{"action":"created","issue":{"url":"https://api.github.com/repos/owncloud/core/issues/20217","labels_url":"https://api.github.com/repos/owncloud/core/issues/20217/labels{/name}","comments_url":"https://api.github.com/repos/owncloud/core/issues/20217/comments","events_url":"https://api.github.com/repos/owncloud/core/issues/20217/events","html_url":"https://github.com/owncloud/core/issues/20217","id":114554543,"number":20217,"title":"Unable to update private key password issue after ActiveDirectory password change","user":{"login":"GCC0THerbst","id":13761777,"avatar_url":"https://avatars.githubusercontent.com/u/13761777?v=3","gravatar_id":"","url":"https://api.github.com/users/GCC0THerbst","html_url":"https://github.com/GCC0THerbst","followers_url":"https://api.github.com/users/GCC0THerbst/followers","following_url":"https://api.github.com/users/GCC0THerbst/following{/other_user}","gists_url":"https://api.github.com/users/GCC0THerbst/gists{/gist_id}","starred_url":"https://api.github.com/users/GCC0THerbst/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/GCC0THerbst/subscriptions","organizations_url":"https://api.github.com/users/GCC0THerbst/orgs","repos_url":"https://api.github.com/users/GCC0THerbst/repos","events_url":"https://api.github.com/users/GCC0THerbst/events{/privacy}","received_events_url":"https://api.github.com/users/GCC0THerbst/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/owncloud/core/labels/app:encryption","name":"app:encryption","color":"02d7e1"},{"url":"https://api.github.com/repos/owncloud/core/labels/app:user_ldap","name":"app:user_ldap","color":"02d7e1"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-11-02T09:14:46Z","updated_at":"2015-11-02T10:29:14Z","closed_at":null,"body":"Hi there,\r\n\r\nwe're hosting the ownCloud server 8.1.3 with basic encryption and LDAP user backend, for using AD users within ownCloud. After setting up the third server, a user changed its password and rings up for help, because she wasn't able to access any files.\r\n\r\nThen we tried to update the private key password as her user, that didn't worked. And updating the password by using the administrator tool with recovery password did the same... nothing. Fortunately she recognized her old password, so we're able to set it back to the old state on the AD site. After doing so, she was able to access her files for now.\r\n\r\nWe've tried to change the LDAP configuration but that didn't took any affect on this. Also we've followed as mentioned on this issue: https://github.com/owncloud/core/issues/12361\r\n\r\nWithin the ownCloud server administration section no configuration errors are shown, LDAP configuration is OK and status is green. Users can be found and log in as wanted and configured.\r\n\r\n### Steps to reproduce\r\n1. Activate basic encryption module\r\n2. Enter recovery password\r\n3. Activate LDAP user backend\r\n4. Configure LDAP backend, server and filters\r\n5. Verify and check configuration\r\n6. Log in with available LDAP user and password\r\n7. Activate password recovery for basic encryption module\r\n8. Log out\r\n9. Change password on the AD site\r\n10. Log in with new password\r\n11. Get the private key password error message\r\n12. Try to update password in the personal section\r\n13. Get the unable to update private key password error message\r\n14. Log out\r\n15. Log in with administrator account\r\n16. Try to update the users password by using the recovery password\r\n17. Get the unable to change password on user backend error message\r\n18. Log out\r\n19. Log in with the user with new password\r\n20. Get the private key password error message\r\n21. Try to update the private key password again\r\n22. Get the unable to update private key password error message\r\n23. Recognize that you can’t access any of your files\r\n24. Recognize that the administrator is unable to help you\r\n25. Remember, that you’re the administrator\r\n26. Take a towel and try not to get into panic\r\n\r\nDisaster recovery…\r\nOnly possible if user can remember last used password, so the password can be changed back on the AD site.\r\n\r\n### Expected behaviour\r\nChanging the password on AD site and updating the private key password within ownCloud works smoothly out of the box - because if the user can log in with the new password, then the system recognizes it and can grab the information as needed to do as wanted.\r\n\r\n### Actual behaviour\r\nChanging the password on AD site causes data loss, because the encrypted files can’t be accessed and bringing up the discussion of the productive usage of ownCloud server, because if an important user looses its password and critical data is stored securely, then no one will be able to recover the stored files, without knowing the old password, because the password recovery functionality won’t work in this case!