fix: check against memberUid instead of posixGroup - #719
Merged
Conversation
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
9 tasks
|
identity.go#L470 — this is the same bug Should this get the same |
posixGroup might be set up as an auxiliary class, and the oCIS configuration might target a structural class such as groupOfNames. This means that the memberUid attribute might appear in groups configured with groupsOfNames, not just with posixGroup. We'll look for usernames if the group membership is configured as "memberUid" in oCIS regardless of the specific object class for groups.
jvillafanez
force-pushed
the
ldap_group_memberuid
branch
from
August 19, 2026 07:49
b46cc1a to
8c5679e
Compare
Member
Author
Yes, you're right. It's fixed now. |
LukasHirt
approved these changes
Aug 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
posixGroup might be set up as an auxiliary class, and the oCIS configuration might target a structural class such as groupOfNames. This means that the memberUid attribute might appear in groups configured with groupsOfNames, not just with posixGroup.
We'll look for usernames if the group membership is configured as "memberUid" in oCIS regardless of the specific object class for groups.
NOTE: In LDAP is possible to configure groups containing "member" and "memberUid" attributes at the same time, both of them targeting different users. However, oCIS is currently expecting only one group membership attribute.
In this scenario, it's expected that only the users in the configured oCIS' group membership attribute (either "member" or "memberUid") are shown, while the rest of users are ignored.