Repository navigation
Slow login after change ldap password #3762
Description
Steps to reproduce
- enable ldap users in nextcloud
- change an ldap user's password externally
- discover that logins now take forever
Expected behaviour
Changing an ldap user's password should only affect nextcloud in that you need to login with your new password.
Actual behaviour
The new password is accepted, but login to the web interface takes ~30 seconds, and other apps such as the desktop sync client or mobile apps error out with timeouts.
Currently the desktop sync client is showing "No connection to Nextcloud at . Operation cancelled."
Server configuration
Operating system: Archlinux
Web server: Nginx
Database: MariaDB
PHP version: 7.1.1
Nextcloud version: 11.0.2
Updated from an older Nextcloud/ownCloud or fresh install: Updated from 11.0.1 (which in turn was updated from 11.0.0)
Where did you install Nextcloud from:
Signing status:
Signing status
No errors have been found
List of activated apps:
App list
Enabled:
- activity: 2.4.1
- admin_audit: 1.1.0
- announcementcenter: 3.0.0
- audioplayer: 1.4.1
- bookmarks: 0.9.1
- calendar: 1.5.1
- comments: 1.1.0
- contacts: 1.5.3
- dav: 1.1.1
- external: true
- federatedfilesharing: 1.1.1
- federation: 1.1.1
- files: 1.6.1
- files_accesscontrol: 1.1.2
- files_external: 1.1.2
- files_markdown: 1.0.1
- files_pdfviewer: 1.0.1
- files_sharing: 1.1.1
- files_texteditor: 2.2
- files_trashbin: 1.1.0
- files_versions: 1.4.0
- files_videoplayer: 1.0.0
- firstrunwizard: 2.0
- gallery: 16.0.0
- keeweb: 0.3.0
- logreader: 2.0.0
- lookup_server_connector: 1.0.0
- news: 10.1.0
- nextcloud_announcements: 1.0
- notes: 2.2.0
- notifications: 1.0.1
- password_policy: 1.1.0
- provisioning_api: 1.1.0
- serverinfo: 1.1.1
- sharebymail: 1.0.1
- survey_client: 0.1.5
- systemtags: 1.1.3
- tasks: 0.9.5
- theming: 1.1.1
- twofactor_backupcodes: 1.0.0
- updatenotification: 1.1.1
- user_external: 0.4
- user_ldap: 1.1.2
- workflowengine: 1.1.1
Disabled:
- direct_menu
- encryption
- files_automatedtagging
- files_retention
- richdocuments
- templateeditor
- user_saml
(however, it was slow even after updating to 11.0.2, where it automatically disables all extra apps)
The content of config/config.php:
Config report
{
"system": {
"instanceid": "oc9jp25ikolt",
"passwordsalt": "***REMOVED SENSITIVE VALUE***",
"secret": "***REMOVED SENSITIVE VALUE***",
"trusted_domains": [
"REDACTED"
],
"datadirectory": "\/mnt\/storage1\/data\/nextcloud-data",
"overwrite.cli.url": "REDACTED",
"dbtype": "mysql",
"version": "11.0.2.7",
"dbname": "nextcloud",
"dbhost": "localhost",
"dbport": "",
"dbtableprefix": "oc_",
"dbuser": "***REMOVED SENSITIVE VALUE***",
"dbpassword": "***REMOVED SENSITIVE VALUE***",
"logtimezone": "UTC",
"installed": true,
"ldapIgnoreNamingRules": false,
"ldapProviderFactory": "\\OCA\\User_LDAP\\LDAPProviderFactory",
"loglevel": 2,
"updater.release.channel": "stable",
"appstoreenabled": true,
"appstoreurl": "https:\/\/apps.nextcloud.com\/api\/v0",
"appstore.experimental.enabled": true,
"maintenance": false,
"mail_smtpmode": "sendmail",
"mail_from_address": "nextcloud",
"mail_domain": "REDACTED",
"auth.bruteforce.protection.enabled": true,
"updater.secret": "***REMOVED SENSITIVE VALUE***"
}
}
Are you using external storage, if yes which one: smb
Are you using encryption: no
Are you using an external user-backend, if yes which one: LDAP
LDAP configuration (delete this part if not used)
