[Bug]: LDAP shows "Invalid query" for a valid LDAP filter and does not save it via UI

⚠️ This issue respects the following points: ⚠️

• This is not a troubleshooting question, general support matter, or webserver/proxy problem, but likely a bug (if unsure, ask the Community Help Forum).
• This issue is not already reported on Github OR solved at the Community Help Forum (I've searched!).
• I'm using a maintained major version of Nextcloud Server and tested against the latest patch level. (Supported major versions and current patch levels).
• I agree to follow Nextcloud's Code of Conduct.
• I've tried my best to provide clear reproduction steps that someone unfamiliar with this bug could use to reproduce it.

Bug description

We use LDAP for user authentication and have a rather simple filter set: (&(objectclass=user)(|(department=departmentname)(employeeNumber=123456))). This filter was set via the Web UI in the past on some previous major version, and has been working perfectly fine since then.

There is a need to add an additional employeeNumber entry to this filter. In the meantime we have updated to the latest version of Nextcloud. Now, when switching from the "Server" to the "Benutzer" tab (language is set to german, probably "User" in english) in the LDAP Configuration an error is shown: "Invalid query, please check the syntax. API specifications are here: http://www.freedesktop.org/wiki/Specifications/open-collaboration-services.". This error prevents us from changing the user filter, as it does not seem to save the new one if this validation fails.

Setting the ldapUserFilter configuration to the new filter via the occ command works fine.

This is a screenshot of the error being shown (this is after changing the filter via occ, but it showed the same error with the old filter too, and both filters work fine in practice):

Even a filter as simple as (objectclass=user) produces the error:

One thing to note is that this LDAP configuration has an empty string as its name or configID. I think it predates the support for more than one LDAP config.

Steps to reproduce

I don't know if this is reproducible on a fresh installation, but it is:

1. Configure an LDAP server
2. Try to change the user filter in any way

Expected behavior

I expected the filter to be accepted, the query to work, the user count to be shown correctly, and the filter to be saved.

Nextcloud Server version

34

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.4

Web server

Apache (supported)

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Upgraded to a MAJOR version (ex. 31 to 32)

Are you using the Nextcloud Server Encryption module?

Encryption is Disabled

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "default_phone_region": "DE",
        "auth.bruteforce.protection.enabled": true,
        "forbidden_filenames": [
            ".htaccess",
            "Thumbs.db",
            "thumbs.db"
        ],
        "cron_log": true,
        "enable_previews": true,
        "enabledPreviewProviders": [
            "OC\\Preview\\PNG",
            "OC\\Preview\\JPEG",
            "OC\\Preview\\GIF",
            "OC\\Preview\\BMP",
            "OC\\Preview\\XBitmap",
            "OC\\Preview\\Movie",
            "OC\\Preview\\PDF",
            "OC\\Preview\\MP3",
            "OC\\Preview\\TXT",
            "OC\\Preview\\MarkDown",
            "OC\\Preview\\HEIC",
            "OC\\Preview\\Movie",
            "OC\\Preview\\MKV",
            "OC\\Preview\\MP4",
            "OC\\Preview\\AVI"
        ],
        "preview_max_x": 1024,
        "preview_max_y": 768,
        "preview_max_scale_factor": 1,
        "filesystem_check_changes": 0,
        "filelocking.enabled": "true",
        "htaccess.RewriteBase": "\/",
        "integrity.check.disabled": false,
        "knowledgebaseenabled": false,
        "logfile": "\/var\/log\/nextcloud\/nextcloud.log",
        "loglevel": 2,
        "logtimezone": "Europe\/Berlin",
        "log_rotate_size": 104857600,
        "overwriteprotocol": "https",
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "ice4cloud.fz-juelich.de",
            "icg1333.icg.kfa-juelich.de"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "overwrite.cli.url": "https:\/\/ice4cloud.fz-juelich.de",
        "dbtype": "mysql",
        "version": "34.0.3.2",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "ldapUserCleanupInterval": 51,
        "ldapIgnoreNamingRules": false,
        "ldapProviderFactory": "\\OCA\\User_LDAP\\LDAPProviderFactory",
        "maintenance": false,
        "maintenance_window_start": 1,
        "theme": "",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "memcached_servers": [
            [
                "localhost",
                11211
            ]
        ],
        "memcached_options": {
            "14": 50,
            "15": 50,
            "19": 50,
            "20": 50,
            "8": 50,
            "-1001": true,
            "16": true,
            "18": true
        },
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 0,
            "timeout": 0.5,
            "dbindex": 1,
            "password": "***REMOVED SENSITIVE VALUE***"
        },
        "mail_smtpmode": "smtp",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "25",
        "mail_smtpauthtype": "PLAIN",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "updater.release.channel": "stable",
        "app_install_overwrite": [
            "spreed",
            "bbb",
            "rocketchat_nextcloud",
            "documentserver_community",
            "apporder"
        ],
        "mysql.utf8mb4": true,
        "encryption.legacy_format_support": false,
        "encryption.key_storage_migrated": false,
        "mail_sendmailmode": "smtp",
        "onlyoffice": {
            "verify_peer_off": false
        },
        "remember_login_cookie_lifetime": 36000,
        "session_lifetime": 36000,
        "session_keepalive": true,
        "auto_logout": true,
        "activity_expire_days": 14,
        "allow_local_remote_servers": true,
        "profile.enabled": false,
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "overwritehost": "ice4cloud.fz-juelich.de"
    }
}

