Troubleshooting LDAP problems¶

Check that there are no unwanted configuration¶

Run:

php occ ldap:show-config

Check that there is only one LDAP configuration, or that there are several on purpose and not by mistake.

Test the configuration through occ¶

For each configuration, run:

php occ ldap:test-config s01

Replace s01 by the configuration id that you see in the output of ldap:show-config. The output should be:

The configuration is valid and the connection could be established!

If not, it means something is wrong with your configuration and Nextcloud cannot connect to or bind to the LDAP server. You may want to run the command with debug log level and look into the log to get more details about the problem.

Make sure that the service user used by Nextcloud to connect to the LDAP has sufficient permissions¶

There is no magic command for that, but it is a common source of issue when connecting Nextcloud to an LDAP server. The user that Nextcloud use to connect to the LDAP has to have enough rights to read the users, the groups and their attributes.

Use a dedicated service user for Nextcloud¶

This recommendation is actually a general one: use one service account per application. This makes it easier to pinpoint issues related to a service and terminates the possibility of side effects. It also allows to disable or modify a service users without affecting the operations of applications with different needs and allows finer granularity on permissions.

Check case sensitivity¶

Configs like DN and Base DN are case sensitive. If there are mistakes, this will lead to a "Configuration incorrect" warning in the LDAP/AD integration window.

Check LDAP configuration¶

In the output of occ ldap:show-config, make sure that:

• ldapBaseGroups and ldapBaseUsers are equal to ldapBase, or subnodes of ldapBase

Group membership issues¶

• On 31 or higher, use occ ldap:test-user-settings to debug configuration
• Check that ldapGroupMemberAssocAttr is correctly set to the attribute used for group membership association in your LDAP tree
• Check that ldapGroupFilter matches your groups
• If hasMemberOfFilterSupport and useMemberOfToDetectMembership are both 1, make sure memberof operational attribute is set up and correctly working on your LDAP server
• Check ldapGidNumber, empty it if you do not use gidNumber for group membership
• Check ldapNestedGroups and make sure it’s on only if you really need nested group support (it’s a common source of issues, even if we fix some of them in each version)

Search issues¶

• Check that ldapAttributesForUserSearch contains the attributes that you want to use when searching for users
• Search in LDAP do not use substr matching by default, make sure you search user by entering the beginning of their name, or start your search string with a *
• Test your settings with occ ldap:search

Testing with ldapsearch¶

To find out if an issue is a configuration issue or an LDAP server issue, you can use the tool ldapsearch to manually try the same kind of request that Nextcloud will make. This usually helps to understand issues. You can use the command as follows:

ldapsearch -x -H ldaps://ldapHost:ldapPort -D ldapAgentName -W -b ldapBase -s subtree ldapFilter

• Replace ldapHost, ldapPort and ldapAgentName from the values in the output of occ ldap:show-config.
• Replace ldapBase by the value of either ldapBase, ldapBaseUsers or ldapBaseGroups depending on what you’re testing.
• Replace ldapFilter by the value of either ldapUserFilter, ldapLoginFilter or ldapGroupFilter.
• Replace ldaps:// by ldap:// if ldapTLS is 0.

To troubleshoot connection issues (e.g. when a LDAPS connection fails), please add the parameter -d1 to your ldapsearch command. This will output debug information and should highlight why a successful connection failed.