nextcloud / server

apps/user_ldap/lib/Group_LDAP.php

Indentation +1317 added lines, -1317 removed lines

@@ -53,1321 +53,1321 @@
 use Psr\Log\LoggerInterface;
 
 class Group_LDAP extends BackendUtility implements GroupInterface, IGroupLDAP, IGetDisplayNameBackend, IDeleteGroupBackend {
-	protected $enabled = false;
-
-	/** @var string[][] $cachedGroupMembers array of users with gid as key */
-	protected $cachedGroupMembers;
-	/** @var string[] $cachedGroupsByMember array of groups with uid as key */
-	protected $cachedGroupsByMember;
-	/** @var string[] $cachedNestedGroups array of groups with gid (DN) as key */
-	protected $cachedNestedGroups;
-	/** @var GroupPluginManager */
-	protected $groupPluginManager;
-	/** @var LoggerInterface */
-	protected $logger;
-
-	/**
-	 * @var string $ldapGroupMemberAssocAttr contains the LDAP setting (in lower case) with the same name
-	 */
-	protected $ldapGroupMemberAssocAttr;
-
-	public function __construct(Access $access, GroupPluginManager $groupPluginManager) {
-		parent::__construct($access);
-		$filter = $this->access->connection->ldapGroupFilter;
-		$gAssoc = $this->access->connection->ldapGroupMemberAssocAttr;
-		if (!empty($filter) && !empty($gAssoc)) {
-			$this->enabled = true;
-		}
-
-		$this->cachedGroupMembers = new CappedMemoryCache();
-		$this->cachedGroupsByMember = new CappedMemoryCache();
-		$this->cachedNestedGroups = new CappedMemoryCache();
-		$this->groupPluginManager = $groupPluginManager;
-		$this->logger = OC::$server->get(LoggerInterface::class);
-		$this->ldapGroupMemberAssocAttr = strtolower((string)$gAssoc);
-	}
-
-	/**
-	 * is user in group?
-	 *
-	 * @param string $uid uid of the user
-	 * @param string $gid gid of the group
-	 * @return bool
-	 * @throws Exception
-	 * @throws ServerNotAvailableException
-	 */
-	public function inGroup($uid, $gid) {
-		if (!$this->enabled) {
-			return false;
-		}
-		$cacheKey = 'inGroup' . $uid . ':' . $gid;
-		$inGroup = $this->access->connection->getFromCache($cacheKey);
-		if (!is_null($inGroup)) {
-			return (bool)$inGroup;
-		}
-
-		$userDN = $this->access->username2dn($uid);
-
-		if (isset($this->cachedGroupMembers[$gid])) {
-			return in_array($userDN, $this->cachedGroupMembers[$gid]);
-		}
-
-		$cacheKeyMembers = 'inGroup-members:' . $gid;
-		$members = $this->access->connection->getFromCache($cacheKeyMembers);
-		if (!is_null($members)) {
-			$this->cachedGroupMembers[$gid] = $members;
-			$isInGroup = in_array($userDN, $members, true);
-			$this->access->connection->writeToCache($cacheKey, $isInGroup);
-			return $isInGroup;
-		}
-
-		$groupDN = $this->access->groupname2dn($gid);
-		// just in case
-		if (!$groupDN || !$userDN) {
-			$this->access->connection->writeToCache($cacheKey, false);
-			return false;
-		}
-
-		//check primary group first
-		if ($gid === $this->getUserPrimaryGroup($userDN)) {
-			$this->access->connection->writeToCache($cacheKey, true);
-			return true;
-		}
-
-		//usually, LDAP attributes are said to be case insensitive. But there are exceptions of course.
-		$members = $this->_groupMembers($groupDN);
-
-		//extra work if we don't get back user DNs
-		switch ($this->ldapGroupMemberAssocAttr) {
-			case 'memberuid':
-			case 'zimbramailforwardingaddress':
-				$requestAttributes = $this->access->userManager->getAttributes(true);
-				$users = [];
-				$filterParts = [];
-				$bytes = 0;
-				foreach ($members as $mid) {
-					if ($this->ldapGroupMemberAssocAttr === 'zimbramailforwardingaddress') {
-						$parts = explode('@', $mid); //making sure we get only the uid
-						$mid = $parts[0];
-					}
-					$filter = str_replace('%uid', $mid, $this->access->connection->ldapLoginFilter);
-					$filterParts[] = $filter;
-					$bytes += strlen($filter);
-					if ($bytes >= 9000000) {
-						// AD has a default input buffer of 10 MB, we do not want
-						// to take even the chance to exceed it
-						// so we fetch results with the filterParts we collected so far
-						$filter = $this->access->combineFilterWithOr($filterParts);
-						$search = $this->access->fetchListOfUsers($filter, $requestAttributes, count($filterParts));
-						$bytes = 0;
-						$filterParts = [];
-						$users = array_merge($users, $search);
-					}
-				}
-
-				if (count($filterParts) > 0) {
-					// if there are filterParts left we need to add their result
-					$filter = $this->access->combineFilterWithOr($filterParts);
-					$search = $this->access->fetchListOfUsers($filter, $requestAttributes, count($filterParts));
-					$users = array_merge($users, $search);
-				}
-
-				// now we cleanup the users array to get only dns
-				$dns = [];
-				foreach ($users as $record) {
-					$dns[$record['dn'][0]] = 1;
-				}
-				$members = array_keys($dns);
-
-				break;
-		}
-
-		if (count($members) === 0) {
-			$this->access->connection->writeToCache($cacheKey, false);
-			return false;
-		}
-
-		$isInGroup = in_array($userDN, $members);
-		$this->access->connection->writeToCache($cacheKey, $isInGroup);
-		$this->access->connection->writeToCache($cacheKeyMembers, $members);
-		$this->cachedGroupMembers[$gid] = $members;
-
-		return $isInGroup;
-	}
-
-	/**
-	 * For a group that has user membership defined by an LDAP search url
-	 * attribute returns the users that match the search url otherwise returns
-	 * an empty array.
-	 *
-	 * @throws ServerNotAvailableException
-	 */
-	public function getDynamicGroupMembers(string $dnGroup): array {
-		$dynamicGroupMemberURL = strtolower((string)$this->access->connection->ldapDynamicGroupMemberURL);
-
-		if (empty($dynamicGroupMemberURL)) {
-			return [];
-		}
-
-		$dynamicMembers = [];
-		$memberURLs = $this->access->readAttribute(
-			$dnGroup,
-			$dynamicGroupMemberURL,
-			$this->access->connection->ldapGroupFilter
-		);
-		if ($memberURLs !== false) {
-			// this group has the 'memberURL' attribute so this is a dynamic group
-			// example 1: ldap:///cn=users,cn=accounts,dc=dcsubbase,dc=dcbase??one?(o=HeadOffice)
-			// example 2: ldap:///cn=users,cn=accounts,dc=dcsubbase,dc=dcbase??one?(&(o=HeadOffice)(uidNumber>=500))
-			$pos = strpos($memberURLs[0], '(');
-			if ($pos !== false) {
-				$memberUrlFilter = substr($memberURLs[0], $pos);
-				$foundMembers = $this->access->searchUsers($memberUrlFilter, ['dn']);
-				$dynamicMembers = [];
-				foreach ($foundMembers as $value) {
-					$dynamicMembers[$value['dn'][0]] = 1;
-				}
-			} else {
-				$this->logger->debug('No search filter found on member url of group {dn}',
-					[
-						'app' => 'user_ldap',
-						'dn' => $dnGroup,
-					]
-				);
-			}
-		}
-		return $dynamicMembers;
-	}
-
-	/**
-	 * @throws ServerNotAvailableException
-	 */
-	private function _groupMembers(string $dnGroup, ?array &$seen = null): array {
-		if ($seen === null) {
-			$seen = [];
-			// the root entry has to be marked as processed to avoind infinit loops,
-			// but not included in the results laters on
-			$excludeFromResult = $dnGroup;
-		}
-		// cache only base groups, otherwise groups get additional unwarranted members
-		$shouldCacheResult = count($seen) === 0;
-
-		static $rawMemberReads = []; // runtime cache for intermediate ldap read results
-		$allMembers = [];
-
-		if (array_key_exists($dnGroup, $seen)) {
-			return [];
-		}
-		// used extensively in cron job, caching makes sense for nested groups
-		$cacheKey = '_groupMembers' . $dnGroup;
-		$groupMembers = $this->access->connection->getFromCache($cacheKey);
-		if ($groupMembers !== null) {
-			return $groupMembers;
-		}
-
-		if ($this->access->connection->ldapNestedGroups
-			&& $this->access->connection->useMemberOfToDetectMembership
-			&& $this->access->connection->hasMemberOfFilterSupport
-			&& $this->access->connection->ldapMatchingRuleInChainState !== Configuration::LDAP_SERVER_FEATURE_UNAVAILABLE
-		) {
-			$attemptedLdapMatchingRuleInChain = true;
-			// compatibility hack with servers supporting :1.2.840.113556.1.4.1941:, and others)
-			$filter = $this->access->combineFilterWithAnd([
-				$this->access->connection->ldapUserFilter,
-				$this->access->connection->ldapUserDisplayName . '=*',
-				'memberof:1.2.840.113556.1.4.1941:=' . $dnGroup
-			]);
-			$memberRecords = $this->access->fetchListOfUsers(
-				$filter,
-				$this->access->userManager->getAttributes(true)
-			);
-			$result = array_reduce($memberRecords, function ($carry, $record) {
-				$carry[] = $record['dn'][0];
-				return $carry;
-			}, []);
-			if ($this->access->connection->ldapMatchingRuleInChainState === Configuration::LDAP_SERVER_FEATURE_AVAILABLE) {
-				return $result;
-			} elseif (!empty($memberRecords)) {
-				$this->access->connection->ldapMatchingRuleInChainState = Configuration::LDAP_SERVER_FEATURE_AVAILABLE;
-				$this->access->connection->saveConfiguration();
-				return $result;
-			}
-			// when feature availability is unknown, and the result is empty, continue and test with original approach
-		}
-
-		$seen[$dnGroup] = 1;
-		$members = $rawMemberReads[$dnGroup] ?? null;
-		if ($members === null) {
-			$members = $this->access->readAttribute($dnGroup, $this->access->connection->ldapGroupMemberAssocAttr);
-			$rawMemberReads[$dnGroup] = $members;
-		}
-		if (is_array($members)) {
-			$fetcher = function ($memberDN) use (&$seen) {
-				return $this->_groupMembers($memberDN, $seen);
-			};
-			$allMembers = $this->walkNestedGroups($dnGroup, $fetcher, $members, $seen);
-		}
-
-		$allMembers += $this->getDynamicGroupMembers($dnGroup);
-		if (isset($excludeFromResult)) {
-			$index = array_search($excludeFromResult, $allMembers, true);
-			if ($index !== false) {
-				unset($allMembers[$index]);
-			}
-		}
-
-		if ($shouldCacheResult) {
-			$this->access->connection->writeToCache($cacheKey, $allMembers);
-			unset($rawMemberReads[$dnGroup]);
-		}
-		if (isset($attemptedLdapMatchingRuleInChain)
-			&& $this->access->connection->ldapMatchingRuleInChainState === Configuration::LDAP_SERVER_FEATURE_UNKNOWN
-			&& !empty($allMembers)
-		) {
-			$this->access->connection->ldapMatchingRuleInChainState = Configuration::LDAP_SERVER_FEATURE_UNAVAILABLE;
-			$this->access->connection->saveConfiguration();
-		}
-		return $allMembers;
-	}
-
-	/**
-	 * @throws ServerNotAvailableException
-	 */
-	private function _getGroupDNsFromMemberOf(string $dn): array {
-		$groups = $this->access->readAttribute($dn, 'memberOf');
-		if (!is_array($groups)) {
-			return [];
-		}
-
-		$fetcher = function ($groupDN) {
-			if (isset($this->cachedNestedGroups[$groupDN])) {
-				$nestedGroups = $this->cachedNestedGroups[$groupDN];
-			} else {
-				$nestedGroups = $this->access->readAttribute($groupDN, 'memberOf');
-				if (!is_array($nestedGroups)) {
-					$nestedGroups = [];
-				}
-				$this->cachedNestedGroups[$groupDN] = $nestedGroups;
-			}
-			return $nestedGroups;
-		};
-
-		$groups = $this->walkNestedGroups($dn, $fetcher, $groups);
-		return $this->filterValidGroups($groups);
-	}
-
-	private function walkNestedGroups(string $dn, Closure $fetcher, array $list, array &$seen = []): array {
-		$nesting = (int)$this->access->connection->ldapNestedGroups;
-		// depending on the input, we either have a list of DNs or a list of LDAP records
-		// also, the output expects either DNs or records. Testing the first element should suffice.
-		$recordMode = is_array($list) && isset($list[0]) && is_array($list[0]) && isset($list[0]['dn'][0]);
-
-		if ($nesting !== 1) {
-			if ($recordMode) {
-				// the keys are numeric, but should hold the DN
-				return array_reduce($list, function ($transformed, $record) use ($dn) {
-					if ($record['dn'][0] != $dn) {
-						$transformed[$record['dn'][0]] = $record;
-					}
-					return $transformed;
-				}, []);
-			}
-			return $list;
-		}
-
-		while ($record = array_shift($list)) {
-			$recordDN = $record['dn'][0] ?? $record;
-			if ($recordDN === $dn || array_key_exists($recordDN, $seen)) {
-				// Prevent loops
-				continue;
-			}
-			$fetched = $fetcher($record);
-			$list = array_merge($list, $fetched);
-			if (!isset($seen[$recordDN]) || is_bool($seen[$recordDN]) && is_array($record)) {
-				$seen[$recordDN] = $record;
-			}
-		}
-
-		// on record mode, filter out intermediate state
-		return $recordMode ? array_filter($seen, 'is_array') : array_keys($seen);
-	}
-
-	/**
-	 * translates a gidNumber into an ownCloud internal name
-	 *
-	 * @return string|bool
-	 * @throws Exception
-	 * @throws ServerNotAvailableException
-	 */
-	public function gidNumber2Name(string $gid, string $dn) {
-		$cacheKey = 'gidNumberToName' . $gid;
-		$groupName = $this->access->connection->getFromCache($cacheKey);
-		if (!is_null($groupName) && isset($groupName)) {
-			return $groupName;
-		}
-
-		//we need to get the DN from LDAP
-		$filter = $this->access->combineFilterWithAnd([
-			$this->access->connection->ldapGroupFilter,
-			'objectClass=posixGroup',
-			$this->access->connection->ldapGidNumber . '=' . $gid
-		]);
-		return $this->getNameOfGroup($filter, $cacheKey) ?? false;
-	}
-
-	/**
-	 * @throws ServerNotAvailableException
-	 * @throws Exception
-	 */
-	private function getNameOfGroup(string $filter, string $cacheKey) {
-		$result = $this->access->searchGroups($filter, ['dn'], 1);
-		if (empty($result)) {
-			$this->access->connection->writeToCache($cacheKey, false);
-			return null;
-		}
-		$dn = $result[0]['dn'][0];
-
-		//and now the group name
-		//NOTE once we have separate Nextcloud group IDs and group names we can
-		//directly read the display name attribute instead of the DN
-		$name = $this->access->dn2groupname($dn);
-
-		$this->access->connection->writeToCache($cacheKey, $name);
-
-		return $name;
-	}
-
-	/**
-	 * returns the entry's gidNumber
-	 *
-	 * @return string|bool
-	 * @throws ServerNotAvailableException
-	 */
-	private function getEntryGidNumber(string $dn, string $attribute) {
-		$value = $this->access->readAttribute($dn, $attribute);
-		if (is_array($value) && !empty($value)) {
-			return $value[0];
-		}
-		return false;
-	}
-
-	/**
-	 * @return string|bool
-	 * @throws ServerNotAvailableException
-	 */
-	public function getGroupGidNumber(string $dn) {
-		return $this->getEntryGidNumber($dn, 'gidNumber');
-	}
-
-	/**
-	 * returns the user's gidNumber
-	 *
-	 * @return string|bool
-	 * @throws ServerNotAvailableException
-	 */
-	public function getUserGidNumber(string $dn) {
-		$gidNumber = false;
-		if ($this->access->connection->hasGidNumber) {
-			$gidNumber = $this->getEntryGidNumber($dn, $this->access->connection->ldapGidNumber);
-			if ($gidNumber === false) {
-				$this->access->connection->hasGidNumber = false;
-			}
-		}
-		return $gidNumber;
-	}
-
-	/**
-	 * @throws ServerNotAvailableException
-	 * @throws Exception
-	 */
-	private function prepareFilterForUsersHasGidNumber(string $groupDN, string $search = ''): string {
-		$groupID = $this->getGroupGidNumber($groupDN);
-		if ($groupID === false) {
-			throw new Exception('Not a valid group');
-		}
-
-		$filterParts = [];
-		$filterParts[] = $this->access->getFilterForUserCount();
-		if ($search !== '') {
-			$filterParts[] = $this->access->getFilterPartForUserSearch($search);
-		}
-		$filterParts[] = $this->access->connection->ldapGidNumber . '=' . $groupID;
-
-		return $this->access->combineFilterWithAnd($filterParts);
-	}
-
-	/**
-	 * returns a list of users that have the given group as gid number
-	 *
-	 * @throws ServerNotAvailableException
-	 */
-	public function getUsersInGidNumber(
-		string $groupDN,
-		string $search = '',
-		?int $limit = -1,
-		?int $offset = 0
-	): array {
-		try {
-			$filter = $this->prepareFilterForUsersHasGidNumber($groupDN, $search);
-			$users = $this->access->fetchListOfUsers(
-				$filter,
-				[$this->access->connection->ldapUserDisplayName, 'dn'],
-				$limit,
-				$offset
-			);
-			return $this->access->nextcloudUserNames($users);
-		} catch (ServerNotAvailableException $e) {
-			throw $e;
-		} catch (Exception $e) {
-			return [];
-		}
-	}
-
-	/**
-	 * @throws ServerNotAvailableException
-	 * @return bool
-	 */
-	public function getUserGroupByGid(string $dn) {
-		$groupID = $this->getUserGidNumber($dn);
-		if ($groupID !== false) {
-			$groupName = $this->gidNumber2Name($groupID, $dn);
-			if ($groupName !== false) {
-				return $groupName;
-			}
-		}
-
-		return false;
-	}
-
-	/**
-	 * translates a primary group ID into an Nextcloud internal name
-	 *
-	 * @return string|bool
-	 * @throws Exception
-	 * @throws ServerNotAvailableException
-	 */
-	public function primaryGroupID2Name(string $gid, string $dn) {
-		$cacheKey = 'primaryGroupIDtoName_' . $gid;
-		$groupName = $this->access->connection->getFromCache($cacheKey);
-		if (!is_null($groupName)) {
-			return $groupName;
-		}
-
-		$domainObjectSid = $this->access->getSID($dn);
-		if ($domainObjectSid === false) {
-			return false;
-		}
-
-		//we need to get the DN from LDAP
-		$filter = $this->access->combineFilterWithAnd([
-			$this->access->connection->ldapGroupFilter,
-			'objectsid=' . $domainObjectSid . '-' . $gid
-		]);
-		return $this->getNameOfGroup($filter, $cacheKey) ?? false;
-	}
-
-	/**
-	 * returns the entry's primary group ID
-	 *
-	 * @return string|bool
-	 * @throws ServerNotAvailableException
-	 */
-	private function getEntryGroupID(string $dn, string $attribute) {
-		$value = $this->access->readAttribute($dn, $attribute);
-		if (is_array($value) && !empty($value)) {
-			return $value[0];
-		}
-		return false;
-	}
-
-	/**
-	 * @return string|bool
-	 * @throws ServerNotAvailableException
-	 */
-	public function getGroupPrimaryGroupID(string $dn) {
-		return $this->getEntryGroupID($dn, 'primaryGroupToken');
-	}
-
-	/**
-	 * @return string|bool
-	 * @throws ServerNotAvailableException
-	 */
-	public function getUserPrimaryGroupIDs(string $dn) {
-		$primaryGroupID = false;
-		if ($this->access->connection->hasPrimaryGroups) {
-			$primaryGroupID = $this->getEntryGroupID($dn, 'primaryGroupID');
-			if ($primaryGroupID === false) {
-				$this->access->connection->hasPrimaryGroups = false;
-			}
-		}
-		return $primaryGroupID;
-	}
-
-	/**
-	 * @throws Exception
-	 * @throws ServerNotAvailableException
-	 */
-	private function prepareFilterForUsersInPrimaryGroup(string $groupDN, string $search = ''): string {
-		$groupID = $this->getGroupPrimaryGroupID($groupDN);
-		if ($groupID === false) {
-			throw new Exception('Not a valid group');
-		}
-
-		$filterParts = [];
-		$filterParts[] = $this->access->getFilterForUserCount();
-		if ($search !== '') {
-			$filterParts[] = $this->access->getFilterPartForUserSearch($search);
-		}
-		$filterParts[] = 'primaryGroupID=' . $groupID;
-
-		return $this->access->combineFilterWithAnd($filterParts);
-	}
-
-	/**
-	 * @throws ServerNotAvailableException
-	 */
-	public function getUsersInPrimaryGroup(
