Cloudron makes it easy to run web apps like WordPress, Nextcloud, GitLab on your server. Find out more or install now.


Skip to content
  • Categories
  • Recent
  • Tags
  • Popular
  • Bookmarks
  • Search
Skins
  • Light
  • Cerulean
  • Cosmo
  • Flatly
  • Journal
  • Litera
  • Lumen
  • Lux
  • Materia
  • Minty
  • Morph
  • Pulse
  • Sandstone
  • Simplex
  • Sketchy
  • Spacelab
  • United
  • Yeti
  • Zephyr
  • Dark
  • Cyborg
  • Darkly
  • Quartz
  • Slate
  • Solar
  • Superhero
  • Vapor

  • Default (No Skin)
  • No Skin
Collapse
Brand Logo

Cloudron Forum

Apps | Demo | Docs | Install
  1. Cloudron Forum
  2. Nextcloud
  3. LDAP Group support in Nextcloud

LDAP Group support in Nextcloud

Scheduled Pinned Locked Moved Solved Nextcloud
13 Posts 7 Posters 5.4k Views 8 Watching
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • J Offline
      J Offline
      jfergus1
      wrote on last edited by
      #1

      Hi. I am relatively new to Cloudron and have been experimenting with it the past couple of weeks to see if it is a solution for my enterprise. After finding that the LDAP groups are not available in apps, especially Nextcloud, it’s pretty much a deal breaker. As no has responded with a specific use case, I will outline mine.

      Currently users and groups are defined in active directory. Access control to files shares and specific folders is done via group membership. Essentially, only members of the team working on a specific project are allowed to access the files for the project.

      One of the benefits of Cloudron is to link the platform to active directory and not have to setup individual apps access to active directory over and over again. However, without the propagation of the AD groups through LDAPs to Cloudron and finally to apps themselves, I would need to essentially manage access control within each individual app which will lead to errors and a maintenance nightmare.

      I like the product thus far, but this current issue is giving me pause.

      nebulonN 1 Reply Last reply
      2
      • J jfergus1

        Hi. I am relatively new to Cloudron and have been experimenting with it the past couple of weeks to see if it is a solution for my enterprise. After finding that the LDAP groups are not available in apps, especially Nextcloud, it’s pretty much a deal breaker. As no has responded with a specific use case, I will outline mine.

        Currently users and groups are defined in active directory. Access control to files shares and specific folders is done via group membership. Essentially, only members of the team working on a specific project are allowed to access the files for the project.

        One of the benefits of Cloudron is to link the platform to active directory and not have to setup individual apps access to active directory over and over again. However, without the propagation of the AD groups through LDAPs to Cloudron and finally to apps themselves, I would need to essentially manage access control within each individual app which will lead to errors and a maintenance nightmare.

        I like the product thus far, but this current issue is giving me pause.

        nebulonN Offline
        nebulonN Offline
        nebulon
        Staff
        wrote on last edited by
        #2

        @jfergus1 since Cloudron v7 the groups should be exposed by now into the apps. If the apps are not picking them up maybe there is a problem with specific apps. at least for Nextcloud in the instances I have checked now, the groups exist when querying them in the Nextcloud LDAP settings, however I can also see that they are not available in the sharing feature. So this might be a limitation of Nextcloud itself?

        1 Reply Last reply
        2
        • girishG girish moved this topic from Discuss on
        • girishG Offline
          girishG Offline
          girish
          Staff
          wrote on last edited by
          #3

          Maybe https://github.com/nextcloud/server/issues/25062 which says sharing with LDAP group is still broken ?

          1 Reply Last reply
          1
          • J Offline
            J Offline
            jfergus1
            wrote on last edited by
            #4

            I did some experimenting today by setting up a Nextcloud ldap profile to a windows server domain controller via ldap. After Nextcloud connected to the DC, the groups received over LDAP were populated in Nextcloud as expected. Here's a difference I noticed between the Cloudron LDAP server and the Windows DC.

            In Nextcloud -> LDAP/AD integration -> tab Groups -> "Only these object classes":

            • When connected to the DC, this drop down has an object class named "group", when that is selected, the groups are populated in Nextcloud.
            • When connected to the Cloudron LDAP server, this drop down does NOT have an object class named "group", just inetorgperson, organizationalperson, person, top, and user. I did try manually creating the LDAP query for objectclass=group. Nextcloud does get the count of groups correct, however they do not auto populate.

