that the big red error is gone.

Expected behavior

I expect the same behavior for Admin/Overview for accounts with delegated admin privileges and accounts in the Admin Group - Especially since this was the case for v29.0.9.

Nextcloud Server version

30

Operating system

Other

PHP engine version

PHP 8.3

Web server

Nginx

Database engine version

PostgreSQL

Is this bug present after an update or on a fresh install?

Upgraded to a MAJOR version (ex. 28 to 29)

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

www-data@43552193d26d:~/html$ ./occ config:list system
{
    "system": {
        "apps_paths": [
            {
                "path": "\/var\/www\/html\/apps",
                "url": "\/apps",
                "writable": false
            },
            {
                "path": "\/var\/www\/html\/custom_apps",
                "url": "\/custom_apps",
                "writable": true
            }
        ],
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": {
            "0": "files.sample.com",
            "1": "ncutest.sample.com",
            "3": "10.0.40.233"
        },
        "overwrite.cli.url": "http:\/\/10.0.40.233:9090\/",
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "forwarded_for_headers": [
            "HTTP_X_FORWARDED_FOR"
        ],
        "dbtype": "pgsql",
        "version": "30.0.2.2",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "logtimezone": "UTC",
        "installed": true,
        "ldapIgnoreNamingRules": false,
        "ldapProviderFactory": "\\OCA\\User_LDAP\\LDAPProviderFactory",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpmode": "smtp",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "25",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "default_phone_region": "US",
        "loglevel": 2,
        "log.condition": {
            "apps": [
                "admin_audit"
            ]
        },
        "maintenance": false,
        "maintenance_window_start": 1,
        "theme": "",
        "mail_smtpauthtype": "LOGIN",
        "mail_smtpsecure": "tls",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 6379,
            "password": "***REMOVED SENSITIVE VALUE***"
        },
        "twofactor_enforced": "false",
        "twofactor_enforced_groups": [
            "testbed_admins"
        ],
        "twofactor_enforced_excluded_groups": [],
        "app_install_overwrite": [
            "twofactor_totp"
        ],
        "upgrade.disable-web": true
    }
}

List of activated Apps

www-data@43552193d26d:~/html$ ./occ app:list
Enabled:
  - admin_audit: 1.20.0
  - app_api: 4.0.0
  - circles: 30.0.0
  - cloud_federation_api: 1.13.0
  - collectives: 2.15.0
  - dav: 1.31.1
  - federatedfilesharing: 1.20.0
  - files: 2.2.0
  - files_downloadlimit: 3.0.0
  - files_reminders: 1.3.0
  - files_sharing: 1.22.0
  - files_trashbin: 1.20.1
  - files_versions: 1.23.0
  - firstrunwizard: 3.0.0
  - logreader: 3.0.0
  - lookup_server_connector: 1.18.0
  - oauth2: 1.18.1
  - password_policy: 2.0.0
  - provisioning_api: 1.20.0
  - related_resources: 1.5.0
  - serverinfo: 2.0.0
  - settings: 1.13.0
  - sharebymail: 1.20.0
  - text: 4.1.0
  - theming: 2.5.0
  - twofactor_backupcodes: 1.19.0
  - twofactor_totp: 12.0.0-dev
  - user_ldap: 1.21.0
  - viewer: 3.0.0
  - webhook_listeners: 1.1.0-dev
  - workflowengine: 2.12.0
Disabled:
  - activity: 3.0.0 (installed 2.15.0)
  - bruteforcesettings: 3.0.0 (installed 2.4.0)
  - comments: 1.20.1 (installed 1.12.0)
  - contactsinteraction: 1.11.0 (installed 1.2.0)
  - dashboard: 7.10.0 (installed 7.1.0)
  - encryption: 2.18.0
  - federation: 1.20.0 (installed 1.11.0)
  - files_external: 1.22.0
  - files_pdfviewer: 3.0.0 (installed 2.1.0)
  - files_rightclick: 0.15.1 (installed 1.0.0)
  - nextcloud_announcements: 2.0.0 (installed 1.10.0)
  - notifications: 3.0.0 (installed 2.10.1)
  - openotp_auth: 1.4.5 (installed 1.4.5)
  - photos: 3.0.2 (installed 1.3.0)
  - privacy: 2.0.0 (installed 1.5.0)
  - recommendations: 3.0.0 (installed 1.0.0)
  - support: 2.0.0 (installed 1.4.0)
  - survey_client: 2.0.0 (installed 1.9.0)
  - suspicious_login: 8.0.0
  - systemtags: 1.20.0 (installed 1.12.0)
  - twofactor_nextcloud_notification: 4.0.0
  - updatenotification: 1.20.0 (installed 1.12.0)
  - user_status: 1.10.0 (installed 1.1.1)
  - weather_status: 1.10.0 (installed 1.1.0)