-		string $groupDN,
-		string $search = '',
-		?int $limit = -1,
-		?int $offset = 0
-	): array {
-		try {
-			$filter = $this->prepareFilterForUsersInPrimaryGroup($groupDN, $search);
-			$users = $this->access->fetchListOfUsers(
-				$filter,
-				[$this->access->connection->ldapUserDisplayName, 'dn'],
-				$limit,
-				$offset
-			);
-			return $this->access->nextcloudUserNames($users);
-		} catch (ServerNotAvailableException $e) {
-			throw $e;
-		} catch (Exception $e) {
-			return [];
-		}
-	}
-
-	/**
-	 * @throws ServerNotAvailableException
-	 */
-	public function countUsersInPrimaryGroup(
-		string $groupDN,
-		string $search = '',
-		int $limit = -1,
-		int $offset = 0
-	): int {
-		try {
-			$filter = $this->prepareFilterForUsersInPrimaryGroup($groupDN, $search);
-			$users = $this->access->countUsers($filter, ['dn'], $limit, $offset);
-			return (int)$users;
-		} catch (ServerNotAvailableException $e) {
-			throw $e;
-		} catch (Exception $e) {
-			return 0;
-		}
-	}
-
-	/**
-	 * @return string|bool
-	 * @throws ServerNotAvailableException
-	 */
-	public function getUserPrimaryGroup(string $dn) {
-		$groupID = $this->getUserPrimaryGroupIDs($dn);
-		if ($groupID !== false) {
-			$groupName = $this->primaryGroupID2Name($groupID, $dn);
-			if ($groupName !== false) {
-				return $groupName;
-			}
-		}
-
-		return false;
-	}
-
-	/**
-	 * This function fetches all groups a user belongs to. It does not check
-	 * if the user exists at all.
-	 *
-	 * This function includes groups based on dynamic group membership.
-	 *
-	 * @param string $uid Name of the user
-	 * @return array with group names
-	 * @throws Exception
-	 * @throws ServerNotAvailableException
-	 */
-	public function getUserGroups($uid) {
-		if (!$this->enabled) {
-			return [];
-		}
-		$cacheKey = 'getUserGroups' . $uid;
-		$userGroups = $this->access->connection->getFromCache($cacheKey);
-		if (!is_null($userGroups)) {
-			return $userGroups;
-		}
-		$userDN = $this->access->username2dn($uid);
-		if (!$userDN) {
-			$this->access->connection->writeToCache($cacheKey, []);
-			return [];
-		}
-
-		$groups = [];
-		$primaryGroup = $this->getUserPrimaryGroup($userDN);
-		$gidGroupName = $this->getUserGroupByGid($userDN);
-
-		$dynamicGroupMemberURL = strtolower($this->access->connection->ldapDynamicGroupMemberURL);
-
-		if (!empty($dynamicGroupMemberURL)) {
-			// look through dynamic groups to add them to the result array if needed
-			$groupsToMatch = $this->access->fetchListOfGroups(
-				$this->access->connection->ldapGroupFilter, ['dn', $dynamicGroupMemberURL]);
-			foreach ($groupsToMatch as $dynamicGroup) {
-				if (!array_key_exists($dynamicGroupMemberURL, $dynamicGroup)) {
-					continue;
-				}
-				$pos = strpos($dynamicGroup[$dynamicGroupMemberURL][0], '(');
-				if ($pos !== false) {
-					$memberUrlFilter = substr($dynamicGroup[$dynamicGroupMemberURL][0], $pos);
-					// apply filter via ldap search to see if this user is in this
-					// dynamic group
-					$userMatch = $this->access->readAttribute(
-						$userDN,
-						$this->access->connection->ldapUserDisplayName,
-						$memberUrlFilter
-					);
-					if ($userMatch !== false) {
-						// match found so this user is in this group
-						$groupName = $this->access->dn2groupname($dynamicGroup['dn'][0]);
-						if (is_string($groupName)) {
-							// be sure to never return false if the dn could not be
-							// resolved to a name, for whatever reason.
-							$groups[] = $groupName;
-						}
-					}
-				} else {
-					$this->logger->debug('No search filter found on member url of group {dn}',
-						[
-							'app' => 'user_ldap',
-							'dn' => $dynamicGroup,
-						]
-					);
-				}
-			}
-		}
-
-		// if possible, read out membership via memberOf. It's far faster than
-		// performing a search, which still is a fallback later.
-		// memberof doesn't support memberuid, so skip it here.
-		if ((int)$this->access->connection->hasMemberOfFilterSupport === 1
-			&& (int)$this->access->connection->useMemberOfToDetectMembership === 1
-			&& $this->ldapGroupMemberAssocAttr !== 'memberuid'
-			&& $this->ldapGroupMemberAssocAttr !== 'zimbramailforwardingaddress') {
-			$groupDNs = $this->_getGroupDNsFromMemberOf($userDN);
-			if (is_array($groupDNs)) {
-				foreach ($groupDNs as $dn) {
-					$groupName = $this->access->dn2groupname($dn);
-					if (is_string($groupName)) {
-						// be sure to never return false if the dn could not be
-						// resolved to a name, for whatever reason.
-						$groups[] = $groupName;
-					}
-				}
-			}
-
-			if ($primaryGroup !== false) {
-				$groups[] = $primaryGroup;
-			}
-			if ($gidGroupName !== false) {
-				$groups[] = $gidGroupName;
-			}
-			$this->access->connection->writeToCache($cacheKey, $groups);
-			return $groups;
-		}
-
-		//uniqueMember takes DN, memberuid the uid, so we need to distinguish
-		switch ($this->ldapGroupMemberAssocAttr) {
-			case 'uniquemember':
-			case 'member':
-				$uid = $userDN;
-				break;
-
-			case 'memberuid':
-			case 'zimbramailforwardingaddress':
-				$result = $this->access->readAttribute($userDN, 'uid');
-				if ($result === false) {
-					$this->logger->debug('No uid attribute found for DN {dn} on {host}',
-						[
-							'app' => 'user_ldap',
-							'dn' => $userDN,
-							'host' => $this->access->connection->ldapHost,
-						]
-					);
-					$uid = false;
-				} else {
-					$uid = $result[0];
-				}
-				break;
-
-			default:
-				// just in case
-				$uid = $userDN;
-				break;
-		}
-
-		if ($uid !== false) {
-			if (isset($this->cachedGroupsByMember[$uid])) {
-				$groups = array_merge($groups, $this->cachedGroupsByMember[$uid]);
-			} else {
-				$groupsByMember = array_values($this->getGroupsByMember($uid));
-				$groupsByMember = $this->access->nextcloudGroupNames($groupsByMember);
-				$this->cachedGroupsByMember[$uid] = $groupsByMember;
-				$groups = array_merge($groups, $groupsByMember);
-			}
-		}
-
-		if ($primaryGroup !== false) {
-			$groups[] = $primaryGroup;
-		}
-		if ($gidGroupName !== false) {
-			$groups[] = $gidGroupName;
-		}
-
-		$groups = array_unique($groups, SORT_LOCALE_STRING);
-		$this->access->connection->writeToCache($cacheKey, $groups);
-
-		return $groups;
-	}
-
-	/**
-	 * @throws ServerNotAvailableException
-	 */
-	private function getGroupsByMember(string $dn, array &$seen = null): array {
-		if ($seen === null) {
-			$seen = [];
-		}
-		if (array_key_exists($dn, $seen)) {
-			// avoid loops
-			return [];
-		}
-		$allGroups = [];
-		$seen[$dn] = true;
-		$filter = $this->access->connection->ldapGroupMemberAssocAttr . '=' . $dn;
-
-		if ($this->ldapGroupMemberAssocAttr === 'zimbramailforwardingaddress') {
-			//in this case the member entries are email addresses
-			$filter .= '@*';
-		}
-
-		$nesting = (int)$this->access->connection->ldapNestedGroups;
-		if ($nesting === 0) {
-			$filter = $this->access->combineFilterWithAnd([$filter, $this->access->connection->ldapGroupFilter]);
-		}
-
-		$groups = $this->access->fetchListOfGroups($filter,
-			[strtolower($this->access->connection->ldapGroupMemberAssocAttr), $this->access->connection->ldapGroupDisplayName, 'dn']);
-		$fetcher = function ($dn) use (&$seen) {
-			if (is_array($dn) && isset($dn['dn'][0])) {
-				$dn = $dn['dn'][0];
-			}
-			return $this->getGroupsByMember($dn, $seen);
-		};
-
-		if (empty($dn)) {
-			$dn = "";
-		}
-
-		$allGroups = $this->walkNestedGroups($dn, $fetcher, $groups, $seen);
-		$visibleGroups = $this->filterValidGroups($allGroups);
-		return array_intersect_key($allGroups, $visibleGroups);
-	}
-
-	/**
-	 * get a list of all users in a group
-	 *
-	 * @param string $gid
-	 * @param string $search
-	 * @param int $limit
-	 * @param int $offset
-	 * @return array with user ids
-	 * @throws Exception
-	 * @throws ServerNotAvailableException
-	 */
-	public function usersInGroup($gid, $search = '', $limit = -1, $offset = 0) {
-		if (!$this->enabled) {
-			return [];
-		}
-		if (!$this->groupExists($gid)) {
-			return [];
-		}
-		$search = $this->access->escapeFilterPart($search, true);
-		$cacheKey = 'usersInGroup-' . $gid . '-' . $search . '-' . $limit . '-' . $offset;
-		// check for cache of the exact query
-		$groupUsers = $this->access->connection->getFromCache($cacheKey);
-		if (!is_null($groupUsers)) {
-			return $groupUsers;
-		}
-
-		if ($limit === -1) {
-			$limit = null;
-		}
-		// check for cache of the query without limit and offset
-		$groupUsers = $this->access->connection->getFromCache('usersInGroup-' . $gid . '-' . $search);
-		if (!is_null($groupUsers)) {
-			$groupUsers = array_slice($groupUsers, $offset, $limit);
-			$this->access->connection->writeToCache($cacheKey, $groupUsers);
-			return $groupUsers;
-		}
-
-		$groupDN = $this->access->groupname2dn($gid);
-		if (!$groupDN) {
-			// group couldn't be found, return empty resultset
-			$this->access->connection->writeToCache($cacheKey, []);
-			return [];
-		}
-
-		$primaryUsers = $this->getUsersInPrimaryGroup($groupDN, $search, $limit, $offset);
-		$posixGroupUsers = $this->getUsersInGidNumber($groupDN, $search, $limit, $offset);
-		$members = $this->_groupMembers($groupDN);
-		if (!$members && empty($posixGroupUsers) && empty($primaryUsers)) {
-			//in case users could not be retrieved, return empty result set
-			$this->access->connection->writeToCache($cacheKey, []);
-			return [];
-		}
-
-		$groupUsers = [];
-		$attrs = $this->access->userManager->getAttributes(true);
-		foreach ($members as $member) {
-			switch ($this->ldapGroupMemberAssocAttr) {
-				/** @noinspection PhpMissingBreakStatementInspection */
-				case 'zimbramailforwardingaddress':
-					//we get email addresses and need to convert them to uids
-					$parts = explode('@', $member);
-					$member = $parts[0];
-					//no break needed because we just needed to remove the email part and now we have uids
-				case 'memberuid':
-					//we got uids, need to get their DNs to 'translate' them to user names
-					$filter = $this->access->combineFilterWithAnd([
-						str_replace('%uid', trim($member), $this->access->connection->ldapLoginFilter),
-						$this->access->combineFilterWithAnd([
-							$this->access->getFilterPartForUserSearch($search),
-							$this->access->connection->ldapUserFilter
-						])
-					]);
-					$ldap_users = $this->access->fetchListOfUsers($filter, $attrs, 1);
-					if (empty($ldap_users)) {
-						break;
-					}
-					$groupUsers[] = $this->access->dn2username($ldap_users[0]['dn'][0]);
-					break;
-				default:
-					//we got DNs, check if we need to filter by search or we can give back all of them
-					$uid = $this->access->dn2username($member);
-					if (!$uid) {
-						break;
-					}
-
-					$cacheKey = 'userExistsOnLDAP' . $uid;
-					$userExists = $this->access->connection->getFromCache($cacheKey);
-					if ($userExists === false) {
-						break;
-					}
-					if ($userExists === null || $search !== '') {
-						if (!$this->access->readAttribute($member,
-							$this->access->connection->ldapUserDisplayName,
-							$this->access->combineFilterWithAnd([
-								$this->access->getFilterPartForUserSearch($search),
-								$this->access->connection->ldapUserFilter
-							]))) {
-							if ($search === '') {
-								$this->access->connection->writeToCache($cacheKey, false);
-							}
-							break;
-						}
-						$this->access->connection->writeToCache($cacheKey, true);
-					}
-					$groupUsers[] = $uid;
-					break;
-			}
-		}
-
-		$groupUsers = array_unique(array_merge($groupUsers, $primaryUsers, $posixGroupUsers));
-		natsort($groupUsers);
-		$this->access->connection->writeToCache('usersInGroup-' . $gid . '-' . $search, $groupUsers);
-		$groupUsers = array_slice($groupUsers, $offset, $limit);
-
-		$this->access->connection->writeToCache($cacheKey, $groupUsers);
-
-		return $groupUsers;
-	}
-
-	/**
-	 * returns the number of users in a group, who match the search term
-	 *
-	 * @param string $gid the internal group name
-	 * @param string $search optional, a search string
-	 * @return int|bool
-	 * @throws Exception
-	 * @throws ServerNotAvailableException
-	 */
-	public function countUsersInGroup($gid, $search = '') {
-		if ($this->groupPluginManager->implementsActions(GroupInterface::COUNT_USERS)) {
-			return $this->groupPluginManager->countUsersInGroup($gid, $search);
-		}
-
-		$cacheKey = 'countUsersInGroup-' . $gid . '-' . $search;
-		if (!$this->enabled || !$this->groupExists($gid)) {
-			return false;
-		}
-		$groupUsers = $this->access->connection->getFromCache($cacheKey);
-		if (!is_null($groupUsers)) {
-			return $groupUsers;
-		}
-
-		$groupDN = $this->access->groupname2dn($gid);
-		if (!$groupDN) {
-			// group couldn't be found, return empty result set
-			$this->access->connection->writeToCache($cacheKey, false);
-			return false;
-		}
-
-		$members = $this->_groupMembers($groupDN);
-		$primaryUserCount = $this->countUsersInPrimaryGroup($groupDN, '');
-		if (!$members && $primaryUserCount === 0) {
-			//in case users could not be retrieved, return empty result set
-			$this->access->connection->writeToCache($cacheKey, false);
-			return false;
-		}
-
-		if ($search === '') {
-			$groupUsers = count($members) + $primaryUserCount;
-			$this->access->connection->writeToCache($cacheKey, $groupUsers);
-			return $groupUsers;
-		}
-		$search = $this->access->escapeFilterPart($search, true);
-		$isMemberUid =
-			($this->ldapGroupMemberAssocAttr === 'memberuid' ||
-				$this->ldapGroupMemberAssocAttr === 'zimbramailforwardingaddress');
-
-		//we need to apply the search filter
-		//alternatives that need to be checked:
-		//a) get all users by search filter and array_intersect them
-		//b) a, but only when less than 1k 10k ?k users like it is
-		//c) put all DNs|uids in a LDAP filter, combine with the search string
-		//   and let it count.
-		//For now this is not important, because the only use of this method
-		//does not supply a search string
-		$groupUsers = [];
-		foreach ($members as $member) {
-			if ($isMemberUid) {
-				if ($this->ldapGroupMemberAssocAttr === 'zimbramailforwardingaddress') {
-					//we get email addresses and need to convert them to uids
-					$parts = explode('@', $member);
-					$member = $parts[0];
-				}
-				//we got uids, need to get their DNs to 'translate' them to user names
-				$filter = $this->access->combineFilterWithAnd([
-					str_replace('%uid', $member, $this->access->connection->ldapLoginFilter),
-					$this->access->getFilterPartForUserSearch($search)
-				]);
-				$ldap_users = $this->access->fetchListOfUsers($filter, ['dn'], 1);
-				if (count($ldap_users) < 1) {
-					continue;
-				}
-				$groupUsers[] = $this->access->dn2username($ldap_users[0]);
-			} else {
-				//we need to apply the search filter now
-				if (!$this->access->readAttribute($member,
-					$this->access->connection->ldapUserDisplayName,
-					$this->access->getFilterPartForUserSearch($search))) {
-					continue;
-				}
-				// dn2username will also check if the users belong to the allowed base
-				if ($ncGroupId = $this->access->dn2username($member)) {
-					$groupUsers[] = $ncGroupId;
-				}
-			}
-		}
-
-		//and get users that have the group as primary
-		$primaryUsers = $this->countUsersInPrimaryGroup($groupDN, $search);
-
-		return count($groupUsers) + $primaryUsers;
-	}
-
-	/**
-	 * get a list of all groups using a paged search
-	 *
-	 * @param string $search
-	 * @param int $limit
-	 * @param int $offset
-	 * @return array with group names
-	 *
-	 * Returns a list with all groups
-	 * Uses a paged search if available to override a
-	 * server side search limit.
-	 * (active directory has a limit of 1000 by default)
-	 * @throws Exception
-	 */
-	public function getGroups($search = '', $limit = -1, $offset = 0) {
-		if (!$this->enabled) {
-			return [];
-		}
-		$search = $this->access->escapeFilterPart($search, true);
-		$cacheKey = 'getGroups-' . $search . '-' . $limit . '-' . $offset;
-
-		//Check cache before driving unnecessary searches
-		$ldap_groups = $this->access->connection->getFromCache($cacheKey);
-		if (!is_null($ldap_groups)) {
-			return $ldap_groups;
-		}
-
-		// if we'd pass -1 to LDAP search, we'd end up in a Protocol
-		// error. With a limit of 0, we get 0 results. So we pass null.
-		if ($limit <= 0) {
-			$limit = null;
-		}
-		$filter = $this->access->combineFilterWithAnd([
-			$this->access->connection->ldapGroupFilter,
-			$this->access->getFilterPartForGroupSearch($search)
-		]);
-		$ldap_groups = $this->access->fetchListOfGroups($filter,
-			[$this->access->connection->ldapGroupDisplayName, 'dn'],
-			$limit,
-			$offset);
-		$ldap_groups = $this->access->nextcloudGroupNames($ldap_groups);
-
-		$this->access->connection->writeToCache($cacheKey, $ldap_groups);
-		return $ldap_groups;
-	}
-
-	/**
-	 * check if a group exists
-	 *
-	 * @param string $gid
-	 * @return bool
-	 * @throws ServerNotAvailableException
-	 */
-	public function groupExists($gid) {
-		$groupExists = $this->access->connection->getFromCache('groupExists' . $gid);
-		if (!is_null($groupExists)) {
-			return (bool)$groupExists;
-		}
-
-		//getting dn, if false the group does not exist. If dn, it may be mapped
-		//only, requires more checking.
-		$dn = $this->access->groupname2dn($gid);
-		if (!$dn) {
-			$this->access->connection->writeToCache('groupExists' . $gid, false);
-			return false;
-		}
-
-		if (!$this->access->isDNPartOfBase($dn, $this->access->connection->ldapBaseGroups)) {
-			$this->access->connection->writeToCache('groupExists' . $gid, false);
-			return false;
-		}
-
-		//if group really still exists, we will be able to read its objectClass
-		if (!is_array($this->access->readAttribute($dn, '', $this->access->connection->ldapGroupFilter))) {
-			$this->access->connection->writeToCache('groupExists' . $gid, false);
-			return false;
-		}
-
-		$this->access->connection->writeToCache('groupExists' . $gid, true);
-		return true;
-	}
-
-	/**
-	 * @throws ServerNotAvailableException
-	 * @throws Exception
-	 */
-	protected function filterValidGroups(array $listOfGroups): array {
-		$validGroupDNs = [];
-		foreach ($listOfGroups as $key => $item) {
-			$dn = is_string($item) ? $item : $item['dn'][0];
-			$gid = $this->access->dn2groupname($dn);
-			if (!$gid) {
-				continue;
-			}
-			if ($this->groupExists($gid)) {
-				$validGroupDNs[$key] = $item;
-			}
-		}
-		return $validGroupDNs;
-	}
-
-	/**
-	 * Check if backend implements actions
-	 *
-	 * @param int $actions bitwise-or'ed actions
-	 * @return boolean
-	 *
-	 * Returns the supported actions as int to be
-	 * compared with GroupInterface::CREATE_GROUP etc.
-	 */
-	public function implementsActions($actions) {
-		return (bool)((GroupInterface::COUNT_USERS |
-				GroupInterface::DELETE_GROUP |
-				$this->groupPluginManager->getImplementedActions()) & $actions);
-	}
-
-	/**
-	 * Return access for LDAP interaction.
-	 *
-	 * @return Access instance of Access for LDAP interaction
-	 */
-	public function getLDAPAccess($gid) {
-		return $this->access;
-	}
-
-	/**
-	 * create a group
-	 *
-	 * @param string $gid
-	 * @return bool
-	 * @throws Exception
-	 * @throws ServerNotAvailableException
-	 */
-	public function createGroup($gid) {
-		if ($this->groupPluginManager->implementsActions(GroupInterface::CREATE_GROUP)) {
-			if ($dn = $this->groupPluginManager->createGroup($gid)) {
-				//updates group mapping
-				$uuid = $this->access->getUUID($dn, false);
-				if (is_string($uuid)) {
-					$this->access->mapAndAnnounceIfApplicable(
-						$this->access->getGroupMapper(),
-						$dn,
-						$gid,
-						$uuid,
-						false
-					);
-					$this->access->cacheGroupExists($gid);
-				}
-			}
-			return $dn != null;
-		}
-		throw new Exception('Could not create group in LDAP backend.');
-	}
-
-	/**
-	 * delete a group
-	 *
-	 * @param string $gid gid of the group to delete
-	 * @throws Exception
-	 */
-	public function deleteGroup(string $gid): bool {
-		if ($this->groupPluginManager->canDeleteGroup()) {
-			if ($ret = $this->groupPluginManager->deleteGroup($gid)) {
-				// Delete group in nextcloud internal db
-				$this->access->getGroupMapper()->unmap($gid);
-				$this->access->connection->writeToCache("groupExists" . $gid, false);
-			}
-			return $ret;
-		}
-
-		// Getting dn, if false the group is not mapped
-		$dn = $this->access->groupname2dn($gid);
-		if (!$dn) {
-			throw new Exception('Could not delete unknown group '.$gid.' in LDAP backend.');
-		}
-
-		if (!$this->groupExists($gid)) {
-			// The group does not exist in the LDAP, remove the mapping
-			$this->access->getGroupMapper()->unmap($gid);
-			$this->access->connection->writeToCache("groupExists" . $gid, false);
-			return true;
-		}
-
-		throw new Exception('Could not delete existing group '.$gid.' in LDAP backend.');
-	}
-
-	/**
-	 * Add a user to a group
-	 *
-	 * @param string $uid Name of the user to add to group
-	 * @param string $gid Name of the group in which add the user
-	 * @return bool
-	 * @throws Exception
-	 */
-	public function addToGroup($uid, $gid) {
-		if ($this->groupPluginManager->implementsActions(GroupInterface::ADD_TO_GROUP)) {
-			if ($ret = $this->groupPluginManager->addToGroup($uid, $gid)) {
-				$this->access->connection->clearCache();
-				unset($this->cachedGroupMembers[$gid]);
-			}
-			return $ret;
-		}
-		throw new Exception('Could not add user to group in LDAP backend.');
-	}
-
-	/**
-	 * Removes a user from a group
-	 *
-	 * @param string $uid Name of the user to remove from group
-	 * @param string $gid Name of the group from which remove the user
-	 * @return bool
-	 * @throws Exception
-	 */
-	public function removeFromGroup($uid, $gid) {
-		if ($this->groupPluginManager->implementsActions(GroupInterface::REMOVE_FROM_GROUP)) {
-			if ($ret = $this->groupPluginManager->removeFromGroup($uid, $gid)) {
-				$this->access->connection->clearCache();
-				unset($this->cachedGroupMembers[$gid]);
-			}
-			return $ret;
-		}
-		throw new Exception('Could not remove user from group in LDAP backend.');
-	}
-
-	/**
-	 * Gets group details
-	 *
-	 * @param string $gid Name of the group
-	 * @return array|false
-	 * @throws Exception
-	 */
-	public function getGroupDetails($gid) {
-		if ($this->groupPluginManager->implementsActions(GroupInterface::GROUP_DETAILS)) {
-			return $this->groupPluginManager->getGroupDetails($gid);
-		}
-		throw new Exception('Could not get group details in LDAP backend.');
-	}
-
-	/**
-	 * Return LDAP connection resource from a cloned connection.
-	 * The cloned connection needs to be closed manually.
-	 * of the current access.
-	 *
-	 * @param string $gid
-	 * @return resource|\LDAP\Connection The LDAP connection
-	 * @throws ServerNotAvailableException
-	 */
-	public function getNewLDAPConnection($gid) {
-		$connection = clone $this->access->getConnection();
-		return $connection->getConnectionResource();
-	}
-
-	/**
-	 * @throws ServerNotAvailableException
-	 */
-	public function getDisplayName(string $gid): string {
-		if ($this->groupPluginManager instanceof IGetDisplayNameBackend) {
-			return $this->groupPluginManager->getDisplayName($gid);
-		}
-
-		$cacheKey = 'group_getDisplayName' . $gid;
-		if (!is_null($displayName = $this->access->connection->getFromCache($cacheKey))) {
-			return $displayName;
-		}
-
-		$displayName = $this->access->readAttribute(
-			$this->access->groupname2dn($gid),
-			$this->access->connection->ldapGroupDisplayName);
-
-		if (($displayName !== false) && (count($displayName) > 0)) {
-			$displayName = $displayName[0];
-			$this->access->connection->writeToCache($cacheKey, $displayName);
-			return $displayName;
-		}
-
-		return '';
-	}
+    protected $enabled = false;
+
+    /** @var string[][] $cachedGroupMembers array of users with gid as key */
+    protected $cachedGroupMembers;
+    /** @var string[] $cachedGroupsByMember array of groups with uid as key */
+    protected $cachedGroupsByMember;
+    /** @var string[] $cachedNestedGroups array of groups with gid (DN) as key */
+    protected $cachedNestedGroups;
+    /** @var GroupPluginManager */
+    protected $groupPluginManager;
+    /** @var LoggerInterface */
+    protected $logger;
+
+    /**
+     * @var string $ldapGroupMemberAssocAttr contains the LDAP setting (in lower case) with the same name
+     */
+    protected $ldapGroupMemberAssocAttr;
+
+    public function __construct(Access $access, GroupPluginManager $groupPluginManager) {
+        parent::__construct($access);
+        $filter = $this->access->connection->ldapGroupFilter;
+        $gAssoc = $this->access->connection->ldapGroupMemberAssocAttr;
+        if (!empty($filter) && !empty($gAssoc)) {
+            $this->enabled = true;
+        }
+
+        $this->cachedGroupMembers = new CappedMemoryCache();
+        $this->cachedGroupsByMember = new CappedMemoryCache();
+        $this->cachedNestedGroups = new CappedMemoryCache();
+        $this->groupPluginManager = $groupPluginManager;
+        $this->logger = OC::$server->get(LoggerInterface::class);
+        $this->ldapGroupMemberAssocAttr = strtolower((string)$gAssoc);
+    }
+
+    /**
+     * is user in group?
+     *
+     * @param string $uid uid of the user
+     * @param string $gid gid of the group
+     * @return bool
+     * @throws Exception
+     * @throws ServerNotAvailableException
+     */
+    public function inGroup($uid, $gid) {
+        if (!$this->enabled) {
+            return false;
+        }
+        $cacheKey = 'inGroup' . $uid . ':' . $gid;
+        $inGroup = $this->access->connection->getFromCache($cacheKey);
+        if (!is_null($inGroup)) {
+            return (bool)$inGroup;
+        }
+
+        $userDN = $this->access->username2dn($uid);
+
+        if (isset($this->cachedGroupMembers[$gid])) {
+            return in_array($userDN, $this->cachedGroupMembers[$gid]);
+        }
+
+        $cacheKeyMembers = 'inGroup-members:' . $gid;
+        $members = $this->access->connection->getFromCache($cacheKeyMembers);
+        if (!is_null($members)) {
+            $this->cachedGroupMembers[$gid] = $members;
+            $isInGroup = in_array($userDN, $members, true);
+            $this->access->connection->writeToCache($cacheKey, $isInGroup);
+            return $isInGroup;
+        }
+
+        $groupDN = $this->access->groupname2dn($gid);
+        // just in case
+        if (!$groupDN || !$userDN) {
+            $this->access->connection->writeToCache($cacheKey, false);
+            return false;
+        }
+
+        //check primary group first
+        if ($gid === $this->getUserPrimaryGroup($userDN)) {
+            $this->access->connection->writeToCache($cacheKey, true);
+            return true;
+        }
+
+        //usually, LDAP attributes are said to be case insensitive. But there are exceptions of course.
+        $members = $this->_groupMembers($groupDN);
+
+        //extra work if we don't get back user DNs
+        switch ($this->ldapGroupMemberAssocAttr) {
+            case 'memberuid':
+            case 'zimbramailforwardingaddress':
+                $requestAttributes = $this->access->userManager->getAttributes(true);
+                $users = [];
+                $filterParts = [];
+                $bytes = 0;
+                foreach ($members as $mid) {
+                    if ($this->ldapGroupMemberAssocAttr === 'zimbramailforwardingaddress') {
+                        $parts = explode('@', $mid); //making sure we get only the uid
+                        $mid = $parts[0];
+                    }
+                    $filter = str_replace('%uid', $mid, $this->access->connection->ldapLoginFilter);
+                    $filterParts[] = $filter;
+                    $bytes += strlen($filter);
+                    if ($bytes >= 9000000) {
+                        // AD has a default input buffer of 10 MB, we do not want
+                        // to take even the chance to exceed it
+                        // so we fetch results with the filterParts we collected so far
+                        $filter = $this->access->combineFilterWithOr($filterParts);
+                        $search = $this->access->fetchListOfUsers($filter, $requestAttributes, count($filterParts));
+                        $bytes = 0;
+                        $filterParts = [];
+                        $users = array_merge($users, $search);
+                    }
+                }
+
+                if (count($filterParts) > 0) {
+                    // if there are filterParts left we need to add their result
+                    $filter = $this->access->combineFilterWithOr($filterParts);
+                    $search = $this->access->fetchListOfUsers($filter, $requestAttributes, count($filterParts));
+                    $users = array_merge($users, $search);
+                }
+
+                // now we cleanup the users array to get only dns
+                $dns = [];
+                foreach ($users as $record) {
+                    $dns[$record['dn'][0]] = 1;
+                }
+                $members = array_keys($dns);
+
+                break;
+        }
+
+        if (count($members) === 0) {
+            $this->access->connection->writeToCache($cacheKey, false);
+            return false;
+        }
+
+        $isInGroup = in_array($userDN, $members);
+        $this->access->connection->writeToCache($cacheKey, $isInGroup);
+        $this->access->connection->writeToCache($cacheKeyMembers, $members);
+        $this->cachedGroupMembers[$gid] = $members;
+
+        return $isInGroup;
+    }
+
+    /**
+     * For a group that has user membership defined by an LDAP search url
+     * attribute returns the users that match the search url otherwise returns
+     * an empty array.
+     *
+     * @throws ServerNotAvailableException
+     */
+    public function getDynamicGroupMembers(string $dnGroup): array {
+        $dynamicGroupMemberURL = strtolower((string)$this->access->connection->ldapDynamicGroupMemberURL);
+
+        if (empty($dynamicGroupMemberURL)) {
+            return [];
+        }
+
+        $dynamicMembers = [];
+        $memberURLs = $this->access->readAttribute(
+            $dnGroup,
+            $dynamicGroupMemberURL,
+            $this->access->connection->ldapGroupFilter
+        );
+        if ($memberURLs !== false) {
+            // this group has the 'memberURL' attribute so this is a dynamic group
+            // example 1: ldap:///cn=users,cn=accounts,dc=dcsubbase,dc=dcbase??one?(o=HeadOffice)
+            // example 2: ldap:///cn=users,cn=accounts,dc=dcsubbase,dc=dcbase??one?(&(o=HeadOffice)(uidNumber>=500))
+            $pos = strpos($memberURLs[0], '(');
+            if ($pos !== false) {
+                $memberUrlFilter = substr($memberURLs[0], $pos);
+                $foundMembers = $this->access->searchUsers($memberUrlFilter, ['dn']);
+                $dynamicMembers = [];
+                foreach ($foundMembers as $value) {
+                    $dynamicMembers[$value['dn'][0]] = 1;
+                }
+            } else {
+                $this->logger->debug('No search filter found on member url of group {dn}',
+                    [
+                        'app' => 'user_ldap',
+                        'dn' => $dnGroup,
+                    ]
+                );
+            }
+        }
+        return $dynamicMembers;
+    }
+
+    /**
+     * @throws ServerNotAvailableException
+     */
+    private function _groupMembers(string $dnGroup, ?array &$seen = null): array {
+        if ($seen === null) {
+            $seen = [];
+            // the root entry has to be marked as processed to avoind infinit loops,
+            // but not included in the results laters on
+            $excludeFromResult = $dnGroup;
+        }
+        // cache only base groups, otherwise groups get additional unwarranted members
+        $shouldCacheResult = count($seen) === 0;
+
+        static $rawMemberReads = []; // runtime cache for intermediate ldap read results
+        $allMembers = [];
+
+        if (array_key_exists($dnGroup, $seen)) {
+            return [];
+        }
+        // used extensively in cron job, caching makes sense for nested groups
+        $cacheKey = '_groupMembers' . $dnGroup;
+        $groupMembers = $this->access->connection->getFromCache($cacheKey);
+        if ($groupMembers !== null) {
+            return $groupMembers;
+        }
+
+        if ($this->access->connection->ldapNestedGroups
+            && $this->access->connection->useMemberOfToDetectMembership
+            && $this->access->connection->hasMemberOfFilterSupport
+            && $this->access->connection->ldapMatchingRuleInChainState !== Configuration::LDAP_SERVER_FEATURE_UNAVAILABLE
+        ) {
+            $attemptedLdapMatchingRuleInChain = true;
+            // compatibility hack with servers supporting :1.2.840.113556.1.4.1941:, and others)
+            $filter = $this->access->combineFilterWithAnd([
+                $this->access->connection->ldapUserFilter,
+                $this->access->connection->ldapUserDisplayName . '=*',
+                'memberof:1.2.840.113556.1.4.1941:=' . $dnGroup
+            ]);
+            $memberRecords = $this->access->fetchListOfUsers(
+                $filter,
+                $this->access->userManager->getAttributes(true)
+            );
+            $result = array_reduce($memberRecords, function ($carry, $record) {
+                $carry[] = $record['dn'][0];
+                return $carry;
+            }, []);
+            if ($this->access->connection->ldapMatchingRuleInChainState === Configuration::LDAP_SERVER_FEATURE_AVAILABLE) {
+                return $result;
+            } elseif (!empty($memberRecords)) {
+                $this->access->connection->ldapMatchingRuleInChainState = Configuration::LDAP_SERVER_FEATURE_AVAILABLE;
+                $this->access->connection->saveConfiguration();
+                return $result;
+            }
+            // when feature availability is unknown, and the result is empty, continue and test with original approach
+        }
+
+        $seen[$dnGroup] = 1;
+        $members = $rawMemberReads[$dnGroup] ?? null;
+        if ($members === null) {
+            $members = $this->access->readAttribute($dnGroup, $this->access->connection->ldapGroupMemberAssocAttr);
+            $rawMemberReads[$dnGroup] = $members;
+        }
+        if (is_array($members)) {
+            $fetcher = function ($memberDN) use (&$seen) {
+                return $this->_groupMembers($memberDN, $seen);
+            };
+            $allMembers = $this->walkNestedGroups($dnGroup, $fetcher, $members, $seen);
+        }
+
+        $allMembers += $this->getDynamicGroupMembers($dnGroup);
+        if (isset($excludeFromResult)) {
+            $index = array_search($excludeFromResult, $allMembers, true);
+            if ($index !== false) {
+                unset($allMembers[$index]);
+            }
+        }
+
+        if ($shouldCacheResult) {
+            $this->access->connection->writeToCache($cacheKey, $allMembers);
+            unset($rawMemberReads[$dnGroup]);
+        }
+        if (isset($attemptedLdapMatchingRuleInChain)
+            && $this->access->connection->ldapMatchingRuleInChainState === Configuration::LDAP_SERVER_FEATURE_UNKNOWN
+            && !empty($allMembers)
+        ) {
+            $this->access->connection->ldapMatchingRuleInChainState = Configuration::LDAP_SERVER_FEATURE_UNAVAILABLE;
+            $this->access->connection->saveConfiguration();
+        }
+        return $allMembers;
+    }
+
+    /**
+     * @throws ServerNotAvailableException
+     */
+    private function _getGroupDNsFromMemberOf(string $dn): array {
+        $groups = $this->access->readAttribute($dn, 'memberOf');
+        if (!is_array($groups)) {
+            return [];
+        }
+
+        $fetcher = function ($groupDN) {
+            if (isset($this->cachedNestedGroups[$groupDN])) {
+                $nestedGroups = $this->cachedNestedGroups[$groupDN];
+            } else {
+                $nestedGroups = $this->access->readAttribute($groupDN, 'memberOf');
+                if (!is_array($nestedGroups)) {
+                    $nestedGroups = [];
+                }
+                $this->cachedNestedGroups[$groupDN] = $nestedGroups;
+            }
+            return $nestedGroups;
+        };
+
+        $groups = $this->walkNestedGroups($dn, $fetcher, $groups);
+        return $this->filterValidGroups($groups);
+    }
+
+    private function walkNestedGroups(string $dn, Closure $fetcher, array $list, array &$seen = []): array {
+        $nesting = (int)$this->access->connection->ldapNestedGroups;
+        // depending on the input, we either have a list of DNs or a list of LDAP records
+        // also, the output expects either DNs or records. Testing the first element should suffice.
+        $recordMode = is_array($list) && isset($list[0]) && is_array($list[0]) && isset($list[0]['dn'][0]);
+
+        if ($nesting !== 1) {
+            if ($recordMode) {
+                // the keys are numeric, but should hold the DN
+                return array_reduce($list, function ($transformed, $record) use ($dn) {
+                    if ($record['dn'][0] != $dn) {
+                        $transformed[$record['dn'][0]] = $record;
+                    }
+                    return $transformed;
+                }, []);
+            }
