[Bug]: Nextcloud 32 breaks LDAP for some overlay directory schemas

[vwbusguy]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

Upon upgrading to Nextcloud 32, Nextcloud throws an exception due to LDAP connection problems with an LDAP config that has worked in previous versions of Nextcloud. This is due to assumptions that the User/Group base is always the same as root base, but this may not be true for some overlay directory schemas. This doesn't just break LDAP login, but causes Nextcloud to throw an exception generally for web based requests.

Commenting out the checks allows users and groups to resolve normally with the previous config.

Steps to reproduce

1. Set up LDAP auth where users and groups have a different base on Nextcloud <32
2. Upgrade to Nextcloud 32
3. Observe the fireworks

Expected behavior

Upgrades between Nextcloud versions continue to generally function and/or gracefully handle breaking configuration changes between versions.

Nextcloud Server version

32

Operating system

RHEL/CentOS

PHP engine version

PHP 8.2

Web server

Other

Database engine version

MariaDB

Is this bug present after an update or on a fresh install?

Upgraded to a MAJOR version (ex. 31 to 32)

Are you using the Nextcloud Server Encryption module?

None

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "nextcloud.lsit.ucsb.edu"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "32.0.0.13",
        "overwrite.cli.url": "https:\/\/nextcloud.lsit.ucsb.edu",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "default_language": "en",
        "default_locale": "en_US",
        "default_phone_region": "US",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "ldapProviderFactory": "OCA\\User_LDAP\\LDAPProviderFactory",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 6379
        },
        "updater.secret": "***REMOVED SENSITIVE VALUE***",
        "maintenance": false,
        "theme": "",
        "loglevel": 2
    }
}

List of activated Apps

Enabled:
  - activity: 5.0.0-dev.0
  - admin_audit: 1.22.0
  - announcementcenter: 7.2.1
  - app_api: 32.0.0
  - approval: 2.4.0
  - bruteforcesettings: 5.0.0-dev.0
  - circles: 32.0.0
  - cloud_federation_api: 1.16.0
  - comments: 1.22.0
  - contacts: 8.0.2
  - contactsinteraction: 1.13.1
  - dashboard: 7.12.0
  - dav: 1.34.2
  - federatedfilesharing: 1.22.0
  - federation: 1.22.0
  - files: 2.4.0
  - files_accesscontrol: 3.0.0
  - files_automatedtagging: 3.0.0
  - files_downloadlimit: 5.0.0-dev.0
  - files_external: 1.24.0
  - files_pdfviewer: 5.0.0-dev.0
  - files_reminders: 1.5.0
  - files_retention: 3.0.0
  - files_sharing: 1.24.0
  - files_trashbin: 1.22.0
  - files_versions: 1.25.0
  - firstrunwizard: 5.0.0-dev.0
  - logreader: 5.0.0-dev.0
  - lookup_server_connector: 1.20.0
  - nextcloud_announcements: 4.0.0-dev.0
  - notes: 4.12.3
  - notifications: 5.0.0-dev.0
  - oauth2: 1.20.0
  - password_policy: 4.0.0-dev.0
  - photos: 5.0.0-dev.1
  - privacy: 4.0.0-dev.0
  - profile: 1.1.0
  - provisioning_api: 1.22.0
  - quota_warning: 1.22.0
  - recommendations: 5.0.0-dev.0
  - related_resources: 3.0.0-dev.0
  - richdocuments: 9.0.0
  - serverinfo: 4.0.0-dev.0
  - settings: 1.15.1
  - sharebymail: 1.22.0
  - spreed: 22.0.0
  - support: 4.0.0-dev.0
  - survey_client: 4.0.0-dev.0
  - systemtags: 1.22.0
  - terms_of_service: 4.6.0
  - text: 6.0.0-dev.0
  - theming: 2.7.0
  - twofactor_backupcodes: 1.21.0
  - updatenotification: 1.22.0
  - user_ldap: 1.23.0
  - user_status: 1.12.0
  - viewer: 5.0.0-dev.0
  - weather_status: 1.12.0
  - webhook_listeners: 1.3.0
  - workflowengine: 2.14.0
Disabled:
  - cfg_share_links: 7.0.1 (installed 7.0.1)
  - deck: 1.15.2 (installed 1.15.2)
  - drawio: 3.1.0 (installed 3.1.0)
  - encryption: 2.20.0
  - files_downloadactivity: 1.18.1 (installed 1.18.1)
  - files_rightclick: 0.15.1 (installed 1.6.0)
  - forms: 5.1.0 (installed 5.1.0)
  - groupfolders: 19.0.4 (installed 19.0.4)
  - socialsharing_email: 3.3.0 (installed 3.3.0)
  - suspicious_login: 10.0.0-dev.0
  - tasks: 0.16.1 (installed 0.16.1)
  - twofactor_nextcloud_notification: 6.0.0-dev.0
  - twofactor_totp: 14.0.0

Nextcloud Signing status

No errors have been found.