LDAP config
+-------------------------------+------------------------------------------------+
| Configuration | |
+-------------------------------+------------------------------------------------+
| hasMemberOfFilterSupport | |
| hasPagedResultSupport | |
| homeFolderNamingRule | |
| lastJpegPhotoLookup | 0 |
| ldapAgentName | |
| ldapAgentPassword | *** |
| ldapAttributesForGroupSearch | |
| ldapAttributesForUserSearch | |
| ldapBackupHost | |
| ldapBackupPort | |
| ldapBase | REDACTED |
| ldapBaseGroups | ou=People,REDACTED |
| ldapBaseUsers | ou=People,REDACTED |
| ldapCacheTTL | 600 |
| ldapConfigurationActive | 1 |
| ldapDynamicGroupMemberURL | |
| ldapEmailAttribute | mail |
| ldapExperiencedAdmin | 0 |
| ldapExpertUUIDGroupAttr | |
| ldapExpertUUIDUserAttr | |
| ldapExpertUsernameAttr | |
| ldapGroupDisplayName | cn |
| ldapGroupFilter | (&(|(objectclass=posixGroup))) |
| ldapGroupFilterGroups | |
| ldapGroupFilterMode | 0 |
| ldapGroupFilterObjectclass | posixGroup |
| ldapGroupMemberAssocAttr | uniqueMember |
| ldapHost | localhost |
| ldapIgnoreNamingRules | |
| ldapLoginFilter | (&(|(objectclass=inetOrgPerson))(|(uid=%uid))) |
| ldapLoginFilterAttributes | uid |
| ldapLoginFilterEmail | 0 |
| ldapLoginFilterMode | 0 |
| ldapLoginFilterUsername | 0 |
| ldapNestedGroups | 0 |
| ldapOverrideMainServer | |
| ldapPagingSize | 500 |
| ldapPort | 389 |
| ldapQuotaAttribute | |
| ldapQuotaDefault | |
| ldapTLS | 0 |
| ldapUserDisplayName | cn |
| ldapUserDisplayName2 | |
| ldapUserFilter | (|(objectclass=inetOrgPerson)) |
| ldapUserFilterGroups | |
| ldapUserFilterMode | 0 |
| ldapUserFilterObjectclass | inetOrgPerson |
| ldapUuidGroupAttribute | auto |
| ldapUuidUserAttribute | auto |
| turnOffCertCheck | 0 |
| turnOnPasswordChange | 0 |
| useMemberOfToDetectMembership | 1 |
+-------------------------------+------------------------------------------------+
Client configuration
Browser: Chromium, and all others tested
Operating system: Archlinux, Android
Logs
Web server error log
Web server error log
2017/03/07 16:52:46 [error] 615#615: *257 upstream timed out (110: Connection timed out) while reading response header from upstream, client: 10.0.0.1, server: redacted.example.com, request: "PROPFIND /remote.php/dav/calendars/52488d1b-608a-4e9a-a615-1a809b6cdab2/contact_birthdays/ HTTP/1.1", upstream: "fastcgi://unix:/var/run/php-fpm/php-fpm.sock", host: "redacted.example.com"
2017/03/07 16:53:47 [error] 615#615: *257 upstream timed out (110: Connection timed out) while reading response header from upstream, client: 10.0.0.1, server: redacted.example.com, request: "PROPFIND /remote.php/dav/addressbooks/users/52488d1b-608a-4e9a-a615-1a809b6cdab2/contacts.vcf/ HTTP/1.1", upstream: "fastcgi://unix:/var/run/php-fpm/php-fpm.sock", host: "redacted.example.com"
2017/03/07 20:55:12 [error] 617#617: *13357 upstream timed out (110: Connection timed out) while reading response header from upstream, client: 10.0.0.1, server: redacted.example.com, request: "GET /index.php/apps/news/api/v1-2/items/updated?lastModified=1488837605&type=3&id=0 HTTP/1.1", upstream: "fastcgi://unix:/var/run/php-fpm/php-fpm.sock", host: "redacted.example.com"
2017/03/07 20:55:12 [error] 617#617: *13355 upstream timed out (110: Connection timed out) while reading response header from upstream, client: 10.0.0.1, server: redacted.example.com, request: "GET /index.php/apps/news/api/v1-2/user HTTP/1.1", upstream: "fastcgi://unix:/var/run/php-fpm/php-fpm.sock", host: "redacted.example.com"