+            return $list;
+        }
+
+        while ($record = array_shift($list)) {
+            $recordDN = $record['dn'][0] ?? $record;
+            if ($recordDN === $dn || array_key_exists($recordDN, $seen)) {
+                // Prevent loops
+                continue;
+            }
+            $fetched = $fetcher($record);
+            $list = array_merge($list, $fetched);
+            if (!isset($seen[$recordDN]) || is_bool($seen[$recordDN]) && is_array($record)) {
+                $seen[$recordDN] = $record;
+            }
+        }
+
+        // on record mode, filter out intermediate state
+        return $recordMode ? array_filter($seen, 'is_array') : array_keys($seen);
+    }
+
+    /**
+     * translates a gidNumber into an ownCloud internal name
+     *
+     * @return string|bool
+     * @throws Exception
+     * @throws ServerNotAvailableException
+     */
+    public function gidNumber2Name(string $gid, string $dn) {
+        $cacheKey = 'gidNumberToName' . $gid;
+        $groupName = $this->access->connection->getFromCache($cacheKey);
+        if (!is_null($groupName) && isset($groupName)) {
+            return $groupName;
+        }
+
+        //we need to get the DN from LDAP
+        $filter = $this->access->combineFilterWithAnd([
+            $this->access->connection->ldapGroupFilter,
+            'objectClass=posixGroup',
+            $this->access->connection->ldapGidNumber . '=' . $gid
+        ]);
+        return $this->getNameOfGroup($filter, $cacheKey) ?? false;
+    }
+
+    /**
+     * @throws ServerNotAvailableException
+     * @throws Exception
+     */
+    private function getNameOfGroup(string $filter, string $cacheKey) {
+        $result = $this->access->searchGroups($filter, ['dn'], 1);
+        if (empty($result)) {
+            $this->access->connection->writeToCache($cacheKey, false);
+            return null;
+        }
+        $dn = $result[0]['dn'][0];
+
+        //and now the group name
+        //NOTE once we have separate Nextcloud group IDs and group names we can
+        //directly read the display name attribute instead of the DN
+        $name = $this->access->dn2groupname($dn);
+
+        $this->access->connection->writeToCache($cacheKey, $name);
+
+        return $name;
+    }
+
+    /**
+     * returns the entry's gidNumber
+     *
+     * @return string|bool
+     * @throws ServerNotAvailableException
+     */
+    private function getEntryGidNumber(string $dn, string $attribute) {
+        $value = $this->access->readAttribute($dn, $attribute);
+        if (is_array($value) && !empty($value)) {
+            return $value[0];
+        }
+        return false;
+    }
+
+    /**
+     * @return string|bool
+     * @throws ServerNotAvailableException
+     */
+    public function getGroupGidNumber(string $dn) {
+        return $this->getEntryGidNumber($dn, 'gidNumber');
+    }
+
+    /**
+     * returns the user's gidNumber
+     *
+     * @return string|bool
+     * @throws ServerNotAvailableException
+     */
+    public function getUserGidNumber(string $dn) {
+        $gidNumber = false;
+        if ($this->access->connection->hasGidNumber) {
+            $gidNumber = $this->getEntryGidNumber($dn, $this->access->connection->ldapGidNumber);
+            if ($gidNumber === false) {
+                $this->access->connection->hasGidNumber = false;
+            }
+        }
+        return $gidNumber;
+    }
+
+    /**
+     * @throws ServerNotAvailableException
+     * @throws Exception
+     */
+    private function prepareFilterForUsersHasGidNumber(string $groupDN, string $search = ''): string {
+        $groupID = $this->getGroupGidNumber($groupDN);
+        if ($groupID === false) {
+            throw new Exception('Not a valid group');
+        }
+
+        $filterParts = [];
+        $filterParts[] = $this->access->getFilterForUserCount();
+        if ($search !== '') {
+            $filterParts[] = $this->access->getFilterPartForUserSearch($search);
+        }
+        $filterParts[] = $this->access->connection->ldapGidNumber . '=' . $groupID;
+
+        return $this->access->combineFilterWithAnd($filterParts);
+    }
+
+    /**
+     * returns a list of users that have the given group as gid number
+     *
+     * @throws ServerNotAvailableException
+     */
+    public function getUsersInGidNumber(
+        string $groupDN,
+        string $search = '',
+        ?int $limit = -1,
+        ?int $offset = 0
+    ): array {
+        try {
+            $filter = $this->prepareFilterForUsersHasGidNumber($groupDN, $search);
+            $users = $this->access->fetchListOfUsers(
+                $filter,
+                [$this->access->connection->ldapUserDisplayName, 'dn'],
+                $limit,
+                $offset
+            );
+            return $this->access->nextcloudUserNames($users);
+        } catch (ServerNotAvailableException $e) {
+            throw $e;
+        } catch (Exception $e) {
+            return [];
+        }
+    }
+
+    /**
+     * @throws ServerNotAvailableException
+     * @return bool
+     */
+    public function getUserGroupByGid(string $dn) {
+        $groupID = $this->getUserGidNumber($dn);
+        if ($groupID !== false) {
+            $groupName = $this->gidNumber2Name($groupID, $dn);
+            if ($groupName !== false) {
+                return $groupName;
+            }
+        }
+
+        return false;
+    }
+
+    /**
+     * translates a primary group ID into an Nextcloud internal name
+     *
+     * @return string|bool
+     * @throws Exception
+     * @throws ServerNotAvailableException
+     */
+    public function primaryGroupID2Name(string $gid, string $dn) {
+        $cacheKey = 'primaryGroupIDtoName_' . $gid;
+        $groupName = $this->access->connection->getFromCache($cacheKey);
+        if (!is_null($groupName)) {
+            return $groupName;
+        }
+
+        $domainObjectSid = $this->access->getSID($dn);
+        if ($domainObjectSid === false) {
+            return false;
+        }
+
+        //we need to get the DN from LDAP
+        $filter = $this->access->combineFilterWithAnd([
+            $this->access->connection->ldapGroupFilter,
+            'objectsid=' . $domainObjectSid . '-' . $gid
+        ]);
+        return $this->getNameOfGroup($filter, $cacheKey) ?? false;
+    }
+
+    /**
+     * returns the entry's primary group ID
+     *
+     * @return string|bool
+     * @throws ServerNotAvailableException
+     */
+    private function getEntryGroupID(string $dn, string $attribute) {
+        $value = $this->access->readAttribute($dn, $attribute);
+        if (is_array($value) && !empty($value)) {
+            return $value[0];
+        }
+        return false;
+    }
+
+    /**
+     * @return string|bool
+     * @throws ServerNotAvailableException
+     */
+    public function getGroupPrimaryGroupID(string $dn) {
+        return $this->getEntryGroupID($dn, 'primaryGroupToken');
+    }
+
+    /**
+     * @return string|bool
+     * @throws ServerNotAvailableException
+     */
+    public function getUserPrimaryGroupIDs(string $dn) {
+        $primaryGroupID = false;
+        if ($this->access->connection->hasPrimaryGroups) {
+            $primaryGroupID = $this->getEntryGroupID($dn, 'primaryGroupID');
+            if ($primaryGroupID === false) {
+                $this->access->connection->hasPrimaryGroups = false;
+            }
+        }
+        return $primaryGroupID;
+    }
+
+    /**
+     * @throws Exception
+     * @throws ServerNotAvailableException
+     */
+    private function prepareFilterForUsersInPrimaryGroup(string $groupDN, string $search = ''): string {
+        $groupID = $this->getGroupPrimaryGroupID($groupDN);
+        if ($groupID === false) {
+            throw new Exception('Not a valid group');
+        }
+
+        $filterParts = [];
+        $filterParts[] = $this->access->getFilterForUserCount();
+        if ($search !== '') {
+            $filterParts[] = $this->access->getFilterPartForUserSearch($search);
+        }
+        $filterParts[] = 'primaryGroupID=' . $groupID;
+
+        return $this->access->combineFilterWithAnd($filterParts);
+    }
+
+    /**
+     * @throws ServerNotAvailableException
+     */
+    public function getUsersInPrimaryGroup(
+        string $groupDN,
+        string $search = '',
+        ?int $limit = -1,
+        ?int $offset = 0
+    ): array {
+        try {
+            $filter = $this->prepareFilterForUsersInPrimaryGroup($groupDN, $search);
+            $users = $this->access->fetchListOfUsers(
+                $filter,
+                [$this->access->connection->ldapUserDisplayName, 'dn'],
+                $limit,
+                $offset
+            );
+            return $this->access->nextcloudUserNames($users);
+        } catch (ServerNotAvailableException $e) {
+            throw $e;
+        } catch (Exception $e) {
+            return [];
+        }
+    }
+
+    /**
+     * @throws ServerNotAvailableException
+     */
+    public function countUsersInPrimaryGroup(
+        string $groupDN,
+        string $search = '',
+        int $limit = -1,
+        int $offset = 0
+    ): int {
+        try {
+            $filter = $this->prepareFilterForUsersInPrimaryGroup($groupDN, $search);
+            $users = $this->access->countUsers($filter, ['dn'], $limit, $offset);
+            return (int)$users;
+        } catch (ServerNotAvailableException $e) {
+            throw $e;
+        } catch (Exception $e) {
+            return 0;
+        }
+    }
+
+    /**
+     * @return string|bool
+     * @throws ServerNotAvailableException
+     */
+    public function getUserPrimaryGroup(string $dn) {
+        $groupID = $this->getUserPrimaryGroupIDs($dn);
+        if ($groupID !== false) {
+            $groupName = $this->primaryGroupID2Name($groupID, $dn);
+            if ($groupName !== false) {
+                return $groupName;
+            }
+        }
+
+        return false;
+    }
+
+    /**
+     * This function fetches all groups a user belongs to. It does not check
+     * if the user exists at all.
+     *
+     * This function includes groups based on dynamic group membership.
+     *
+     * @param string $uid Name of the user
+     * @return array with group names
+     * @throws Exception
+     * @throws ServerNotAvailableException
+     */
+    public function getUserGroups($uid) {
+        if (!$this->enabled) {
+            return [];
+        }
+        $cacheKey = 'getUserGroups' . $uid;
+        $userGroups = $this->access->connection->getFromCache($cacheKey);
+        if (!is_null($userGroups)) {
+            return $userGroups;
+        }
+        $userDN = $this->access->username2dn($uid);
+        if (!$userDN) {
+            $this->access->connection->writeToCache($cacheKey, []);
+            return [];
+        }
+
+        $groups = [];
+        $primaryGroup = $this->getUserPrimaryGroup($userDN);
+        $gidGroupName = $this->getUserGroupByGid($userDN);
+
+        $dynamicGroupMemberURL = strtolower($this->access->connection->ldapDynamicGroupMemberURL);
+
+        if (!empty($dynamicGroupMemberURL)) {
+            // look through dynamic groups to add them to the result array if needed
+            $groupsToMatch = $this->access->fetchListOfGroups(
+                $this->access->connection->ldapGroupFilter, ['dn', $dynamicGroupMemberURL]);
+            foreach ($groupsToMatch as $dynamicGroup) {
+                if (!array_key_exists($dynamicGroupMemberURL, $dynamicGroup)) {
+                    continue;
+                }
+                $pos = strpos($dynamicGroup[$dynamicGroupMemberURL][0], '(');
+                if ($pos !== false) {
+                    $memberUrlFilter = substr($dynamicGroup[$dynamicGroupMemberURL][0], $pos);
+                    // apply filter via ldap search to see if this user is in this
+                    // dynamic group
+                    $userMatch = $this->access->readAttribute(
+                        $userDN,
+                        $this->access->connection->ldapUserDisplayName,
+                        $memberUrlFilter
+                    );
+                    if ($userMatch !== false) {
+                        // match found so this user is in this group
+                        $groupName = $this->access->dn2groupname($dynamicGroup['dn'][0]);
+                        if (is_string($groupName)) {
+                            // be sure to never return false if the dn could not be
+                            // resolved to a name, for whatever reason.
+                            $groups[] = $groupName;
+                        }
+                    }
+                } else {
+                    $this->logger->debug('No search filter found on member url of group {dn}',
+                        [
+                            'app' => 'user_ldap',
+                            'dn' => $dynamicGroup,
+                        ]
+                    );
+                }
+            }
+        }
+
+        // if possible, read out membership via memberOf. It's far faster than
+        // performing a search, which still is a fallback later.
+        // memberof doesn't support memberuid, so skip it here.
+        if ((int)$this->access->connection->hasMemberOfFilterSupport === 1
+            && (int)$this->access->connection->useMemberOfToDetectMembership === 1
+            && $this->ldapGroupMemberAssocAttr !== 'memberuid'
+            && $this->ldapGroupMemberAssocAttr !== 'zimbramailforwardingaddress') {
+            $groupDNs = $this->_getGroupDNsFromMemberOf($userDN);
+            if (is_array($groupDNs)) {
+                foreach ($groupDNs as $dn) {
+                    $groupName = $this->access->dn2groupname($dn);
+                    if (is_string($groupName)) {
+                        // be sure to never return false if the dn could not be
+                        // resolved to a name, for whatever reason.
+                        $groups[] = $groupName;
+                    }
+                }
+            }
+
+            if ($primaryGroup !== false) {
+                $groups[] = $primaryGroup;
+            }
+            if ($gidGroupName !== false) {
+                $groups[] = $gidGroupName;
+            }
+            $this->access->connection->writeToCache($cacheKey, $groups);
+            return $groups;
+        }
+
+        //uniqueMember takes DN, memberuid the uid, so we need to distinguish
+        switch ($this->ldapGroupMemberAssocAttr) {
+            case 'uniquemember':
+            case 'member':
+                $uid = $userDN;
+                break;
+
+            case 'memberuid':
+            case 'zimbramailforwardingaddress':
+                $result = $this->access->readAttribute($userDN, 'uid');
+                if ($result === false) {
+                    $this->logger->debug('No uid attribute found for DN {dn} on {host}',
+                        [
+                            'app' => 'user_ldap',
+                            'dn' => $userDN,
+                            'host' => $this->access->connection->ldapHost,
+                        ]
+                    );
+                    $uid = false;
+                } else {
+                    $uid = $result[0];
+                }
+                break;
+
+            default:
+                // just in case
+                $uid = $userDN;
+                break;
+        }
+
+        if ($uid !== false) {
+            if (isset($this->cachedGroupsByMember[$uid])) {
+                $groups = array_merge($groups, $this->cachedGroupsByMember[$uid]);
+            } else {
+                $groupsByMember = array_values($this->getGroupsByMember($uid));
+                $groupsByMember = $this->access->nextcloudGroupNames($groupsByMember);
+                $this->cachedGroupsByMember[$uid] = $groupsByMember;
+                $groups = array_merge($groups, $groupsByMember);
+            }
+        }
+
+        if ($primaryGroup !== false) {
+            $groups[] = $primaryGroup;
+        }
+        if ($gidGroupName !== false) {
+            $groups[] = $gidGroupName;
+        }
+
+        $groups = array_unique($groups, SORT_LOCALE_STRING);
+        $this->access->connection->writeToCache($cacheKey, $groups);
+
+        return $groups;
+    }
+
+    /**
+     * @throws ServerNotAvailableException
+     */
+    private function getGroupsByMember(string $dn, array &$seen = null): array {
+        if ($seen === null) {
+            $seen = [];
+        }
+        if (array_key_exists($dn, $seen)) {
+            // avoid loops
+            return [];
+        }
+        $allGroups = [];
+        $seen[$dn] = true;
+        $filter = $this->access->connection->ldapGroupMemberAssocAttr . '=' . $dn;
+
+        if ($this->ldapGroupMemberAssocAttr === 'zimbramailforwardingaddress') {
+            //in this case the member entries are email addresses
+            $filter .= '@*';
+        }
+
+        $nesting = (int)$this->access->connection->ldapNestedGroups;
+        if ($nesting === 0) {
+            $filter = $this->access->combineFilterWithAnd([$filter, $this->access->connection->ldapGroupFilter]);
+        }
+
+        $groups = $this->access->fetchListOfGroups($filter,
+            [strtolower($this->access->connection->ldapGroupMemberAssocAttr), $this->access->connection->ldapGroupDisplayName, 'dn']);
+        $fetcher = function ($dn) use (&$seen) {
+            if (is_array($dn) && isset($dn['dn'][0])) {
+                $dn = $dn['dn'][0];
+            }
+            return $this->getGroupsByMember($dn, $seen);
+        };
+
+        if (empty($dn)) {
+            $dn = "";
+        }
+
+        $allGroups = $this->walkNestedGroups($dn, $fetcher, $groups, $seen);
+        $visibleGroups = $this->filterValidGroups($allGroups);
+        return array_intersect_key($allGroups, $visibleGroups);
+    }
+
+    /**
+     * get a list of all users in a group
+     *
+     * @param string $gid
+     * @param string $search
+     * @param int $limit
+     * @param int $offset
+     * @return array with user ids
+     * @throws Exception
+     * @throws ServerNotAvailableException
+     */
+    public function usersInGroup($gid, $search = '', $limit = -1, $offset = 0) {
+        if (!$this->enabled) {
+            return [];
+        }
+        if (!$this->groupExists($gid)) {
+            return [];
+        }
+        $search = $this->access->escapeFilterPart($search, true);
+        $cacheKey = 'usersInGroup-' . $gid . '-' . $search . '-' . $limit . '-' . $offset;
+        // check for cache of the exact query
+        $groupUsers = $this->access->connection->getFromCache($cacheKey);