Nextcloud Logs

{"reqId":"fpTz1k9Kb2FqJhBzk984","level":3,"time":"2025-10-07T17:40:42+00:00","remoteAddr":"184.189.235.227","user":"--","app":"no app in context","method":"PROPFIND","url":"/remote.php/dav/files/scottwilliams_3700/","message":"Connection to LDAP server could not be established","userAgent":"Mozilla/5.0 (Linux) mirall/3.16.3daily (Nextcloud, fedora-6.16.8-200.fc42.x86_64 ClientArchitecture: x86_64 OsArchitecture: x86_64)","version":"32.0.0.13","clientReqId":"ad464a43-a1eb-49fa-bc93-eed8107ea1a7","exception":{"Exception":"OC\\ServerNotAvailableException","Message":"Connection to LDAP server could not be established","Code":0,"Trace":[{"file":"/var/www/html/apps/user_ldap/lib/Access.php","line":1118,"function":"getConnectionResource","class":"OCA\\User_LDAP\\Connection","type":"->"},{"file":"/var/www/html/apps/user_ldap/lib/Access.php","line":1294,"function":"executeSearch","class":"OCA\\User_LDAP\\Access","type":"->"},{"file":"/var/www/html/apps/user_ldap/lib/Access.php","line":985,"function":"search","class":"OCA\\User_LDAP\\Access","type":"->"},{"file":"/var/www/html/apps/user_ldap/lib/Access.php","line":894,"function":"searchUsers","class":"OCA\\User_LDAP\\Access","type":"->"},{"file":"/var/www/html/apps/user_ldap/lib/Access.php","line":874,"function":"fetchListOfUsers","class":"OCA\\User_LDAP\\Access","type":"->"},{"file":"/var/www/html/apps/user_ldap/lib/User_LDAP.php","line":120,"function":"fetchUsersByLoginName","class":"OCA\\User_LDAP\\Access","type":"->"},{"file":"/var/www/html/apps/user_ldap/lib/User_LDAP.php","line":80,"function":"getLDAPUserByLoginName","class":"OCA\\User_LDAP\\User_LDAP","type":"->"},{"function":"loginName2UserName","class":"OCA\\User_LDAP\\User_LDAP","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/apps/user_ldap/lib/User_Proxy.php","line":66,"function":"call_user_func_array"},{"file":"/var/www/html/apps/user_ldap/lib/Proxy.php","line":153,"function":"walkBackends","class":"OCA\\User_LDAP\\User_Proxy","type":"->"},{"file":"/var/www/html/apps/user_ldap/lib/User_Proxy.php","line":226,"function":"handleRequest","class":"OCA\\User_LDAP\\Proxy","type":"->"},{"file":"/var/www/html/apps/user_ldap/lib/Helper.php","line":298,"function":"loginName2UserName","class":"OCA\\User_LDAP\\User_Proxy","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/lib/private/legacy/OC_Hook.php","line":85,"function":"loginName2UserName","class":"OCA\\User_LDAP\\Helper","type":"::","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/lib/public/Util.php","line":432,"function":"emit","class":"OC_Hook","type":"::"},{"file":"/var/www/html/apps/password_policy/lib/ComplianceService.php","line":61,"function":"emitHook","class":"OCP\\Util","type":"::"},{"file":"/var/www/html/apps/password_policy/lib/Listener/BeforeUserLoggedInEventListener.php","line":31,"function":"entryControl","class":"OCA\\Password_Policy\\ComplianceService","type":"->"},{"file":"/var/www/html/lib/private/EventDispatcher/ServiceEventListener.php","line":57,"function":"handle","class":"OCA\\Password_Policy\\Listener\\BeforeUserLoggedInEventListener","type":"->"},{"file":"/var/www/html/3rdparty/symfony/event-dispatcher/EventDispatcher.php","line":220,"function":"__invoke","class":"OC\\EventDispatcher\\ServiceEventListener","type":"->"},{"file":"/var/www/html/3rdparty/symfony/event-dispatcher/EventDispatcher.php","line":56,"function":"callListeners","class":"Symfony\\Component\\EventDispatcher\\EventDispatcher","type":"->"},{"file":"/var/www/html/lib/private/EventDispatcher/EventDispatcher.php","line":67,"function":"dispatch","class":"Symfony\\Component\\EventDispatcher\\EventDispatcher","type":"->"},{"file":"/var/www/html/lib/private/EventDispatcher/EventDispatcher.php","line":79,"function":"dispatch","class":"OC\\EventDispatcher\\EventDispatcher","type":"->"},{"file":"/var/www/html/lib/private/Server.php","line":518,"function":"dispatchTyped","class":"OC\\EventDispatcher\\EventDispatcher","type":"->"},{"function":"OC\\{closure}","class":"OC\\Server","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/lib/private/Hooks/EmitterTrait.php","line":89,"function":"call_user_func_array"},{"file":"/var/www/html/lib/private/Hooks/PublicEmitter.php","line":23,"function":"emit","class":"OC\\Hooks\\BasicEmitter","type":"->"},{"file":"/var/www/html/lib/private/User/Session.php","line":388,"function":"emit","class":"OC\\Hooks\\PublicEmitter","type":"->"},{"file":"/var/www/html/apps/dav/lib/Connector/Sabre/Auth.php","line":81,"function":"logClientIn","class":"OC\\User\\Session","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/3rdparty/sabre/dav/lib/DAV/Auth/Backend/AbstractBasic.php","line":103,"function":"validateUserPass","class":"OCA\\DAV\\Connector\\Sabre\\Auth","type":"->","args":["*** sensitive parameters replaced ***"]},{"file":"/var/www/html/apps/dav/lib/Connector/Sabre/Auth.php","line":193,"function":"check","class":"Sabre\\DAV\\Auth\\Backend\\AbstractBasic","type":"->"},{"file":"/var/www/html/apps/dav/lib/Connector/Sabre/Auth.php","line":106,"function":"auth","class":"OCA\\DAV\\Connector\\Sabre\\Auth","type":"->"},{"file":"/var/www/html/3rdparty/sabre/dav/lib/DAV/Auth/Plugin.php","line":179,"function":"check","class":"OCA\\DAV\\Connector\\Sabre\\Auth","type":"->"},{"file":"/var/www/html/3rdparty/sabre/dav/lib/DAV/Auth/Plugin.php","line":135,"function":"check","class":"Sabre\\DAV\\Auth\\Plugin","type":"->"},{"file":"/var/www/html/3rdparty/sabre/event/lib/WildcardEmitterTrait.php","line":89,"function":"beforeMethod","class":"Sabre\\DAV\\Auth\\Plugin","type":"->"},{"file":"/var/www/html/3rdparty/sabre/dav/lib/DAV/Server.php","line":456,"function":"emit","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/var/www/html/apps/dav/lib/Connector/Sabre/Server.php","line":211,"function":"invokeMethod","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/var/www/html/apps/dav/lib/Server.php","line":424,"function":"start","class":"OCA\\DAV\\Connector\\Sabre\\Server","type":"->"},{"file":"/var/www/html/apps/dav/appinfo/v2/remote.php","line":22,"function":"exec","class":"OCA\\DAV\\Server","type":"->"},{"file":"/var/www/html/remote.php","line":151,"args":["/var/www/html/apps/dav/appinfo/v2/remote.php"],"function":"require_once"}],"File":"/var/www/html/apps/user_ldap/lib/Connection.php","Line":249,"message":"Connection to LDAP server could not be established","exception":{},"CustomMessage":"Connection to LDAP server could not be established"}}
{"reqId":"fpTz1k9Kb2FqJhBzk984","level":3,"time":"2025-10-07T17:40:42+00:00","remoteAddr":"184.189.235.227","user":"--","app":"webdav","method":"PROPFIND","url":"/remote.php/dav/files/scottwilliams_3700/","message":"OC\\ServerNotAvailableException: Connection to LDAP server could not be established","userAgent":"Mozilla/5.0 (Linux) mirall/3.16.3daily (Nextcloud, fedora-6.16.8-200.fc42.x86_64 ClientArchitecture: x86_64 OsArchitecture: x86_64)","version":"32.0.0.13","clientReqId":"ad464a43-a1eb-49fa-bc93-eed8107ea1a7","exception":{"Exception":"Sabre\\DAV\\Exception\\ServiceUnavailable","Message":"OC\\ServerNotAvailableException: Connection to LDAP server could not be