Skip to content

fix: check against memberUid instead of posixGroup - #719

Merged
jvillafanez merged 1 commit into
owncloud:mainfrom
jvillafanez:ldap_group_memberuid
Aug 20, 2026
Merged

fix: check against memberUid instead of posixGroup#719
jvillafanez merged 1 commit into
owncloud:mainfrom
jvillafanez:ldap_group_memberuid

Conversation

@jvillafanez

Copy link
Copy Markdown
Member

posixGroup might be set up as an auxiliary class, and the oCIS configuration might target a structural class such as groupOfNames. This means that the memberUid attribute might appear in groups configured with groupsOfNames, not just with posixGroup.
We'll look for usernames if the group membership is configured as "memberUid" in oCIS regardless of the specific object class for groups.


NOTE: In LDAP is possible to configure groups containing "member" and "memberUid" attributes at the same time, both of them targeting different users. However, oCIS is currently expecting only one group membership attribute.
In this scenario, it's expected that only the users in the configured oCIS' group membership attribute (either "member" or "memberUid") are shown, while the rest of users are ignored.

@jvillafanez jvillafanez self-assigned this Aug 18, 2026
@jvillafanez
jvillafanez requested a review from a team as a code owner August 18, 2026 08:50
@kw-security

kw-security commented Aug 18, 2026

Copy link
Copy Markdown

Snyk checks have passed. No issues have been found so far.

Status Scan Engine Critical High Medium Low Total (0)
Open Source Security 0 0 0 0 0 issues
Licenses 0 0 0 0 0 issues
Code Security 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

@LukasHirt

Copy link
Copy Markdown

GetLDAPGroupMembers still branches on Objectclass == "posixgroup"

identity.go#L470 — this is the same bug GetLDAPUserGroups had before this fix. With group_schema.member = "memberUid" and group_objectclass = "groupOfNames", member values are bare usernames, but this branch takes the else path and passes them to GetLDAPUserByDN as if they were DNs, so the lookup fails and the member is silently dropped. Group member listing ends up empty/incomplete for the config this PR targets.

Should this get the same Schema.Member check?

posixGroup might be set up as an auxiliary class, and the oCIS
configuration might target a structural class such as groupOfNames. This
means that the memberUid attribute might appear in groups configured
with groupsOfNames, not just with posixGroup.
We'll look for usernames if the group membership is configured as
"memberUid" in oCIS regardless of the specific object class for groups.
@jvillafanez
jvillafanez force-pushed the ldap_group_memberuid branch from b46cc1a to 8c5679e Compare August 19, 2026 07:49
@jvillafanez

Copy link
Copy Markdown
Member Author

Should this get the same Schema.Member check?

Yes, you're right. It's fixed now.

@jvillafanez
jvillafanez merged commit 457151e into owncloud:main Aug 20, 2026
17 of 25 checks passed
@jvillafanez
jvillafanez deleted the ldap_group_memberuid branch August 20, 2026 11:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants