LDAP User First time login is disabled

[ahoward22]

Steps to reproduce

1. Add the Active Directory user to the specified group (Nextcloud Users)
2. Have the user attempt to login with their AD credentials

Expected behaviour

The user should successfully login

Actual behaviour

The user, who has never logged in to the Nextcloud Server, is presented with "User disabled" upon putting in the correct credentials
I cannot see the User disabled in Nextcloud GUI or CLI while searching for UUID or username.
**This does not happen for every user. There are 107 users in the group and it has happened to 2 users. Under the admin > LDAP config tab I can put in the username and it says "User found: OK" for the user I am specifically working on

Server configuration detail

Operating system: Linux 4.4.0-103-generic #126-Ubuntu SMP Mon Dec 4 16:23:28 UTC 2017 x86_64

Webserver: Apache/2.4.18 (Ubuntu) (apache2handler)

Database: mysql 5.7.20

PHP version: 7.0.22-0ubuntu0.16.04.1
Modules loaded: Core, date, libxml, openssl, pcre, zlib, filter, hash, Reflection, SPL, session, standard, apache2handler, mysqlnd, PDO, xml, calendar, ctype, curl, dom, mbstring, fileinfo, ftp, gd, gettext, iconv, imap, intl, json, ldap, exif, mcrypt, mysqli, pdo_mysql, pdo_pgsql, pdo_sqlite, pgsql, Phar, posix, readline, shmop, SimpleXML, smbclient, sockets, sqlite3, sysvmsg, sysvsem, sysvshm, tokenizer, wddx, xmlreader, xmlwriter, xsl, zip, libsmbclient, Zend OPcache

Nextcloud version: 12.0.4 - 12.0.4.3

**Updated from an older Nextcloud/ownCloud or fresh install: Updated from 12.0.0

**Where did you install Nextcloud from: OVA Template

Signing status

Array

List of activated apps

Enabled:
 - activity: 2.5.2
 - admin_audit: 1.2.0
 - bruteforcesettings: 1.0.2
 - comments: 1.2.0
 - dav: 1.3.0
 - federatedfilesharing: 1.2.0
 - files: 1.7.2
 - files_pdfviewer: 1.1.1
 - files_sharing: 1.4.0
 - files_texteditor: 2.4.1
 - files_trashbin: 1.2.0
 - files_versions: 1.5.0
 - files_videoplayer: 1.1.0
 - gallery: 17.0.0
 - impersonate: 1.0.1
 - issuetemplate: 0.3.0
 - logreader: 2.0.0
 - lookup_server_connector: 1.0.0
 - nextcloud_announcements: 1.1
 - notifications: 2.0.0
 - oauth2: 1.0.5
 - password_policy: 1.2.2
 - provisioning_api: 1.2.0
 - quota_warning: 1.1.1
 - serverinfo: 1.2.0
 - sharebymail: 1.2.0
 - spreed: 2.0.2
 - survey_client: 1.0.0
 - systemtags: 1.2.0
 - theming: 1.3.0
 - twofactor_backupcodes: 1.1.1
 - updatenotification: 1.2.0
 - user_ldap: 1.2.1
 - workflowengine: 1.2.0
Disabled:
 - encryption
 - federation
 - files_external
 - firstrunwizard
 - user_external

Configuration (config/config.php)

{
    "passwordsalt": "***REMOVED SENSITIVE VALUE***",
    "secret": "***REMOVED SENSITIVE VALUE***",
    "trusted_domains": [
        "localhost",
        "",
        "",
        "nextcloud"
    ],
    "datadirectory": "\/var\/ncdata",
    "overwrite.cli.url": "https:\/\/nextcloud\/",
    "dbtype": "mysql",
    "version": "12.0.4.3",
    "dbname": "nextcloud_db",
    "dbhost": "localhost",
    "dbport": "",
    "dbtableprefix": "oc_",
    "dbuser": "***REMOVED SENSITIVE VALUE***",
    "dbpassword": "***REMOVED SENSITIVE VALUE***",
    "logtimezone": "UTC",
    "logfile": "\/var\/log\/nextcloud.log",
    "loglevel": 0,
    "installed": true,
    "instanceid": "ocjpfpi04mdk",
    "appstore.experimental.enabled": "true",
    "trashbin_retention_obligation": "D30, auto",
    "mail_smtpmode": "smtp",
    "mail_smtpport": "25",
    "mail_smtphost": "IP Address",
    "mail_from_address": "cloud",
    "mail_domain": "Domain.com",
    "preview_libreoffice_path": "\/usr\/bin\/libreoffice",
    "filelocking.enabled": true,
    "memcache.locking": "\\OC\\Memcache\\Redis",
    "redis": {
        "host": "\/var\/run\/redis\/redis.sock",
        "port": 0,
        "timeout": 0,
        "dbindex": 0
    },
    "htaccess.RewriteBase": "\/",
    "maintenance": false,
    "ldapIgnoreNamingRules": false,
    "ldapProviderFactory": "\\OCA\\User_LDAP\\LDAPProviderFactory",
    "updater.release.channel": "production",
    "mail_smtpauthtype": "LOGIN"
}

