LDAP wizard 'Could not connect to LDAP'

[RobinMcCorkell]

I upgraded my ownCloud instance from 8.1.3 to 8.2.0, with a configured LDAP server (which worked). Today I wanted to change one of the LDAP settings, but the wizard breaks with a 'Could not connect to LDAP' error. All users and groups continue to display correctly though. The following is seen in the logs:

Oct 25 11:12:57 atlas.lan.mccorkell.me.uk ownCloud[32387]: {PHP} ldap_connect(): Could not create session handle: Bad parameter to an ldap routine at /usr/share/webapps/owncloud/apps/user_ldap/lib/ldap.php#257
Oct 25 11:12:57 atlas.lan.mccorkell.me.uk ownCloud[32387]: {PHP} ldap_set_option(): supplied argument is not a valid ldap link resource at /usr/share/webapps/owncloud/apps/user_ldap/lib/ldap.php#257
Oct 25 11:12:57 atlas.lan.mccorkell.me.uk ownCloud[32387]: {PHP} ldap_set_option(): supplied argument is not a valid ldap link resource at /usr/share/webapps/owncloud/apps/user_ldap/lib/ldap.php#257
Oct 25 11:12:57 atlas.lan.mccorkell.me.uk ownCloud[32387]: {PHP} ldap_set_option(): supplied argument is not a valid ldap link resource at /usr/share/webapps/owncloud/apps/user_ldap/lib/ldap.php#257

LDAP configuration:

+-------------------------------+--------------------------------------------+
| Configuration                 |                                            |
+-------------------------------+--------------------------------------------+
| hasMemberOfFilterSupport      |                                            |
| hasPagedResultSupport         |                                            |
| homeFolderNamingRule          |                                            |
| lastJpegPhotoLookup           | 0                                          |
| ldapAgentName                 |                                            |
| ldapAgentPassword             | ***                                        |
| ldapAttributesForGroupSearch  |                                            |
| ldapAttributesForUserSearch   |                                            |
| ldapBackupHost                |                                            |
| ldapBackupPort                |                                            |
| ldapBase                      | dc=mccorkell,dc=me,dc=uk                   |
| ldapBaseGroups                | ou=groups,dc=mccorkell,dc=me,dc=uk         |
| ldapBaseUsers                 | ou=users,dc=mccorkell,dc=me,dc=uk          |
| ldapCacheTTL                  | 600                                        |
| ldapConfigurationActive       | 1                                          |
| ldapEmailAttribute            | mail                                       |
| ldapExperiencedAdmin          | 0                                          |
| ldapExpertUUIDGroupAttr       |                                            |
| ldapExpertUUIDUserAttr        |                                            |
| ldapExpertUsernameAttr        | uid                                        |
| ldapGroupDisplayName          | cn                                         |
| ldapGroupFilter               | (&(|(objectclass=posixGroup)))             |
| ldapGroupFilterGroups         |                                            |
| ldapGroupFilterMode           | 0                                          |
| ldapGroupFilterObjectclass    | posixGroup                                 |
| ldapGroupMemberAssocAttr      | memberUid                                  |
| ldapHost                      | zeus.lan.mccorkell.me.uk                   |
| ldapIgnoreNamingRules         |                                            |
| ldapLoginFilter               | (&(|(objectclass=posixAccount))(uid=%uid)) |
| ldapLoginFilterAttributes     |                                            |
| ldapLoginFilterEmail          | 0                                          |
| ldapLoginFilterMode           | 0                                          |
| ldapLoginFilterUsername       | 1                                          |
| ldapNestedGroups              | 0                                          |
| ldapOverrideMainServer        | 0                                          |
| ldapPagingSize                | 500                                        |
| ldapPort                      | 389                                        |
| ldapQuotaAttribute            |                                            |
| ldapQuotaDefault              |                                            |
| ldapTLS                       | 0                                          |
| ldapUserDisplayName           | cn                                         |
| ldapUserFilter                | (|(objectclass=posixAccount))              |
| ldapUserFilterGroups          |                                            |
| ldapUserFilterMode            | 0                                          |
| ldapUserFilterObjectclass     | posixAccount                               |
| ldapUuidGroupAttribute        | auto                                       |
| ldapUuidUserAttribute         | auto                                       |
| turnOffCertCheck              | 0                                          |
| useMemberOfToDetectMembership | 0                                          |
+-------------------------------+--------------------------------------------+

cc @blizzz

[PVince81]

