LDAP error in Nextcloud 13 beta1

[Emi94]

I just upgraded to Nextcloud 13 beta1 (user_ldap version: 1.3.1) and this error appears over and over in the logs when an LDAP user does any action, even when clicking a button or reloading the page.

bin2hex() expects parameter 1 to be string, array given at /var/www/nextcloud/apps/user_ldap/lib/Access.php#1638

Everything seems to work fine for now, but even if this is a harmless error it fills the logs pretty quick with just one LDAP user logged in. With a few dozens of active users it will produce way more logs than wanted.

[Emi94]

If it's worth noting, I upgraded another nextcloud server and I get the same error

[blizzz]

@Emi94 AD I guess? Would be great if you could provide a full report according to the template https://raw.githubusercontent.com/nextcloud/server/master/issue_template.md

[Emi94]

Steps to reproduce

1. Login with an LDAP user
2. Do anything, like pressing some buttons or reloading the page

Expected behaviour

No Error should be thrown

Actual behaviour

This error is thrown multiple times when an LDAP user does any action:

bin2hex() expects parameter 1 to be string, array given at /var/www/nextcloud/apps/user_ldap/lib/Access.php#1638

Server configuration

Operating system: Ubuntu 16.04
Web server: Apache2
Database: Postgresql 9.5
PHP version: php 7.0
Nextcloud version: 13.0.0 beta1
Updated from an older Nextcloud/ownCloud or fresh install: updated from 12.0.3

Signing status

"No errors have been found."

App list

Enabled:
  - activity: 2.6.1
  - admin_audit: 1.3.0
  - circles: 0.13.6
  - comments: 1.3.0
  - dav: 1.4.5
  - federatedfilesharing: 1.3.1
  - federation: 1.3.0
  - files: 1.8.0
  - files_pdfviewer: 1.2.0
  - files_sharing: 1.5.0
  - files_texteditor: 2.5.1
  - files_trashbin: 1.3.0
  - files_versions: 1.6.0
  - files_videoplayer: 1.2.0
  - firstrunwizard: 2.2.1
  - gallery: 18.0.0
  - groupfolders: 1.1.0
  - logreader: 2.0.0
  - lookup_server_connector: 1.1.0
  - nextcloud_announcements: 1.2.0
  - notifications: 2.1.0
  - oauth2: 1.1.0
  - ojsxc: 3.3.2
  - password_policy: 1.3.0
  - provisioning_api: 1.3.0
  - serverinfo: 1.3.0
  - sharebymail: 1.3.0
  - survey_client: 1.1.0
  - systemtags: 1.3.0
  - theming: 1.4.1
  - twofactor_backupcodes: 1.2.3
  - updatenotification: 1.3.0
  - user_ldap: 1.3.1
  - workflowengine: 1.3.0
Disabled:
  - bruteforcesettings
  - encryption
  - external
  - files_external
  - ownnote
  - spreedme
  - user_external
  - workin2gether

Nextcloud configuration:

Config report

{
    "system": {
        "trashbin_retention_obligation": 30,
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "my.domain.com",
            "mysecond.domain.com"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "overwrite.cli.url": "http:\/\/my.domain.com",
        "dbtype": "pgsql",
        "version": "13.0.0.6",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "logtimezone": "UTC",
        "installed": true,
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpmode": "php",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "maintenance": false,
        "theme": "",
        "loglevel": 2,
        "updater.secret": "***REMOVED SENSITIVE VALUE***",
        "updater.release.channel": "beta",
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.local": "\\OC\\Memcache\\Redis",
        "filelocking.enabled": "true",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "timeout": 0,
            "dbindex": 0,
            "port": 6379
        },
        "versions_retention_obligation": "auto, 14",
        "ldapIgnoreNamingRules": false,
        "ldapProviderFactory": "\\OCA\\User_LDAP\\LDAPProviderFactory",
        "data-fingerprint": "***REMOVED SENSITIVE VALUE***",
        "overwriteprotocol": "https",
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***"
    }
}

Are you using external storage, if yes which one: no

Are you using encryption: no

Are you using an external user-backend, if yes which one: LDAP(Samba)

LDAP configuration (delete this part if not used)