+        if (!is_null($groupUsers)) {
+            return $groupUsers;
+        }
+
+        if ($limit === -1) {
+            $limit = null;
+        }
+        // check for cache of the query without limit and offset
+        $groupUsers = $this->access->connection->getFromCache('usersInGroup-' . $gid . '-' . $search);
+        if (!is_null($groupUsers)) {
+            $groupUsers = array_slice($groupUsers, $offset, $limit);
+            $this->access->connection->writeToCache($cacheKey, $groupUsers);
+            return $groupUsers;
+        }
+
+        $groupDN = $this->access->groupname2dn($gid);
+        if (!$groupDN) {
+            // group couldn't be found, return empty resultset
+            $this->access->connection->writeToCache($cacheKey, []);
+            return [];
+        }
+
+        $primaryUsers = $this->getUsersInPrimaryGroup($groupDN, $search, $limit, $offset);
+        $posixGroupUsers = $this->getUsersInGidNumber($groupDN, $search, $limit, $offset);
+        $members = $this->_groupMembers($groupDN);
+        if (!$members && empty($posixGroupUsers) && empty($primaryUsers)) {
+            //in case users could not be retrieved, return empty result set
+            $this->access->connection->writeToCache($cacheKey, []);
+            return [];
+        }
+
+        $groupUsers = [];
+        $attrs = $this->access->userManager->getAttributes(true);
+        foreach ($members as $member) {
+            switch ($this->ldapGroupMemberAssocAttr) {
+                /** @noinspection PhpMissingBreakStatementInspection */
+                case 'zimbramailforwardingaddress':
+                    //we get email addresses and need to convert them to uids
+                    $parts = explode('@', $member);
+                    $member = $parts[0];
+                    //no break needed because we just needed to remove the email part and now we have uids
+                case 'memberuid':
+                    //we got uids, need to get their DNs to 'translate' them to user names
+                    $filter = $this->access->combineFilterWithAnd([
+                        str_replace('%uid', trim($member), $this->access->connection->ldapLoginFilter),
+                        $this->access->combineFilterWithAnd([
+                            $this->access->getFilterPartForUserSearch($search),
+                            $this->access->connection->ldapUserFilter
+                        ])
+                    ]);
+                    $ldap_users = $this->access->fetchListOfUsers($filter, $attrs, 1);
+                    if (empty($ldap_users)) {
+                        break;
+                    }
+                    $groupUsers[] = $this->access->dn2username($ldap_users[0]['dn'][0]);
+                    break;
+                default:
+                    //we got DNs, check if we need to filter by search or we can give back all of them
+                    $uid = $this->access->dn2username($member);
+                    if (!$uid) {
+                        break;
+                    }
+
+                    $cacheKey = 'userExistsOnLDAP' . $uid;
+                    $userExists = $this->access->connection->getFromCache($cacheKey);
+                    if ($userExists === false) {
+                        break;
+                    }
+                    if ($userExists === null || $search !== '') {
+                        if (!$this->access->readAttribute($member,
+                            $this->access->connection->ldapUserDisplayName,
+                            $this->access->combineFilterWithAnd([
+                                $this->access->getFilterPartForUserSearch($search),
+                                $this->access->connection->ldapUserFilter
+                            ]))) {
+                            if ($search === '') {
+                                $this->access->connection->writeToCache($cacheKey, false);
+                            }
+                            break;
+                        }
+                        $this->access->connection->writeToCache($cacheKey, true);
+                    }
+                    $groupUsers[] = $uid;
+                    break;
+            }
+        }
+
+        $groupUsers = array_unique(array_merge($groupUsers, $primaryUsers, $posixGroupUsers));
+        natsort($groupUsers);
+        $this->access->connection->writeToCache('usersInGroup-' . $gid . '-' . $search, $groupUsers);
+        $groupUsers = array_slice($groupUsers, $offset, $limit);
+
+        $this->access->connection->writeToCache($cacheKey, $groupUsers);
+
+        return $groupUsers;
+    }
+
+    /**
+     * returns the number of users in a group, who match the search term
+     *
+     * @param string $gid the internal group name
+     * @param string $search optional, a search string
+     * @return int|bool
+     * @throws Exception
+     * @throws ServerNotAvailableException
+     */
+    public function countUsersInGroup($gid, $search = '') {
+        if ($this->groupPluginManager->implementsActions(GroupInterface::COUNT_USERS)) {
+            return $this->groupPluginManager->countUsersInGroup($gid, $search);
+        }
+
+        $cacheKey = 'countUsersInGroup-' . $gid . '-' . $search;
+        if (!$this->enabled || !$this->groupExists($gid)) {
+            return false;
+        }
+        $groupUsers = $this->access->connection->getFromCache($cacheKey);
+        if (!is_null($groupUsers)) {
+            return $groupUsers;
+        }
+
+        $groupDN = $this->access->groupname2dn($gid);
+        if (!$groupDN) {
+            // group couldn't be found, return empty result set
+            $this->access->connection->writeToCache($cacheKey, false);
+            return false;
+        }
+
+        $members = $this->_groupMembers($groupDN);
+        $primaryUserCount = $this->countUsersInPrimaryGroup($groupDN, '');
+        if (!$members && $primaryUserCount === 0) {
+            //in case users could not be retrieved, return empty result set
+            $this->access->connection->writeToCache($cacheKey, false);
+            return false;
+        }
+
+        if ($search === '') {
+            $groupUsers = count($members) + $primaryUserCount;
+            $this->access->connection->writeToCache($cacheKey, $groupUsers);
+            return $groupUsers;
+        }
+        $search = $this->access->escapeFilterPart($search, true);
+        $isMemberUid =
+            ($this->ldapGroupMemberAssocAttr === 'memberuid' ||
+                $this->ldapGroupMemberAssocAttr === 'zimbramailforwardingaddress');
+
+        //we need to apply the search filter
+        //alternatives that need to be checked:
+        //a) get all users by search filter and array_intersect them
+        //b) a, but only when less than 1k 10k ?k users like it is
+        //c) put all DNs|uids in a LDAP filter, combine with the search string
+        //   and let it count.
+        //For now this is not important, because the only use of this method
+        //does not supply a search string
+        $groupUsers = [];
+        foreach ($members as $member) {
+            if ($isMemberUid) {
+                if ($this->ldapGroupMemberAssocAttr === 'zimbramailforwardingaddress') {
+                    //we get email addresses and need to convert them to uids
+                    $parts = explode('@', $member);
+                    $member = $parts[0];
+                }
+                //we got uids, need to get their DNs to 'translate' them to user names
+                $filter = $this->access->combineFilterWithAnd([
+                    str_replace('%uid', $member, $this->access->connection->ldapLoginFilter),
+                    $this->access->getFilterPartForUserSearch($search)
+                ]);
+                $ldap_users = $this->access->fetchListOfUsers($filter, ['dn'], 1);
+                if (count($ldap_users) < 1) {
+                    continue;
+                }
+                $groupUsers[] = $this->access->dn2username($ldap_users[0]);
+            } else {
+                //we need to apply the search filter now
+                if (!$this->access->readAttribute($member,
+                    $this->access->connection->ldapUserDisplayName,
+                    $this->access->getFilterPartForUserSearch($search))) {
+                    continue;
+                }
+                // dn2username will also check if the users belong to the allowed base
+                if ($ncGroupId = $this->access->dn2username($member)) {
+                    $groupUsers[] = $ncGroupId;
+                }
+            }
+        }
+
+        //and get users that have the group as primary
+        $primaryUsers = $this->countUsersInPrimaryGroup($groupDN, $search);
+
+        return count($groupUsers) + $primaryUsers;
+    }
+
+    /**
+     * get a list of all groups using a paged search
+     *
+     * @param string $search
+     * @param int $limit
+     * @param int $offset
+     * @return array with group names
+     *
+     * Returns a list with all groups
+     * Uses a paged search if available to override a
+     * server side search limit.
+     * (active directory has a limit of 1000 by default)
+     * @throws Exception
+     */
+    public function getGroups($search = '', $limit = -1, $offset = 0) {
+        if (!$this->enabled) {
+            return [];
+        }
+        $search = $this->access->escapeFilterPart($search, true);
+        $cacheKey = 'getGroups-' . $search . '-' . $limit . '-' . $offset;
+
+        //Check cache before driving unnecessary searches
+        $ldap_groups = $this->access->connection->getFromCache($cacheKey);
+        if (!is_null($ldap_groups)) {
+            return $ldap_groups;
+        }
+
+        // if we'd pass -1 to LDAP search, we'd end up in a Protocol
+        // error. With a limit of 0, we get 0 results. So we pass null.
+        if ($limit <= 0) {
+            $limit = null;
+        }
+        $filter = $this->access->combineFilterWithAnd([
+            $this->access->connection->ldapGroupFilter,
+            $this->access->getFilterPartForGroupSearch($search)
+        ]);
+        $ldap_groups = $this->access->fetchListOfGroups($filter,
+            [$this->access->connection->ldapGroupDisplayName, 'dn'],
+            $limit,
+            $offset);
+        $ldap_groups = $this->access->nextcloudGroupNames($ldap_groups);
+
+        $this->access->connection->writeToCache($cacheKey, $ldap_groups);
+        return $ldap_groups;
+    }
+
+    /**
+     * check if a group exists
+     *
+     * @param string $gid
+     * @return bool
+     * @throws ServerNotAvailableException
+     */
+    public function groupExists($gid) {
+        $groupExists = $this->access->connection->getFromCache('groupExists' . $gid);
+        if (!is_null($groupExists)) {
+            return (bool)$groupExists;
+        }
+
+        //getting dn, if false the group does not exist. If dn, it may be mapped
+        //only, requires more checking.
+        $dn = $this->access->groupname2dn($gid);
+        if (!$dn) {
+            $this->access->connection->writeToCache('groupExists' . $gid, false);
+            return false;
+        }
+
+        if (!$this->access->isDNPartOfBase($dn, $this->access->connection->ldapBaseGroups)) {
+            $this->access->connection->writeToCache('groupExists' . $gid, false);
+            return false;
+        }
+
+        //if group really still exists, we will be able to read its objectClass
+        if (!is_array($this->access->readAttribute($dn, '', $this->access->connection->ldapGroupFilter))) {
+            $this->access->connection->writeToCache('groupExists' . $gid, false);
+            return false;
+        }
+
+        $this->access->connection->writeToCache('groupExists' . $gid, true);
+        return true;
+    }
+
+    /**
+     * @throws ServerNotAvailableException
+     * @throws Exception
+     */
+    protected function filterValidGroups(array $listOfGroups): array {
+        $validGroupDNs = [];
+        foreach ($listOfGroups as $key => $item) {
+            $dn = is_string($item) ? $item : $item['dn'][0];
+            $gid = $this->access->dn2groupname($dn);
+            if (!$gid) {
+                continue;
+            }
+            if ($this->groupExists($gid)) {
+                $validGroupDNs[$key] = $item;
+            }
+        }
+        return $validGroupDNs;
+    }
+
+    /**
+     * Check if backend implements actions
+     *
+     * @param int $actions bitwise-or'ed actions
+     * @return boolean
+     *
+     * Returns the supported actions as int to be
+     * compared with GroupInterface::CREATE_GROUP etc.
+     */
+    public function implementsActions($actions) {
+        return (bool)((GroupInterface::COUNT_USERS |
+                GroupInterface::DELETE_GROUP |
+                $this->groupPluginManager->getImplementedActions()) & $actions);
+    }
+
+    /**
+     * Return access for LDAP interaction.
+     *
+     * @return Access instance of Access for LDAP interaction
+     */
+    public function getLDAPAccess($gid) {
+        return $this->access;
+    }
+
+    /**
+     * create a group
+     *
+     * @param string $gid
+     * @return bool
+     * @throws Exception
+     * @throws ServerNotAvailableException
+     */
+    public function createGroup($gid) {
+        if ($this->groupPluginManager->implementsActions(GroupInterface::CREATE_GROUP)) {
+            if ($dn = $this->groupPluginManager->createGroup($gid)) {
+                //updates group mapping
+                $uuid = $this->access->getUUID($dn, false);
+                if (is_string($uuid)) {
+                    $this->access->mapAndAnnounceIfApplicable(
+                        $this->access->getGroupMapper(),
+                        $dn,
+                        $gid,
+                        $uuid,
+                        false
+                    );
+                    $this->access->cacheGroupExists($gid);
+                }
+            }
+            return $dn != null;
+        }
+        throw new Exception('Could not create group in LDAP backend.');
+    }
+
+    /**
+     * delete a group
+     *
+     * @param string $gid gid of the group to delete
+     * @throws Exception
+     */
+    public function deleteGroup(string $gid): bool {
+        if ($this->groupPluginManager->canDeleteGroup()) {
+            if ($ret = $this->groupPluginManager->deleteGroup($gid)) {
+                // Delete group in nextcloud internal db
+                $this->access->getGroupMapper()->unmap($gid);
+                $this->access->connection->writeToCache("groupExists" . $gid, false);
+            }
+            return $ret;
+        }
+
+        // Getting dn, if false the group is not mapped
+        $dn = $this->access->groupname2dn($gid);
+        if (!$dn) {
+            throw new Exception('Could not delete unknown group '.$gid.' in LDAP backend.');
+        }
+
+        if (!$this->groupExists($gid)) {
+            // The group does not exist in the LDAP, remove the mapping
+            $this->access->getGroupMapper()->unmap($gid);
+            $this->access->connection->writeToCache("groupExists" . $gid, false);
+            return true;
+        }
+
+        throw new Exception('Could not delete existing group '.$gid.' in LDAP backend.');
+    }
+
+    /**
+     * Add a user to a group
+     *
+     * @param string $uid Name of the user to add to group
+     * @param string $gid Name of the group in which add the user
+     * @return bool
+     * @throws Exception
+     */
+    public function addToGroup($uid, $gid) {
+        if ($this->groupPluginManager->implementsActions(GroupInterface::ADD_TO_GROUP)) {
+            if ($ret = $this->groupPluginManager->addToGroup($uid, $gid)) {
+                $this->access->connection->clearCache();
+                unset($this->cachedGroupMembers[$gid]);
+            }
+            return $ret;
+        }
+        throw new Exception('Could not add user to group in LDAP backend.');
+    }
+
+    /**
+     * Removes a user from a group
+     *
+     * @param string $uid Name of the user to remove from group
+     * @param string $gid Name of the group from which remove the user
+     * @return bool
+     * @throws Exception
+     */
+    public function removeFromGroup($uid, $gid) {
+        if ($this->groupPluginManager->implementsActions(GroupInterface::REMOVE_FROM_GROUP)) {
+            if ($ret = $this->groupPluginManager->removeFromGroup($uid, $gid)) {
+                $this->access->connection->clearCache();
+                unset($this->cachedGroupMembers[$gid]);
+            }
+            return $ret;
+        }
+        throw new Exception('Could not remove user from group in LDAP backend.');
+    }
+
+    /**
+     * Gets group details
+     *
+     * @param string $gid Name of the group
+     * @return array|false
+     * @throws Exception
+     */
+    public function getGroupDetails($gid) {
+        if ($this->groupPluginManager->implementsActions(GroupInterface::GROUP_DETAILS)) {
+            return $this->groupPluginManager->getGroupDetails($gid);
+        }
+        throw new Exception('Could not get group details in LDAP backend.');
+    }
+
+    /**
+     * Return LDAP connection resource from a cloned connection.
+     * The cloned connection needs to be closed manually.
+     * of the current access.
+     *
+     * @param string $gid
+     * @return resource|\LDAP\Connection The LDAP connection
+     * @throws ServerNotAvailableException
+     */
+    public function getNewLDAPConnection($gid) {
+        $connection = clone $this->access->getConnection();
+        return $connection->getConnectionResource();
+    }
+
+    /**
+     * @throws ServerNotAvailableException
+     */
+    public function getDisplayName(string $gid): string {
+        if ($this->groupPluginManager instanceof IGetDisplayNameBackend) {
+            return $this->groupPluginManager->getDisplayName($gid);
+        }
+
+        $cacheKey = 'group_getDisplayName' . $gid;
+        if (!is_null($displayName = $this->access->connection->getFromCache($cacheKey))) {
+            return $displayName;
+        }
+
+        $displayName = $this->access->readAttribute(
+            $this->access->groupname2dn($gid),
+            $this->access->connection->ldapGroupDisplayName);
+
+        if (($displayName !== false) && (count($displayName) > 0)) {
+            $displayName = $displayName[0];
+            $this->access->connection->writeToCache($cacheKey, $displayName);
+            return $displayName;
+        }
+
+        return '';
+    }
 }

