From cf4ec7a4b6cb9870d7661048ec3e867b6ffb9c17 Mon Sep 17 00:00:00 2001 From: Roland Tapken Date: Wed, 7 Feb 2018 12:02:58 +0100 Subject: [PATCH 1/2] Apply ldapUserFilter on members of group Refers to issue #8220 user_ldap configured with custom filters for active directory access (group-member-association is "member"). Then it can happen that the members of a group contain members that don't belong to the users available in Nextcloud (the most trivial reason is that the user filter contains "(!(UserAccountControl:1.2.840.113556.1.4.803:=2))" to exclude disabled users from being imported). This can be fixed by applying the ldapUserFilter when resolving the UID for a DN fetched from the group's member list. Signed-off-by: Roland Tapken --- apps/user_ldap/lib/Access.php | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/apps/user_ldap/lib/Access.php b/apps/user_ldap/lib/Access.php index 3d18207776..e255156dcf 100644 --- a/apps/user_ldap/lib/Access.php +++ b/apps/user_ldap/lib/Access.php @@ -564,7 +564,11 @@ class Access extends LDAPUtility implements IUserTools { } if(is_null($ldapName)) { - $ldapName = $this->readAttribute($fdn, $nameAttribute); + if ($isUser) { + $ldapName = $this->readAttribute($fdn, $nameAttribute, $this->connection->ldapUserFilter); + } else { + $ldapName = $this->readAttribute($fdn, $nameAttribute); + } if(!isset($ldapName[0]) && empty($ldapName[0])) { \OCP\Util::writeLog('user_ldap', 'No or empty name for '.$fdn.'.', \OCP\Util::INFO); return false; From 2472b93fd99e2270fd240874ee0f3a2c42bce191 Mon Sep 17 00:00:00 2001 From: Roland Tapken Date: Wed, 7 Mar 2018 12:18:46 +0100 Subject: [PATCH 2/2] dn2ocname: also apply group filter to readAttribute() Signed-off-by: Roland Tapken --- apps/user_ldap/lib/Access.php | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/apps/user_ldap/lib/Access.php b/apps/user_ldap/lib/Access.php index e255156dcf..73512cc420 100644 --- a/apps/user_ldap/lib/Access.php +++ b/apps/user_ldap/lib/Access.php @@ -538,9 +538,11 @@ class Access extends LDAPUtility implements IUserTools { if($isUser) { $mapper = $this->getUserMapper(); $nameAttribute = $this->connection->ldapUserDisplayName; + $filter = $this->connection->ldapUserFilter; } else { $mapper = $this->getGroupMapper(); $nameAttribute = $this->connection->ldapGroupDisplayName; + $filter = $this->connection->ldapGroupFilter; } //let's try to retrieve the Nextcloud name from the mappings table @@ -564,13 +566,9 @@ class Access extends LDAPUtility implements IUserTools { } if(is_null($ldapName)) { - if ($isUser) { - $ldapName = $this->readAttribute($fdn, $nameAttribute, $this->connection->ldapUserFilter); - } else { - $ldapName = $this->readAttribute($fdn, $nameAttribute); - } + $ldapName = $this->readAttribute($fdn, $nameAttribute, $filter); if(!isset($ldapName[0]) && empty($ldapName[0])) { - \OCP\Util::writeLog('user_ldap', 'No or empty name for '.$fdn.'.', \OCP\Util::INFO); + \OCP\Util::writeLog('user_ldap', 'No or empty name for '.$fdn.' with filter '.$filter.'.', \OCP\Util::INFO); return false; } $ldapName = $ldapName[0];