LDAP config

+-------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------+
| Configuration                 |                                                                                                                                                      |
+-------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------+
| hasMemberOfFilterSupport      | 1                                                                                                                                                    |
| hasPagedResultSupport         |                                                                                                                                                      |
| homeFolderNamingRule          |                                                                                                                                                      |
| lastJpegPhotoLookup           | 0                                                                                                                                                    |
| ldapAgentName                 | cn=next.cloud,cn=users,dc=mydomain,dc=com                                                                                                           |
| ldapAgentPassword             | ***                                                                                                                                                  |
| ldapAttributesForGroupSearch  |                                                                                                                                                      |
| ldapAttributesForUserSearch   |                                                                                                                                                      |
| ldapBackupHost                |                                                                                                                                                      |
| ldapBackupPort                |                                                                                                                                                      |
| ldapBase                      | dc=mydomain,dc=com                                                                                                                                  |
| ldapBaseGroups                | dc=mydomain,dc=com                                                                                                                                  |
| ldapBaseUsers                 | dc=mydomain,dc=com                                                                                                                                  |
| ldapCacheTTL                  | 600                                                                                                                                                  |
| ldapConfigurationActive       | 1                                                                                                                                                    |
| ldapDefaultPPolicyDN          |                                                                                                                                                      |
| ldapDynamicGroupMemberURL     |                                                                                                                                                      |
| ldapEmailAttribute            | mail                                                                                                                                                 |
| ldapExperiencedAdmin          | 0                                                                                                                                                    |
| ldapExpertUUIDGroupAttr       |                                                                                                                                                      |
| ldapExpertUUIDUserAttr        |                                                                                                                                                      |
| ldapExpertUsernameAttr        | sAMAccountName                                                                                                                                       |
| ldapGidNumber                 | gidNumber                                                                                                                                            |
| ldapGroupDisplayName          | cn                                                                                                                                                   |
| ldapGroupFilter               |                                                                                                                                                      |
| ldapGroupFilterGroups         |                                                                                                                                                      |
| ldapGroupFilterMode           | 0                                                                                                                                                    |
| ldapGroupFilterObjectclass    |                                                                                                                                                      |
| ldapGroupMemberAssocAttr      | uniqueMember                                                                                                                                         |
| ldapHost                      | ldaps://dc.mydomain.com                                                                                                                      |
| ldapIgnoreNamingRules         |                                                                                                                                                      |
| ldapLoginFilter               | (&(&(|(objectclass=person))(|(|(memberof=CN=Domain Users,CN=Users,DC=mydomain,DC=com)(primaryGroupID=513))))(|(samaccountname=%uid)(|(mail=%uid)))) |
| ldapLoginFilterAttributes     | mail                                                                                                                                                 |
| ldapLoginFilterEmail          | 0                                                                                                                                                    |
| ldapLoginFilterMode           | 0                                                                                                                                                    |
| ldapLoginFilterUsername       | 1                                                                                                                                                    |
| ldapNestedGroups              | 0                                                                                                                                                    |
| ldapOverrideMainServer        |                                                                                                                                                      |
| ldapPagingSize                | 500                                                                                                                                                  |
| ldapPort                      | 636                                                                                                                                                  |
| ldapQuotaAttribute            |                                                                                                                                                      |
| ldapQuotaDefault              |                                                                                                                                                      |
| ldapTLS                       | 0                                                                                                                                                    |
| ldapUserDisplayName           | displayName                                                                                                                                          |
| ldapUserDisplayName2          |                                                                                                                                                      |
| ldapUserFilter                | (&(|(objectclass=person))(|(|(memberof=CN=Domain Users,CN=Users,DC=mydomain,DC=com)(primaryGroupID=513))))                                          |
| ldapUserFilterGroups          | Domain Users                                                                                                                                         |
| ldapUserFilterMode            | 0                                                                                                                                                    |
| ldapUserFilterObjectclass     | person                                                                                                                                               |
| ldapUuidGroupAttribute        | auto                                                                                                                                                 |
| ldapUuidUserAttribute         | auto                                                                                                                                                 |
| turnOffCertCheck              | 0                                                                                                                                                    |
| turnOnPasswordChange          | 0                                                                                                                                                    |
| useMemberOfToDetectMembership | 1                                                                                                                                                    |
+-------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------+

Logs

Nextcloud log (data/nextcloud.log)

Nextcloud log

{"reqId":"AtA14Ajf4jlJO8K1zf1a","level":3,"time":"2017-12-07T11:37:10+00:00","remoteAddr":"11.22.33.44","user":"emilian.mitocariu","app":"PHP","method":"PROPFIND","url":"\/remote.php\/dav\/files\/emilian.mitocariu\/","message":"bin2hex() expects parameter 1 to be string, array given at \/var\/www\/nextcloud\/apps\/user_ldap\/lib\/Access.php#1638","userAgent":"Mozilla\/5.0 (Linux) mirall\/2.3.2 (Nextcloud)","version":"13.0.0.6"}

[MJLorne]

Steps to reproduce

1. connect to AD
2. Login with AD user

Expected behaviour

Clean Logfile

Actual behaviour

Every action of the AD-User creates an error:
bin2hex() expects parameter 1 to be string, array given at /var/www/nextcloud/apps/user_ldap/lib/Access.php#1638

Server configuration

Operating system: Ubuntu 16.04
Web server: Apache2
Database: MariaDB 10.0.31
PHP version: 7.0.22
Nextcloud version: Nextcloud 13.0.0 Beta 1 Build:2017-12-06T22:01:29+00:00 430f60d
Updated from an older Nextcloud/ownCloud or fresh install: Update from 12.0.3
Where did you install Nextcloud from: Nextcloud.com
Signing status:

Signing status

No errors have been found.