established","Code":0,"Trace":[{"file":"/var/www/html/3rdparty/sabre/dav/lib/DAV/Auth/Plugin.php","line":179,"function":"check","class":"OCA\\DAV\\Connector\\Sabre\\Auth","type":"->"},{"file":"/var/www/html/3rdparty/sabre/dav/lib/DAV/Auth/Plugin.php","line":135,"function":"check","class":"Sabre\\DAV\\Auth\\Plugin","type":"->"},{"file":"/var/www/html/3rdparty/sabre/event/lib/WildcardEmitterTrait.php","line":89,"function":"beforeMethod","class":"Sabre\\DAV\\Auth\\Plugin","type":"->"},{"file":"/var/www/html/3rdparty/sabre/dav/lib/DAV/Server.php","line":456,"function":"emit","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/var/www/html/apps/dav/lib/Connector/Sabre/Server.php","line":211,"function":"invokeMethod","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/var/www/html/apps/dav/lib/Server.php","line":424,"function":"start","class":"OCA\\DAV\\Connector\\Sabre\\Server","type":"->"},{"file":"/var/www/html/apps/dav/appinfo/v2/remote.php","line":22,"function":"exec","class":"OCA\\DAV\\Server","type":"->"},{"file":"/var/www/html/remote.php","line":151,"args":["/var/www/html/apps/dav/appinfo/v2/remote.php"],"function":"require_once"}],"File":"/var/www/html/apps/dav/lib/Connector/Sabre/Auth.php","Line":113,"message":"OC\\ServerNotAvailableException: Connection to LDAP server could not be established","exception":{},"CustomMessage":"OC\\ServerNotAvailableException: Connection to LDAP server could not be established"}}
{"reqId":"fpTz1k9Kb2FqJhBzk984","level":3,"time":"2025-10-07T17:40:42+00:00","remoteAddr":"184.189.235.227","user":"--","app":"no app in context","method":"PROPFIND","url":"/remote.php/dav/files/scottwilliams_3700/","message":"Uncaught exception","userAgent":"Mozilla/5.0 (Linux) mirall/3.16.3daily (Nextcloud, fedora-6.16.8-200.fc42.x86_64 ClientArchitecture: x86_64 OsArchitecture: x86_64)","version":"32.0.0.13","clientReqId":"ad464a43-a1eb-49fa-bc93-eed8107ea1a7","exception":{"Exception":"Sabre\\DAV\\Exception\\ServiceUnavailable","Message":"OC\\ServerNotAvailableException: Connection to LDAP server could not be established","Code":0,"Trace":[{"file":"/var/www/html/3rdparty/sabre/dav/lib/DAV/Auth/Plugin.php","line":179,"function":"check","class":"OCA\\DAV\\Connector\\Sabre\\Auth","type":"->"},{"file":"/var/www/html/3rdparty/sabre/dav/lib/DAV/Auth/Plugin.php","line":135,"function":"check","class":"Sabre\\DAV\\Auth\\Plugin","type":"->"},{"file":"/var/www/html/3rdparty/sabre/event/lib/WildcardEmitterTrait.php","line":89,"function":"beforeMethod","class":"Sabre\\DAV\\Auth\\Plugin","type":"->"},{"file":"/var/www/html/3rdparty/sabre/dav/lib/DAV/Server.php","line":456,"function":"emit","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/var/www/html/apps/dav/lib/Connector/Sabre/Server.php","line":211,"function":"invokeMethod","class":"Sabre\\DAV\\Server","type":"->"},{"file":"/var/www/html/apps/dav/lib/Server.php","line":424,"function":"start","class":"OCA\\DAV\\Connector\\Sabre\\Server","type":"->"},{"file":"/var/www/html/apps/dav/appinfo/v2/remote.php","line":22,"function":"exec","class":"OCA\\DAV\\Server","type":"->"},{"file":"/var/www/html/remote.php","line":151,"args":["/var/www/html/apps/dav/appinfo/v2/remote.php"],"function":"require_once"}],"File":"/var/www/html/apps/dav/lib/Connector/Sabre/Auth.php","Line":113,"message":"Uncaught exception","exception":{},"CustomMessage":"Uncaught exception"}}
{"reqId":"YfMGzafIVpwypISXVsRT","level":2,"time":"2025-10-07T17:41:05+00:00","remoteAddr":"","user":"--","app":"no app in context","method":"","url":"--","message":"Configuration Error (prefix s01): User base is not in root base","userAgent":"--","version":"32.0.0.13","exception":{"Exception":"OCA\\User_LDAP\\Exceptions\\ConfigurationIssueException","Message":"User base is not in root base","Code":0,"Trace":[{"file":"/var/www/html/apps/user_ldap/lib/Connection.php","line":584,"function":"doCriticalValidation","class":"OCA\\User_LDAP\\Connection","type":"->"},{"file":"/var/www/html/apps/user_ldap/lib/Connection.php","line":329,"function":"validateConfiguration","class":"OCA\\User_LDAP\\Connection","type":"->"},{"file":"/var/www/html/apps/user_ldap/lib/Connection.php","line":369,"function":"readConfiguration","class":"OCA\\User_LDAP\\Connection","type":"->"},{"file":"/var/www/html/apps/user_ldap/lib/Command/TestConfig.php","line":77,"function":"getConfiguration","class":"OCA\\User_LDAP\\Connection","