2017/03/07 20:55:12 [error] 617#617: *13358 upstream timed out (110: Connection timed out) while reading response header from upstream, client: 10.0.0.1, server: redacted.example.com, request: "GET /index.php/apps/news/api/v1-2/folders HTTP/1.1", upstream: "fastcgi://unix:/var/run/php-fpm/php-fpm.sock", host: "redacted.example.com"
2017/03/07 20:55:12 [error] 617#617: *13356 upstream timed out (110: Connection timed out) while reading response header from upstream, client: 10.0.0.1, server: redacted.example.com, request: "GET /index.php/apps/news/api/v1-2/feeds HTTP/1.1", upstream: "fastcgi://unix:/var/run/php-fpm/php-fpm.sock", host: "redacted.example.com"
2017/03/07 20:56:49 [error] 617#617: *13395 upstream timed out (110: Connection timed out) while reading response header from upstream, client: 10.0.0.1, server: redacted.example.com, request: "PROPFIND /remote.php/dav/calendars/52488d1b-608a-4e9a-a615-1a809b6cdab2/calendar.ics/ HTTP/1.1", upstream: "fastcgi://unix:/var/run/php-fpm/php-fpm.sock", host: "redacted.example.com"
Nextcloud log (data/nextcloud.log)
Nextcloud log
{"reqId":"\/sUcXl9OXKlwyviaNPeC","remoteAddr":"10.0.0.1","app":"core","message":"Login failed: 'redacted' (Remote IP: '10.0.0.1')","level":2,"time":"2017-03-07T10:25:48+00:00","method":"GET","url":"\/index.php\/apps\/news\/api\/v1-2\/user","user":"--","version":"11.0.2.7"}
{"reqId":"qfyDdI9JaS\/lmMCv1eQM","remoteAddr":"10.0.0.1","app":"user_ldap","message":"Bind failed: 49: Invalid credentials","level":2,"time":"2017-03-07T10:26:11+00:00","method":"GET","url":"\/index.php\/apps\/news\/api\/v1-2\/feeds","user":"--","version":"11.0.2.7"}
{"reqId":"qfyDdI9JaS\/lmMCv1eQM","remoteAddr":"10.0.0.1","app":"core","message":"Login failed: 'redacted' (Remote IP: '10.0.0.1')","level":2,"time":"2017-03-07T10:26:11+00:00","method":"GET","url":"\/index.php\/apps\/news\/api\/v1-2\/feeds","user":"--","version":"11.0.2.7"}
{"reqId":"3JOJgObBuSJp9tYQIlV2","remoteAddr":"10.0.0.1","app":"user_ldap","message":"Bind failed: 49: Invalid credentials","level":2,"time":"2017-03-07T10:26:13+00:00","method":"GET","url":"\/index.php\/apps\/news\/api\/v1-2\/folders","user":"--","version":"11.0.2.7"}
{"reqId":"3JOJgObBuSJp9tYQIlV2","remoteAddr":"10.0.0.1","app":"core","message":"Login failed: 'redacted' (Remote IP: '10.0.0.1')","level":2,"time":"2017-03-07T10:26:13+00:00","method":"GET","url":"\/index.php\/apps\/news\/api\/v1-2\/folders","user":"--","version":"11.0.2.7"}
{"reqId":"PCigR+5hw7LLFIo+Tzda","remoteAddr":"10.0.0.1","app":"user_ldap","message":"Bind failed: 49: Invalid credentials","level":2,"time":"2017-03-07T10:26:13+00:00","method":"GET","url":"\/index.php\/apps\/news\/api\/v1-2\/items\/updated?lastModified=1488837605&type=3&id=0","user":"--","version":"11.0.2.7"}
{"reqId":"PCigR+5hw7LLFIo+Tzda","remoteAddr":"10.0.0.1","app":"core","message":"Login failed: 'redacted' (Remote IP: '10.0.0.1')","level":2,"time":"2017-03-07T10:26:13+00:00","method":"GET","url":"\/index.php\/apps\/news\/api\/v1-2\/items\/updated?lastModified=1488837605&type=3&id=0","user":"--","version":"11.0.2.7"}
{"reqId":"pQko6\/9kHQE4fXP+UOkE","remoteAddr":"10.0.0.1","app":"user_ldap","message":"Bind failed: 49: Invalid credentials","level":2,"time":"2017-03-07T10:26:14+00:00","method":"PROPFIND","url":"\/remote.php\/dav\/calendars\/52488d1b-608a-4e9a-a615-1a809b6cdab2\/calendar.ics\/","user":"--","version":"11.0.2.7"}
