Cloudron Forum

Also:
independent of group assignments, NC doesn't even show a user's own files (but it probably should, shouldn't it?)

No, that did not resolve the problem,
even if ›staff‹ is also a group in NC and the users are assigned to that group,
our files & folders (below top level) do not show up in the NC interface.

But in a way you're up to something:
This group ›staff‹ is only defined in Cloudron, not in NC.

Maybe user_ldap also fetches group assignments from Cloudron no matter if defined in NC, wheras ›OpenID connect user backend‹ only fetches those available in the app / in NC.

I'll try that.

Probably I have – whatever is visible in the NC admin interface is available.
Are you suggesting that I should disable user_ldap again and check?

But isn't the question rather this:

Given the fact that the user-group mapping is available in NC as soon as I enable user_ldap, isn't this a hint on „no cause in NC, but rather in the Cloudron mothernship“ (this being the OpenID provider)?
No update, no restart, just enabling user_ldap and login – even „on the fly“.

Interestingly (and annoyingly) our current NextCloud-Instance was not working again this morning, meaning that login was only possible via the „login with cloudron“redirection and that subfolders & documents were missing. The reason: user_ldap was disabled again …

Obviously NC was automatically upgraded to release 31.0.2 last night, and user_ldap got disabled in the process.
I have disabled auto-updates for now.

So I can confirm that this is the reason for our „document loss“.

And yes, it looks like the connection from OpenID-authenticated users to NC documents + folders gets lost somehow/somewhere.
But it's not the case that there are „extra user accounts“ in NextCloud. They are the same (same name, same, password, same 2fa) before & after activation of user_ldap.

I don't know how permissions are implemented „under the hood“ in NC.
We grant r/w access based on a group („staff“), not on a user base.

I noted one difference between „with / without user_ldap“:
the „owner“ of the folders is slightly different:
With user_ldap enabled, it's the full name „Christian A Vogl“, whereas when it's disabled, it's the short login name „cav“. Maybe a hint, that some data fetching from the Cloudron master did not succeed, and maybe the same data fetching action that should get the user's groups?

PS:
We do not use other plugins or apps in NC. But I could test one or the other, if you think that might help finding the cause.

Provided some guidance, I could assist with some debugging, logfiles, configuration excerpts.
I have two copies of the NC installation still there, but switched off – I could mess around in them without any disturbance or costs.

In the running NC instance, OIDC seems to be configured, all 9 environment variables are given and have reasonable values, which are mentioned in https://docs.cloudron.io/packaging/addons/#oidc
curling the endpoints works, response is valid JSON at first glance.

Do I need to verify in the user accounts in the Cloudron master?

I don't know, frankly speaking.
We only login via Browserform provided by NextCloud – before & after the upgrade. (cf. Screenshot)

For years, I used to be under the impression, these user accounts are somehow stored in a NC database or something like that, but last autumn I realized that our cloudron accounts are used. So I guess this is done via ldap?

Confusing thing this morning was that loging in via the button ›Login with Cloudron‹ granted access, but without giving the files.

So, I was indeed able to restore yesterday's NC in version 30.0.5 on app version 4.23.4 by cloning, and this shows all data + files and also allows login.

I was also able to localize the responsible NC plugin: turns out it was not an active plugin, but one disabled by the upgrade process: user_ldap
Identified this by comparing the plugin lists in 4.23.4/30.0.5 and 5.4.0/31.0.1.

After re-enabling user_ldap, all documents und subfolders were visible in NextCloud 31.0.1, too.

I suppose there was good reason for disabling it.
But at least one step seems to be missing in the shift from ldap to oidc.

Thanks again, Joseph, your support was very helpful!
/Chris

No success with cloning version 5.0.4 from this morning, running Nextcloud 30.0.5.
Same behavior: login not possible, after login via Cloudron, no documents available.

I'll try yesterday's version.

Ah, interesting.
And yes, the File Manager shows the directory structure with the uploaded files, including the new subfolder from yesterday with its two files.

That's good, I suppose.

Started a clone of backup 1 of this morning's upgrades, maybe I'll find a working version.

Thank you very much for your immediate replies + directions, Joseph! I expected way slower support, and you're even helping!

@joseph By ›File manager‹, do you mean the normal view of „all files“ in the NextCloud browser interface, accessed via the left navigation bar (screenshot)?
This is actually the only way we are using NC, no other clients, no WebDav, nothing.

One question:
for every step, there was a backup created, so that I have seven of them.
Is it „safe“ in whatever sense to restore to one of these backups, maybe even step by step, or does this not affect data / storage?

I wonder if this could lead to finding the „point of failure“.

NextCloud is now version 31.0.1, yes.

Our Cloudron is on 8.2.4 still, because I was warned of

This update is a pre-release and not considered stable yet. Please update at your own risk.

(I am just offered 8.3.1, not 8.3.0)

After upgrading NextCloud from 4.23.4 to 5.4, almost all folders and data are gone, unfortunately:

Top level folders are still there and even show the date of last modification (correct at least for one folder modified yesterday),
but every top level folder shows empty (cf. screenshots). No subfolders, no documents in subfolders are there.

The long non-update phase (since February 6) was due to trouble with docker (invalid blocks due to “toomanyrequests”, seemingly related to IPv6 subnet blocking in our Frankfurt data center …), we only realized that last Friday and figured out this morning how to circumvent this (by disabling IPv6 – but the issue with our NextCloud installation persists after reenabling IPv6).

I have to admit that I don't have an idea where to start looking for errors / misconfiguration or where to start inspecting the containers.
Any idea anyone?

Sidenote:
We have also installed RocketChat, for which there was also half a dozen updates – everything went fine here, as it seems.

Regards,
Christian

PS:
Logins to NC did not work, probably also the OIDC issue reported by others; we logged in via Cloudron.

Screenshots:

Top level folder list, with correct modification dates:

Empty folder Team, no subfolders, there should be half a dozen as well as some documents, one newly created yesterday:

Empty folder, about a dozen subfolders missing: