[Bug]: The account limit of this instance has been reached, but only 63/100 active users

[autoantwort]

⚠️ This issue respects the following points: ⚠️

• This is a bug, not a question or a configuration/webserver/proxy issue.
• This issue is not already reported on Github OR Nextcloud Community Forum (I've searched it).
• Nextcloud Server is up to date. See Maintenance and Release Schedule for supported versions.
• I agree to follow Nextcloud's Code of Conduct.

Bug description

We use nextcloud aio and use the ldap sync which worked for months, but since a few days we are getting the error Das Kontenlimit dieser Instanz ist erreicht. If I go to Settings -> Konten: Alle Konten only lists 7 Accounts, so way less then 100. If I go to Deaktivierte Konten 325 Accounts are listed, but they are there since day one months ago and back then this also was not a problem and

server/lib/private/Support/Subscription/Registry.php

Line 189 in 01b2ae4

$userCount = $userCount - $disabledUsersCount;

indicates that disabled users do not count.
I also opened a discussion at the aio repo but they said I should create a bug report here (nextcloud/all-in-one#5655).

Steps to reproduce

1. Use Nextcloud AIO
2. Use the LDAP Sync with more than 100 users but disable most of them (??)
3. Wait some months (??) and get the error that you have to many users.

Expected behavior

Don't get the error that I have more than 100 users or list more than 100 users in the Active Users list.

Nextcloud Server version

30

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.3

Web server

Nginx

Database engine version

PostgreSQL

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

Nice way to get this from aio? Would be nice if I could just download this from the admin settings

[joshtrichards]

Nice way to get this from aio? Would be nice if I could just download this from the admin settings

https://github.com/nextcloud/all-in-one#how-to-run-occ-commands

We need the output of config:list system

Please also check your Nextcloud log. Particularly for things like "Can not determine user count for" [...] and/or "Total user count was negative" [...].

[autoantwort]

docker exec --user www-data -it nextcloud-aio-nextcloud php occ config:list system

{
    "system": {
        "one-click-instance": true,
        "one-click-instance.user-limit": 100,
        "memcache.local": "\\OC\\Memcache\\APCu",
        "apps_paths": [
            {
                "path": "\/var\/www\/html\/apps",
                "url": "\/apps",
                "writable": false
            },
            {
                "path": "\/var\/www\/html\/custom_apps",
                "url": "\/custom_apps",
                "writable": true
            }
        ],
        "appsallowlist": false,
        "check_data_directory_permissions": false,
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "password": "***REMOVED SENSITIVE VALUE***",
            "port": 6379
        },
        "overwritehost": "cloud.hilton.rwth-aachen.de",
        "overwriteprotocol": "https",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "localhost",
            "cloud.hilton.rwth-aachen.de"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "pgsql",
        "version": "30.0.2.2",
        "overwrite.cli.url": "https:\/\/cloud.hilton.rwth-aachen.de\/",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "maintenance": false,
        "loglevel": "2",
        "log_type": "file",
        "logfile": "\/var\/www\/html\/data\/nextcloud.log",
        "log_rotate_size": "10485760",
        "log.condition": {
            "apps": [
                "admin_audit"
            ]
        },
        "preview_max_x": "2048",
        "preview_max_y": "2048",
        "jpeg_quality": "60",
        "enabledPreviewProviders": {
            "1": "OC\\Preview\\Image",
            "2": "OC\\Preview\\MarkDown",
            "3": "OC\\Preview\\MP3",
            "4": "OC\\Preview\\TXT",
            "5": "OC\\Preview\\OpenDocument",
            "6": "OC\\Preview\\Movie",
            "7": "OC\\Preview\\Krita",
            "0": "OC\\Preview\\Imaginary"
        },
        "enable_previews": true,
        "upgrade.disable-web": true,
        "mail_smtpmode": "smtp",
        "trashbin_retention_obligation": "auto, 30",
        "versions_retention_obligation": "auto, 30",
        "activity_expire_days": "30",
        "simpleSignUpLink.shown": false,
        "share_folder": "\/Shared",
        "one-click-instance.link": "https:\/\/nextcloud.com\/all-in-one\/",
        "upgrade.cli-upgrade-link": "https:\/\/github.com\/nextcloud\/all-in-one\/discussions\/2726",
        "updatedirectory": "\/nc-updater",
        "allow_local_remote_servers": true,
        "davstorage.request_timeout": 3600,
        "htaccess.RewriteBase": "\/",
        "dbpersistent": false,
        "files_external_allow_create_new_local": false,
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "ldapProviderFactory": "OCA\\User_LDAP\\LDAPProviderFactory",
        "mail_smtpsecure": "tls",
        "mail_sendmailmode": "smtp",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "587",
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpauth": 1,
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpauthtype": "LOGIN",
        "preview_imaginary_url": "***REMOVED SENSITIVE VALUE***",
        "maintenance_window_start": 100,
        "preview_imaginary_key": "***REMOVED SENSITIVE VALUE***",
        "auth.bruteforce.protection.enabled": true,
        "ratelimit.protection.enabled": true,
        "documentation_url.server_logs": "https:\/\/github.com\/nextcloud\/all-in-one\/discussions\/5425",
        "DOMAIN": "cloud.hilton.rwth-aachen.de"
    }
}

The latest logs are from 4 am (maybe it rebooted automatically), but the check was 21 hours ago. So I will check the logs later (or is there a way to get older logs?).

And

╭─root@nextcloud-aio /var/lib/docker/volumes/nextcloud_aio_nextcloud/_data/data 
╰─# grep "Can not determine user count for" *
╭─root@nextcloud-aio /var/lib/docker/volumes/nextcloud_aio_nextcloud/_data/data 
╰─# grep "Total user count was negative" *                                                                                                                                                                  1 ↵
╭─root@nextcloud-aio /var/lib/docker/volumes/nextcloud_aio_nextcloud/_data/data 
╰─# ls                                                                                                                                                                                                      1 ↵
audit.log  audit.log.1  index.html  install.log  nextcloud.log  nextcloud.log.1  update.log

docker exec --user www-data -it nextcloud-aio-nextcloud php occ user:report

+------------------+-----+
| Account Report   |     |
+------------------+-----+
| Database         | 3   |
| LDAP             | 425 |
|                  |     |
| total users      | 428 |
|                  |     |
| user directories | 2   |
| active users     | 63  |
| disabled users   | 327 |
+------------------+-----+

$ docker exec --user www-data -it nextcloud-aio-nextcloud php occ config:system:get one-click-instance.user-limit 
100

[autoantwort]

Ok 428 (total users) - 327 (disabled users) = 101 which is > 100, but ≠ 63 (active users )

[joshtrichards]

https://docs.nextcloud.com/server/latest/admin_manual/occ_command.html#user-report

Sounds like you have 38 (428 - 327 - 63) users that are neither disabled nor active (i.e. valid/enabled accounts that have simply never logged in).

[autoantwort]

But can I see them somewhere in the ui so that I can disable them?

[divansantana]

I have the same issue. only 8 active users yet new users can't login. So this means, basically that nextcloud-aio+ldap is for many organisations unusable, unless they pay for the enterprise version.

# docker exec --user www-data -it nextcloud-aio-nextcloud php occ user:report
+----------------+------+
| Account Report |      |
+----------------+------+
| Database       | 5    |
| LDAP           | 2492 |
|                |      |
| total users    | 2497 |
|                |      |
| active users   | 8    |
| disabled users | 0    |
+----------------+------+