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

{"reqId":"ENCew9GZYx9jCeVBiqAn","level":0,"time":"2024-11-18T21:21:35+00:00","remoteAddr":"xx.yy.178.66","user":"433DA5B0-7A82-4D4E-B7DD-1067BE513330","app":"no app in context","method":"GET","url":"/apps/logreader/api/poll?lastReqId=WxkDfUsZJDa61AhHdAyn","message":"The loading of lazy AppConfig values have been requested","userAgent":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36","version":"30.0.2.2","exception":{"Exception":"RuntimeException","Message":"ignorable exception","Code":0,"Trace":[{"file":"/var/www/html/lib/private/AppConfig.php","line":1180,"function":"loadConfig","class":"OC\\AppConfig","type":"->","args":[null]},{"file":"/var/www/html/lib/private/AppConfig.php","line":100,"function":"loadConfigAll","class":"OC\\AppConfig","type":"->","args":[]},{"file":"/var/www/html/lib/private/AllConfig.php","line":169,"function":"getKeys","class":"OC\\AppConfig","type":"->","args":["user_ldap"]},{"file":"/var/www/html/apps/user_ldap/lib/Helper.php","line":111,"function":"getAppKeys","class":"OC\\AllConfig","type":"->","args":["user_ldap"]},{"file":"/var/www/html/apps/user_ldap/lib/Helper.php","line":52,"function":"getServersConfig","class":"OCA\\User_LDAP\\Helper","type":"->","args":["ldap_configuration_active"]},{"file":"/var/www/html/apps/user_ldap/lib/AppInfo/Application.php","line":114,"function":"getServerConfigurationPrefixes","class":"OCA\\User_LDAP\\Helper","type":"->","args":[true]},{"file":"/var/www/html/lib/private/AppFramework/Bootstrap/FunctionInjector.php","line":28,"function":"OCA\\User_LDAP\\AppInfo\\{closure}","class":"OCA\\User_LDAP\\AppInfo\\Application","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/lib/private/AppFramework/Bootstrap/BootContext.php","line":32,"function":"injectFn","class":"OC\\AppFramework\\Bootstrap\\FunctionInjector","type":"->","args":[{"__class__":"Closure"}]},{"file":"/var/www/html/apps/user_ldap/lib/AppInfo/Application.php","line":105,"function":"injectFn","class":"OC\\AppFramework\\Bootstrap\\BootContext","type":"->","args":[{"__class__":"Closure"}]},{"file":"/var/www/html/lib/private/AppFramework/Bootstrap/Coordinator.php","line":157,"function":"boot","class":"OCA\\User_LDAP\\AppInfo\\Application","type":"->","args":[{"__class__":"OC\\AppFramework\\Bootstrap\\BootContext"}]},{"file":"/var/www/html/lib/private/App/AppManager.php","line":434,"function":"bootApp","class":"OC\\AppFramework\\Bootstrap\\Coordinator","type":"->","args":["user_ldap"]},{"file":"/var/www/html/lib/private/App/AppManager.php","line":211,"function":"loadApp","class":"OC\\App\\AppManager","type":"->","args":["user_ldap"]},{"file":"/var/www/html/lib/private/legacy/OC_App.php","line":85,"function":"loadApps","class":"OC\\App\\AppManager","type":"->","args":[["authentication"]]},{"file":"/var/www/html/lib/base.php","line":973,"function":"loadApps","class":"OC_App","type":"::","args":[["authentication"]]},{"file":"/var/www/html/index.php","line":24,"function":"handleRequest","class":"OC","type":"::","args":[]}],"File":"/var/www/html/lib/private/AppConfig.php","Line":1194,"message":"The loading of lazy AppConfig values have been requested","exception":[],"CustomMessage":"The loading of lazy AppConfig values have been requested"},"id":"673bafdf9c93d"}

Additional info

I'm running in Docker using unprivileged nginx. This was first documented on the Community Forum, and there are some additional details there. I decided to open a ticket here after after 2 weeks without a response, especially since the apparent problem changed.

Reproduce the Admin/Overview request with delegated and full Admin Group accounts, then inspect the trace through apps/user_ldap/lib/Helper.php, apps/user_ldap/lib/AppInfo/Application.php, and lib/private/AppConfig.php. Compare the resulting logs and permissions behavior across both account types; done means delegated administrators no longer receive the setup-check error while full administrators remain unaffected.