nextcloud / server

lib/private/legacy/user.php

Indentation +444 added lines, -444 removed lines

@@ -57,448 +57,448 @@
  */
 class OC_User {
 
-	/**
-	 * @return \OC\User\Session
-	 */
-	public static function getUserSession() {
-		return OC::$server->getUserSession();
-	}
-
-	private static $_usedBackends = array();
-
-	private static $_setupedBackends = array();
-
-	// bool, stores if a user want to access a resource anonymously, e.g if they open a public link
-	private static $incognitoMode = false;
-
-	/**
-	 * Adds the backend to the list of used backends
-	 *
-	 * @param string|\OCP\UserInterface $backend default: database The backend to use for user management
-	 * @return bool
-	 *
-	 * Set the User Authentication Module
-	 */
-	public static function useBackend($backend = 'database') {
-		if ($backend instanceof \OCP\UserInterface) {
-			self::$_usedBackends[get_class($backend)] = $backend;
-			\OC::$server->getUserManager()->registerBackend($backend);
-		} else {
-			// You'll never know what happens
-			if (null === $backend OR !is_string($backend)) {
-				$backend = 'database';
-			}
-
-			// Load backend
-			switch ($backend) {
-				case 'database':
-				case 'mysql':
-				case 'sqlite':
-					\OCP\Util::writeLog('core', 'Adding user backend ' . $backend . '.', \OCP\Util::DEBUG);
-					self::$_usedBackends[$backend] = new \OC\User\Database();
-					\OC::$server->getUserManager()->registerBackend(self::$_usedBackends[$backend]);
-					break;
-				case 'dummy':
-					self::$_usedBackends[$backend] = new \Test\Util\User\Dummy();
-					\OC::$server->getUserManager()->registerBackend(self::$_usedBackends[$backend]);
-					break;
-				default:
-					\OCP\Util::writeLog('core', 'Adding default user backend ' . $backend . '.', \OCP\Util::DEBUG);
-					$className = 'OC_USER_' . strtoupper($backend);
-					self::$_usedBackends[$backend] = new $className();
-					\OC::$server->getUserManager()->registerBackend(self::$_usedBackends[$backend]);
-					break;
-			}
-		}
-		return true;
-	}
-
-	/**
-	 * remove all used backends
-	 */
-	public static function clearBackends() {
-		self::$_usedBackends = array();
-		\OC::$server->getUserManager()->clearBackends();
-	}
-
-	/**
-	 * setup the configured backends in config.php
-	 */
-	public static function setupBackends() {
-		OC_App::loadApps(['prelogin']);
-		$backends = \OC::$server->getSystemConfig()->getValue('user_backends', []);
-		if (isset($backends['default']) && !$backends['default']) {
-			// clear default backends
-			self::clearBackends();
-		}
-		foreach ($backends as $i => $config) {
-			if (!is_array($config)) {
-				continue;
-			}
-			$class = $config['class'];
-			$arguments = $config['arguments'];
-			if (class_exists($class)) {
-				if (array_search($i, self::$_setupedBackends) === false) {
-					// make a reflection object
-					$reflectionObj = new ReflectionClass($class);
-
-					// use Reflection to create a new instance, using the $args
-					$backend = $reflectionObj->newInstanceArgs($arguments);
-					self::useBackend($backend);
-					self::$_setupedBackends[] = $i;
-				} else {
-					\OCP\Util::writeLog('core', 'User backend ' . $class . ' already initialized.', \OCP\Util::DEBUG);
-				}
-			} else {
-				\OCP\Util::writeLog('core', 'User backend ' . $class . ' not found.', \OCP\Util::ERROR);
-			}
-		}
-	}
-
-	/**
-	 * Try to login a user, assuming authentication
-	 * has already happened (e.g. via Single Sign On).
-	 *
-	 * Log in a user and regenerate a new session.
-	 *
-	 * @param \OCP\Authentication\IApacheBackend $backend
-	 * @return bool
-	 */
-	public static function loginWithApache(\OCP\Authentication\IApacheBackend $backend) {
-
-		$uid = $backend->getCurrentUserId();
-		$run = true;
-		OC_Hook::emit("OC_User", "pre_login", array("run" => &$run, "uid" => $uid));
-
-		if ($uid) {
-			if (self::getUser() !== $uid) {
-				self::setUserId($uid);
-				$setUidAsDisplayName = true;
-				if($backend instanceof \OCP\UserInterface
-					&& $backend->implementsActions(\OC\User\Backend::GET_DISPLAYNAME)) {
-
-					$backendDisplayName = $backend->getDisplayName($uid);
-					if(is_string($backendDisplayName) && trim($backendDisplayName) !== '') {
-						$setUidAsDisplayName = false;
-					}
-				}
-				if($setUidAsDisplayName) {
-					self::setDisplayName($uid);
-				}
-				$userSession = self::getUserSession();
-				$userSession->setLoginName($uid);
-				$request = OC::$server->getRequest();
-				$userSession->createSessionToken($request, $uid, $uid);
-				// setup the filesystem
-				OC_Util::setupFS($uid);
-				// first call the post_login hooks, the login-process needs to be
-				// completed before we can safely create the users folder.
-				// For example encryption needs to initialize the users keys first
-				// before we can create the user folder with the skeleton files
-				OC_Hook::emit("OC_User", "post_login", array("uid" => $uid, 'password' => ''));
-				//trigger creation of user home and /files folder
-				\OC::$server->getUserFolder($uid);
-			}
-			return true;
-		}
-		return false;
-	}
-
-	/**
-	 * Verify with Apache whether user is authenticated.
-	 *
-	 * @return boolean|null
-	 *          true: authenticated
-	 *          false: not authenticated
-	 *          null: not handled / no backend available
-	 */
-	public static function handleApacheAuth() {
-		$backend = self::findFirstActiveUsedBackend();
-		if ($backend) {
-			OC_App::loadApps();
-
-			//setup extra user backends
-			self::setupBackends();
-			self::getUserSession()->unsetMagicInCookie();
-
-			return self::loginWithApache($backend);
-		}
-
-		return null;
-	}
-
-
-	/**
-	 * Sets user id for session and triggers emit
-	 *
-	 * @param string $uid
-	 */
-	public static function setUserId($uid) {
-		$userSession = \OC::$server->getUserSession();
-		$userManager = \OC::$server->getUserManager();
-		if ($user = $userManager->get($uid)) {
-			$userSession->setUser($user);
-		} else {
-			\OC::$server->getSession()->set('user_id', $uid);
-		}
-	}
-
-	/**
-	 * Sets user display name for session
-	 *
-	 * @param string $uid
-	 * @param string $displayName
-	 * @return bool Whether the display name could get set
-	 */
-	public static function setDisplayName($uid, $displayName = null) {
-		if (is_null($displayName)) {
-			$displayName = $uid;
-		}
-		$user = \OC::$server->getUserManager()->get($uid);
-		if ($user) {
-			return $user->setDisplayName($displayName);
-		} else {
-			return false;
-		}
-	}
-
-	/**
-	 * Check if the user is logged in, considers also the HTTP basic credentials
-	 *
-	 * @deprecated use \OC::$server->getUserSession()->isLoggedIn()
-	 * @return bool
-	 */
-	public static function isLoggedIn() {
-		return \OC::$server->getUserSession()->isLoggedIn();
-	}
-
-	/**
-	 * set incognito mode, e.g. if a user wants to open a public link
-	 *
-	 * @param bool $status
-	 */
-	public static function setIncognitoMode($status) {
-		self::$incognitoMode = $status;
-	}
-
-	/**
-	 * get incognito mode status
-	 *
-	 * @return bool
-	 */
-	public static function isIncognitoMode() {
-		return self::$incognitoMode;
-	}
-
-	/**
-	 * Supplies an attribute to the logout hyperlink. The default behaviour
-	 * is to return an href with '?logout=true' appended. However, it can
-	 * supply any attribute(s) which are valid for <a>.