            How do we get the Cloudron LDAP server to feed up the "group" object class?

            I also noticed that the Server Tab, the Base DN is set to ou=users,dc=cloudron. Since Groups are at ou=groups,dc=cloudron, I would expect the Base DN to just be dc=cloudron as the Base user tree and Base group tree are set in the advanced tab. However when I try to set the Base DN to dc=cloudron, nextcloud does not like the config anymore.

            girishG 2 Replies Last reply
            1
            • J jfergus1

              I did some experimenting today by setting up a Nextcloud ldap profile to a windows server domain controller via ldap. After Nextcloud connected to the DC, the groups received over LDAP were populated in Nextcloud as expected. Here's a difference I noticed between the Cloudron LDAP server and the Windows DC.

              In Nextcloud -> LDAP/AD integration -> tab Groups -> "Only these object classes":

              • When connected to the DC, this drop down has an object class named "group", when that is selected, the groups are populated in Nextcloud.
              • When connected to the Cloudron LDAP server, this drop down does NOT have an object class named "group", just inetorgperson, organizationalperson, person, top, and user. I did try manually creating the LDAP query for objectclass=group. Nextcloud does get the count of groups correct, however they do not auto populate.

              How do we get the Cloudron LDAP server to feed up the "group" object class?

              I also noticed that the Server Tab, the Base DN is set to ou=users,dc=cloudron. Since Groups are at ou=groups,dc=cloudron, I would expect the Base DN to just be dc=cloudron as the Base user tree and Base group tree are set in the advanced tab. However when I try to set the Base DN to dc=cloudron, nextcloud does not like the config anymore.

              girishG Offline
              girishG Offline
              girish
              Staff
              wrote on last edited by
              #5

              @jfergus1 said in LDAP Group support in Nextcloud:

              How do we get the Cloudron LDAP server to feed up the "group" object class?

              I think the issue here might be that we don't seem to be setting objectcategory=group for the group objects in the LDAP server. Testing this out now.

              1 Reply Last reply
              2
              • J jfergus1

                I did some experimenting today by setting up a Nextcloud ldap profile to a windows server domain controller via ldap. After Nextcloud connected to the DC, the groups received over LDAP were populated in Nextcloud as expected. Here's a difference I noticed between the Cloudron LDAP server and the Windows DC.

                In Nextcloud -> LDAP/AD integration -> tab Groups -> "Only these object classes":

                • When connected to the DC, this drop down has an object class named "group", when that is selected, the groups are populated in Nextcloud.
                • When connected to the Cloudron LDAP server, this drop down does NOT have an object class named "group", just inetorgperson, organizationalperson, person, top, and user. I did try manually creating the LDAP query for objectclass=group. Nextcloud does get the count of groups correct, however they do not auto populate.

                How do we get the Cloudron LDAP server to feed up the "group" object class?

                I also noticed that the Server Tab, the Base DN is set to ou=users,dc=cloudron. Since Groups are at ou=groups,dc=cloudron, I would expect the Base DN to just be dc=cloudron as the Base user tree and Base group tree are set in the advanced tab. However when I try to set the Base DN to dc=cloudron, nextcloud does not like the config anymore.

                girishG Offline
                girishG Offline
                girish
                Staff
                wrote on last edited by
                #6

                @jfergus1 Just editing the LDAP query directly does the trick.

                That said, I don't really know how to make LDAP groups appear in sharing.

                05d1860f-ad53-433b-9e06-b61a524aed2b-image.png

                P 2 Replies Last reply
                1
                • nebulonN nebulon referenced this topic on
                • girishG girish

                  @jfergus1 Just editing the LDAP query directly does the trick.

                  That said, I don't really know how to make LDAP groups appear in sharing.

                  05d1860f-ad53-433b-9e06-b61a524aed2b-image.png

                  P Offline
                  P Offline
                  perler
                  wrote on last edited by
                  #7

                  @girish ok, setting the (objectclass=group) query works and verifying finds the correct amount of groups, but the association here:

                  2682a0db-e622-4117-8b2f-adcd36b8b4cf-image.png
                  is not mirrored inside nextcloud:
                  e8a2272e-426c-4489-b419-d4b54839055d-image.png

                  should this work at all?