List of activated Apps

Enabled:
  - activity: 7.0.0
  - admin_audit: 1.24.0
  - app_api: 34.0.0
  - appstore: 1.0.0
  - assistant: 3.5.0
  - bbb: 2.9.3
  - bruteforcesettings: 7.0.0
  - calendar: 6.5.4
  - circles: 34.0.0
  - cloud_federation_api: 1.18.0
  - collectives: 4.6.0
  - comments: 1.24.0
  - contacts: 8.7.6
  - contactsinteraction: 1.15.0
  - dashboard: 7.14.0
  - dav: 1.40.0
  - deck: 1.18.3
  - drawio: 4.3.8
  - external: 9.0.1
  - federatedfilesharing: 1.24.0
  - federation: 1.24.0
  - files: 2.6.0
  - files_automatedtagging: 5.0.0
  - files_downloadlimit: 5.2.0
  - files_external: 1.26.0
  - files_lock: 34.0.1
  - files_reminders: 1.7.0
  - files_sharing: 1.26.0
  - files_trashbin: 1.24.0
  - files_versions: 1.27.0
  - firstrunwizard: 7.0.0-dev.0
  - forms: 5.3.6
  - groupfolders: 22.0.6
  - iframewidget: 1.0.3
  - integration_openai: 4.5.2
  - integration_zimbra: 1.1.0
  - logreader: 7.0.0
  - lookup_server_connector: 1.22.0
  - nextcloud_announcements: 6.0.0
  - notes: 6.0.2
  - notifications: 7.0.0-dev.1
  - notify_push: 1.4.0
  - oauth2: 1.22.0
  - office: 1.0.0
  - password_policy: 6.0.0-dev.0
  - photos: 7.0.0
  - privacy: 6.0.0-dev.1
  - profile: 1.3.0
  - provisioning_api: 1.24.0
  - recommendations: 7.0.0
  - related_resources: 5.0.0-dev.0
  - richdocuments: 11.1.0
  - serverinfo: 6.0.0
  - settings: 1.17.0
  - sharebymail: 1.24.0
  - support: 6.0.0
  - survey_client: 6.0.0-dev.0
  - suspicious_login: 12.0.0-dev.0
  - systemtags: 1.24.0
  - text: 8.0.0
  - theming: 2.9.0
  - twofactor_backupcodes: 1.23.0
  - twofactor_totp: 16.0.0
  - updatenotification: 1.24.0
  - user_ldap: 1.25.0
  - user_status: 1.14.0
  - viewer: 7.0.0-dev.0
  - weather_status: 1.14.0
  - webhook_listeners: 1.6.0
  - workflowengine: 2.16.0
Disabled:
  - audioplayer: 3.9.0 (installed 3.9.0)
  - bookmarks: 16.2.6 (installed 16.2.6)
  - context_chat: 5.4.0 (installed 5.3.1)
  - encryption: 2.22.0 (installed 2.17.0)
  - event_update_notification: 2.9.0 (installed 2.9.0)
  - files_pdfviewer: 7.0.0-dev.0 (installed 5.0.0-dev.0)
  - htmlviewer: 34.0.0 (installed 34.0.0)
  - integration_github: 3.2.7 (installed 3.2.7)
  - integration_gitlab: 5.0.0 (installed 5.0.0)
  - integration_mattermost: 3.2.0 (installed 3.2.0)
  - libresign: 14.1.0 (installed 14.1.0)
  - mail: 5.11.2 (installed 5.11.2)
  - polls: 9.2.1 (installed 8.6.3)
  - richdocumentscode: 26.4.104 (installed 26.4.104)
  - rocketchat_nextcloud: 0.9.6 (installed 0.9.6)
  - spreed: 24.0.4 (installed 24.0.4)
  - tables: 2.2.2 (installed 2.2.2)
  - tasks: 0.18.1 (installed 0.18.1)
  - twofactor_nextcloud_notification: 8.0.0

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

The error does not produce any log entry.

Additional info

No response

Reproduce the problem in the LDAP Configuration User tab with a valid filter, including the simple (objectclass=user) case, and compare it with the same value set through occ. Trace the UI validation and save path for the LDAP user filter. Done means the filter is accepted, the user count is shown, and the edited filter is saved.