-	 *
-	 * @return string with one or more HTML attributes.
-	 */
-	public static function getLogoutAttribute() {
-		$backend = self::findFirstActiveUsedBackend();
-		if ($backend) {
-			return $backend->getLogoutAttribute();
-		}
-
-		$logoutUrl = \OC::$server->getURLGenerator()->linkToRouteAbsolute(
-			'core.login.logout',
-			[
-				'requesttoken' => \OCP\Util::callRegister(),
-			]
-		);
-
-		return 'href="'.$logoutUrl.'"';
-	}
-
-	/**
-	 * Check if the user is an admin user
-	 *
-	 * @param string $uid uid of the admin
-	 * @return bool
-	 */
-	public static function isAdminUser($uid) {
-		$group = \OC::$server->getGroupManager()->get('admin');
-		$user = \OC::$server->getUserManager()->get($uid);
-		if ($group && $user && $group->inGroup($user) && self::$incognitoMode === false) {
-			return true;
-		}
-		return false;
-	}
-
-
-	/**
-	 * get the user id of the user currently logged in.
-	 *
-	 * @return string|bool uid or false
-	 */
-	public static function getUser() {
-		$uid = \OC::$server->getSession() ? \OC::$server->getSession()->get('user_id') : null;
-		if (!is_null($uid) && self::$incognitoMode === false) {
-			return $uid;
-		} else {
-			return false;
-		}
-	}
-
-	/**
-	 * get the display name of the user currently logged in.
-	 *
-	 * @param string $uid
-	 * @return string uid or false
-	 */
-	public static function getDisplayName($uid = null) {
-		if ($uid) {
-			$user = \OC::$server->getUserManager()->get($uid);
-			if ($user) {
-				return $user->getDisplayName();
-			} else {
-				return $uid;
-			}
-		} else {
-			$user = self::getUserSession()->getUser();
-			if ($user) {
-				return $user->getDisplayName();
-			} else {
-				return false;
-			}
-		}
-	}
-
-	/**
-	 * Set password
-	 *
-	 * @param string $uid The username
-	 * @param string $password The new password
-	 * @param string $recoveryPassword for the encryption app to reset encryption keys
-	 * @return bool
-	 *
-	 * Change the password of a user
-	 */
-	public static function setPassword($uid, $password, $recoveryPassword = null) {
-		$user = \OC::$server->getUserManager()->get($uid);
-		if ($user) {
-			return $user->setPassword($password, $recoveryPassword);
-		} else {
-			return false;
-		}
-	}
-
-	/**
-	 * Check if the password is correct
-	 *
-	 * @param string $uid The username
-	 * @param string $password The password
-	 * @return string|false user id a string on success, false otherwise
-	 *
-	 * Check if the password is correct without logging in the user
-	 * returns the user id or false
-	 */
-	public static function checkPassword($uid, $password) {
-		$manager = \OC::$server->getUserManager();
-		$username = $manager->checkPassword($uid, $password);
-		if ($username !== false) {
-			return $username->getUID();
-		}
-		return false;
-	}
-
-	/**
-	 * @param string $uid The username
-	 * @return string
-	 *
-	 * returns the path to the users home directory
-	 * @deprecated Use \OC::$server->getUserManager->getHome()
-	 */
-	public static function getHome($uid) {
-		$user = \OC::$server->getUserManager()->get($uid);
-		if ($user) {
-			return $user->getHome();
-		} else {
-			return \OC::$server->getSystemConfig()->getValue('datadirectory', OC::$SERVERROOT . '/data') . '/' . $uid;
-		}
-	}
-
-	/**
-	 * Get a list of all users
-	 *
-	 * @return array an array of all uids
-	 *
-	 * Get a list of all users.
-	 * @param string $search
-	 * @param integer $limit
-	 * @param integer $offset
-	 */
-	public static function getUsers($search = '', $limit = null, $offset = null) {
-		$users = \OC::$server->getUserManager()->search($search, $limit, $offset);
-		$uids = array();
-		foreach ($users as $user) {
-			$uids[] = $user->getUID();
-		}
-		return $uids;
-	}
-
-	/**
-	 * Get a list of all users display name
-	 *
-	 * @param string $search
-	 * @param int $limit
-	 * @param int $offset
-	 * @return array associative array with all display names (value) and corresponding uids (key)
-	 *
-	 * Get a list of all display names and user ids.
-	 * @deprecated Use \OC::$server->getUserManager->searchDisplayName($search, $limit, $offset) instead.
-	 */
-	public static function getDisplayNames($search = '', $limit = null, $offset = null) {
-		$displayNames = array();
-		$users = \OC::$server->getUserManager()->searchDisplayName($search, $limit, $offset);
-		foreach ($users as $user) {
-			$displayNames[$user->getUID()] = $user->getDisplayName();
-		}
-		return $displayNames;
-	}
-
-	/**
-	 * check if a user exists
-	 *
-	 * @param string $uid the username
-	 * @return boolean
-	 */
-	public static function userExists($uid) {
-		return \OC::$server->getUserManager()->userExists($uid);
-	}
-
-	/**
-	 * checks if a user is enabled
-	 *
-	 * @param string $uid
-	 * @return bool
-	 */
-	public static function isEnabled($uid) {
-		$user = \OC::$server->getUserManager()->get($uid);
-		if ($user) {
-			return $user->isEnabled();
-		} else {
-			return false;
-		}
-	}
-
-	/**
-	 * Returns the first active backend from self::$_usedBackends.
-	 *
-	 * @return OCP\Authentication\IApacheBackend|null if no backend active, otherwise OCP\Authentication\IApacheBackend
-	 */
-	private static function findFirstActiveUsedBackend() {
-		foreach (self::$_usedBackends as $backend) {
-			if ($backend instanceof OCP\Authentication\IApacheBackend) {
-				if ($backend->isSessionActive()) {
-					return $backend;
-				}
-			}
-		}
-
-		return null;
-	}
+    /**
+     * @return \OC\User\Session
+     */
+    public static function getUserSession() {
+        return OC::$server->getUserSession();
+    }
+
+    private static $_usedBackends = array();
+
+    private static $_setupedBackends = array();
+
+    // bool, stores if a user want to access a resource anonymously, e.g if they open a public link
+    private static $incognitoMode = false;
+
+    /**
+     * Adds the backend to the list of used backends
+     *
+     * @param string|\OCP\UserInterface $backend default: database The backend to use for user management
+     * @return bool
+     *
+     * Set the User Authentication Module
+     */
+    public static function useBackend($backend = 'database') {
+        if ($backend instanceof \OCP\UserInterface) {
+            self::$_usedBackends[get_class($backend)] = $backend;
+            \OC::$server->getUserManager()->registerBackend($backend);
+        } else {
+            // You'll never know what happens
+            if (null === $backend OR !is_string($backend)) {
+                $backend = 'database';
+            }
+
+            // Load backend
+            switch ($backend) {
+                case 'database':
+                case 'mysql':
+                case 'sqlite':
+                    \OCP\Util::writeLog('core', 'Adding user backend ' . $backend . '.', \OCP\Util::DEBUG);
+                    self::$_usedBackends[$backend] = new \OC\User\Database();
+                    \OC::$server->getUserManager()->registerBackend(self::$_usedBackends[$backend]);
+                    break;
+                case 'dummy':
+                    self::$_usedBackends[$backend] = new \Test\Util\User\Dummy();
+                    \OC::$server->getUserManager()->registerBackend(self::$_usedBackends[$backend]);
+                    break;
+                default:
+                    \OCP\Util::writeLog('core', 'Adding default user backend ' . $backend . '.', \OCP\Util::DEBUG);
+                    $className = 'OC_USER_' . strtoupper($backend);
+                    self::$_usedBackends[$backend] = new $className();
+                    \OC::$server->getUserManager()->registerBackend(self::$_usedBackends[$backend]);
+                    break;
+            }
+        }
+        return true;
+    }
+
+    /**
+     * remove all used backends
+     */
+    public static function clearBackends() {
+        self::$_usedBackends = array();
+        \OC::$server->getUserManager()->clearBackends();
+    }
+
+    /**
+     * setup the configured backends in config.php
+     */
+    public static function setupBackends() {
+        OC_App::loadApps(['prelogin']);
+        $backends = \OC::$server->getSystemConfig()->getValue('user_backends', []);
+        if (isset($backends['default']) && !$backends['default']) {
+            // clear default backends
+            self::clearBackends();
+        }
+        foreach ($backends as $i => $config) {
+            if (!is_array($config)) {
+                continue;
+            }
+            $class = $config['class'];
+            $arguments = $config['arguments'];
+            if (class_exists($class)) {
+                if (array_search($i, self::$_setupedBackends) === false) {
+                    // make a reflection object
+                    $reflectionObj = new ReflectionClass($class);
+
+                    // use Reflection to create a new instance, using the $args
+                    $backend = $reflectionObj->newInstanceArgs($arguments);
+                    self::useBackend($backend);
+                    self::$_setupedBackends[] = $i;
+                } else {
+                    \OCP\Util::writeLog('core', 'User backend ' . $class . ' already initialized.', \OCP\Util::DEBUG);
+                }
+            } else {
+                \OCP\Util::writeLog('core', 'User backend ' . $class . ' not found.', \OCP\Util::ERROR);
+            }
+        }
+    }
+
+    /**
+     * Try to login a user, assuming authentication
+     * has already happened (e.g. via Single Sign On).