{"reqId":"pQko6\/9kHQE4fXP+UOkE","remoteAddr":"10.0.0.1","app":"core","message":"Login failed: 'redacted' (Remote IP: '10.0.0.1')","level":2,"time":"2017-03-07T10:26:14+00:00","method":"PROPFIND","url":"\/remote.php\/dav\/calendars\/52488d1b-608a-4e9a-a615-1a809b6cdab2\/calendar.ics\/","user":"--","version":"11.0.2.7"}
{"reqId":"\/sUcXl9OXKlwyviaNPeC","remoteAddr":"10.0.0.1","app":"user_ldap","message":"Bind failed: 49: Invalid credentials","level":2,"time":"2017-03-07T10:26:18+00:00","method":"GET","url":"\/index.php\/apps\/news\/api\/v1-2\/user","user":"--","version":"11.0.2.7"}
{"reqId":"\/sUcXl9OXKlwyviaNPeC","remoteAddr":"10.0.0.1","app":"core","message":"Login failed: 'redacted' (Remote IP: '10.0.0.1')","level":2,"time":"2017-03-07T10:26:18+00:00","method":"GET","url":"\/index.php\/apps\/news\/api\/v1-2\/user","user":"--","version":"11.0.2.7"}
{"reqId":"qfyDdI9JaS\/lmMCv1eQM","remoteAddr":"10.0.0.1","app":"user_ldap","message":"Bind failed: 49: Invalid credentials","level":2,"time":"2017-03-07T10:26:41+00:00","method":"GET","url":"\/index.php\/apps\/news\/api\/v1-2\/feeds","user":"--","version":"11.0.2.7"}
{"reqId":"qfyDdI9JaS\/lmMCv1eQM","remoteAddr":"10.0.0.1","app":"core","message":"Login failed: 'redacted' (Remote IP: '10.0.0.1')","level":2,"time":"2017-03-07T10:26:41+00:00","method":"GET","url":"\/index.php\/apps\/news\/api\/v1-2\/feeds","user":"--","version":"11.0.2.7"}
{"reqId":"3JOJgObBuSJp9tYQIlV2","remoteAddr":"10.0.0.1","app":"user_ldap","message":"Bind failed: 49: Invalid credentials","level":2,"time":"2017-03-07T10:26:43+00:00","method":"GET","url":"\/index.php\/apps\/news\/api\/v1-2\/folders","user":"--","version":"11.0.2.7"}
{"reqId":"3JOJgObBuSJp9tYQIlV2","remoteAddr":"10.0.0.1","app":"core","message":"Login failed: 'redacted' (Remote IP: '10.0.0.1')","level":2,"time":"2017-03-07T10:26:43+00:00","method":"GET","url":"\/index.php\/apps\/news\/api\/v1-2\/folders","user":"--","version":"11.0.2.7"}
{"reqId":"PFLJFUZfxFwkIGA\/5XKW","remoteAddr":"10.0.0.1","app":"user_ldap","message":"Bind failed: 49: Invalid credentials","level":2,"time":"2017-03-07T10:26:43+00:00","method":"PROPFIND","url":"\/remote.php\/dav\/addressbooks\/users\/52488d1b-608a-4e9a-a615-1a809b6cdab2\/contacts.vcf\/","user":"--","version":"11.0.2.7"}
{"reqId":"PFLJFUZfxFwkIGA\/5XKW","remoteAddr":"10.0.0.1","app":"core","message":"Login failed: 'redacted' (Remote IP: '10.0.0.1')","level":2,"time":"2017-03-07T10:26:43+00:00","method":"PROPFIND","url":"\/remote.php\/dav\/addressbooks\/users\/52488d1b-608a-4e9a-a615-1a809b6cdab2\/contacts.vcf\/","user":"--","version":"11.0.2.7"}
{"reqId":"pQko6\/9kHQE4fXP+UOkE","remoteAddr":"10.0.0.1","app":"user_ldap","message":"Bind failed: 49: Invalid credentials","level":2,"time":"2017-03-07T10:26:44+00:00","method":"PROPFIND","url":"\/remote.php\/dav\/calendars\/52488d1b-608a-4e9a-a615-1a809b6cdab2\/calendar.ics\/","user":"--","version":"11.0.2.7"}
{"reqId":"pQko6\/9kHQE4fXP+UOkE","remoteAddr":"10.0.0.1","app":"core","message":"Login failed: 'redacted' (Remote IP: '10.0.0.1')","level":2,"time":"2017-03-07T10:26:44+00:00","method":"PROPFIND","url":"\/remote.php\/dav\/calendars\/52488d1b-608a-4e9a-a615-1a809b6cdab2\/calendar.ics\/","user":"--","version":"11.0.2.7"}