\r\n\r\n### Server configuration\r\n**Operating system**: Ubuntu Server 14.04.3 LTS\r\n\r\n**Web server:** Apache 2.4.7\r\n\r\n**Database:** 5.5.46\r\n\r\n**PHP version:** 5.5.9\r\n\r\n**ownCloud version:** 8.1.3\r\n\r\n**Updated from an older ownCloud or fresh install:** Productive servers\r\n\r\n**List of activated apps:** \r\n\r\nEnabled:\r\n - activity: 2.0.2\r\n - encryption: 1.0.0\r\n - external: 1.2\r\n - files: 1.1.10\r\n - files_locking: \r\n - files_pdfviewer: 0.7\r\n - files_sharing: 0.6.2\r\n - files_texteditor: 0.4\r\n - files_trashbin: 0.6.3\r\n - files_versions: 1.0.6\r\n - files_videoviewer: 0.1.3\r\n - firstrunwizard: 1.1\r\n - gallery: 0.6.0\r\n - provisioning_api: 0.2\r\n - templateeditor: 0.1\r\n - user_ldap: 0.6.1\r\n\r\nDisabled:\r\n - files_antivirus\r\n - files_external\r\n - updater\r\n - user_external\r\n - user_webdavauth\r\n\r\n**The content of config/config.php:**\r\n\r\n<?php\r\n$CONFIG = array (\r\n  'instanceid' => '---',\r\n  'passwordsalt' => '---',\r\n  'secret' => '---',\r\n  'trusted_domains' => \r\n  array (\r\n    0 => 'HOSTNAME',\r\n    1 => 'IPADDRESS',\r\n  ),\r\n  'datadirectory' => '/media/oc_datastore',\r\n  'overwrite.cli.url' => 'https://HOSTNAME',\r\n  'dbtype' => 'mysql',\r\n  'version' => '8.1.3.0',\r\n  'dbname' => 'oc_db',\r\n  'dbhost' => 'localhost',\r\n  'dbtableprefix' => 'oc_',\r\n  'dbuser' => 'oc_sql',\r\n  'dbpassword' => '---',\r\n  'logtimezone' => 'CET',\r\n  'installed' => true,\r\n  'memcache.local' => '\\\\OC\\\\Memcache\\\\Memcached',\r\n  'ldapIgnoreNamingRules' => false,\r\n  'mail_smtpmode' => 'smtp',\r\n  'mail_from_address' => 'owncloud',\r\n  'mail_domain' => 'HOSTNAME',\r\n  'mail_smtphost' => 'IPADDRESS',\r\n  'mail_smtpport' => '25',\r\n  'maintenance' => false,\r\n);\r\n\r\n\r\n**Are you using external storage, if yes which one:** No\r\n\r\n**Are you using encryption:** yes\r\n\r\n**Are you using an external user-backend, if yes which one:** LDAP\r\n\r\n#### LDAP configuration\r\n\r\n+-------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+\r\n| Configuration                 |                                                                                                                                                                                                                           |\r\n+-------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+\r\n| hasMemberOfFilterSupport      | 1                                                                                                                                                                                                                         |\r\n| hasPagedResultSupport         |                                                                                                                                                                                                                           |\r\n| homeFolderNamingRule          |                                                                                                                                                                                                                           |\r\n| lastJpegPhotoLookup           | 0                                                                                                                                                                                                                         |\r\n| ldapAgentName                 | CN=Administrator,CN=Users,DC=de,DC=DOMAIN,DC=local                                                                                                                                                                        |\r\n| ldapAgentPassword             | ***                                                                                                                                                                                                                       |\r\n| ldapAttributesForGroupSearch  |                                                                                                                                                                                                                           |\r\n| ldapAttributesForUserSearch   |                                                                                                                                                                                                                           |\r\n| ldapBackupHost                |                                                                                                                                                                                                                           |\r\n| ldapBackupPort                |                                                                                                                                                                                                                           |\r\n| ldapBase                      | DC=de,DC=DOMAIN,DC=local                                                                                                                                                                                                  |\r\n| ldapBaseGroups                | DC=de,DC=DOMAIN,DC=local                                                                                                                                                                                                  |\r\n| ldapBaseUsers                 | DC=de,DC=DOMAIN,DC=local                                                                                                                                                                                                  |\r\n| ldapCacheTTL                  | 600                                                                                                                                                                                                                       |\r\n| ldapConfigurationActive       | 1                                                                                                                                                                                                                         |\r\n| ldapEmailAttribute            | mail                                                                                                                                                                                                                      |\r\n| ldapExperiencedAdmin          | 