+     *
+     * Log in a user and regenerate a new session.
+     *
+     * @param \OCP\Authentication\IApacheBackend $backend
+     * @return bool
+     */
+    public static function loginWithApache(\OCP\Authentication\IApacheBackend $backend) {
+
+        $uid = $backend->getCurrentUserId();
+        $run = true;
+        OC_Hook::emit("OC_User", "pre_login", array("run" => &$run, "uid" => $uid));
+
+        if ($uid) {
+            if (self::getUser() !== $uid) {
+                self::setUserId($uid);
+                $setUidAsDisplayName = true;
+                if($backend instanceof \OCP\UserInterface
+                    && $backend->implementsActions(\OC\User\Backend::GET_DISPLAYNAME)) {
+
+                    $backendDisplayName = $backend->getDisplayName($uid);
+                    if(is_string($backendDisplayName) && trim($backendDisplayName) !== '') {
+                        $setUidAsDisplayName = false;
+                    }
+                }
+                if($setUidAsDisplayName) {
+                    self::setDisplayName($uid);
+                }
+                $userSession = self::getUserSession();
+                $userSession->setLoginName($uid);
+                $request = OC::$server->getRequest();
+                $userSession->createSessionToken($request, $uid, $uid);
+                // setup the filesystem
+                OC_Util::setupFS($uid);
+                // first call the post_login hooks, the login-process needs to be
+                // completed before we can safely create the users folder.
+                // For example encryption needs to initialize the users keys first
+                // before we can create the user folder with the skeleton files
+                OC_Hook::emit("OC_User", "post_login", array("uid" => $uid, 'password' => ''));
+                //trigger creation of user home and /files folder
+                \OC::$server->getUserFolder($uid);
+            }
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * Verify with Apache whether user is authenticated.
+     *
+     * @return boolean|null
+     *          true: authenticated
+     *          false: not authenticated
+     *          null: not handled / no backend available
+     */
+    public static function handleApacheAuth() {
+        $backend = self::findFirstActiveUsedBackend();
+        if ($backend) {
+            OC_App::loadApps();
+
+            //setup extra user backends
+            self::setupBackends();
+            self::getUserSession()->unsetMagicInCookie();
+
+            return self::loginWithApache($backend);
+        }
+
+        return null;
+    }
+
+
+    /**
+     * Sets user id for session and triggers emit
+     *
+     * @param string $uid
+     */
+    public static function setUserId($uid) {
+        $userSession = \OC::$server->getUserSession();
+        $userManager = \OC::$server->getUserManager();
+        if ($user = $userManager->get($uid)) {
+            $userSession->setUser($user);
+        } else {
+            \OC::$server->getSession()->set('user_id', $uid);
+        }
+    }
+
+    /**
+     * Sets user display name for session
+     *
+     * @param string $uid
+     * @param string $displayName
+     * @return bool Whether the display name could get set
+     */
+    public static function setDisplayName($uid, $displayName = null) {
+        if (is_null($displayName)) {
+            $displayName = $uid;
+        }
+        $user = \OC::$server->getUserManager()->get($uid);
+        if ($user) {
+            return $user->setDisplayName($displayName);
+        } else {
+            return false;
+        }
+    }
+
+    /**
+     * Check if the user is logged in, considers also the HTTP basic credentials
+     *
+     * @deprecated use \OC::$server->getUserSession()->isLoggedIn()
+     * @return bool
+     */
+    public static function isLoggedIn() {
+        return \OC::$server->getUserSession()->isLoggedIn();
+    }
+
+    /**
+     * set incognito mode, e.g. if a user wants to open a public link
+     *
+     * @param bool $status
+     */
+    public static function setIncognitoMode($status) {
+        self::$incognitoMode = $status;
+    }
+
+    /**
+     * get incognito mode status
+     *
+     * @return bool
+     */
+    public static function isIncognitoMode() {
+        return self::$incognitoMode;
+    }
+
+    /**
+     * Supplies an attribute to the logout hyperlink. The default behaviour
+     * is to return an href with '?logout=true' appended. However, it can
+     * supply any attribute(s) which are valid for <a>.
+     *
+     * @return string with one or more HTML attributes.
+     */
+    public static function getLogoutAttribute() {
+        $backend = self::findFirstActiveUsedBackend();
+        if ($backend) {
+            return $backend->getLogoutAttribute();
+        }
+
+        $logoutUrl = \OC::$server->getURLGenerator()->linkToRouteAbsolute(
+            'core.login.logout',
+            [
+                'requesttoken' => \OCP\Util::callRegister(),
+            ]
+        );
+
+        return 'href="'.$logoutUrl.'"';
+    }
+
+    /**
+     * Check if the user is an admin user
+     *
+     * @param string $uid uid of the admin
+     * @return bool
+     */
+    public static function isAdminUser($uid) {
+        $group = \OC::$server->getGroupManager()->get('admin');
+        $user = \OC::$server->getUserManager()->get($uid);
+        if ($group && $user && $group->inGroup($user) && self::$incognitoMode === false) {
+            return true;
+        }
+        return false;
+    }
+
+
+    /**
+     * get the user id of the user currently logged in.
+     *
+     * @return string|bool uid or false
+     */
+    public static function getUser() {
+        $uid = \OC::$server->getSession() ? \OC::$server->getSession()->get('user_id') : null;
+        if (!is_null($uid) && self::$incognitoMode === false) {
+            return $uid;
+        } else {
+            return false;
+        }
+    }
+
+    /**
+     * get the display name of the user currently logged in.
