From cf4ec7a4b6cb9870d7661048ec3e867b6ffb9c17 Mon Sep 17 00:00:00 2001 From: Roland Tapken Date: Wed, 7 Feb 2018 12:02:58 +0100 Subject: [PATCH] Apply ldapUserFilter on members of group Refers to issue #8220 user_ldap configured with custom filters for active directory access (group-member-association is "member"). Then it can happen that the members of a group contain members that don't belong to the users available in Nextcloud (the most trivial reason is that the user filter contains "(!(UserAccountControl:1.2.840.113556.1.4.803:=2))" to exclude disabled users from being imported). This can be fixed by applying the ldapUserFilter when resolving the UID for a DN fetched from the group's member list. Signed-off-by: Roland Tapken --- apps/user_ldap/lib/Access.php | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/apps/user_ldap/lib/Access.php b/apps/user_ldap/lib/Access.php index 3d18207776..e255156dcf 100644 --- a/apps/user_ldap/lib/Access.php +++ b/apps/user_ldap/lib/Access.php @@ -564,7 +564,11 @@ class Access extends LDAPUtility implements IUserTools { } if(is_null($ldapName)) { - $ldapName = $this->readAttribute($fdn, $nameAttribute); + if ($isUser) { + $ldapName = $this->readAttribute($fdn, $nameAttribute, $this->connection->ldapUserFilter); + } else { + $ldapName = $this->readAttribute($fdn, $nameAttribute); + } if(!isset($ldapName[0]) && empty($ldapName[0])) { \OCP\Util::writeLog('user_ldap', 'No or empty name for '.$fdn.'.', \OCP\Util::INFO); return false;