{"reqId":"PFLJFUZfxFwkIGA\/5XKW","remoteAddr":"10.0.0.1","app":"no app in context","message":"Exception: {\"Exception\":\"Exception\",\"Message\":\"Session has been closed - no further changes to the session are allowed\",\"Code\":0,\"Trace\":\"#0 \\\/mnt\\\/storage1\\\/srv\\\/http\\\/nextcloud\\\/lib\\\/private\\\/Session\\\/Internal.php(64): OC\\\\Session\\\\Internal->validateSession()\\n#1 \\\/mnt\\\/storage1\\\/srv\\\/http\\\/nextcloud\\\/lib\\\/private\\\/Session\\\/CryptoSessionData.php(164): OC\\\\Session\\\\Internal->set('encrypted_sessi...', '57f9e844f69aeb4...')\\n#2 \\\/mnt\\\/storage1\\\/srv\\\/http\\\/nextcloud\\\/apps\\\/dav\\\/lib\\\/Connector\\\/Sabre\\\/Auth.php(132): OC\\\\Session\\\\CryptoSessionData->close()\\n#3 \\\/mnt\\\/storage1\\\/srv\\\/http\\\/nextcloud\\\/3rdparty\\\/sabre\\\/dav\\\/lib\\\/DAV\\\/Auth\\\/Backend\\\/AbstractBasic.php(105): OCA\\\\DAV\\\\Connector\\\\Sabre\\\\Auth->validateUserPass(*** sensitive parameters replaced ***)\\n#4 \\\/mnt\\\/storage1\\\/srv\\\/http\\\/nextcloud\\\/apps\\\/dav\\\/lib\\\/Connector\\\/Sabre\\\/Auth.php(251): Sabre\\\\DAV\\\\Auth\\\\Backend\\\\AbstractBasic->check(Object(Sabre\\\\HTTP\\\\Request), Object(Sabre\\\\HTTP\\\\Response))\\n#5 \\\/mnt\\\/storage1\\\/srv\\\/http\\\/nextcloud\\\/apps\\\/dav\\\/lib\\\/Connector\\\/Sabre\\\/Auth.php(154): OCA\\\\DAV\\\\Connector\\\\Sabre\\\\Auth->auth(Object(Sabre\\\\HTTP\\\\Request), Object(Sabre\\\\HTTP\\\\Response))\\n#6 \\\/mnt\\\/storage1\\\/srv\\\/http\\\/nextcloud\\\/3rdparty\\\/sabre\\\/dav\\\/lib\\\/DAV\\\/Auth\\\/Plugin.php(199): OCA\\\\DAV\\\\Connector\\\\Sabre\\\\Auth->check(Object(Sabre\\\\HTTP\\\\Request), Object(Sabre\\\\HTTP\\\\Response))\\n#7 \\\/mnt\\\/storage1\\\/srv\\\/http\\\/nextcloud\\\/3rdparty\\\/sabre\\\/dav\\\/lib\\\/DAV\\\/Auth\\\/Plugin.php(150): Sabre\\\\DAV\\\\Auth\\\\Plugin->check(Object(Sabre\\\\HTTP\\\\Request), Object(Sabre\\\\HTTP\\\\Response))\\n#8 [internal function]: Sabre\\\\DAV\\\\Auth\\\\Plugin->beforeMethod(Object(Sabre\\\\HTTP\\\\Request), Object(Sabre\\\\HTTP\\\\Response))\\n#9 \\\/mnt\\\/storage1\\\/srv\\\/http\\\/nextcloud\\\/3rdparty\\\/sabre\\\/event\\\/lib\\\/EventEmitterTrait.php(105): call_user_func_array(Array, Array)\\n#10 \\\/mnt\\\/storage1\\\/srv\\\/http\\\/nextcloud\\\/3rdparty\\\/sabre\\\/dav\\\/lib\\\/DAV\\\/Server.php(466): Sabre\\\\Event\\\\EventEmitter->emit('beforeMethod', Array)\\n#11 \\\/mnt\\\/storage1\\\/srv\\\/http\\\/nextcloud\\\/3rdparty\\\/sabre\\\/dav\\\/lib\\\/DAV\\\/Server.php(254): Sabre\\\\DAV\\\\Server->invokeMethod(Object(Sabre\\\\HTTP\\\\Request), Object(Sabre\\\\HTTP\\\\Response))\\n#12 \\\/mnt\\\/storage1\\\/srv\\\/http\\\/nextcloud\\\/apps\\\/dav\\\/lib\\\/Server.php(227): Sabre\\\\DAV\\\\Server->exec()\\n#13 \\\/mnt\\\/storage1\\\/srv\\\/http\\\/nextcloud\\\/apps\\\/dav\\\/appinfo\\\/v2\\\/remote.php(30): OCA\\\\DAV\\\\Server->exec()\\n#14 \\\/mnt\\\/storage1\\\/srv\\\/http\\\/nextcloud\\\/remote.php(165): require_once('\\\/mnt\\\/storage1\\\/s...')\\n#15 {main}\",\"File\":\"\\\/mnt\\\/storage1\\\/srv\\\/http\\\/nextcloud\\\/lib\\\/private\\\/Session\\\/Internal.php\",\"Line\":154}","level":3,"time":"2017-03-07T10:27:14+00:00","method":"PROPFIND","url":"\/remote.php\/dav\/addressbooks\/users\/52488d1b-608a-4e9a-a615-1a809b6cdab2\/contacts.vcf\/","user":"52488d1b-608a-4e9a-a615-1a809b6cdab2","version":"11.0.2.7"}