apps/user_ldap/lib/GroupPluginManager.php

Indentation +157 added lines, -157 removed lines

@@ -26,161 +26,161 @@
 use OCP\GroupInterface;
 
 class GroupPluginManager {
-	private int $respondToActions = 0;
-
-	/** @var array<int, ?ILDAPGroupPlugin> */
-	private array $which = [
-		GroupInterface::CREATE_GROUP => null,
-		GroupInterface::DELETE_GROUP => null,
-		GroupInterface::ADD_TO_GROUP => null,
-		GroupInterface::REMOVE_FROM_GROUP => null,
-		GroupInterface::COUNT_USERS => null,
-		GroupInterface::GROUP_DETAILS => null
-	];
-
-	private bool $suppressDeletion = false;
-
-	/**
-	 * @return int All implemented actions
-	 */
-	public function getImplementedActions() {
-		return $this->respondToActions;
-	}
-
-	/**
-	 * Registers a group plugin that may implement some actions, overriding User_LDAP's group actions.
-	 * @param ILDAPGroupPlugin $plugin
-	 */
-	public function register(ILDAPGroupPlugin $plugin) {
-		$respondToActions = $plugin->respondToActions();
-		$this->respondToActions |= $respondToActions;
-
-		foreach ($this->which as $action => $v) {
-			if ((bool)($respondToActions & $action)) {
-				$this->which[$action] = $plugin;
-				\OC::$server->getLogger()->debug("Registered action ".$action." to plugin ".get_class($plugin), ['app' => 'user_ldap']);
-			}
-		}
-	}
-
-	/**
-	 * Signal if there is a registered plugin that implements some given actions
-	 * @param int $actions Actions defined in \OCP\GroupInterface, like GroupInterface::REMOVE_FROM_GROUP
-	 * @return bool
-	 */
-	public function implementsActions($actions) {
-		return ($actions & $this->respondToActions) == $actions;
-	}
-
-	/**
-	 * Create a group
-	 * @param string $gid Group Id
-	 * @return string | null The group DN if group creation was successful.
-	 * @throws \Exception
-	 */
-	public function createGroup($gid) {
-		$plugin = $this->which[GroupInterface::CREATE_GROUP];
-
-		if ($plugin) {
-			return $plugin->createGroup($gid);
-		}
-		throw new \Exception('No plugin implements createGroup in this LDAP Backend.');
-	}
-
-	public function canDeleteGroup(): bool {
-		return !$this->suppressDeletion && $this->implementsActions(GroupInterface::DELETE_GROUP);
-	}
-
-	/**
-	 * @return bool – the value before the change
-	 */
-	public function setSuppressDeletion(bool $value): bool {
-		$old = $this->suppressDeletion;
-		$this->suppressDeletion = $value;
-		return $old;
-	}
-
-	/**
-	 * Delete a group
-	 *
-	 * @throws \Exception
-	 */
-	public function deleteGroup(string $gid): bool {
-		$plugin = $this->which[GroupInterface::DELETE_GROUP];
-
-		if ($plugin) {
-			if ($this->suppressDeletion) {
-				return false;
-			}
-			return $plugin->deleteGroup($gid);
-		}
-		throw new \Exception('No plugin implements deleteGroup in this LDAP Backend.');
-	}
-
-	/**
-	 * Add a user to a group
-	 * @param string $uid ID of the user to add to group
-	 * @param string $gid ID of the group in which add the user
-	 * @return bool
-	 * @throws \Exception
-	 *
-	 * Adds a user to a group.
-	 */
-	public function addToGroup($uid, $gid) {
-		$plugin = $this->which[GroupInterface::ADD_TO_GROUP];
-
-		if ($plugin) {
-			return $plugin->addToGroup($uid, $gid);
-		}
-		throw new \Exception('No plugin implements addToGroup in this LDAP Backend.');
-	}
-
-	/**
-	 * Removes a user from a group
-	 * @param string $uid ID of the user to remove from group
-	 * @param string $gid ID of the group from which remove the user
-	 * @return bool
-	 * @throws \Exception
-	 *
-	 * removes the user from a group.
-	 */
-	public function removeFromGroup($uid, $gid) {
-		$plugin = $this->which[GroupInterface::REMOVE_FROM_GROUP];
-
-		if ($plugin) {
-			return $plugin->removeFromGroup($uid, $gid);
-		}
-		throw new \Exception('No plugin implements removeFromGroup in this LDAP Backend.');
-	}
-
-	/**
-	 * get the number of all users matching the search string in a group
-	 * @param string $gid ID of the group
-	 * @param string $search query string
-	 * @return int|false
-	 * @throws \Exception
-	 */
-	public function countUsersInGroup($gid, $search = '') {
-		$plugin = $this->which[GroupInterface::COUNT_USERS];
-
-		if ($plugin) {
-			return $plugin->countUsersInGroup($gid,$search);
-		}
-		throw new \Exception('No plugin implements countUsersInGroup in this LDAP Backend.');
-	}
-
-	/**
-	 * get an array with group details
-	 * @param string $gid
-	 * @return array|false
-	 * @throws \Exception
-	 */
-	public function getGroupDetails($gid) {
-		$plugin = $this->which[GroupInterface::GROUP_DETAILS];
-
-		if ($plugin) {
-			return $plugin->getGroupDetails($gid);
-		}
-		throw new \Exception('No plugin implements getGroupDetails in this LDAP Backend.');
-	}
+    private int $respondToActions = 0;
+
+    /** @var array<int, ?ILDAPGroupPlugin> */
+    private array $which = [
+        GroupInterface::CREATE_GROUP => null,
+        GroupInterface::DELETE_GROUP => null,
+        GroupInterface::ADD_TO_GROUP => null,
+        GroupInterface::REMOVE_FROM_GROUP => null,
+        GroupInterface::COUNT_USERS => null,
+        GroupInterface::GROUP_DETAILS => null
+    ];
+
+    private bool $suppressDeletion = false;
+
+    /**
+     * @return int All implemented actions
+     */
+    public function getImplementedActions() {
+        return $this->respondToActions;
+    }
+
+    /**
+     * Registers a group plugin that may implement some actions, overriding User_LDAP's group actions.
+     * @param ILDAPGroupPlugin $plugin
+     */
+    public function register(ILDAPGroupPlugin $plugin) {
+        $respondToActions = $plugin->respondToActions();
+        $this->respondToActions |= $respondToActions;
+
+        foreach ($this->which as $action => $v) {
+            if ((bool)($respondToActions & $action)) {
+                $this->which[$action] = $plugin;
+                \OC::$server->getLogger()->debug("Registered action ".$action." to plugin ".get_class($plugin), ['app' => 'user_ldap']);
+            }
+        }
+    }
+
+    /**
+     * Signal if there is a registered plugin that implements some given actions
+     * @param int $actions Actions defined in \OCP\GroupInterface, like GroupInterface::REMOVE_FROM_GROUP
+     * @return bool
+     */
+    public function implementsActions($actions) {
+        return ($actions & $this->respondToActions) == $actions;
+    }
+
+    /**
+     * Create a group
+     * @param string $gid Group Id
+     * @return string | null The group DN if group creation was successful.
+     * @throws \Exception
+     */
+    public function createGroup($gid) {
+        $plugin = $this->which[GroupInterface::CREATE_GROUP];
+
+        if ($plugin) {
+            return $plugin->createGroup($gid);
+        }
+        throw new \Exception('No plugin implements createGroup in this LDAP Backend.');
+    }
+
+    public function canDeleteGroup(): bool {
+        return !$this->suppressDeletion && $this->implementsActions(GroupInterface::DELETE_GROUP);
+    }
+
+    /**
+     * @return bool – the value before the change
+     */
+    public function setSuppressDeletion(bool $value): bool {
+        $old = $this->suppressDeletion;
+        $this->suppressDeletion = $value;
+        return $old;
+    }
+
+    /**
+     * Delete a group
+     *
+     * @throws \Exception
+     */
+    public function deleteGroup(string $gid): bool {
+        $plugin = $this->which[GroupInterface::DELETE_GROUP];
+
+        if ($plugin) {
+            if ($this->suppressDeletion) {
+                return false;
+            }
+            return $plugin->deleteGroup($gid);
+        }
+        throw new \Exception('No plugin implements deleteGroup in this LDAP Backend.');
+    }
+
+    /**
+     * Add a user to a group
+     * @param string $uid ID of the user to add to group
+     * @param string $gid ID of the group in which add the user
+     * @return bool
+     * @throws \Exception
+     *
+     * Adds a user to a group.
+     */
+    public function addToGroup($uid, $gid) {
+        $plugin = $this->which[GroupInterface::ADD_TO_GROUP];
+
+        if ($plugin) {
+            return $plugin->addToGroup($uid, $gid);
+        }
+        throw new \Exception('No plugin implements addToGroup in this LDAP Backend.');
+    }
+
+    /**
+     * Removes a user from a group
+     * @param string $uid ID of the user to remove from group
+     * @param string $gid ID of the group from which remove the user
+     * @return bool
+     * @throws \Exception
+     *
+     * removes the user from a group.
+     */
+    public function removeFromGroup($uid, $gid) {
+        $plugin = $this->which[GroupInterface::REMOVE_FROM_GROUP];
+
+        if ($plugin) {
+            return $plugin->removeFromGroup($uid, $gid);
+        }
+        throw new \Exception('No plugin implements removeFromGroup in this LDAP Backend.');
+    }
+
+    /**
+     * get the number of all users matching the search string in a group
+     * @param string $gid ID of the group
+     * @param string $search query string
+     * @return int|false
+     * @throws \Exception
+     */
+    public function countUsersInGroup($gid, $search = '') {
+        $plugin = $this->which[GroupInterface::COUNT_USERS];
+
+        if ($plugin) {
+            return $plugin->countUsersInGroup($gid,$search);
+        }
+        throw new \Exception('No plugin implements countUsersInGroup in this LDAP Backend.');
+    }
+
+    /**
+     * get an array with group details
+     * @param string $gid
+     * @return array|false
+     * @throws \Exception
+     */
+    public function getGroupDetails($gid) {
+        $plugin = $this->which[GroupInterface::GROUP_DETAILS];
+
+        if ($plugin) {
+            return $plugin->getGroupDetails($gid);
+        }
+        throw new \Exception('No plugin implements getGroupDetails in this LDAP Backend.');
+    }
 }

apps/user_ldap/lib/Group_Proxy.php

Indentation +247 added lines, -247 removed lines

@@ -33,277 +33,277 @@
 use OCP\Group\Backend\INamedBackend;
 
 class Group_Proxy extends Proxy implements \OCP\GroupInterface, IGroupLDAP, IGetDisplayNameBackend, INamedBackend, IDeleteGroupBackend {
-	private $backends = [];
-	private $refBackend = null;
+    private $backends = [];
+    private $refBackend = null;
 
-	public function __construct(Helper $helper, ILDAPWrapper $ldap, GroupPluginManager $groupPluginManager) {
-		parent::__construct($ldap);
-		$serverConfigPrefixes = $helper->getServerConfigurationPrefixes(true);
-		foreach ($serverConfigPrefixes as $configPrefix) {
-			$this->backends[$configPrefix] =
-				new \OCA\User_LDAP\Group_LDAP($this->getAccess($configPrefix), $groupPluginManager);
-			if (is_null($this->refBackend)) {
-				$this->refBackend = &$this->backends[$configPrefix];
-			}
-		}
-	}
+    public function __construct(Helper $helper, ILDAPWrapper $ldap, GroupPluginManager $groupPluginManager) {
+        parent::__construct($ldap);
+        $serverConfigPrefixes = $helper->getServerConfigurationPrefixes(true);
+        foreach ($serverConfigPrefixes as $configPrefix) {
+            $this->backends[$configPrefix] =
+                new \OCA\User_LDAP\Group_LDAP($this->getAccess($configPrefix), $groupPluginManager);
+            if (is_null($this->refBackend)) {
+                $this->refBackend = &$this->backends[$configPrefix];
+            }
+        }
+    }
 
