LDAP cleanup in config.php

[Fred-DTV]

I was really confused when I started receiving bounced e-mail errors for the daily Nextcloud notification mail for a user that I had removed from our company (incl. the e-mail) and our nextcloud.
A lot of bounced e-mails would also eventually damage our domain's spam rating so I tried to find where in NC that e-mail address was still present.
After some time I actually found the problem and a solution: The LDAP database in NC doesn't cleanup after itself automatically. So when you delete useres via LDAP they still stay somewhere in the NC database.

The solution is quite simple:
As described here:
https://docs.nextcloud.com/server/latest/admin_manual/configuration_user/user_auth_ldap_cleanup.html
You just have to add
'ldapUserCleanupInterval' => '51'
to the nextcloud config.php

Could this be implemented as default into the AIO NC containers config.php? or would this cause a problem if LDAP isn't activated?

[szaimen]

Hi, we will not add this by default but could add a hint to our docs. https://github.com/nextcloud/all-in-one?tab=readme-ov-file#ldap and potentially https://github.com/nextcloud/all-in-one/tree/main/community-containers/lldap

[szaimen]

Would you mind opening a PR that adds this? :)

[Fred-DTV]

Ok there seems to be more to this problem than thought.
One week later now I started receiving the bounced e-mail warnings again for the same deleted user.

So I went into the docs again and tried the following commands:
sudo docker exec --user www-data -it nextcloud-aio-nextcloud php occ ldap:show-remnants
Which showed me that this specific users is deleted, which one should think should be enough to not send updates to that account anymore 😅
But to be 100% certain i even deleted the user from there by using this command:
sudo docker exec --user www-data -it nextcloud-aio-nextcloud php occ user:delete <insert-nextcloudname-here-which-for-ldap-is-the long-string-of numbers>

I will report back and see if this solved the issue.
However, there has to be something flawed with the way NC is handling it's LDAP user database, as deleting a user from the LDAP server should be enough to clear it from NC as well.

P.S.: For reference, I am using the Synology LDAP server

[szaimen]

I will report back and see if this solved the issue.

Did it?

[Fred-DTV]

Sorry I have some private troubles at the moment so I couldn't find the time for this.

However, I think I actually found the cause of this issue: The "Everyone Group" App.
The NC extension app doesn't delete users from it's group that have been deleted from LDAP.

So I am pretty certain that this isn't a problem of NC in general.