                  1 Reply Last reply
                  1
                  • P perler referenced this topic on
                  • girishG girish

                    @jfergus1 Just editing the LDAP query directly does the trick.

                    That said, I don't really know how to make LDAP groups appear in sharing.

                    05d1860f-ad53-433b-9e06-b61a524aed2b-image.png

                    P Offline
                    P Offline
                    perler
                    wrote on last edited by
                    #8

                    @girish @nebulon
                    ok, I tried quite a lot and read stuff like this but no success. Any ideas?

                    1 Reply Last reply
                    0
                    • nebulonN Offline
                      nebulonN Offline
                      nebulon
                      Staff
                      wrote on last edited by
                      #9

                      To update this thread, the Nextcloud app required some fixes, see https://git.cloudron.io/cloudron/nextcloud-app/-/commit/ad9adf70f5a6b13ce30ed272c369ae0109b0443d

                      Once we have released Cloudron version 7.3.0 then groups should as expected in Nextcloud.

                      Just a heads up though, in order to use groups, they have to be explicitly selected in the LDAP plugin settings UI within Nextcloud.

                      jdaviescoatesJ 32463 2 Replies Last reply
                      4
                      • nebulonN nebulon marked this topic as a question on
                      • girishG girish has marked this topic as solved on
                      • nebulonN nebulon

                        To update this thread, the Nextcloud app required some fixes, see https://git.cloudron.io/cloudron/nextcloud-app/-/commit/ad9adf70f5a6b13ce30ed272c369ae0109b0443d

                        Once we have released Cloudron version 7.3.0 then groups should as expected in Nextcloud.

                        Just a heads up though, in order to use groups, they have to be explicitly selected in the LDAP plugin settings UI within Nextcloud.

                        jdaviescoatesJ Offline
                        jdaviescoatesJ Offline
                        jdaviescoates
                        wrote on last edited by
                        #10

                        @nebulon said in LDAP Group support in Nextcloud:

                        in order to use groups, they have to be explicitly selected in the LDAP plugin settings UI within Nextcloud.

                        This (and info about taking advantage of LDAP Groups generally) should be added to the docs (I'd go submit a PR myself but I'm on my phone)

                        I use Cloudron with Gandi & Hetzner

                        1 Reply Last reply
                        0
                        • avatar1024A Offline
                          avatar1024A Offline
                          avatar1024
                          wrote on last edited by avatar1024
                          #11

                          Groups kinda work but no fully in my experience.

                          In the list of active users in Nextcloud, I can see users being part of the correct LDAP groups (under the fourth column "Groups"), but when I click on a group in the left hand side column, they're all empty.

                          Anyone else experiencing this behaviour?

                          1 Reply Last reply
                          1
                          • David 0D David 0 referenced this topic on
                          • nebulonN nebulon

                            To update this thread, the Nextcloud app required some fixes, see https://git.cloudron.io/cloudron/nextcloud-app/-/commit/ad9adf70f5a6b13ce30ed272c369ae0109b0443d

                            Once we have released Cloudron version 7.3.0 then groups should as expected in Nextcloud.

                            Just a heads up though, in order to use groups, they have to be explicitly selected in the LDAP plugin settings UI within Nextcloud.

                            32463 Offline
                            32463 Offline
                            3246
                            wrote on last edited by
                            #12

                            @nebulon said in LDAP Group support in Nextcloud:

                            Just a heads up though, in order to use groups, they have to be explicitly selected in the LDAP plugin settings UI within Nextcloud.

                            Please, can you provide the correct query to use? Just using (|(objectclass=group)) validates but shows 0 groups when it should show 11.

                            Otherwise, is there a way to specify a group to allow users access from?

                            👉 Find our more www.bebraver.online

                            1 Reply Last reply
                            0
                            • nebulonN Offline
                              nebulonN Offline
                              nebulon
                              Staff
                              wrote on last edited by
                              #13

                              The current package should setup LDAP correctly by default to use groups from Cloudron within nextcloud. This thread is a bit outdated.

                              1 Reply Last reply
                              1
                              Reply
                              • Reply as topic
                              Log in to reply
                              • Oldest to Newest
                              • Newest to Oldest
                              • Most Votes


                                • Login

                                • Don't have an account? Register

                                • Login or register to search.
                                • First post
                                  Last post
                                0
                                • Categories
                                • Recent
                                • Tags
                                • Popular
                                • Bookmarks
                                • Search