+     *
+     * @param string $uid
+     * @return string uid or false
+     */
+    public static function getDisplayName($uid = null) {
+        if ($uid) {
+            $user = \OC::$server->getUserManager()->get($uid);
+            if ($user) {
+                return $user->getDisplayName();
+            } else {
+                return $uid;
+            }
+        } else {
+            $user = self::getUserSession()->getUser();
+            if ($user) {
+                return $user->getDisplayName();
+            } else {
+                return false;
+            }
+        }
+    }
+
+    /**
+     * Set password
+     *
+     * @param string $uid The username
+     * @param string $password The new password
+     * @param string $recoveryPassword for the encryption app to reset encryption keys
+     * @return bool
+     *
+     * Change the password of a user
+     */
+    public static function setPassword($uid, $password, $recoveryPassword = null) {
+        $user = \OC::$server->getUserManager()->get($uid);
+        if ($user) {
+            return $user->setPassword($password, $recoveryPassword);
+        } else {
+            return false;
+        }
+    }
+
+    /**
+     * Check if the password is correct
+     *
+     * @param string $uid The username
+     * @param string $password The password
+     * @return string|false user id a string on success, false otherwise
+     *
+     * Check if the password is correct without logging in the user
+     * returns the user id or false
+     */
+    public static function checkPassword($uid, $password) {
+        $manager = \OC::$server->getUserManager();
+        $username = $manager->checkPassword($uid, $password);
+        if ($username !== false) {
+            return $username->getUID();
+        }
+        return false;
+    }
+
+    /**
+     * @param string $uid The username
+     * @return string
+     *
+     * returns the path to the users home directory
+     * @deprecated Use \OC::$server->getUserManager->getHome()
+     */
+    public static function getHome($uid) {
+        $user = \OC::$server->getUserManager()->get($uid);
+        if ($user) {
+            return $user->getHome();
+        } else {
+            return \OC::$server->getSystemConfig()->getValue('datadirectory', OC::$SERVERROOT . '/data') . '/' . $uid;
+        }
+    }
+
+    /**
+     * Get a list of all users
+     *
+     * @return array an array of all uids
+     *
+     * Get a list of all users.
+     * @param string $search
+     * @param integer $limit
+     * @param integer $offset
+     */
+    public static function getUsers($search = '', $limit = null, $offset = null) {
+        $users = \OC::$server->getUserManager()->search($search, $limit, $offset);
+        $uids = array();
+        foreach ($users as $user) {
+            $uids[] = $user->getUID();
+        }
+        return $uids;
+    }
+
+    /**
+     * Get a list of all users display name
+     *
+     * @param string $search
+     * @param int $limit
+     * @param int $offset
+     * @return array associative array with all display names (value) and corresponding uids (key)
+     *
+     * Get a list of all display names and user ids.
+     * @deprecated Use \OC::$server->getUserManager->searchDisplayName($search, $limit, $offset) instead.
+     */
+    public static function getDisplayNames($search = '', $limit = null, $offset = null) {
+        $displayNames = array();
+        $users = \OC::$server->getUserManager()->searchDisplayName($search, $limit, $offset);
+        foreach ($users as $user) {
+            $displayNames[$user->getUID()] = $user->getDisplayName();
+        }
+        return $displayNames;
+    }
+
+    /**
+     * check if a user exists
+     *
+     * @param string $uid the username
+     * @return boolean
+     */
+    public static function userExists($uid) {
+        return \OC::$server->getUserManager()->userExists($uid);
+    }
+
+    /**
+     * checks if a user is enabled
+     *
+     * @param string $uid
+     * @return bool
+     */
+    public static function isEnabled($uid) {
+        $user = \OC::$server->getUserManager()->get($uid);
+        if ($user) {
+            return $user->isEnabled();
+        } else {
+            return false;
+        }
+    }
+
+    /**
+     * Returns the first active backend from self::$_usedBackends.
+     *
+     * @return OCP\Authentication\IApacheBackend|null if no backend active, otherwise OCP\Authentication\IApacheBackend
+     */
+    private static function findFirstActiveUsedBackend() {
+        foreach (self::$_usedBackends as $backend) {
+            if ($backend instanceof OCP\Authentication\IApacheBackend) {
+                if ($backend->isSessionActive()) {
+                    return $backend;
+                }
+            }
+        }
+
+        return null;
+    }
 }

Spacing +9 added lines, -9 removed lines

@@ -94,7 +94,7 @@ 
 				case 'database':
 				case 'mysql':
 				case 'sqlite':
-					\OCP\Util::writeLog('core', 'Adding user backend ' . $backend . '.', \OCP\Util::DEBUG);
+					\OCP\Util::writeLog('core', 'Adding user backend '.$backend.'.', \OCP\Util::DEBUG);
 					self::$_usedBackends[$backend] = new \OC\User\Database();
 					\OC::$server->getUserManager()->registerBackend(self::$_usedBackends[$backend]);
 					break;
@@ -103,8 +103,8 @@ 
 					\OC::$server->getUserManager()->registerBackend(self::$_usedBackends[$backend]);
 					break;
 				default:
-					\OCP\Util::writeLog('core', 'Adding default user backend ' . $backend . '.', \OCP\Util::DEBUG);
-					$className = 'OC_USER_' . strtoupper($backend);
+					\OCP\Util::writeLog('core', 'Adding default user backend '.$backend.'.', \OCP\Util::DEBUG);
+					$className = 'OC_USER_'.strtoupper($backend);
 					self::$_usedBackends[$backend] = new $className();
 					\OC::$server->getUserManager()->registerBackend(self::$_usedBackends[$backend]);
 					break;
@@ -147,10 +147,10 @@ 
 					self::useBackend($backend);
 					self::$_setupedBackends[] = $i;
 				} else {
-					\OCP\Util::writeLog('core', 'User backend ' . $class . ' already initialized.', \OCP\Util::DEBUG);
+					\OCP\Util::writeLog('core', 'User backend '.$class.' already initialized.', \OCP\Util::DEBUG);
 				}
 			} else {
-				\OCP\Util::writeLog('core', 'User backend ' . $class . ' not found.', \OCP\Util::ERROR);
+				\OCP\Util::writeLog('core', 'User backend '.$class.' not found.', \OCP\Util::ERROR);
 			}
 		}
 	}
@@ -174,15 +174,15 @@ 
 			if (self::getUser() !== $uid) {
 				self::setUserId($uid);
 				$setUidAsDisplayName = true;
-				if($backend instanceof \OCP\UserInterface
+				if ($backend instanceof \OCP\UserInterface
 					&& $backend->implementsActions(\OC\User\Backend::GET_DISPLAYNAME)) {
 
 					$backendDisplayName = $backend->getDisplayName($uid);
-					if(is_string($backendDisplayName) && trim($backendDisplayName) !== '') {
+					if (is_string($backendDisplayName) && trim($backendDisplayName) !== '') {
 						$setUidAsDisplayName = false;
 					}
 				}
-				if($setUidAsDisplayName) {
+				if ($setUidAsDisplayName) {
 					self::setDisplayName($uid);
 				}
 				$userSession = self::getUserSession();
@@ -417,7 +417,7 @@ 
 		if ($user) {
 			return $user->getHome();
 		} else {
-			return \OC::$server->getSystemConfig()->getValue('datadirectory', OC::$SERVERROOT . '/data') . '/' . $uid;
+			return \OC::$server->getSystemConfig()->getValue('datadirectory', OC::$SERVERROOT.'/data').'/'.$uid;
 		}
 	}
 

apps/user_ldap/lib/User_LDAP.php

Indentation +501 added lines, -501 removed lines

@@ -45,508 +45,508 @@
 use OCP\Util;
 
 class User_LDAP extends BackendUtility implements \OCP\IUserBackend, \OCP\UserInterface, IUserLDAP {
-	/** @var string[] $homesToKill */
-	protected $homesToKill = array();
-
-	/** @var \OCP\IConfig */
-	protected $ocConfig;
-
-	/** @var INotificationManager */
-	protected $notificationManager;
-
-	/**
-	 * @param Access $access
-	 * @param \OCP\IConfig $ocConfig
-	 * @param \OCP\Notification\IManager $notificationManager
-	 */
-	public function __construct(Access $access, IConfig $ocConfig, INotificationManager $notificationManager) {
-		parent::__construct($access);
-		$this->ocConfig = $ocConfig;
-		$this->notificationManager = $notificationManager;
-	}
-
-	/**
-	 * checks whether the user is allowed to change his avatar in Nextcloud
-	 * @param string $uid the Nextcloud user name
-	 * @return boolean either the user can or cannot
-	 */
-	public function canChangeAvatar($uid) {
-		$user = $this->access->userManager->get($uid);
-		if(!$user instanceof User) {
-			return false;
-		}
-		if($user->getAvatarImage() === false) {
-			return true;
-		}
-
-		return false;
-	}
-
-	/**
-	 * returns the username for the given login name, if available
-	 *
-	 * @param string $loginName
-	 * @return string|false
-	 */
-	public function loginName2UserName($loginName) {
-		$cacheKey = 'loginName2UserName-'.$loginName;
-		$username = $this->access->connection->getFromCache($cacheKey);
-		if(!is_null($username)) {
-			return $username;
-		}
-
-		try {
-			$ldapRecord = $this->getLDAPUserByLoginName($loginName);
-			$user = $this->access->userManager->get($ldapRecord['dn'][0]);
-			if($user instanceof OfflineUser) {
-				// this path is not really possible, however get() is documented
-				// to return User or OfflineUser so we are very defensive here.
