Skip to content

[stable15] resolve user and groups in nested groups first before filtering the results #14591

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
MorrisJobke merged 8 commits into from
Mar 8, 2019
Merged

[stable15] resolve user and groups in nested groups first before filtering the results #14591

Changes from 1 commit
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
fe169b0
user_ldap: Filter groups after nexted groups
Feb 7, 2018
0997fd9
user_ldap: really resolve nested groups
Feb 7, 2018
0a469e8
Reduce queries to LDAP by caching nested groups
Feb 7, 2018
3384e25
Fixed unit test: groupsMatchFilter will not be called multiple times …
Feb 8, 2018
a6c0d53
fix nested group retrieval also for 2 other cases
blizzz Mar 1, 2019
3ea24fa
with LDAP server set offline, config cannot be controlled via ocs any…
blizzz Mar 5, 2019
5c21e94
add missing config bits to integration tests
blizzz Mar 5, 2019
a358c4d
remove unused use statement
blizzz Mar 5, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Next Next commit
user_ldap: Filter groups after nexted groups 
Currently groupsMatchFilter is called before nested groups are resolved.
This basicly breaks this feature since it is not possible to inherit
membership in a group from another group.

Minimal example:

  Group filter: (&(objectClass=group),(cn=nextcloud))
  Nested groups: enabled

  cn=nextcloud,ou=Nextcloud,ou=groups,dn=company,dn=local
    objectClass: group

  cn=IT,ou=groups,dn=company,dn=local
    objectClass: group
    memberOf: cn=nextcloud,ou=Nextcloud,ou=groups,dn=company,dn=local

  cn=John Doe,ou=users,dn=company,dn=local
    objectClass: person
    memberOf: cn=IT,ou=groups,dn=company,dn=local

Since 'cn=IT,ou=groups,dn=company,dn=local' doesn't match the group
filter, John wouldn't be a member of group 'nextcloud'.

This patch fixes this by filtering the groups after all nested groups
have been collected. If nested groups is disabled the result will be the
same as without this patch.

Signed-off-by: Roland Tapken <[email protected]>
  • Loading branch information
@blizzz
Roland Tapken authored and blizzz committed Mar 7, 2019
commit fe169b021d31b1a1a165f82c85d79fd49449bf51
3 changes: 1 addition & 2 deletions apps/user_ldap/lib/Group_LDAP.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -265,7 +265,6 @@ private function _getGroupDNsFromMemberOf($DN, &$seen = null) {
if (!is_array($groups)) {
return array();
}
$groups = $this->access->groupsMatchFilter($groups);
$allGroups = $groups;
$nestedGroups = $this->access->connection->ldapNestedGroups;
if ((int)$nestedGroups === 1) {
Expand All @@ -274,7 +273,7 @@ private function _getGroupDNsFromMemberOf($DN, &$seen = null) {
$allGroups = array_merge($allGroups, $subGroups);
}
}
return $allGroups;
return $this->access->groupsMatchFilter($allGroups);
}

/**
Expand Down