type":"->"},{"file":"/var/www/html/apps/user_ldap/lib/Command/TestConfig.php","line":53,"function":"testConfig","class":"OCA\\User_LDAP\\Command\\TestConfig","type":"->"},{"file":"/var/www/html/3rdparty/symfony/console/Command/Command.php","line":326,"function":"execute","class":"OCA\\User_LDAP\\Command\\TestConfig","type":"->"},{"file":"/var/www/html/3rdparty/symfony/console/Application.php","line":1078,"function":"run","class":"Symfony\\Component\\Console\\Command\\Command","type":"->"},{"file":"/var/www/html/3rdparty/symfony/console/Application.php","line":324,"function":"doRunCommand","class":"Symfony\\Component\\Console\\Application","type":"->"},{"file":"/var/www/html/3rdparty/symfony/console/Application.php","line":175,"function":"doRun","class":"Symfony\\Component\\Console\\Application","type":"->"},{"file":"/var/www/html/lib/private/Console/Application.php","line":187,"function":"run","class":"Symfony\\Component\\Console\\Application","type":"->"},{"file":"/var/www/html/console.php","line":90,"function":"run","class":"OC\\Console\\Application","type":"->"},{"file":"/var/www/html/occ","line":33,"args":["/var/www/html/console.php"],"function":"require_once"}],"File":"/var/www/html/apps/user_ldap/lib/Connection.php","Line":524,"Hint":"User base DN is not a subnode of global base DN","message":"Configuration Error (prefix s01): User base is not in root base","exception":{},"CustomMessage":"Configuration Error (prefix s01): User base is not in root base"}}
{"reqId":"YfMGzafIVpwypISXVsRT","level":2,"time":"2025-10-07T17:41:05+00:00","remoteAddr":"","user":"--","app":"no app in context","method":"","url":"--","message":"Configuration Error (prefix s01): User base is not in root base","userAgent":"--","version":"32.0.0.13","exception":{"Exception":"OCA\\User_LDAP\\Exceptions\\ConfigurationIssueException","Message":"User base is not in root base","Code":0,"Trace":[{"file":"/var/www/html/apps/user_ldap/lib/Connection.php","line":584,"function":"doCriticalValidation","class":"OCA\\User_LDAP\\Connection","type":"->"},{"file":"/var/www/html/apps/user_ldap/lib/Connection.php","line":347,"function":"validateConfiguration","class":"OCA\\User_LDAP\\Connection","type":"->"},{"file":"/var/www/html/apps/user_ldap/lib/Command/TestConfig.php","line":79,"function":"setConfiguration","class":"OCA\\User_LDAP\\Connection","type":"->"},{"file":"/var/www/html/apps/user_ldap/lib/Command/TestConfig.php","line":53,"function":"testConfig","class":"OCA\\User_LDAP\\Command\\TestConfig","type":"->"},{"file":"/var/www/html/3rdparty/symfony/console/Command/Command.php","line":326,"function":"execute","class":"OCA\\User_LDAP\\Command\\TestConfig","type":"->"},{"file":"/var/www/html/3rdparty/symfony/console/Application.php","line":1078,"function":"run","class":"Symfony\\Component\\Console\\Command\\Command","type":"->"},{"file":"/var/www/html/3rdparty/symfony/console/Application.php","line":324,"function":"doRunCommand","class":"Symfony\\Component\\Console\\Application","type":"->"},{"file":"/var/www/html/3rdparty/symfony/console/Application.php","line":175,"function":"doRun","class":"Symfony\\Component\\Console\\Application","type":"->"},{"file":"/var/www/html/lib/private/Console/Application.php","line":187,"function":"run","class":"Symfony\\Component\\Console\\Application","type":"->"},{"file":"/var/www/html/console.php","line":90,"function":"run","class":"OC\\Console\\Application","type":"->"},{"file":"/var/www/html/occ","line":33,"args":["/var/www/html/console.php"],"function":"require_once"}],"File":"/var/www/html/apps/user_ldap/lib/Connection.php","Line":524,"Hint":"User base DN is not a subnode of global base DN","message":"Configuration Error (prefix s01): User base is not in root base","exception":{},"CustomMessage":"Configuration Error (prefix s01): User base is not in root base"}}