-				$this->access->connection->writeToCache($cacheKey, false);
-				return false;
-			}
-			$username = $user->getUsername();
-			$this->access->connection->writeToCache($cacheKey, $username);
-			return $username;
-		} catch (NotOnLDAP $e) {
-			$this->access->connection->writeToCache($cacheKey, false);
-			return false;
-		}
-	}
+    /** @var string[] $homesToKill */
+    protected $homesToKill = array();
+
+    /** @var \OCP\IConfig */
+    protected $ocConfig;
+
+    /** @var INotificationManager */
+    protected $notificationManager;
+
+    /**
+     * @param Access $access
+     * @param \OCP\IConfig $ocConfig
+     * @param \OCP\Notification\IManager $notificationManager
+     */
+    public function __construct(Access $access, IConfig $ocConfig, INotificationManager $notificationManager) {
+        parent::__construct($access);
+        $this->ocConfig = $ocConfig;
+        $this->notificationManager = $notificationManager;
+    }
+
+    /**
+     * checks whether the user is allowed to change his avatar in Nextcloud
+     * @param string $uid the Nextcloud user name
+     * @return boolean either the user can or cannot
+     */
+    public function canChangeAvatar($uid) {
+        $user = $this->access->userManager->get($uid);
+        if(!$user instanceof User) {
+            return false;
+        }
+        if($user->getAvatarImage() === false) {
+            return true;
+        }
+
+        return false;
+    }
+
+    /**
+     * returns the username for the given login name, if available
+     *
+     * @param string $loginName
+     * @return string|false
+     */
+    public function loginName2UserName($loginName) {
+        $cacheKey = 'loginName2UserName-'.$loginName;
+        $username = $this->access->connection->getFromCache($cacheKey);
+        if(!is_null($username)) {
+            return $username;
+        }
+
+        try {
+            $ldapRecord = $this->getLDAPUserByLoginName($loginName);
+            $user = $this->access->userManager->get($ldapRecord['dn'][0]);
+            if($user instanceof OfflineUser) {
+                // this path is not really possible, however get() is documented
+                // to return User or OfflineUser so we are very defensive here.
+                $this->access->connection->writeToCache($cacheKey, false);
+                return false;
+            }
+            $username = $user->getUsername();
+            $this->access->connection->writeToCache($cacheKey, $username);
+            return $username;
+        } catch (NotOnLDAP $e) {
+            $this->access->connection->writeToCache($cacheKey, false);
+            return false;
+        }
+    }
 	
-	/**
-	 * returns the username for the given LDAP DN, if available
-	 *
-	 * @param string $dn
-	 * @return string|false with the username
-	 */
-	public function dn2UserName($dn) {
-		return $this->access->dn2username($dn);
-	}
-
-	/**
-	 * returns an LDAP record based on a given login name
-	 *
-	 * @param string $loginName
-	 * @return array
-	 * @throws NotOnLDAP
-	 */
-	public function getLDAPUserByLoginName($loginName) {
-		//find out dn of the user name
-		$attrs = $this->access->userManager->getAttributes();
-		$users = $this->access->fetchUsersByLoginName($loginName, $attrs);
-		if(count($users) < 1) {
-			throw new NotOnLDAP('No user available for the given login name on ' .
-				$this->access->connection->ldapHost . ':' . $this->access->connection->ldapPort);
-		}
-		return $users[0];
-	}
-
-	/**
-	 * Check if the password is correct without logging in the user
-	 *
-	 * @param string $uid The username
-	 * @param string $password The password
-	 * @return false|string
-	 */
-	public function checkPassword($uid, $password) {
-		try {
-			$ldapRecord = $this->getLDAPUserByLoginName($uid);
-		} catch(NotOnLDAP $e) {
-			if($this->ocConfig->getSystemValue('loglevel', Util::WARN) === Util::DEBUG) {
-				\OC::$server->getLogger()->logException($e, ['app' => 'user_ldap']);
-			}
-			return false;
-		}
-		$dn = $ldapRecord['dn'][0];
-		$user = $this->access->userManager->get($dn);
-
-		if(!$user instanceof User) {
-			Util::writeLog('user_ldap',
-				'LDAP Login: Could not get user object for DN ' . $dn .
-				'. Maybe the LDAP entry has no set display name attribute?',
-				Util::WARN);
-			return false;
-		}
-		if($user->getUsername() !== false) {
-			//are the credentials OK?
-			if(!$this->access->areCredentialsValid($dn, $password)) {
-				return false;
-			}
-
-			$this->access->cacheUserExists($user->getUsername());
-			$user->processAttributes($ldapRecord);
-			$user->markLogin();
-
-			return $user->getUsername();
-		}
-
-		return false;
-	}
-
-	/**
-	 * Set password
-	 * @param string $uid The username
-	 * @param string $password The new password
-	 * @return bool
-	 */
-	public function setPassword($uid, $password) {
-		$user = $this->access->userManager->get($uid);
-
-		if(!$user instanceof User) {
-			throw new \Exception('LDAP setPassword: Could not get user object for uid ' . $uid .
-				'. Maybe the LDAP entry has no set display name attribute?');
-		}
-		if($user->getUsername() !== false && $this->access->setPassword($user->getDN(), $password)) {
-			$ldapDefaultPPolicyDN = $this->access->connection->ldapDefaultPPolicyDN;
-			$turnOnPasswordChange = $this->access->connection->turnOnPasswordChange;
-			if (!empty($ldapDefaultPPolicyDN) && (intval($turnOnPasswordChange) === 1)) {
-				//remove last password expiry warning if any
-				$notification = $this->notificationManager->createNotification();
-				$notification->setApp('user_ldap')
-					->setUser($uid)
-					->setObject('pwd_exp_warn', $uid)
-				;
-				$this->notificationManager->markProcessed($notification);
-			}
-			return true;
-		}
-
-		return false;
-	}
-
-	/**
-	 * Get a list of all users
-	 *
-	 * @param string $search
-	 * @param integer $limit
-	 * @param integer $offset
-	 * @return string[] an array of all uids
-	 */
-	public function getUsers($search = '', $limit = 10, $offset = 0) {
-		$search = $this->access->escapeFilterPart($search, true);
-		$cachekey = 'getUsers-'.$search.'-'.$limit.'-'.$offset;
-
-		//check if users are cached, if so return
-		$ldap_users = $this->access->connection->getFromCache($cachekey);
-		if(!is_null($ldap_users)) {
-			return $ldap_users;
-		}
-
-		// if we'd pass -1 to LDAP search, we'd end up in a Protocol
-		// error. With a limit of 0, we get 0 results. So we pass null.
