From 57a8fa1b2270c7916c19cb1cf748888aa9a9c7d6 Mon Sep 17 00:00:00 2001 From: Roland Tapken Date: Wed, 7 Feb 2018 12:02:58 +0100 Subject: Apply ldapUserFilter on members of group Refers to issue #8220 user_ldap configured with custom filters for active directory access (group-member-association is "member"). Then it can happen that the members of a group contain members that don't belong to the users available in Nextcloud (the most trivial reason is that the user filter contains "(!(UserAccountControl:1.2.840.113556.1.4.803:=2))" to exclude disabled users from being imported). This can be fixed by applying the ldapUserFilter when resolving the UID for a DN fetched from the group's member list. Signed-off-by: Roland Tapken --- apps/user_ldap/lib/Access.php | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/apps/user_ldap/lib/Access.php b/apps/user_ldap/lib/Access.php index 02f69715f4c..fe286f88a83 100644 --- a/apps/user_ldap/lib/Access.php +++ b/apps/user_ldap/lib/Access.php @@ -565,7 +565,11 @@ class Access extends LDAPUtility implements IUserTools { } if(is_null($ldapName)) { - $ldapName = $this->readAttribute($fdn, $nameAttribute); + if ($isUser) { + $ldapName = $this->readAttribute($fdn, $nameAttribute, $this->connection->ldapUserFilter); + } else { + $ldapName = $this->readAttribute($fdn, $nameAttribute); + } if(!isset($ldapName[0]) && empty($ldapName[0])) { \OCP\Util::writeLog('user_ldap', 'No or empty name for '.$fdn.'.', \OCP\Util::INFO); return false; -- cgit v1.2.3