Lost connection to LDAP server causes app password to be removed

[RobinMcCorkell]

I've got an LDAP server providing my authentication, and have several Nextcloud clients connected using app passwords added in the web interface. Sometimes my LDAP server goes down or is busy, and Nextcloud complains that it is unavailable, however when the server comes back the app password used by my desktop client is missing, and I have to create a new one.

I'm assuming the client tries a log in with an app password, then the server cannot connect to LDAP so marks that app password as invalid, removing it.

Nothing special in the logs, just a bunch of "bind failed", "lost connection to LDAP" and some bruteforce warnings.

Nextcloud 12.0.3, but I've noticed this for many versions now

[juliusknorr]

cc @blizzz for ldap and @LukasReschke for authentication

[ChristophWurst]

@Xenopathic what version of the Nextcloud server are you using? IIRC we fixed this bug a few months ago.

[blizzz]

@ChristophWurst he states

Nextcloud 12.0.3, but I've noticed this for many versions now

[ChristophWurst]

Thanks, @blizzz, I overlooked that.

@blizzz do you remember the issue/PR title of the related bug? IIRC it's the bug we had on c.nc.com whenever the LDAP server wasn't available. Not sure who submitted/fixed it or how we fixed it. I can't find it right now.

[blizzz]

One issue was #2431 and a fix for this was #3324. IIRC it was not all, there was another code path that we fixed (which affected also non-LDAP users).

One was related to updated scenarios: #4289

I also believe to remember that we also had a fix in the login process, although i cannot find it right now. Perhaps I am mixing it up.

[blizzz]

@Xenopathic can you reliable reproduce it?

[goddib]

I can confirm the behaviour described by @Xenopathic . This also applies, when a user is temporarily deactivated (which is probably desired). I assume either whenever the cronjob runs and checks the users on the LDAP (is that included in the cronjob) or when the user tries to logon (through app and app password) and the user is not found it's removed from the nextcloud database and the password deleted along (even though other settings are retained?)

[blizzz]

@goddib thansk for chiming in and your thought. Users are not removed without manual action. When the LDAP server goes offline and cannot be reached anymore, an exception is thrown, and nothing would continue. @ChristophWurst could there be a code path were leaving that extra-ordinarily would cause such an effect?

[ChristophWurst]

@ChristophWurst could there be a code path were leaving that extra-ordinarily would cause such an effect?

Can't answer that right away but I'll investigate.

[ChristophWurst]

I have the feeling this code here

server/lib/private/User/Session.php

Lines 679 to 684 in 343a695

	if ($this->manager->checkPassword($dbToken->getLoginName(), $pwd) === false
	|| (!is_null($this->activeUser) && !$this->activeUser->isEnabled())) {
	$this->tokenProvider->invalidateToken($token);
	// Password has changed or user was disabled -> log user out
	return false;
	}

could be triggered because either the user is not set (because it cannot be loaded from the LDAP back-end) or the back-end marks it is disabled.
All the other code paths that lead to an app token being deleted seem unlikely to cause this.

@Xenopathic any chance you could try to debug this, e.g. by adding a log statement inside the if-block? Something like \OC::$server->getLogger()->warning(…) should work.

[RobinMcCorkell]

@ChristophWurst I can confirm that block is being hit when the LDAP server is unavailable.