List of activated apps:

App list

Enabled:

• activity: 2.6.1
• comments: 1.3.0
• dav: 1.4.5
• federatedfilesharing: 1.3.1
• federation: 1.3.0
• files: 1.8.0
• files_pdfviewer: 1.2.0
• files_sharing: 1.5.0
• files_texteditor: 2.5.1
• files_trashbin: 1.3.0
• files_versions: 1.6.0
• files_videoplayer: 1.2.0
• firstrunwizard: 2.2.1
• gallery: 18.0.0
• logreader: 2.0.0
• lookup_server_connector: 1.1.0
• nextcloud_announcements: 1.2.0
• notifications: 2.1.2
• oauth2: 1.1.0
• password_policy: 1.3.0
• provisioning_api: 1.3.0
• serverinfo: 1.3.0
• sharebymail: 1.3.0
• survey_client: 1.1.0
• systemtags: 1.3.0
• theming: 1.4.1
• twofactor_backupcodes: 1.2.3
• updatenotification: 1.3.0
• user_ldap: 1.3.1
• workflowengine: 1.3.0
  Disabled:
• admin_audit
• bruteforcesettings
• encryption
• files_external
• user_external
• workin2gether

Nextcloud configuration:

Config report

"system": {
    "instanceid": "***REMOVED SENSITIVE VALUE***",
    "passwordsalt": "***REMOVED SENSITIVE VALUE***",
    "secret": "***REMOVED SENSITIVE VALUE***",
    "trusted_domains": [
        "172.16.1.188",
    ],
    "datadirectory": "***REMOVED SENSITIVE VALUE***",
    "overwrite.cli.url": "***REMOVED SENSITIVE VALUE***",
    "htaccess.RewriteBase": "\/",
    "dbtype": "mysql",
    "version": "13.0.0.6",
    "dbname": "***REMOVED SENSITIVE VALUE***",
    "dbhost": "***REMOVED SENSITIVE VALUE***",
    "dbport": "",
    "dbtableprefix": "oc_",
    "dbuser": "***REMOVED SENSITIVE VALUE***",
    "dbpassword": "***REMOVED SENSITIVE VALUE***",
    "installed": true,
    "ldapIgnoreNamingRules": false,
    "ldapProviderFactory": "\\OCA\\User_LDAP\\LDAPProviderFactory",
    "updater.release.channel": "daily",
    "maintenance": false,
    "theme": "",
    "loglevel": 2,
    "mail_from_address": "***REMOVED SENSITIVE VALUE***",
    "mail_smtpmode": "smtp",
    "mail_smtpauthtype": "LOGIN",
    "mail_domain": "***REMOVED SENSITIVE VALUE***",
    "mail_smtpauth": 1,
    "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
    "mail_smtpport": "26",
    "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
    "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
    "updater.secret": "***REMOVED SENSITIVE VALUE***"

Are you using external storage, if yes which one:
No
Are you using encryption:
No
Are you using an external user-backend, if yes which one:
ActiveDirectory

LDAP configuration (delete this part if not used)

LDAP config

+-------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| Configuration | s01 |
+-------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| hasMemberOfFilterSupport | 1 |
| hasPagedResultSupport | |
| homeFolderNamingRule | |
| lastJpegPhotoLookup | 0 |
| ldapAgentName | nextcloud |
| ldapAgentPassword | *** |
| ldapAttributesForGroupSearch | |
| ldapAttributesForUserSearch | |
| ldapBackupHost | |
| ldapBackupPort | |
| ldapBase | ou=_changed_neu,dc=changed,dc=de |
| ldapBaseGroups | ou=_changed_neu,dc=changed,dc=de |
| ldapBaseUsers | ou=_changed_neu,dc=changed,dc=de |
| ldapCacheTTL | 600 |
| ldapConfigurationActive | 1 |
| ldapDefaultPPolicyDN | |
| ldapDynamicGroupMemberURL | |
| ldapEmailAttribute | mail |
| ldapExperiencedAdmin | 0 |
| ldapExpertUUIDGroupAttr | |
| ldapExpertUUIDUserAttr | |
| ldapExpertUsernameAttr | |
| ldapGidNumber | gidNumber |
| ldapGroupDisplayName | cn |
| ldapGroupFilter | (|(cn=changed)) |
| ldapGroupFilterGroups | changed |
| ldapGroupFilterMode | 0 |
| ldapGroupFilterObjectclass | |
| ldapGroupMemberAssocAttr | member |
| ldapHost | changed |
| ldapIgnoreNamingRules | |
| ldapLoginFilter | (&(&(|(objectclass=person))(|(|(memberof=CN=changed,OU=Sicherheitsgruppen,OU=_OU_changed,OU=_changed_neu,DC=changed,DC=de)(primaryGroupID=26729))))(|(samaccountname=%uid)(|(mailPrimaryAddress=%uid)(mail=%uid)))) |
| ldapLoginFilterAttributes | |
| ldapLoginFilterEmail | 1 |
| ldapLoginFilterMode | 0 |
| ldapLoginFilterUsername | 1 |
| ldapNestedGroups | 0 |
| ldapOverrideMainServer | |
| ldapPagingSize | 500 |
| ldapPort | 389 |
| ldapQuotaAttribute | |
| ldapQuotaDefault | |
| ldapTLS | 0 |
| ldapUserDisplayName | displayname |
| ldapUserDisplayName2 | |
| ldapUserFilter | (&(|(objectclass=person))(|(|(memberof=CN=changed,OU=Sicherheitsgruppen,OU=_OU_changed,OU=_changed_neu,DC=changed,DC=de)(primaryGroupID=26729)))) |
| ldapUserFilterGroups | changed |
| ldapUserFilterMode | 0 |
| ldapUserFilterObjectclass | person |
| ldapUuidGroupAttribute | auto |
| ldapUuidUserAttribute | auto |
| turnOffCertCheck | 0 |
| turnOnPasswordChange | 0 |
| useMemberOfToDetectMembership | 1 |
+-------------------------------+-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+

Client configuration

Browser: Chrome

Operating system: Windows 10

Logs

Nextcloud log (data/nextcloud.log)

Nextcloud log

{"reqId":"1gwySOA38yWTBqCesb6j","level":3,"time":"2017-12-07T12:23:36+00:00","remoteAddr":"IP_Adress_Changed","user":"001D7D89-485F-4970-8C2A-6B7F82C485DD","app":"PHP","method":"PROPFIND","url":"\/remote.php\/dav\/files\/001D7D89-485F-4970-8C2A-6B7F82C485DD\/","message":"bin2hex() expects parameter 1 to be string, array given at \/var\/www\/nextcloud\/apps\/user_ldap\/lib\/Access.php#1638","userAgent":"Mozilla\/5.0 (Windows) mirall\/2.3.3 (build 1) (Nextcloud)","version":"13.0.0.6"}

[Varbin]

I can also reproduce.

Differences to reports above:

• Web server: h2o/2.2.3
• Operation system: Debian 9
• Fresh install

My ldap server is OpenLDAP's slapd.

[Varbin]

The function in which the error occurs convertObjectGUID2Str($oguid).

[MorrisJobke]

@blizzz: Also happens here and the $oguid is filled with the group DNs:

[
cn=abc,ou=groups,dc=nextcloud,dc=com, 
cn=def,ou=groups,dc=nextcloud,dc=com, 
cn=ghi,ou=groups,dc=nextcloud,dc=com, 
cn=jkl,ou=groups,dc=nextcloud,dc=com, 
cn=mno,ou=groups,dc=nextcloud,dc=com
]

https://github.com/nextcloud/server/blob/master/apps/user_ldap/lib/Access.php#L1639-L1663

[blizzz]

a quick thing you may try:

diff --git a/apps/user_ldap/lib/Access.php b/apps/user_ldap/lib/Access.php
index 95710cd37f..27fda38a73 100644
--- a/apps/user_ldap/lib/Access.php
+++ b/apps/user_ldap/lib/Access.php
@@ -1253,11 +1253,13 @@ class Access extends LDAPUtility implements IUserTools {
                            unset($item[$key]['count']);
                        }
                        if($key !== 'dn') {
-                           $selection[$i][$key] = $this->resemblesDN($key) ?
-                               $this->helper->sanitizeDN($item[$key])
-                               : $key === 'objectguid' || $key === 'guid' ?
-                                   $selection[$i][$key] = $this->convertObjectGUID2Str($item[$key])
-                                   : $item[$key];
+                           if($this->resemblesDN($key)) {
+                               $selection[$i][$key] = $this->helper->sanitizeDN($item[$key]);
+                           } else if($key === 'objectguid' || $key === 'guid') {
+                               $selection[$i][$key] = [$this->convertObjectGUID2Str($item[$key][0])];
+                           } else {
+                               $selection[$i][$key] = $item[$key];
+                           }
                        } else {
                            $selection[$i][$key] = [$this->helper->sanitizeDN($item[$key])];
                        }

essentially it makes it more readable. The function should not have been called in the first play, and I blame the short comparison version as cause, although i could not verify it. Errors will go away anyway since the the function is now provided with the actual value, too.