Additional info

Workaround is to comment out these checks in user_ldap/lib/Connection.php:523

                /**if (!empty($baseUsers) && !$this->checkBasesAreValid($baseUsers, $base)) {
                        throw new ConfigurationIssueException(
                                'User base is not in root base',
                                $this->l10n->t('User base DN is not a subnode of global base DN'),
                        );
                }
                

                if (!empty($baseGroups) && !$this->checkBasesAreValid($baseGroups, $base)) {
                        throw new ConfigurationIssueException(
                                'Group base is not in root base',
                                $this->l10n->t('Group base DN is not a subnode of global base DN'),
                        );
                }
                **/

After doing so, verify LDAP now works again via occ:

./occ ldap:test-config s01
The configuration is valid and the connection could be established!

[szaimen]

cc @come-nc @blizzz

[blizzz]

@vwbusguy possibly duplicate of #55519 ?

[vwbusguy]

@vwbusguy possibly duplicate of #55519 ?

I saw that one and I don't think so. This isn't about TLS. For good measure, I tested with or without changing that flag and got the same result. The thing they have in common is that they're both LDAP config regressions but are otherwise distinct regressions.

[small1]

This said poof on one instance with Authentik as a ldap user backend

[advcron]

I have the same on Debian 13
Ldap usuer backend - Active Directory.
Comment lines in user_ldap/lib/Connection.php:523 solve problem.

[come-nc]

This is not a bug, your configuration is incorrect.
User and group bases should be under the root of the directory.
This was not enforced before but could result in subtle bugs, so it is now enforced.

It’s perfectly fine for user and group bases to be different, but both needs to be inside the base that you set as global base for this configuration.

[vwbusguy]

"Just change your LDAP schema" is a very poor response. This has been working for years with this directory up until we upgraded to 32. Changing LDAP schema for any sizable established org is far from arbitrary and unfortunately your assumption doesn't account for a number of scenerios where this can happen. You're harming the viability of nextcloud in larger corporate environments with this change. Further, if what you're saying is true, there should be a more graceful degradation than straight breaking a nextcloud instance on upgrade. Given the unhandled exception and that other users were surprised to find their instances impacted, this more clearly appears to be an unintended regression as I cannot possibly imagine this was the intended experience, given past excellent experiences with nextcloud.

[small1]

This is not a bug, your configuration is incorrect. User and group bases should be under the root of the directory. This was not enforced before but could result in subtle bugs, so it is now enforced.

It’s perfectly fine for user and group bases to be different, but both needs to be inside the base that you set as global base for this configuration.

@come-nc i have users in ou=users, dc=ldap, dc=domain, dc=topdomain and groups in ou=groups, dc=ldap, dc=domain, dc=topdomain Base dn is dc=ldap, dc=domain, dc=topdomain

And enforcing this is kind of odd, since if clicking on advanced config you can point out your users and group dn. Warn about it yes. But as it is right now the instance gets killed with a horrible error message.

My suggestion is to monve it to a wrning in the overview that the ldap config is not optimal.

I will debug my broken instance during the weekend since it is production and see why it fails.

[vwbusguy]

You're at least more fortunate than us. This is an overlay directory. Users and groups don't share a common directory root because users are effectively part of a different directory. I can't reasonably share those schema internals here, but I do not have any recourse to change them. The backing directory system is older than nextcloud (the company) is. I can tell you that the directory setup works with a large plethora of other services, including nextcloud itself for the past few years up until we upgraded to version 32.