0                                                                                                                                                                                                                         |\r\n| ldapExpertUUIDGroupAttr       |                                                                                                                                                                                                                           |\r\n| ldapExpertUUIDUserAttr        |                                                                                                                                                                                                                           |\r\n| ldapExpertUsernameAttr        |                                                                                                                                                                                                                           |\r\n| ldapGroupDisplayName          | cn                                                                                                                                                                                                                        |\r\n| ldapGroupFilter               | (|(cn=HOSTNAME))                                                                                                                                                                                                          |\r\n| ldapGroupFilterGroups         | HOSTNAME                                                                                                                                                                                                                  |\r\n| ldapGroupFilterMode           | 0                                                                                                                                                                                                                         |\r\n| ldapGroupFilterObjectclass    |                                                                                                                                                                                                                           |\r\n| ldapGroupMemberAssocAttr      | member                                                                                                                                                                                                                    |\r\n| ldapHost                      | IPADDRESS                                                                                                                                                                                                                 |\r\n| ldapIgnoreNamingRules         |                                                                                                                                                                                                                           |\r\n| ldapLoginFilter               | (&(&(|(objectclass=person))(|(|(memberof=CN=HOSTNAME,OU=Gruppen,OU=CITY,OU=COMPANY,DC=de,DC=DOMAIN,DC=local)(primaryGroupID=1234))))(|(samaccountname=%uid)(|(mailPrimaryAddress=%uid)(mail=%uid))(|(displayName=%uid)))) |\r\n| ldapLoginFilterAttributes     | displayName                                                                                                                                                                                                               |\r\n| ldapLoginFilterEmail          | 1                                                                                                                                                                                                                         |\r\n| ldapLoginFilterMode           | 0                                                                                                                                                                                                                         |\r\n| ldapLoginFilterUsername       | 1                                                                                                                                                                                                                         |\r\n| ldapNestedGroups              | 0                                                                                                                                                                                                                         |\r\n| ldapNoCase                    | 0                                                                                                                                                                                                                         |\r\n| ldapOverrideMainServer        |                                                                                                                                                                                                                           |\r\n| ldapPagingSize                | 500                                                                                                                                                                                                                       |\r\n| ldapPort                      | 389                                                                                                                                                                                                                       |\r\n| ldapQuotaAttribute            |                                                                                                                                                                                                                           |\r\n| ldapQuotaDefault              |                                                                                                                                                                                                                           |\r\n| ldapTLS                       | 0                                                                                                                                                                                                                         |\r\n| ldapUserDisplayName           | displayname                                                                                                                                                                                                               |\r\n| ldapUserFilter                | (&(|(objectclass=person))(|(|(memberof=CN=HOSTNAME,OU=Gruppen,OU=CITY,OU=COMPANY,DC=de,DC=DOMAIN,DC=local)(primaryGroupID=1234))))                                                                                        |\r\n| ldapUserFilterGroups          | HOSTNAME                                                                                                                                                                                                                  |\r\n| ldapUserFilterMode            | 0                                                                                                                                                                                                                         |\r\n| ldapUserFilterObjectclass     | person                                                                                                                                                                                                                    |\r\n| ldapUuidGroupAttribute        | auto                                                                                                                                                                                                                      |\r\n| ldapUuidUserAttribute         | auto                                                                                                                                                                                                                      |\r\n| turnOffCertCheck              | 0                                                                                                                                                                                                                         |\r\n| useMemberOfToDetectMembership | 1                                                                                                                                                                                                                         |\r\n+-------------------------------+---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+\r\n\r\n### Client configuration\r\n**Browser:** Safari, Firefox, Opera, Chrome\r\n\r\n**Operating system:** MacOS, Windows,\r\n\r\n### Logs\r\n#### Web server error log\r\n\r\nNo errors\r\n\r\n#### ownCloud log (data/owncloud.log)\r\n\r\n{\"reqId“:“---\",\"remoteAddr“:\"IPADDRESS\",\"app\":\"core\",\"message\":\"Login failed: 'AD_USER_STRING' (Remote IP: 'IPADDRESS)\",\"level\":2,\"time\":\"2015-10-30T09:03:39+01:00\"}\r\n{\"reqId“:“---\",\"remoteAddr\":\"IPADDRESS\",\"app\":\"PHP\",\"message\":\"ldap_read(): Search: Invalid DN syntax at \\/var\\/www\\/owncloud\\/apps\\/user_ldap\\/lib\\/ldap.php#257\",\"level\":3,\"time\":\"2015-10-30T09:05:11+01:00\"}\r\n{\"reqId“:“---\",\"remoteAddr\":\"IPADDRESS\",\"app\":\"user_ldap\",\"message\":\"Bind failed: 49: Invalid credentials\",\"level\":2,\"time\":\"2015-10-30T09:09:40+01:00\"}\r\n{\"reqId“:“---\",\"remoteAddr\":\"IPADDRESS\",\"app\":\"core\",\"message\":\"Login failed: 'AD_DISPLAYNAME' (Remote IP: 'IPADDRESS)\",\"level\":2,\"time\":\"2015-10-30T09:09:40+01:00\"}\r\n\r\n#### Browser log\r\n\r\nNo errors\r\n\r\nWhat can we do, what we've done wrong or do we've to wait until you provide an update, which'll solve this?\r\n\r\nIf we can provide additional data or helping by answering your questions, feel free to ask, please!\r\n\r\nThanks!"},"comment":{"url":"https://api.github.com/repos/owncloud/core/issues/comments/152981992","html_url":"https://github.com/owncloud/core/issues/20217#issuecomment-152981992","issue_url":"https://api.github.com/repos/owncloud/core/issues/20217","id":152981992,"user":{"login":"DeepDiver1975","id":1005065,"avatar_url":"https://avatars.githubusercontent.com/u/1005065?v=3","gravatar_id":"","url":"https://api.github.com/users/DeepDiver1975","html_url":"https://github.com/DeepDiver1975","followers_url":"https://api.github.com/users/DeepDiver1975/followers","following_url":"https://api.github.com/users/DeepDiver1975/following{/other_user}","gists_url":"https://api.github.com/users/DeepDiver1975/gists{/gist_id}","starred_url":"https://api.github.com/users/DeepDiver1975/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DeepDiver1975/subscriptions","organizations_url":"https://api.github.com/users/DeepDiver1975/orgs","repos_url":"https://api.github.com/users/DeepDiver1975/repos","events_url":"https://api.github.com/users/DeepDiver1975/events{/privacy}","received_events_url":"https://api.github.com/users/DeepDiver1975/received_events","type":"User","site_admin":false},"created_at":"2015-11-02T10:29:14Z","updated_at":"2015-11-02T10:29:14Z","body":"Ah .. okay. Hmmmm ..... @blizzz @schiesbn can I ask you to have a look? THX"}}