Maybe user_ldap also fetches group assignments from Cloudron no matter if defined in NC, wheras ›OpenID connect user backend‹ only fetches those available in the app / in NC.

I'll try that.

But isn't the question rather this:

Given the fact that the user-group mapping is available in NC as soon as I enable user_ldap, isn't this a hint on „no cause in NC, but rather in the Cloudron mothernship“ (this being the OpenID provider)?
No update, no restart, just enabling user_ldap and login – even „on the fly“.

Obviously NC was automatically upgraded to release 31.0.2 last night, and user_ldap got disabled in the process.
I have disabled auto-updates for now.

So I can confirm that this is the reason for our „document loss“.

And yes, it looks like the connection from OpenID-authenticated users to NC documents + folders gets lost somehow/somewhere.
But it's not the case that there are „extra user accounts“ in NextCloud. They are the same (same name, same, password, same 2fa) before & after activation of user_ldap.

I don't know how permissions are implemented „under the hood“ in NC.
We grant r/w access based on a group („staff“), not on a user base.

I noted one difference between „with / without user_ldap“:
the „owner“ of the folders is slightly different:
With user_ldap enabled, it's the full name „Christian A Vogl“, whereas when it's disabled, it's the short login name „cav“. Maybe a hint, that some data fetching from the Cloudron master did not succeed, and maybe the same data fetching action that should get the user's groups?

PS:
We do not use other plugins or apps in NC. But I could test one or the other, if you think that might help finding the cause.

In the running NC instance, OIDC seems to be configured, all 9 environment variables are given and have reasonable values, which are mentioned in https://docs.cloudron.io/packaging/addons/#oidc
curling the endpoints works, response is valid JSON at first glance.

Do I need to verify in the user accounts in the Cloudron master?

For years, I used to be under the impression, these user accounts are somehow stored in a NC database or something like that, but last autumn I realized that our cloudron accounts are used. So I guess this is done via ldap?

yes, nextcloud is using ldap to authenticate as cloudron account. but oidc is also the same but using oidc protocol. The LDAP setup will go away at some point. So, it would be good to understand why this is not working

For years, I used to be under the impression, these user accounts are somehow stored in a NC database or something like that, but last autumn I realized that our cloudron accounts are used. So I guess this is done via ldap?

Confusing thing this morning was that loging in via the button ›Login with Cloudron‹ granted access, but without giving the files.

I was also able to localize the responsible NC plugin: turns out it was not an active plugin, but one disabled by the upgrade process: user_ldap
Identified this by comparing the plugin lists in 4.23.4/30.0.5 and 5.4.0/31.0.1.

After re-enabling user_ldap, all documents und subfolders were visible in NextCloud 31.0.1, too.

I suppose there was good reason for disabling it.
But at least one step seems to be missing in the shift from ldap to oidc.

Thanks again, Joseph, your support was very helpful!
/Chris

This usually comes down to the nextcloud apps you have installed . Can you disable some of those apps one by one and try ? https://docs.cloudron.io/apps/nextcloud/#fixing-a-broken-install

I'll try yesterday's version.

That's good, I suppose.

Started a clone of backup 1 of this morning's upgrades, maybe I'll find a working version.

Thank you very much for your immediate replies + directions, Joseph! I expected way slower support, and you're even helping!

Is it „safe“ in whatever sense to restore to one of these backups, maybe even step by step, or does this not affect data / storage?

yes, it's safe . but I recommend using clone instead of restore (it will create a new instance of nextcloud and you can test if that works). of course, a clone will take that amount of additional space and your server should have that space.

I wonder if this could lead to finding the „point of failure“.

Our Cloudron is on 8.2.4 still, because I was warned of

This update is a pre-release and not considered stable yet. Please update at your own risk.

(I am just offered 8.3.1, not 8.3.0)

After upgrading NextCloud from 4.23.4 to 5.4, almost all folders and data are gone, unfortunately:

What versions are these? NC is on version 31... Cloudron is on version 8.3.

edit: don't mind me, I guess you mean the nextcloud package version