-	/**
-	 * Tries the backends one after the other until a positive result is returned from the specified method
-	 *
-	 * @param string $id the gid connected to the request
-	 * @param string $method the method of the group backend that shall be called
-	 * @param array $parameters an array of parameters to be passed
-	 * @return mixed the result of the method or false
-	 */
-	protected function walkBackends($id, $method, $parameters) {
-		$gid = $id;
-		$cacheKey = $this->getGroupCacheKey($gid);
-		foreach ($this->backends as $configPrefix => $backend) {
-			if ($result = call_user_func_array([$backend, $method], $parameters)) {
-				if (!$this->isSingleBackend()) {
-					$this->writeToCache($cacheKey, $configPrefix);
-				}
-				return $result;
-			}
-		}
-		return false;
-	}
+    /**
+     * Tries the backends one after the other until a positive result is returned from the specified method
+     *
+     * @param string $id the gid connected to the request
+     * @param string $method the method of the group backend that shall be called
+     * @param array $parameters an array of parameters to be passed
+     * @return mixed the result of the method or false
+     */
+    protected function walkBackends($id, $method, $parameters) {
+        $gid = $id;
+        $cacheKey = $this->getGroupCacheKey($gid);
+        foreach ($this->backends as $configPrefix => $backend) {
+            if ($result = call_user_func_array([$backend, $method], $parameters)) {
+                if (!$this->isSingleBackend()) {
+                    $this->writeToCache($cacheKey, $configPrefix);
+                }
+                return $result;
+            }
+        }
+        return false;
+    }
 
-	/**
-	 * Asks the backend connected to the server that supposely takes care of the gid from the request.
-	 *
-	 * @param string $id the gid connected to the request
-	 * @param string $method the method of the group backend that shall be called
-	 * @param array $parameters an array of parameters to be passed
-	 * @param mixed $passOnWhen the result matches this variable
-	 * @return mixed the result of the method or false
-	 */
-	protected function callOnLastSeenOn($id, $method, $parameters, $passOnWhen) {
-		$gid = $id;
-		$cacheKey = $this->getGroupCacheKey($gid);
-		$prefix = $this->getFromCache($cacheKey);
-		//in case the uid has been found in the past, try this stored connection first
-		if (!is_null($prefix)) {
-			if (isset($this->backends[$prefix])) {
-				$result = call_user_func_array([$this->backends[$prefix], $method], $parameters);
-				if ($result === $passOnWhen) {
-					//not found here, reset cache to null if group vanished
-					//because sometimes methods return false with a reason
-					$groupExists = call_user_func_array(
-						[$this->backends[$prefix], 'groupExists'],
-						[$gid]
-					);
-					if (!$groupExists) {
-						$this->writeToCache($cacheKey, null);
-					}
-				}
-				return $result;
-			}
-		}
-		return false;
-	}
+    /**
+     * Asks the backend connected to the server that supposely takes care of the gid from the request.
+     *
+     * @param string $id the gid connected to the request
+     * @param string $method the method of the group backend that shall be called
+     * @param array $parameters an array of parameters to be passed
+     * @param mixed $passOnWhen the result matches this variable
+     * @return mixed the result of the method or false
+     */
+    protected function callOnLastSeenOn($id, $method, $parameters, $passOnWhen) {
+        $gid = $id;
+        $cacheKey = $this->getGroupCacheKey($gid);
+        $prefix = $this->getFromCache($cacheKey);
+        //in case the uid has been found in the past, try this stored connection first
+        if (!is_null($prefix)) {
+            if (isset($this->backends[$prefix])) {
+                $result = call_user_func_array([$this->backends[$prefix], $method], $parameters);
+                if ($result === $passOnWhen) {
+                    //not found here, reset cache to null if group vanished
+                    //because sometimes methods return false with a reason
+                    $groupExists = call_user_func_array(
+                        [$this->backends[$prefix], 'groupExists'],
+                        [$gid]
+                    );
+                    if (!$groupExists) {
+                        $this->writeToCache($cacheKey, null);
+                    }
+                }
+                return $result;
+            }
+        }
+        return false;
+    }
 
-	protected function activeBackends(): int {
-		return count($this->backends);
-	}
+    protected function activeBackends(): int {
+        return count($this->backends);
+    }
 
-	/**
-	 * is user in group?
-	 *
-	 * @param string $uid uid of the user
-	 * @param string $gid gid of the group
-	 * @return bool
-	 *
-	 * Checks whether the user is member of a group or not.
-	 */
-	public function inGroup($uid, $gid) {
-		return $this->handleRequest($gid, 'inGroup', [$uid, $gid]);
-	}
+    /**
+     * is user in group?
+     *
+     * @param string $uid uid of the user
+     * @param string $gid gid of the group
+     * @return bool
+     *
+     * Checks whether the user is member of a group or not.
+     */
+    public function inGroup($uid, $gid) {
+        return $this->handleRequest($gid, 'inGroup', [$uid, $gid]);
+    }
 
-	/**
-	 * Get all groups a user belongs to
-	 *
-	 * @param string $uid Name of the user
-	 * @return string[] with group names
-	 *
-	 * This function fetches all groups a user belongs to. It does not check
-	 * if the user exists at all.
-	 */
-	public function getUserGroups($uid) {
-		$groups = [];
+    /**
+     * Get all groups a user belongs to
+     *
+     * @param string $uid Name of the user
+     * @return string[] with group names
+     *
+     * This function fetches all groups a user belongs to. It does not check
+     * if the user exists at all.
+     */
+    public function getUserGroups($uid) {
+        $groups = [];
 
-		foreach ($this->backends as $backend) {
-			$backendGroups = $backend->getUserGroups($uid);
-			if (is_array($backendGroups)) {
-				$groups = array_merge($groups, $backendGroups);
-			}
-		}
+        foreach ($this->backends as $backend) {
+            $backendGroups = $backend->getUserGroups($uid);
+            if (is_array($backendGroups)) {
+                $groups = array_merge($groups, $backendGroups);
+            }
+        }
 
-		return $groups;
-	}
+        return $groups;
+    }
 
-	/**
-	 * get a list of all users in a group
-	 *
-	 * @return string[] with user ids
-	 */
-	public function usersInGroup($gid, $search = '', $limit = -1, $offset = 0) {
-		$users = [];
+    /**
+     * get a list of all users in a group
+     *
+     * @return string[] with user ids
+     */
+    public function usersInGroup($gid, $search = '', $limit = -1, $offset = 0) {
+        $users = [];
 
-		foreach ($this->backends as $backend) {
-			$backendUsers = $backend->usersInGroup($gid, $search, $limit, $offset);
-			if (is_array($backendUsers)) {
-				$users = array_merge($users, $backendUsers);
-			}
-		}
+        foreach ($this->backends as $backend) {
+            $backendUsers = $backend->usersInGroup($gid, $search, $limit, $offset);
+            if (is_array($backendUsers)) {
+                $users = array_merge($users, $backendUsers);
+            }
+        }
 
-		return $users;
-	}
+        return $users;
+    }
 
-	/**
-	 * @param string $gid
-	 * @return bool
-	 */
-	public function createGroup($gid) {
-		return $this->handleRequest(
-			$gid, 'createGroup', [$gid]);
-	}
+    /**
+     * @param string $gid
+     * @return bool
+     */
+    public function createGroup($gid) {
+        return $this->handleRequest(
+            $gid, 'createGroup', [$gid]);
+    }
 
-	/**
-	 * delete a group
-	 */
-	public function deleteGroup(string $gid): bool {
-		return $this->handleRequest(
-			$gid, 'deleteGroup', [$gid]);
-	}
+    /**
+     * delete a group
+     */
+    public function deleteGroup(string $gid): bool {
+        return $this->handleRequest(
+            $gid, 'deleteGroup', [$gid]);
+    }
 
-	/**
-	 * Add a user to a group
-	 *
-	 * @param string $uid Name of the user to add to group
-	 * @param string $gid Name of the group in which add the user
-	 * @return bool
-	 *
-	 * Adds a user to a group.
-	 */
-	public function addToGroup($uid, $gid) {
-		return $this->handleRequest(
-			$gid, 'addToGroup', [$uid, $gid]);
-	}
+    /**
+     * Add a user to a group
+     *
+     * @param string $uid Name of the user to add to group
+     * @param string $gid Name of the group in which add the user
+     * @return bool
+     *
+     * Adds a user to a group.
+     */
+    public function addToGroup($uid, $gid) {
+        return $this->handleRequest(
+            $gid, 'addToGroup', [$uid, $gid]);
+    }
 
-	/**
-	 * Removes a user from a group
-	 *
-	 * @param string $uid Name of the user to remove from group
-	 * @param string $gid Name of the group from which remove the user
-	 * @return bool
-	 *
-	 * removes the user from a group.
-	 */
-	public function removeFromGroup($uid, $gid) {
-		return $this->handleRequest(
-			$gid, 'removeFromGroup', [$uid, $gid]);
-	}
+    /**
+     * Removes a user from a group
+     *
+     * @param string $uid Name of the user to remove from group
+     * @param string $gid Name of the group from which remove the user
+     * @return bool
+     *
+     * removes the user from a group.
+     */
+    public function removeFromGroup($uid, $gid) {
+        return $this->handleRequest(
+            $gid, 'removeFromGroup', [$uid, $gid]);
+    }
 
-	/**
-	 * returns the number of users in a group, who match the search term
-	 *
-	 * @param string $gid the internal group name
-	 * @param string $search optional, a search string
-	 * @return int|bool
-	 */
-	public function countUsersInGroup($gid, $search = '') {
-		return $this->handleRequest(
-			$gid, 'countUsersInGroup', [$gid, $search]);
-	}
+    /**
+     * returns the number of users in a group, who match the search term
+     *
+     * @param string $gid the internal group name
+     * @param string $search optional, a search string
+     * @return int|bool
+     */
+    public function countUsersInGroup($gid, $search = '') {
+        return $this->handleRequest(
+            $gid, 'countUsersInGroup', [$gid, $search]);
+    }
 
-	/**
-	 * get an array with group details
-	 *
-	 * @param string $gid
-	 * @return array|false
-	 */
-	public function getGroupDetails($gid) {
-		return $this->handleRequest(
-			$gid, 'getGroupDetails', [$gid]);
-	}
+    /**
+     * get an array with group details
+     *
+     * @param string $gid
+     * @return array|false
+     */
+    public function getGroupDetails($gid) {
+        return $this->handleRequest(
+            $gid, 'getGroupDetails', [$gid]);
+    }
 
-	/**
-	 * get a list of all groups
-	 *
-	 * @return string[] with group names
-	 *
-	 * Returns a list with all groups
-	 */
-	public function getGroups($search = '', $limit = -1, $offset = 0) {
-		$groups = [];
+    /**
+     * get a list of all groups
+     *
+     * @return string[] with group names
+     *
+     * Returns a list with all groups
+     */
+    public function getGroups($search = '', $limit = -1, $offset = 0) {
+        $groups = [];
 
-		foreach ($this->backends as $backend) {
-			$backendGroups = $backend->getGroups($search, $limit, $offset);
-			if (is_array($backendGroups)) {
-				$groups = array_merge($groups, $backendGroups);
-			}
-		}
+        foreach ($this->backends as $backend) {
+            $backendGroups = $backend->getGroups($search, $limit, $offset);
+            if (is_array($backendGroups)) {
+                $groups = array_merge($groups, $backendGroups);
+            }
+        }
 
-		return $groups;
-	}
+        return $groups;
+    }
 
-	/**
-	 * check if a group exists
-	 *
-	 * @param string $gid
-	 * @return bool
-	 */
-	public function groupExists($gid) {
-		return $this->handleRequest($gid, 'groupExists', [$gid]);
-	}
+    /**
+     * check if a group exists
+     *
+     * @param string $gid
+     * @return bool
+     */
+    public function groupExists($gid) {
+        return $this->handleRequest($gid, 'groupExists', [$gid]);
+    }
 
-	/**
-	 * Check if backend implements actions
-	 *
-	 * @param int $actions bitwise-or'ed actions
-	 * @return boolean
-	 *
-	 * Returns the supported actions as int to be
-	 * compared with \OCP\GroupInterface::CREATE_GROUP etc.
-	 */
-	public function implementsActions($actions) {
-		//it's the same across all our user backends obviously
-		return $this->refBackend->implementsActions($actions);
-	}
+    /**
+     * Check if backend implements actions
+     *
+     * @param int $actions bitwise-or'ed actions
+     * @return boolean
+     *
+     * Returns the supported actions as int to be
+     * compared with \OCP\GroupInterface::CREATE_GROUP etc.
+     */
+    public function implementsActions($actions) {
+        //it's the same across all our user backends obviously
+        return $this->refBackend->implementsActions($actions);
+    }
 
-	/**
-	 * Return access for LDAP interaction.
-	 *
-	 * @param string $gid
-	 * @return Access instance of Access for LDAP interaction
-	 */
-	public function getLDAPAccess($gid) {
-		return $this->handleRequest($gid, 'getLDAPAccess', [$gid]);
-	}
+    /**
+     * Return access for LDAP interaction.
+     *
+     * @param string $gid
+     * @return Access instance of Access for LDAP interaction
+     */
+    public function getLDAPAccess($gid) {
+        return $this->handleRequest($gid, 'getLDAPAccess', [$gid]);
+    }
 
-	/**
-	 * Return a new LDAP connection for the specified group.
-	 * The connection needs to be closed manually.
-	 *
-	 * @param string $gid
-	 * @return resource|\LDAP\Connection The LDAP connection
-	 */
-	public function getNewLDAPConnection($gid) {
-		return $this->handleRequest($gid, 'getNewLDAPConnection', [$gid]);
-	}
+    /**
+     * Return a new LDAP connection for the specified group.
+     * The connection needs to be closed manually.
+     *
+     * @param string $gid
+     * @return resource|\LDAP\Connection The LDAP connection
+     */
+    public function getNewLDAPConnection($gid) {
+        return $this->handleRequest($gid, 'getNewLDAPConnection', [$gid]);
+    }
 
-	public function getDisplayName(string $gid): string {
-		return $this->handleRequest($gid, 'getDisplayName', [$gid]);
-	}
+    public function getDisplayName(string $gid): string {
+        return $this->handleRequest($gid, 'getDisplayName', [$gid]);
+    }
 
-	/**
-	 * Backend name to be shown in group management
-	 * @return string the name of the backend to be shown
-	 * @since 22.0.0
-	 */
-	public function getBackendName(): string {
-		return 'LDAP';
-	}
+    /**
+     * Backend name to be shown in group management
+     * @return string the name of the backend to be shown
+     * @since 22.0.0
+     */
+    public function getBackendName(): string {
+        return 'LDAP';
+    }
 }

apps/user_ldap/lib/UserPluginManager.php

Indentation +192 added lines, -192 removed lines

@@ -28,196 +28,196 @@
 use OC\User\Backend;
 