-		if($limit <= 0) {
-			$limit = null;
-		}
-		$filter = $this->access->combineFilterWithAnd(array(
-			$this->access->connection->ldapUserFilter,
-			$this->access->connection->ldapUserDisplayName . '=*',
-			$this->access->getFilterPartForUserSearch($search)
-		));
-
-		Util::writeLog('user_ldap',
-			'getUsers: Options: search '.$search.' limit '.$limit.' offset '.$offset.' Filter: '.$filter,
-			Util::DEBUG);
-		//do the search and translate results to owncloud names
-		$ldap_users = $this->access->fetchListOfUsers(
-			$filter,
-			$this->access->userManager->getAttributes(true),
-			$limit, $offset);
-		$ldap_users = $this->access->nextcloudUserNames($ldap_users);
-		Util::writeLog('user_ldap', 'getUsers: '.count($ldap_users). ' Users found', Util::DEBUG);
-
-		$this->access->connection->writeToCache($cachekey, $ldap_users);
-		return $ldap_users;
-	}
-
-	/**
-	 * checks whether a user is still available on LDAP
-	 *
-	 * @param string|\OCA\User_LDAP\User\User $user either the Nextcloud user
-	 * name or an instance of that user
-	 * @return bool
-	 * @throws \Exception
-	 * @throws \OC\ServerNotAvailableException
-	 */
-	public function userExistsOnLDAP($user) {
-		if(is_string($user)) {
-			$user = $this->access->userManager->get($user);
-		}
-		if(is_null($user)) {
-			return false;
-		}
-
-		$dn = $user->getDN();
-		//check if user really still exists by reading its entry
-		if(!is_array($this->access->readAttribute($dn, '', $this->access->connection->ldapUserFilter))) {
-			$lcr = $this->access->connection->getConnectionResource();
-			if(is_null($lcr)) {
-				throw new \Exception('No LDAP Connection to server ' . $this->access->connection->ldapHost);
-			}
-
-			try {
-				$uuid = $this->access->getUserMapper()->getUUIDByDN($dn);
-				if(!$uuid) {
-					return false;
-				}
-				$newDn = $this->access->getUserDnByUuid($uuid);
-				//check if renamed user is still valid by reapplying the ldap filter
-				if(!is_array($this->access->readAttribute($newDn, '', $this->access->connection->ldapUserFilter))) {
-					return false;
-				}
-				$this->access->getUserMapper()->setDNbyUUID($newDn, $uuid);
-				return true;
-			} catch (\Exception $e) {
-				return false;
-			}
-		}
-
-		if($user instanceof OfflineUser) {
-			$user->unmark();
-		}
-
-		return true;
-	}
-
-	/**
-	 * check if a user exists
-	 * @param string $uid the username
-	 * @return boolean
-	 * @throws \Exception when connection could not be established
-	 */
-	public function userExists($uid) {
-		$userExists = $this->access->connection->getFromCache('userExists'.$uid);
-		if(!is_null($userExists)) {
-			return (bool)$userExists;
-		}
-		//getting dn, if false the user does not exist. If dn, he may be mapped only, requires more checking.
-		$user = $this->access->userManager->get($uid);
-
-		if(is_null($user)) {
-			Util::writeLog('user_ldap', 'No DN found for '.$uid.' on '.
-				$this->access->connection->ldapHost, Util::DEBUG);
-			$this->access->connection->writeToCache('userExists'.$uid, false);
-			return false;
-		} else if($user instanceof OfflineUser) {
-			//express check for users marked as deleted. Returning true is
-			//necessary for cleanup
-			return true;
-		}
-
-		$result = $this->userExistsOnLDAP($user);
-		$this->access->connection->writeToCache('userExists'.$uid, $result);
-		if($result === true) {
-			$user->update();
-		}
-		return $result;
-	}
-
-	/**
-	* returns whether a user was deleted in LDAP
-	*
-	* @param string $uid The username of the user to delete
-	* @return bool
-	*/
-	public function deleteUser($uid) {
-		$marked = $this->ocConfig->getUserValue($uid, 'user_ldap', 'isDeleted', 0);
-		if(intval($marked) === 0) {
-			\OC::$server->getLogger()->notice(
-				'User '.$uid . ' is not marked as deleted, not cleaning up.',
-				array('app' => 'user_ldap'));
-			return false;
-		}
-		\OC::$server->getLogger()->info('Cleaning up after user ' . $uid,
-			array('app' => 'user_ldap'));
-
-		//Get Home Directory out of user preferences so we can return it later,
-		//necessary for removing directories as done by OC_User.
-		$home = $this->ocConfig->getUserValue($uid, 'user_ldap', 'homePath', '');
-		$this->homesToKill[$uid] = $home;
-		$this->access->getUserMapper()->unmap($uid);
-
-		return true;
-	}
-
-	/**
-	 * get the user's home directory
-	 *
-	 * @param string $uid the username
-	 * @return bool|string
-	 * @throws NoUserException
-	 * @throws \Exception
-	 */
-	public function getHome($uid) {
-		if(isset($this->homesToKill[$uid]) && !empty($this->homesToKill[$uid])) {
-			//a deleted user who needs some clean up
-			return $this->homesToKill[$uid];
-		}
-
-		// user Exists check required as it is not done in user proxy!
-		if(!$this->userExists($uid)) {
-			return false;
-		}
-
-		$cacheKey = 'getHome'.$uid;
-		$path = $this->access->connection->getFromCache($cacheKey);
-		if(!is_null($path)) {
-			return $path;
-		}
-
-		$user = $this->access->userManager->get($uid);
-		if(is_null($user) || ($user instanceof OfflineUser && !$this->userExistsOnLDAP($user->getOCName()))) {
-			throw new NoUserException($uid . ' is not a valid user anymore');
-		}
-		if($user instanceof OfflineUser) {
-			// apparently this user survived the userExistsOnLDAP check,
-			// we request the user instance again in order to retrieve a User
-			// instance instead
-			$user = $this->access->userManager->get($uid);
-		}
-		$path = $user->getHomePath();
-		$this->access->cacheUserHome($uid, $path);
-
-		return $path;
-	}
-
-	/**
-	 * get display name of the user
-	 * @param string $uid user ID of the user
-	 * @return string|false display name
-	 */
-	public function getDisplayName($uid) {
-		if(!$this->userExists($uid)) {
-			return false;
-		}
-
-		$cacheKey = 'getDisplayName'.$uid;
-		if(!is_null($displayName = $this->access->connection->getFromCache($cacheKey))) {
-			return $displayName;
-		}
-
-		//Check whether the display name is configured to have a 2nd feature
-		$additionalAttribute = $this->access->connection->ldapUserDisplayName2;
-		$displayName2 = '';
-		if ($additionalAttribute !== '') {
-			$displayName2 = $this->access->readAttribute(
-				$this->access->username2dn($uid),
-				$additionalAttribute);
-		}
-
-		$displayName = $this->access->readAttribute(
-			$this->access->username2dn($uid),
-			$this->access->connection->ldapUserDisplayName);
-
-		if($displayName && (count($displayName) > 0)) {
-			$displayName = $displayName[0];
-
-			if (is_array($displayName2)){
-				$displayName2 = count($displayName2) > 0 ? $displayName2[0] : '';
-			}
-
-			$user = $this->access->userManager->get($uid);
-			if ($user instanceof User) {
-				$displayName = $user->composeAndStoreDisplayName($displayName, $displayName2);
-				$this->access->connection->writeToCache($cacheKey, $displayName);
-			}
-			if ($user instanceof OfflineUser) {
-				/** @var OfflineUser $user*/
-				$displayName = $user->getDisplayName();
-			}
-			return $displayName;
-		}
-
-		return null;
-	}
-
-	/**
-	 * Get a list of all display names
-	 *
-	 * @param string $search
-	 * @param string|null $limit
-	 * @param string|null $offset
-	 * @return array an array of all displayNames (value) and the corresponding uids (key)
-	 */
-	public function getDisplayNames($search = '', $limit = null, $offset = null) {
-		$cacheKey = 'getDisplayNames-'.$search.'-'.$limit.'-'.$offset;
-		if(!is_null($displayNames = $this->access->connection->getFromCache($cacheKey))) {
-			return $displayNames;
-		}
-
-		$displayNames = array();
-		$users = $this->getUsers($search, $limit, $offset);
-		foreach ($users as $user) {
-			$displayNames[$user] = $this->getDisplayName($user);
-		}
-		$this->access->connection->writeToCache($cacheKey, $displayNames);
-		return $displayNames;
-	}
-
-	/**
-	* Check if backend implements actions
-	* @param int $actions bitwise-or'ed actions
-	* @return boolean
-	*
-	* Returns the supported actions as int to be
-	* compared with \OC\User\Backend::CREATE_USER etc.
-	*/
-	public function implementsActions($actions) {
-		return (bool)((Backend::CHECK_PASSWORD
-			| Backend::GET_HOME
-			| Backend::GET_DISPLAYNAME
-			| Backend::PROVIDE_AVATAR
-			| Backend::COUNT_USERS
-			| ((intval($this->access->connection->turnOnPasswordChange) === 1)?(Backend::SET_PASSWORD):0))
-			& $actions);
-	}
-
-	/**
-	 * @return bool
-	 */
-	public function hasUserListings() {
-		return true;
-	}
-
-	/**
-	 * counts the users in LDAP
-	 *
-	 * @return int|bool
-	 */
-	public function countUsers() {
-		$filter = $this->access->getFilterForUserCount();
-		$cacheKey = 'countUsers-'.$filter;
-		if(!is_null($entries = $this->access->connection->getFromCache($cacheKey))) {
-			return $entries;
-		}
-		$entries = $this->access->countUsers($filter);
-		$this->access->connection->writeToCache($cacheKey, $entries);
-		return $entries;
-	}
-
-	/**
-	 * Backend name to be shown in user management
-	 * @return string the name of the backend to be shown
-	 */
-	public function getBackendName(){
-		return 'LDAP';
-	}
+    /**
+     * returns the username for the given LDAP DN, if available
+     *
+     * @param string $dn
+     * @return string|false with the username
+     */
+    public function dn2UserName($dn) {
+        return $this->access->dn2username($dn);
+    }
+
+    /**
+     * returns an LDAP record based on a given login name
+     *
+     * @param string $loginName
+     * @return array
+     * @throws NotOnLDAP
+     */
+    public function getLDAPUserByLoginName($loginName) {
+        //find out dn of the user name
+        $attrs = $this->access->userManager->getAttributes();
+        $users = $this->access->fetchUsersByLoginName($loginName, $attrs);
+        if(count($users) < 1) {
+            throw new NotOnLDAP('No user available for the given login name on ' .
+                $this->access->connection->ldapHost . ':' . $this->access->connection->ldapPort);
+        }
+        return $users[0];
+    }
+
+    /**
+     * Check if the password is correct without logging in the user
+     *
+     * @param string $uid The username
+     * @param string $password The password
+     * @return false|string
+     */
+    public function checkPassword($uid, $password) {
+        try {
+            $ldapRecord = $this->getLDAPUserByLoginName($uid);
+        } catch(NotOnLDAP $e) {
+            if($this->ocConfig->getSystemValue('loglevel', Util::WARN) === Util::DEBUG) {
+                \OC::$server->getLogger()->logException($e, ['app' => 'user_ldap']);
+            }
+            return false;
+        }
+        $dn = $ldapRecord['dn'][0];
+        $user = $this->access->userManager->get($dn);
+
+        if(!$user instanceof User) {
+            Util::writeLog('user_ldap',
+                'LDAP Login: Could not get user object for DN ' . $dn .
+                '. Maybe the LDAP entry has no set display name attribute?',
+                Util::WARN);
+            return false;
+        }
+        if($user->getUsername() !== false) {
+            //are the credentials OK?
+            if(!$this->access->areCredentialsValid($dn, $password)) {
+                return false;
+            }
+
+            $this->access->cacheUserExists($user->getUsername());
+            $user->processAttributes($ldapRecord);
+            $user->markLogin();
+
+            return $user->getUsername();
+        }
+
+        return false;
+    }
+
+    /**
+     * Set password
+     * @param string $uid The username
+     * @param string $password The new password
+     * @return bool
+     */
+    public function setPassword($uid, $password) {
+        $user = $this->access->userManager->get($uid);
+
+        if(!$user instanceof User) {
+            throw new \Exception('LDAP setPassword: Could not get user object for uid ' . $uid .
+                '. Maybe the LDAP entry has no set display name attribute?');
+        }
+        if($user->getUsername() !== false && $this->access->setPassword($user->getDN(), $password)) {
+            $ldapDefaultPPolicyDN = $this->access->connection->ldapDefaultPPolicyDN;
+            $turnOnPasswordChange = $this->access->connection->turnOnPasswordChange;
+            if (!empty($ldapDefaultPPolicyDN) && (intval($turnOnPasswordChange) === 1)) {
+                //remove last password expiry warning if any
+                $notification = $this->notificationManager->createNotification();
+                $notification->setApp('user_ldap')
+                    ->setUser($uid)
+                    ->setObject('pwd_exp_warn', $uid)
+                ;
+                $this->notificationManager->markProcessed($notification);
+            }
+            return true;
+        }
+
+        return false;
+    }
+
+    /**
+     * Get a list of all users
+     *
+     * @param string $search
+     * @param integer $limit
+     * @param integer $offset
+     * @return string[] an array of all uids
+     */
+    public function getUsers($search = '', $limit = 10, $offset = 0) {
+        $search = $this->access->escapeFilterPart($search, true);
+        $cachekey = 'getUsers-'.$search.'-'.$limit.'-'.$offset;
+
+        //check if users are cached, if so return
+        $ldap_users = $this->access->connection->getFromCache($cachekey);
+        if(!is_null($ldap_users)) {
+            return $ldap_users;
+        }
+
+        // if we'd pass -1 to LDAP search, we'd end up in a Protocol
+        // error. With a limit of 0, we get 0 results. So we pass null.
+        if($limit <= 0) {
+            $limit = null;
+        }
+        $filter = $this->access->combineFilterWithAnd(array(
+            $this->access->connection->ldapUserFilter,
+            $this->access->connection->ldapUserDisplayName . '=*',
+            $this->access->getFilterPartForUserSearch($search)
+        ));
+
+        Util::writeLog('user_ldap',
+            'getUsers: Options: search '.$search.' limit '.$limit.' offset '.$offset.' Filter: '.$filter,
+            Util::DEBUG);
+        //do the search and translate results to owncloud names
+        $ldap_users = $this->access->fetchListOfUsers(
+            $filter,
+            $this->access->userManager->getAttributes(true),
+            $limit, $offset);
+        $ldap_users = $this->access->nextcloudUserNames($ldap_users);
+        Util::writeLog('user_ldap', 'getUsers: '.count($ldap_users). ' Users found', Util::DEBUG);
+
+        $this->access->connection->writeToCache($cachekey, $ldap_users);
+        return $ldap_users;
+    }
+
+    /**
+     * checks whether a user is still available on LDAP
+     *
+     * @param string|\OCA\User_LDAP\User\User $user either the Nextcloud user
+     * name or an instance of that user
+     * @return bool
+     * @throws \Exception
+     * @throws \OC\ServerNotAvailableException
+     */
+    public function userExistsOnLDAP($user) {
+        if(is_string($user)) {
+            $user = $this->access->userManager->get($user);
+        }
+        if(is_null($user)) {
+            return false;
+        }
+
+        $dn = $user->getDN();
+        //check if user really still exists by reading its entry
+        if(!is_array($this->access->readAttribute($dn, '', $this->access->connection->ldapUserFilter))) {
+            $lcr = $this->access->connection->getConnectionResource();
+            if(is_null($lcr)) {
+                throw new \Exception('No LDAP Connection to server ' . $this->access->connection->ldapHost);
+            }
+
+            try {
+                $uuid = $this->access->getUserMapper()->getUUIDByDN($dn);
+                if(!$uuid) {
+                    return false;
+                }
+                $newDn = $this->access->getUserDnByUuid($uuid);
+                //check if renamed user is still valid by reapplying the ldap filter
+                if(!is_array($this->access->readAttribute($newDn, '', $this->access->connection->ldapUserFilter))) {
+                    return false;
+                }
+                $this->access->getUserMapper()->setDNbyUUID($newDn, $uuid);
+                return true;
+            } catch (\Exception $e) {
+                return false;
+            }
+        }
+
+        if($user instanceof OfflineUser) {
+            $user->unmark();
+        }
+
+        return true;
+    }
+
+    /**
+     * check if a user exists
+     * @param string $uid the username
+     * @return boolean
+     * @throws \Exception when connection could not be established
+     */
+    public function userExists($uid) {
+        $userExists = $this->access->connection->getFromCache('userExists'.$uid);
+        if(!is_null($userExists)) {
+            return (bool)$userExists;
+        }
+        //getting dn, if false the user does not exist. If dn, he may be mapped only, requires more checking.