@Xenopathic are you able to reproduce this with an instance installed from scratch ? (just to confirm / evaluate severity, I haven't tried it myself)

[RobinMcCorkell]

Yes, just reproduced with the latest master (although it technically wasn't a clean instance, but the LDAP configuration was completely clean)

[RobinMcCorkell]

Now I'm slightly concerned, I'm reproducing this on 8.1.0 as well...

[RobinMcCorkell]

Oh ffs PHP, it's an upstream regression: https://dev.icinga.org/issues/9298 https://www.netways.org/issues/2931

Basically, they removed support for host:port in ldap_connect()

[LukasReschke]

So we need to block PHP 5.6.11 for the LDAP app? Though then again that would probably mess with custom backports of distributions. Bloody stuff 🙊

We should at least make a note somewhere. Or can we fix/work-around this? The Netways link seems to indicate this?

cc @cmonteroluque

[karlitschek]

We need to understand how many distributions ship the affected PHP version. Let's do release note for now @carlaschroder

[RobinMcCorkell]

@LukasReschke @karlitschek It's not just 5.6.11, I'm running 5.6.14 (yay Arch!) and getting this issue. It's a regression in that it's worked before and no longer works, but I'm not familiar enough with php-ldap to say if it was ever designed to work like this...

[kalletabur]

Having same issues.
Web gui under LDAP Users "Only these object classes" and "Only from these groups" are grayed out and only manual LDAP query is available. Server settings are as usual and on commandline is verified that LDAP server can be connected and port opened.

OwnCloud version: 8.1.3.0
PHP 5.6.13+dfsg-0+deb8u1
Debian 8.2

"reqId":"reqId","remoteAddr":"10.10.10.10","app":"PHP","message":"ldap_connect(): Could not create session handle: Bad parameter to an ldap routine at \/var\/www\/owncloud\/apps\/user_ldap\/lib\/ldap.php#257","level":3,"time":"2015-10-27T09:51:23+00:00"}
{"reqId":"reqId","remoteAddr":"10.10.10.10","app":"PHP","message":"ldap_set_option(): supplied argument is not a valid ldap link resource at \/var\/www\/owncloud\/apps\/user_ldap\/lib\/ldap.php#257","level":3,"time":"2015-10-27T09:51:23+00:00"}
{"reqId":"reqId","remoteAddr":"10.10.10.10","app":"PHP","message":"ldap_set_option(): supplied argument is not a valid ldap link resource at \/var\/www\/owncloud\/apps\/user_ldap\/lib\/ldap.php#257","level":3,"time":"2015-10-27T09:51:23+00:00"}
{"reqId":"reqId","remoteAddr":"10.10.10.10","app":"PHP","message":"ldap_set_option(): supplied argument is not a valid ldap link resource at \/var\/www\/owncloud\/apps\/user_ldap\/lib\/ldap.php#257","level":3,"time":"2015-10-27T09:51:23+00:00"}

[carlaschroder]

Sigh PHP. One expects this sort of behavior from an infant, not from a mature, essential piece of infrastructure. So the release note says "PHP 5.6.11 breaks our nice LDAP wizard, but you can still do stuff via CLI."

[carlaschroder]

Sorry, that was a question. moar coffee.

[RobinMcCorkell]

@carlaschroder That sounds about right, but make sure you say PHP 5.6.11+, since all newer versions in the 5.6 branch are affected. And as far as I can tell no fix is in sight upstream

[carlaschroder]

ok thanks @Xenopathic

thanks @carlaschroder