**Are you using external storage, if yes which one: Local

**Are you using encryption: No

**Are you using an external user-backend, if yes which one: LDAP

LDAP configuration (delete this part if not used)

With access to your command line run e.g.:
sudo -u www-data php occ ldap:show-config
from within your Nextcloud installation folder

+-------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Configuration                 | s01                                                                                                                                                                                        |
+-------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| hasMemberOfFilterSupport      | 1                                                                                                                                                                                          |
| hasPagedResultSupport         |                                                                                                                                                                                            |
| homeFolderNamingRule          |                                                                                                                                                                                            |
| lastJpegPhotoLookup           | 0                                                                                                                                                                                          |
| ldapAgentName                 | CN=Nextcloud,CN=Users,DC=Domain,DC=com                                                                                                                                                   |
| ldapAgentPassword             | ***                                                                                                                                                                                        |
| ldapAttributesForGroupSearch  |                                                                                                                                                                                            |
| ldapAttributesForUserSearch   |                                                                                                                                                                                            |
| ldapBackupHost                |                                                                                                                                                                                            |
| ldapBackupPort                |                                                                                                                                                                                            |
| ldapBase                      | DC=Domain,DC=com                                                                                                                                                                         |
| ldapBaseGroups                | DC=Domain,DC=com                                                                                                                                                                         |
| ldapBaseUsers                 | DC=Domain,DC=com                                                                                                                                                                         |
| ldapCacheTTL                  | 600                                                                                                                                                                                        |
| ldapConfigurationActive       | 1                                                                                                                                                                                          |
| ldapDefaultPPolicyDN          |                                                                                                                                                                                            |
| ldapDynamicGroupMemberURL     |                                                                                                                                                                                            |
| ldapEmailAttribute            | mail                                                                                                                                                                                       |
| ldapExperiencedAdmin          | 0                                                                                                                                                                                          |
| ldapExpertUUIDGroupAttr       |                                                                                                                                                                                            |
| ldapExpertUUIDUserAttr        |                                                                                                                                                                                            |
| ldapExpertUsernameAttr        | sAMAccountName                                                                                                                                                                             |
| ldapGidNumber                 | gidNumber                                                                                                                                                                                  |
| ldapGroupDisplayName          | cn                                                                                                                                                                                         |
| ldapGroupFilter               |                                                                                                                                                                                            |
| ldapGroupFilterGroups         |                                                                                                                                                                                            |
| ldapGroupFilterMode           | 0                                                                                                                                                                                          |
| ldapGroupFilterObjectclass    |                                                                                                                                                                                            |
| ldapGroupMemberAssocAttr      | uniqueMember                                                                                                                                                                               |
| ldapHost                      | IP Address                                                                                                                                                                                |
| ldapIgnoreNamingRules         |                                                                                                                                                                                            |
| ldapLoginFilter               | (&(&(|(objectclass=person))(|(|(memberof=CN=Nextcloud Users,OU=Security Groups,DC=Domain,DC=com)(primaryGroupID=4162))))(|(samaccountname=%uid)(|(mailPrimaryAddress=%uid)(mail=%uid)))) |
| ldapLoginFilterAttributes     |                                                                                                                                                                                            |
| ldapLoginFilterEmail          | 1                                                                                                                                                                                          |
| ldapLoginFilterMode           | 0                                                                                                                                                                                          |
| ldapLoginFilterUsername       | 1                                                                                                                                                                                          |
| ldapNestedGroups              | 0                                                                                                                                                                                          |
| ldapOverrideMainServer        |                                                                                                                                                                                            |
| ldapPagingSize                | 500                                                                                                                                                                                        |
| ldapPort                      | 389                                                                                                                                                                                        |
| ldapQuotaAttribute            |                                                                                                                                                                                            |
| ldapQuotaDefault              |                                                                                                                                                                                            |
| ldapTLS                       | 0                                                                                                                                                                                          |
| ldapUserDisplayName           | displayname                                                                                                                                                                                |
| ldapUserDisplayName2          |                                                                                                                                                                                            |
| ldapUserFilter                | (&(|(objectclass=person))(|(|(memberof=CN=Nextcloud Users,OU=Security Groups,DC=Domain,DC=com)(primaryGroupID=4162))))                                                                   |
| ldapUserFilterGroups          | Nextcloud Users                                                                                                                                                                            |
| ldapUserFilterMode            | 1                                                                                                                                                                                          |
| ldapUserFilterObjectclass     | person                                                                                                                                                                                     |
| ldapUuidGroupAttribute        | auto                                                                                                                                                                                       |
| ldapUuidUserAttribute         | auto                                                                                                                                                                                       |
| turnOffCertCheck              | 0                                                                                                                                                                                          |
| turnOnPasswordChange          | 0                                                                                                                                                                                          |
| useMemberOfToDetectMembership | 1                                                                                                                                                                                          |
+-------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+

Client configuration

Browser: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36

**Operating system: Windows 10 1607

Logs

Nextcloud log

The Nextcloud Log is massive (Here is the relevant):

{"reqId":"b380FZCza7JDnIkVRIuI","level":0,"time":"2017-12-12T16:15:25+00:00","remoteAddr":"","user":"--","app":"user_ldap","method":"--","url":"--","message":"Ready for a paged search","userAgent":"--","version":"12.0.4.3"}
{"reqId":"b380FZCza7JDnIkVRIuI","level":0,"time":"2017-12-12T16:15:25+00:00","remoteAddr":"","user":"--","app":"user_ldap","method":"--","url":"--","message":"readAttribute: cn=teri anzivino,ou=marketing users,ou=users by department,ou=corporate,ou=sites,dc=Domain,dc=com found","userAgent":"--","version":"12.0.4.3"}
{"reqId":"b380FZCza7JDnIkVRIuI","level":0,"time":"2017-12-12T16:15:25+00:00","remoteAddr":"","user":"--","app":"user_ldap","method":"--","url":"--","message":"initializing paged search for  Filter (&(&(|(objectclass=person))(|(|(memberof=CN=Nextcloud Users,OU=Security Groups,DC=Domain,DC=com)(primaryGroupID=4162))))(|(samaccountname=1382409B-AF09-494E-ADF2-B9126C406F7B)(|(mailPrimaryAddress=1382409B-AF09-494E-ADF2-B9126C406F7B)(mail=1382409B-AF09-494E-ADF2-B9126C406F7B)))) base Array\n(\n    [0] => DC=cafaroco,DC=com\n)\n attr Array\n(\n    [0] => dn\n    [1] => uid\n    [2] => samaccountname\n    [3] => memberof\n    [4] => \n    [5] => mail\n    [6] => displayname\n    [7] => \n    [8] => jpegphoto\n    [9] => thumbnailphoto\n)\n limit 500 offset 0","userAgent":"--","version":"12.0.4.3"}
{"reqId":"b380FZCza7JDnIkVRIuI","level":0,"time":"2017-12-12T16:15:25+00:00","remoteAddr":"","user":"--","app":"user_ldap","method":"--","url":"--","message":"Ready for a paged search","userAgent":"--","version":"12.0.4.3"}
{"reqId":"b380FZCza7JDnIkVRIuI","level":0,"time":"2017-12-12T16:15:25+00:00","remoteAddr":"","user":"--","app":"user_ldap","method":"--","url":"--","message":"initializing paged search for  Filter (&(|(objectclass=person))(|(|(memberof=CN=Nextcloud Users,OU=Security Groups,DC=Domain,DC=com)(primaryGroupID=4162)))) base Array\n(\n    [0] => cn=sarah hulea,ou=legal lease users,ou=users by department,ou=corporate,ou=sites,dc=Domain,dc=com\n)\n attr Array\n(\n    [0] => \n)\n limit 500 offset 0","userAgent":"--","version":"12.0.4.3"}
{"reqId":"b380FZCza7JDnIkVRIuI","level":0,"time":"2017-12-12T16:15:25+00:00","remoteAddr":"","user":"--","app":"user_ldap","method":"--","url":"--","message":"Ready for a paged search","userAgent":"--","version":"12.0.4.3"}

[MorrisJobke]

cc @nextcloud/ldap

[blizzz]

Anything when you go to Users page and click on "Disabled" on the left pane?

[ahoward22]

Apologies for taking so long to get back. Nothing when I go to disabled users in the web interface or the CLI . The user (She) never gets logged in. If I add her to my AD group and try and log in I get the "User is Disabled" prior to the profile even being made in my nextcloud data directory (/var/ncdata/). That being said I have tried an occ user:info and user:enable to no avail because there is no profile there.

I currently have her using a local login and she is working. However, if I add her to the user group in AD and she tries to login, I get the same error message. I assumed, since she has a profile in my /var/ncdata already that it would just log her in with AD credentials and be mapped. That is not the case...

Edit 12/26/2017 I also looked in my oc_accounts for her uid or username and there is nothing there.

[blizzz]

Perhaps she is disabled in AD which refuses the login.

[ahoward22]

No, she is an active user on the domain. Although several times for good measure I reset her password and made sure the account was unlocked.

[ahoward22]

Cannot replicate issue with any other user profile.

[MohammedFota]

Hi Nextcloud team, @ahoward22 ,

Was this issue resolved? i'm currently facing this issue on 12.0.7, i tried many ways of cleaning the user data and removing and adding in the LDAP settings, keeps showing on the login screen "User Disabled", yet the user does not show up under disabled users and not disabled in active directory, kindly advise what steps i can take or update in the database to resolve this...

Many thanks in advance,
M Fota