{"reqId":"PFLJFUZfxFwkIGA\/5XKW","remoteAddr":"10.0.0.1","app":"webdav","message":"Exception: {\"Message\":\"HTTP\\\/1.1 503 Exception: Session has been closed - no further changes to the session are allowed\",\"Exception\":\"Sabre\\\\DAV\\\\Exception\\\\ServiceUnavailable\",\"Code\":0,\"Trace\":\"#0 \\\/mnt\\\/storage1\\\/srv\\\/http\\\/nextcloud\\\/3rdparty\\\/sabre\\\/dav\\\/lib\\\/DAV\\\/Auth\\\/Plugin.php(199): OCA\\\\DAV\\\\Connector\\\\Sabre\\\\Auth->check(Object(Sabre\\\\HTTP\\\\Request), Object(Sabre\\\\HTTP\\\\Response))\\n#1 \\\/mnt\\\/storage1\\\/srv\\\/http\\\/nextcloud\\\/3rdparty\\\/sabre\\\/dav\\\/lib\\\/DAV\\\/Auth\\\/Plugin.php(150): Sabre\\\\DAV\\\\Auth\\\\Plugin->check(Object(Sabre\\\\HTTP\\\\Request), Object(Sabre\\\\HTTP\\\\Response))\\n#2 [internal function]: Sabre\\\\DAV\\\\Auth\\\\Plugin->beforeMethod(Object(Sabre\\\\HTTP\\\\Request), Object(Sabre\\\\HTTP\\\\Response))\\n#3 \\\/mnt\\\/storage1\\\/srv\\\/http\\\/nextcloud\\\/3rdparty\\\/sabre\\\/event\\\/lib\\\/EventEmitterTrait.php(105): call_user_func_array(Array, Array)\\n#4 \\\/mnt\\\/storage1\\\/srv\\\/http\\\/nextcloud\\\/3rdparty\\\/sabre\\\/dav\\\/lib\\\/DAV\\\/Server.php(466): Sabre\\\\Event\\\\EventEmitter->emit('beforeMethod', Array)\\n#5 \\\/mnt\\\/storage1\\\/srv\\\/http\\\/nextcloud\\\/3rdparty\\\/sabre\\\/dav\\\/lib\\\/DAV\\\/Server.php(254): Sabre\\\\DAV\\\\Server->invokeMethod(Object(Sabre\\\\HTTP\\\\Request), Object(Sabre\\\\HTTP\\\\Response))\\n#6 \\\/mnt\\\/storage1\\\/srv\\\/http\\\/nextcloud\\\/apps\\\/dav\\\/lib\\\/Server.php(227): Sabre\\\\DAV\\\\Server->exec()\\n#7 \\\/mnt\\\/storage1\\\/srv\\\/http\\\/nextcloud\\\/apps\\\/dav\\\/appinfo\\\/v2\\\/remote.php(30): OCA\\\\DAV\\\\Server->exec()\\n#8 \\\/mnt\\\/storage1\\\/srv\\\/http\\\/nextcloud\\\/remote.php(165): require_once('\\\/mnt\\\/storage1\\\/s...')\\n#9 {main}\",\"File\":\"\\\/mnt\\\/storage1\\\/srv\\\/http\\\/nextcloud\\\/apps\\\/dav\\\/lib\\\/Connector\\\/Sabre\\\/Auth.php\",\"Line\":162,\"User\":\"52488d1b-608a-4e9a-a615-1a809b6cdab2\"}","level":4,"time":"2017-03-07T10:27:14+00:00","method":"PROPFIND","url":"\/remote.php\/dav\/addressbooks\/users\/52488d1b-608a-4e9a-a615-1a809b6cdab2\/contacts.vcf\/","user":"52488d1b-608a-4e9a-a615-1a809b6cdab2","version":"11.0.2.7"}
{"reqId":"33\/FJYqSKY2qBcEQFVwy","remoteAddr":"10.0.0.1","app":"user_ldap","message":"Bind failed: 49: Invalid credentials","level":2,"time":"2017-03-07T10:46:24+00:00","method":"GET","url":"\/index.php\/apps\/news\/api\/v1-2\/user","user":"--","version":"11.0.2.7"}
{"reqId":"oNvaDlfB7NhFzMJP5sPs","remoteAddr":"10.0.0.1","app":"user_ldap","message":"Bind failed: 49: Invalid credentials","level":2,"time":"2017-03-07T10:46:24+00:00","method":"GET","url":"\/index.php\/apps\/news\/api\/v1-2\/folders","user":"--","version":"11.0.2.7"}
{"reqId":"33\/FJYqSKY2qBcEQFVwy","remoteAddr":"10.0.0.1","app":"core","message":"Login failed: 'redacted' (Remote IP: '10.0.0.1')","level":2,"time":"2017-03-07T10:46:24+00:00","method":"GET","url":"\/index.php\/apps\/news\/api\/v1-2\/user","user":"--","version":"11.0.2.7"}
{"reqId":"oNvaDlfB7NhFzMJP5sPs","remoteAddr":"10.0.0.1","app":"core","message":"Login failed: 'redacted' (Remote IP: '10.0.0.1')","level":2,"time":"2017-03-07T10:46:24+00:00","method":"GET","url":"\/index.php\/apps\/news\/api\/v1-2\/folders","user":"--","version":"11.0.2.7"}
{"reqId":"3U\/xRH1JI4avzx8WXEZt","remoteAddr":"10.0.0.1","app":"user_ldap","message":"Bind failed: 49: Invalid credentials","level":2,"time":"2017-03-07T10:46:24+00:00","method":"GET","url":"\/index.php\/apps\/news\/api\/v1-2\/items\/updated?lastModified=1488837605&type=3&id=0","user":"--","version":"11.0.2.7"}