 class UserPluginManager {
-	private int $respondToActions = 0;
-
-	private array $which = [
-		Backend::CREATE_USER => null,
-		Backend::SET_PASSWORD => null,
-		Backend::GET_HOME => null,
-		Backend::GET_DISPLAYNAME => null,
-		Backend::SET_DISPLAYNAME => null,
-		Backend::PROVIDE_AVATAR => null,
-		Backend::COUNT_USERS => null,
-		'deleteUser' => null
-	];
-
-	private bool $suppressDeletion = false;
-
-	/**
-	 * @return int All implemented actions, except for 'deleteUser'
-	 */
-	public function getImplementedActions() {
-		return $this->respondToActions;
-	}
-
-	/**
-	 * Registers a user plugin that may implement some actions, overriding User_LDAP's user actions.
-	 *
-	 * @param ILDAPUserPlugin $plugin
-	 */
-	public function register(ILDAPUserPlugin $plugin) {
-		$respondToActions = $plugin->respondToActions();
-		$this->respondToActions |= $respondToActions;
-
-		foreach ($this->which as $action => $v) {
-			if (is_int($action) && (bool)($respondToActions & $action)) {
-				$this->which[$action] = $plugin;
-				\OC::$server->getLogger()->debug("Registered action ".$action." to plugin ".get_class($plugin), ['app' => 'user_ldap']);
-			}
-		}
-		if (method_exists($plugin,'deleteUser')) {
-			$this->which['deleteUser'] = $plugin;
-			\OC::$server->getLogger()->debug("Registered action deleteUser to plugin ".get_class($plugin), ['app' => 'user_ldap']);
-		}
-	}
-
-	/**
-	 * Signal if there is a registered plugin that implements some given actions
-	 * @param int $actions Actions defined in \OC\User\Backend, like Backend::CREATE_USER
-	 * @return bool
-	 */
-	public function implementsActions($actions) {
-		return ($actions & $this->respondToActions) == $actions;
-	}
-
-	/**
-	 * Create a new user in LDAP Backend
-	 *
-	 * @param string $username The username of the user to create
-	 * @param string $password The password of the new user
-	 * @return string | false The user DN if user creation was successful.
-	 * @throws \Exception
-	 */
-	public function createUser($username, $password) {
-		$plugin = $this->which[Backend::CREATE_USER];
-
-		if ($plugin) {
-			return $plugin->createUser($username,$password);
-		}
-		throw new \Exception('No plugin implements createUser in this LDAP Backend.');
-	}
-
-	/**
-	 * Change the password of a user*
-	 * @param string $uid The username
-	 * @param string $password The new password
-	 * @return bool
-	 * @throws \Exception
-	 */
-	public function setPassword($uid, $password) {
-		$plugin = $this->which[Backend::SET_PASSWORD];
-
-		if ($plugin) {
-			return $plugin->setPassword($uid,$password);
-		}
-		throw new \Exception('No plugin implements setPassword in this LDAP Backend.');
-	}
-
-	/**
-	 * checks whether the user is allowed to change his avatar in Nextcloud
-	 * @param string $uid the Nextcloud user name
-	 * @return boolean either the user can or cannot
-	 * @throws \Exception
-	 */
-	public function canChangeAvatar($uid) {
-		$plugin = $this->which[Backend::PROVIDE_AVATAR];
-
-		if ($plugin) {
-			return $plugin->canChangeAvatar($uid);
-		}
-		throw new \Exception('No plugin implements canChangeAvatar in this LDAP Backend.');
-	}
-
-	/**
-	 * Get the user's home directory
-	 * @param string $uid the username
-	 * @return boolean
-	 * @throws \Exception
-	 */
-	public function getHome($uid) {
-		$plugin = $this->which[Backend::GET_HOME];
-
-		if ($plugin) {
-			return $plugin->getHome($uid);
-		}
-		throw new \Exception('No plugin implements getHome in this LDAP Backend.');
-	}
-
-	/**
-	 * Get display name of the user
-	 * @param string $uid user ID of the user
-	 * @return string display name
-	 * @throws \Exception
-	 */
-	public function getDisplayName($uid) {
-		$plugin = $this->which[Backend::GET_DISPLAYNAME];
-
-		if ($plugin) {
-			return $plugin->getDisplayName($uid);
-		}
-		throw new \Exception('No plugin implements getDisplayName in this LDAP Backend.');
-	}
-
-	/**
-	 * Set display name of the user
-	 * @param string $uid user ID of the user
-	 * @param string $displayName new user's display name
-	 * @return string display name
-	 * @throws \Exception
-	 */
-	public function setDisplayName($uid, $displayName) {
-		$plugin = $this->which[Backend::SET_DISPLAYNAME];
-
-		if ($plugin) {
-			return $plugin->setDisplayName($uid, $displayName);
-		}
-		throw new \Exception('No plugin implements setDisplayName in this LDAP Backend.');
-	}
-
-	/**
-	 * Count the number of users
-	 * @return int|bool
-	 * @throws \Exception
-	 */
-	public function countUsers() {
-		$plugin = $this->which[Backend::COUNT_USERS];
-
-		if ($plugin) {
-			return $plugin->countUsers();
-		}
-		throw new \Exception('No plugin implements countUsers in this LDAP Backend.');
-	}
-
-	/**
-	 * @return bool
-	 */
-	public function canDeleteUser() {
-		return !$this->suppressDeletion && $this->which['deleteUser'] !== null;
-	}
-
-	/**
-	 * @param $uid
-	 * @return bool
-	 * @throws \Exception
-	 */
-	public function deleteUser($uid) {
-		$plugin = $this->which['deleteUser'];
-		if ($plugin) {
-			if ($this->suppressDeletion) {
-				return false;
-			}
-			return $plugin->deleteUser($uid);
-		}
-		throw new \Exception('No plugin implements deleteUser in this LDAP Backend.');
-	}
-
-	/**
-	 * @param bool $value
-	 * @return bool – the value before the change
-	 */
-	public function setSuppressDeletion(bool $value): bool {
-		$old = $this->suppressDeletion;
-		$this->suppressDeletion = $value;
-		return $old;
-	}
+    private int $respondToActions = 0;
+
+    private array $which = [
+        Backend::CREATE_USER => null,
+        Backend::SET_PASSWORD => null,
+        Backend::GET_HOME => null,
+        Backend::GET_DISPLAYNAME => null,
+        Backend::SET_DISPLAYNAME => null,
+        Backend::PROVIDE_AVATAR => null,
+        Backend::COUNT_USERS => null,
+        'deleteUser' => null
+    ];
+
+    private bool $suppressDeletion = false;
+
+    /**
+     * @return int All implemented actions, except for 'deleteUser'
+     */
+    public function getImplementedActions() {
+        return $this->respondToActions;
+    }
+
+    /**
+     * Registers a user plugin that may implement some actions, overriding User_LDAP's user actions.
+     *
+     * @param ILDAPUserPlugin $plugin
+     */
+    public function register(ILDAPUserPlugin $plugin) {
+        $respondToActions = $plugin->respondToActions();
+        $this->respondToActions |= $respondToActions;
+
+        foreach ($this->which as $action => $v) {
+            if (is_int($action) && (bool)($respondToActions & $action)) {
+                $this->which[$action] = $plugin;
+                \OC::$server->getLogger()->debug("Registered action ".$action." to plugin ".get_class($plugin), ['app' => 'user_ldap']);
+            }
+        }
+        if (method_exists($plugin,'deleteUser')) {
+            $this->which['deleteUser'] = $plugin;
+            \OC::$server->getLogger()->debug("Registered action deleteUser to plugin ".get_class($plugin), ['app' => 'user_ldap']);
+        }
+    }
+
+    /**
+     * Signal if there is a registered plugin that implements some given actions
+     * @param int $actions Actions defined in \OC\User\Backend, like Backend::CREATE_USER
+     * @return bool
+     */
+    public function implementsActions($actions) {
+        return ($actions & $this->respondToActions) == $actions;
+    }
+
+    /**
+     * Create a new user in LDAP Backend
+     *
+     * @param string $username The username of the user to create
+     * @param string $password The password of the new user
+     * @return string | false The user DN if user creation was successful.
+     * @throws \Exception
+     */
+    public function createUser($username, $password) {
+        $plugin = $this->which[Backend::CREATE_USER];
+
+        if ($plugin) {
+            return $plugin->createUser($username,$password);
+        }
+        throw new \Exception('No plugin implements createUser in this LDAP Backend.');
+    }
+
+    /**
+     * Change the password of a user*
+     * @param string $uid The username
+     * @param string $password The new password
+     * @return bool
+     * @throws \Exception
+     */
+    public function setPassword($uid, $password) {
+        $plugin = $this->which[Backend::SET_PASSWORD];
+
+        if ($plugin) {
+            return $plugin->setPassword($uid,$password);
+        }
+        throw new \Exception('No plugin implements setPassword in this LDAP Backend.');
+    }
+
+    /**
+     * checks whether the user is allowed to change his avatar in Nextcloud
+     * @param string $uid the Nextcloud user name
+     * @return boolean either the user can or cannot
+     * @throws \Exception
+     */
+    public function canChangeAvatar($uid) {
+        $plugin = $this->which[Backend::PROVIDE_AVATAR];
+
+        if ($plugin) {
+            return $plugin->canChangeAvatar($uid);
+        }
+        throw new \Exception('No plugin implements canChangeAvatar in this LDAP Backend.');
+    }
+
+    /**
+     * Get the user's home directory
+     * @param string $uid the username
+     * @return boolean
+     * @throws \Exception
+     */
+    public function getHome($uid) {
+        $plugin = $this->which[Backend::GET_HOME];
+
+        if ($plugin) {
+            return $plugin->getHome($uid);
+        }
+        throw new \Exception('No plugin implements getHome in this LDAP Backend.');
+    }
+
+    /**
+     * Get display name of the user
+     * @param string $uid user ID of the user
+     * @return string display name
+     * @throws \Exception
+     */
+    public function getDisplayName($uid) {
+        $plugin = $this->which[Backend::GET_DISPLAYNAME];
+
+        if ($plugin) {
+            return $plugin->getDisplayName($uid);
+        }
+        throw new \Exception('No plugin implements getDisplayName in this LDAP Backend.');
+    }
+
+    /**
+     * Set display name of the user
+     * @param string $uid user ID of the user
+     * @param string $displayName new user's display name
+     * @return string display name
+     * @throws \Exception
+     */
+    public function setDisplayName($uid, $displayName) {
+        $plugin = $this->which[Backend::SET_DISPLAYNAME];
+
+        if ($plugin) {
+            return $plugin->setDisplayName($uid, $displayName);
+        }
+        throw new \Exception('No plugin implements setDisplayName in this LDAP Backend.');
+    }
+
+    /**
+     * Count the number of users
+     * @return int|bool
+     * @throws \Exception
+     */
+    public function countUsers() {
+        $plugin = $this->which[Backend::COUNT_USERS];
+
+        if ($plugin) {
+            return $plugin->countUsers();
+        }
+        throw new \Exception('No plugin implements countUsers in this LDAP Backend.');
+    }
+
+    /**
+     * @return bool
+     */
+    public function canDeleteUser() {
+        return !$this->suppressDeletion && $this->which['deleteUser'] !== null;
+    }
+
+    /**
+     * @param $uid
+     * @return bool
+     * @throws \Exception
+     */
+    public function deleteUser($uid) {
+        $plugin = $this->which['deleteUser'];
+        if ($plugin) {
+            if ($this->suppressDeletion) {
+                return false;
+            }
+            return $plugin->deleteUser($uid);
+        }
+        throw new \Exception('No plugin implements deleteUser in this LDAP Backend.');
+    }
+
+    /**
+     * @param bool $value
+     * @return bool – the value before the change
+     */
+    public function setSuppressDeletion(bool $value): bool {
+        $old = $this->suppressDeletion;
+        $this->suppressDeletion = $value;
+        return $old;
+    }
 }

apps/user_ldap/lib/Command/ResetGroup.php

Indentation +68 added lines, -68 removed lines

@@ -36,76 +36,76 @@
 use Symfony\Component\Console\Question\Question;
 
 class ResetGroup extends Command {
-	private IGroupManager $groupManager;
-	private GroupPluginManager $pluginManager;
-	private Group_Proxy $backend;
+    private IGroupManager $groupManager;
+    private GroupPluginManager $pluginManager;
+    private Group_Proxy $backend;
 
-	public function __construct(
-		IGroupManager $groupManager,
-		GroupPluginManager $pluginManager,
-		Group_Proxy $backend
-	) {
-		$this->groupManager = $groupManager;
-		$this->pluginManager = $pluginManager;
-		$this->backend = $backend;
-		parent::__construct();
-	}
+    public function __construct(
+        IGroupManager $groupManager,
+        GroupPluginManager $pluginManager,
+        Group_Proxy $backend
+    ) {
+        $this->groupManager = $groupManager;
+        $this->pluginManager = $pluginManager;
+        $this->backend = $backend;
+        parent::__construct();
+    }
 
-	protected function configure(): void {
-		$this
-			->setName('ldap:reset-group')
-			->setDescription('deletes an LDAP group independent of the group state in the LDAP')
-			->addArgument(
-				'gid',
-				InputArgument::REQUIRED,
-				'the group name as used in Nextcloud'
-			)
-			->addOption(
-				'yes',
-				'y',
-				InputOption::VALUE_NONE,
-				'do not ask for confirmation'
-			);
-	}
+    protected function configure(): void {
+        $this
+            ->setName('ldap:reset-group')
+            ->setDescription('deletes an LDAP group independent of the group state in the LDAP')
+            ->addArgument(
+                'gid',
+                InputArgument::REQUIRED,
+                'the group name as used in Nextcloud'
+            )
+            ->addOption(
+                'yes',
+                'y',
+                InputOption::VALUE_NONE,
+                'do not ask for confirmation'
+            );
+    }
 
-	protected function execute(InputInterface $input, OutputInterface $output): int {
-		try {
-			$gid = $input->getArgument('gid');
-			$group = $this->groupManager->get($gid);
-			if (!$group instanceof IGroup) {
-				throw new \Exception('Group not found');
-			}
-			$backends = $group->getBackendNames();
-			if (!in_array('LDAP', $backends)) {
-				throw new \Exception('The given group is not a recognized LDAP group.');
-			}
-			if ($input->getOption('yes') === false) {
-				/** @var QuestionHelper $helper */
-				$helper = $this->getHelper('question');
-				$q = new Question('Delete all local data of this group (y|N)? ');
-				$input->setOption('yes', $helper->ask($input, $output, $q) === 'y');
-			}
-			if ($input->getOption('yes') !== true) {
-				throw new \Exception('Reset cancelled by operator');
-			}
+    protected function execute(InputInterface $input, OutputInterface $output): int {
+        try {
+            $gid = $input->getArgument('gid');
+            $group = $this->groupManager->get($gid);
+            if (!$group instanceof IGroup) {
+                throw new \Exception('Group not found');
+            }
+            $backends = $group->getBackendNames();
+            if (!in_array('LDAP', $backends)) {
+                throw new \Exception('The given group is not a recognized LDAP group.');
+            }
+            if ($input->getOption('yes') === false) {
+                /** @var QuestionHelper $helper */
+                $helper = $this->getHelper('question');
+                $q = new Question('Delete all local data of this group (y|N)? ');
+                $input->setOption('yes', $helper->ask($input, $output, $q) === 'y');
+            }
+            if ($input->getOption('yes') !== true) {
+                throw new \Exception('Reset cancelled by operator');
+            }
 
-			// Disable real deletion if a plugin supports it
-			$pluginManagerSuppressed = $this->pluginManager->setSuppressDeletion(true);
-			// Bypass groupExists test to force mapping deletion
-			$this->backend->getLDAPAccess($gid)->connection->writeToCache('groupExists' . $gid, false);
-			echo "calling delete $gid\n";
-			if ($group->delete()) {
-				$this->pluginManager->setSuppressDeletion($pluginManagerSuppressed);
-				return 0;
-			}
-		} catch (\Throwable $e) {
-			if (isset($pluginManagerSuppressed)) {
-				$this->pluginManager->setSuppressDeletion($pluginManagerSuppressed);
-			}
-			$output->writeln('<error>' . $e->getMessage() . '</error>');
-			return 1;
-		}
-		$output->writeln('<error>Error while resetting group</error>');
-		return 2;
-	}
+            // Disable real deletion if a plugin supports it
+            $pluginManagerSuppressed = $this->pluginManager->setSuppressDeletion(true);
+            // Bypass groupExists test to force mapping deletion
+            $this->backend->getLDAPAccess($gid)->connection->writeToCache('groupExists' . $gid, false);
+            echo "calling delete $gid\n";
+            if ($group->delete()) {
+                $this->pluginManager->setSuppressDeletion($pluginManagerSuppressed);
+                return 0;
+            }
+        } catch (\Throwable $e) {
+            if (isset($pluginManagerSuppressed)) {
+                $this->pluginManager->setSuppressDeletion($pluginManagerSuppressed);
+            }
+            $output->writeln('<error>' . $e->getMessage() . '</error>');
+            return 1;
+        }
+        $output->writeln('<error>Error while resetting group</error>');
+        return 2;
+    }
 }

core/Command/Group/Delete.php

Indentation +38 added lines, -38 removed lines

@@ -33,45 +33,45 @@
 use Symfony\Component\Console\Output\OutputInterface;
 
 class Delete extends Base {
-	/** @var IGroupManager */
-	protected $groupManager;
+    /** @var IGroupManager */
+    protected $groupManager;
 
-	/**
-	 * @param IGroupManager $groupManager
-	 */
-	public function __construct(IGroupManager $groupManager) {
-		$this->groupManager = $groupManager;
-		parent::__construct();
-	}
+    /**
+     * @param IGroupManager $groupManager
+     */
+    public function __construct(IGroupManager $groupManager) {
+        $this->groupManager = $groupManager;
+        parent::__construct();
+    }
 
-	protected function configure() {
-		$this
-			->setName('group:delete')
-			->setDescription('Remove a group')
-			->addArgument(
-				'groupid',
-				InputArgument::REQUIRED,
-				'Group name'
-			);
-	}
+    protected function configure() {
+        $this
+            ->setName('group:delete')
+            ->setDescription('Remove a group')
+            ->addArgument(
+                'groupid',
+                InputArgument::REQUIRED,
+                'Group name'
+            );
+    }
 
-	protected function execute(InputInterface $input, OutputInterface $output): int {
-		$gid = $input->getArgument('groupid');
-		if ($gid === 'admin') {
-			$output->writeln('<error>Group "' . $gid . '" could not be deleted.</error>');
-			return 1;
-		}
-		if (!$this->groupManager->groupExists($gid)) {
-			$output->writeln('<error>Group "' . $gid . '" does not exist.</error>');
-			return 1;
-		}
-		$group = $this->groupManager->get($gid);
-		if ($group->delete()) {
-			$output->writeln('Group "' . $gid . '" was removed');
-		} else {
-			$output->writeln('<error>Group "' . $gid . '" could not be deleted. Please check the logs.</error>');
-			return 1;
-		}
-		return 0;
-	}
+    protected function execute(InputInterface $input, OutputInterface $output): int {
+        $gid = $input->getArgument('groupid');
+        if ($gid === 'admin') {
+            $output->writeln('<error>Group "' . $gid . '" could not be deleted.</error>');
+            return 1;
+        }
+        if (!$this->groupManager->groupExists($gid)) {
+            $output->writeln('<error>Group "' . $gid . '" does not exist.</error>');
+            return 1;
+        }
+        $group = $this->groupManager->get($gid);
+        if ($group->delete()) {
+            $output->writeln('Group "' . $gid . '" was removed');
+        } else {
+            $output->writeln('<error>Group "' . $gid . '" could not be deleted. Please check the logs.</error>');
+            return 1;
+        }
+        return 0;
+    }
 }