{"reqId":"3U\/xRH1JI4avzx8WXEZt","remoteAddr":"10.0.0.1","app":"core","message":"Login failed: 'redacted' (Remote IP: '10.0.0.1')","level":2,"time":"2017-03-07T10:46:24+00:00","method":"GET","url":"\/index.php\/apps\/news\/api\/v1-2\/items\/updated?lastModified=1488837605&type=3&id=0","user":"--","version":"11.0.2.7"}
{"reqId":"gJtDVS5IuykvttUM42RR","remoteAddr":"10.0.0.1","app":"user_ldap","message":"Bind failed: 49: Invalid credentials","level":2,"time":"2017-03-07T10:46:25+00:00","method":"GET","url":"\/index.php\/apps\/news\/api\/v1-2\/feeds","user":"--","version":"11.0.2.7"}
{"reqId":"gJtDVS5IuykvttUM42RR","remoteAddr":"10.0.0.1","app":"core","message":"Login failed: 'redacted' (Remote IP: '10.0.0.1')","level":2,"time":"2017-03-07T10:46:25+00:00","method":"GET","url":"\/index.php\/apps\/news\/api\/v1-2\/feeds","user":"--","version":"11.0.2.7"}
{"reqId":"33\/FJYqSKY2qBcEQFVwy","remoteAddr":"10.0.0.1","app":"user_ldap","message":"Bind failed: 49: Invalid credentials","level":2,"time":"2017-03-07T10:46:54+00:00","method":"GET","url":"\/index.php\/apps\/news\/api\/v1-2\/user","user":"--","version":"11.0.2.7"}
{"reqId":"33\/FJYqSKY2qBcEQFVwy","remoteAddr":"10.0.0.1","app":"core","message":"Login failed: 'redacted' (Remote IP: '10.0.0.1')","level":2,"time":"2017-03-07T10:46:54+00:00","method":"GET","url":"\/index.php\/apps\/news\/api\/v1-2\/user","user":"--","version":"11.0.2.7"}
{"reqId":"oNvaDlfB7NhFzMJP5sPs","remoteAddr":"10.0.0.1","app":"user_ldap","message":"Bind failed: 49: Invalid credentials","level":2,"time":"2017-03-07T10:46:54+00:00","method":"GET","url":"\/index.php\/apps\/news\/api\/v1-2\/folders","user":"--","version":"11.0.2.7"}
{"reqId":"oNvaDlfB7NhFzMJP5sPs","remoteAddr":"10.0.0.1","app":"core","message":"Login failed: 'redacted' (Remote IP: '10.0.0.1')","level":2,"time":"2017-03-07T10:46:54+00:00","method":"GET","url":"\/index.php\/apps\/news\/api\/v1-2\/folders","user":"--","version":"11.0.2.7"}
{"reqId":"3U\/xRH1JI4avzx8WXEZt","remoteAddr":"10.0.0.1","app":"user_ldap","message":"Bind failed: 49: Invalid credentials","level":2,"time":"2017-03-07T10:46:54+00:00","method":"GET","url":"\/index.php\/apps\/news\/api\/v1-2\/items\/updated?lastModified=1488837605&type=3&id=0","user":"--","version":"11.0.2.7"}
{"reqId":"3U\/xRH1JI4avzx8WXEZt","remoteAddr":"10.0.0.1","app":"core","message":"Login failed: 'redacted' (Remote IP: '10.0.0.1')","level":2,"time":"2017-03-07T10:46:54+00:00","method":"GET","url":"\/index.php\/apps\/news\/api\/v1-2\/items\/updated?lastModified=1488837605&type=3&id=0","user":"--","version":"11.0.2.7"}
{"reqId":"gJtDVS5IuykvttUM42RR","remoteAddr":"10.0.0.1","app":"user_ldap","message":"Bind failed: 49: Invalid credentials","level":2,"time":"2017-03-07T10:46:55+00:00","method":"GET","url":"\/index.php\/apps\/news\/api\/v1-2\/feeds","user":"--","version":"11.0.2.7"}
{"reqId":"gJtDVS5IuykvttUM42RR","remoteAddr":"10.0.0.1","app":"core","message":"Login failed: 'redacted' (Remote IP: '10.0.0.1')","level":2,"time":"2017-03-07T10:46:55+00:00","method":"GET","url":"\/index.php\/apps\/news\/api\/v1-2\/feeds","user":"--","version":"11.0.2.7"}
(I'm guessing the bind failed is from some app still trying to login with the old password, even though I'm sure I updated them all.)
Also I tried turning off the bruteforce protection setting, to no avail.
Activity
samuelallan72 commentedon Mar 7, 2017
Update: it is now working ok after running a system update and rebooting the server. ¯\_(ツ)_/¯
I'd still be interested to know why it does this though - it's the second time I've had the issue, and now both times it's mysteriously resolved itself.
MorrisJobke commentedon Mar 8, 2017
could be related to the brute force detection somehow.
MorrisJobke commentedon Mar 8, 2017
cc @nextcloud/ldap
blizzz commentedon Mar 8, 2017
I also think brute force detection kicked in. Would be the case if there were any clients from the same network (IP) trying to access Nc with the old password. Likely, @swalladge ?
samuelallan72 commentedon Mar 8, 2017
@blizzz yep that is most likely. Are there docs explaining the behaviour of the brute force protection? Either way it's not very user friendly if this happens on local networks every time someone changes their password.
KB7777 commentedon Mar 9, 2017
Every LDAP implementation is not user friendly :(
When LDAP user got info at desktop to change his password he often do it at the last moment :)
There is a situation when password expires at AD, but user is still logged in and he can work with his desktop no problems until he logoff. Meanwhile Nextcloud client will check the LDAP backend and... voila! Wrong password! Very confusing end users until they teach how it works.
Maybe there is some workaround?
blizzz commentedon Mar 9, 2017
Well, this is not specific to LDAP, but would happen with the local backend or any other user backend as well. Then however, perhaps you could add some logic that prevents brute force protection to kick in for an hour or so, when the password is changed. However, we can only now internally about this event, not from other systems like the LDAP server.
You could advise your users to use app/device passwords for clients or machines instead (this can be enforced for non-website auth when you enable TOTP, while then the web interface will ask for a one-time token). Of course this adds some overhead and work for users, but then the LDAP password change would effect web interface login only.
About the brute force protection:
#479
Another point is that the ideal client would recognize that authentication failed (not that the server is offline or has other issues) and asks for entering the password. If enough people share the same IP (proxy?) it won't make a difference though.
GitHubUser4234 commentedon Mar 10, 2017
For expired passwords, the #1023 enhancement might be helpful in this regard, at least for OpenLDAP users. Users would be notified when their password is about to expire, and with grace logins allowed, an active session wouldn't be oddly interrupted on expiry, and for new sessions, users with expired passwords are instructed to renew their password during login.
blizzz commentedon Mar 10, 2017
After a discussion with @LukasReschke yesterday it's also worthwhile to think about deleting brute force attempts from the DB after a successful login from within the IP. This requires frequent DB access (at least another read per login on success).
samuelallan72 commentedon Mar 10, 2017
It would be nice to have a way to view the status of brute force protection from the admin panel - history of brute force attempts, whether it is currently active, and button to reset it.
blizzz commentedon Dec 16, 2017
#7263 resets the brute force attempts on successful login → closing