+        $user = $this->access->userManager->get($uid);
+
+        if(is_null($user)) {
+            Util::writeLog('user_ldap', 'No DN found for '.$uid.' on '.
+                $this->access->connection->ldapHost, Util::DEBUG);
+            $this->access->connection->writeToCache('userExists'.$uid, false);
+            return false;
+        } else if($user instanceof OfflineUser) {
+            //express check for users marked as deleted. Returning true is
+            //necessary for cleanup
+            return true;
+        }
+
+        $result = $this->userExistsOnLDAP($user);
+        $this->access->connection->writeToCache('userExists'.$uid, $result);
+        if($result === true) {
+            $user->update();
+        }
+        return $result;
+    }
+
+    /**
+     * returns whether a user was deleted in LDAP
+     *
+     * @param string $uid The username of the user to delete
+     * @return bool
+     */
+    public function deleteUser($uid) {
+        $marked = $this->ocConfig->getUserValue($uid, 'user_ldap', 'isDeleted', 0);
+        if(intval($marked) === 0) {
+            \OC::$server->getLogger()->notice(
+                'User '.$uid . ' is not marked as deleted, not cleaning up.',
+                array('app' => 'user_ldap'));
+            return false;
+        }
+        \OC::$server->getLogger()->info('Cleaning up after user ' . $uid,
+            array('app' => 'user_ldap'));
+
+        //Get Home Directory out of user preferences so we can return it later,
+        //necessary for removing directories as done by OC_User.
+        $home = $this->ocConfig->getUserValue($uid, 'user_ldap', 'homePath', '');
+        $this->homesToKill[$uid] = $home;
+        $this->access->getUserMapper()->unmap($uid);
+
+        return true;
+    }
+
+    /**
+     * get the user's home directory
+     *
+     * @param string $uid the username
+     * @return bool|string
+     * @throws NoUserException
+     * @throws \Exception
+     */
+    public function getHome($uid) {
+        if(isset($this->homesToKill[$uid]) && !empty($this->homesToKill[$uid])) {
+            //a deleted user who needs some clean up
+            return $this->homesToKill[$uid];
+        }
+
+        // user Exists check required as it is not done in user proxy!
+        if(!$this->userExists($uid)) {
+            return false;
+        }
+
+        $cacheKey = 'getHome'.$uid;
+        $path = $this->access->connection->getFromCache($cacheKey);
+        if(!is_null($path)) {
+            return $path;
+        }
+
+        $user = $this->access->userManager->get($uid);
+        if(is_null($user) || ($user instanceof OfflineUser && !$this->userExistsOnLDAP($user->getOCName()))) {
+            throw new NoUserException($uid . ' is not a valid user anymore');
+        }
+        if($user instanceof OfflineUser) {
+            // apparently this user survived the userExistsOnLDAP check,
+            // we request the user instance again in order to retrieve a User
+            // instance instead
+            $user = $this->access->userManager->get($uid);
+        }
+        $path = $user->getHomePath();
+        $this->access->cacheUserHome($uid, $path);
+
+        return $path;
+    }
+
+    /**
+     * get display name of the user
+     * @param string $uid user ID of the user
+     * @return string|false display name
+     */
+    public function getDisplayName($uid) {
+        if(!$this->userExists($uid)) {
+            return false;
+        }
+
+        $cacheKey = 'getDisplayName'.$uid;
+        if(!is_null($displayName = $this->access->connection->getFromCache($cacheKey))) {
+            return $displayName;
+        }
+
+        //Check whether the display name is configured to have a 2nd feature
+        $additionalAttribute = $this->access->connection->ldapUserDisplayName2;
+        $displayName2 = '';
+        if ($additionalAttribute !== '') {
+            $displayName2 = $this->access->readAttribute(
+                $this->access->username2dn($uid),
+                $additionalAttribute);
+        }
+
+        $displayName = $this->access->readAttribute(
+            $this->access->username2dn($uid),
+            $this->access->connection->ldapUserDisplayName);
+
+        if($displayName && (count($displayName) > 0)) {
+            $displayName = $displayName[0];
+
+            if (is_array($displayName2)){
+                $displayName2 = count($displayName2) > 0 ? $displayName2[0] : '';
+            }
+
+            $user = $this->access->userManager->get($uid);
+            if ($user instanceof User) {
+                $displayName = $user->composeAndStoreDisplayName($displayName, $displayName2);
+                $this->access->connection->writeToCache($cacheKey, $displayName);
+            }
+            if ($user instanceof OfflineUser) {
+                /** @var OfflineUser $user*/
+                $displayName = $user->getDisplayName();
+            }
+            return $displayName;
+        }
+
+        return null;
+    }
+
+    /**
+     * Get a list of all display names
+     *
+     * @param string $search
+     * @param string|null $limit
+     * @param string|null $offset
+     * @return array an array of all displayNames (value) and the corresponding uids (key)
+     */
+    public function getDisplayNames($search = '', $limit = null, $offset = null) {
+        $cacheKey = 'getDisplayNames-'.$search.'-'.$limit.'-'.$offset;
+        if(!is_null($displayNames = $this->access->connection->getFromCache($cacheKey))) {
+            return $displayNames;
+        }
+
+        $displayNames = array();
+        $users = $this->getUsers($search, $limit, $offset);
+        foreach ($users as $user) {
+            $displayNames[$user] = $this->getDisplayName($user);
+        }
+        $this->access->connection->writeToCache($cacheKey, $displayNames);
+        return $displayNames;
+    }
+
+    /**
+     * Check if backend implements actions
+     * @param int $actions bitwise-or'ed actions
+     * @return boolean
+     *
+     * Returns the supported actions as int to be
+     * compared with \OC\User\Backend::CREATE_USER etc.
+     */
+    public function implementsActions($actions) {
+        return (bool)((Backend::CHECK_PASSWORD
+            | Backend::GET_HOME
+            | Backend::GET_DISPLAYNAME
+            | Backend::PROVIDE_AVATAR
+            | Backend::COUNT_USERS
+            | ((intval($this->access->connection->turnOnPasswordChange) === 1)?(Backend::SET_PASSWORD):0))
+            & $actions);
+    }
+
+    /**
+     * @return bool
+     */
+    public function hasUserListings() {
+        return true;
+    }
+
+    /**
+     * counts the users in LDAP
+     *
+     * @return int|bool
+     */
+    public function countUsers() {
+        $filter = $this->access->getFilterForUserCount();
+        $cacheKey = 'countUsers-'.$filter;
+        if(!is_null($entries = $this->access->connection->getFromCache($cacheKey))) {
+            return $entries;
+        }
+        $entries = $this->access->countUsers($filter);
+        $this->access->connection->writeToCache($cacheKey, $entries);
+        return $entries;
+    }
+
+    /**
+     * Backend name to be shown in user management
+     * @return string the name of the backend to be shown
+     */
+    public function getBackendName(){
+        return 'LDAP';
+    }
 	
-	/**
-	 * Return access for LDAP interaction.
-	 * @param string $uid
-	 * @return Access instance of Access for LDAP interaction
-	 */
-	public function getLDAPAccess($uid) {
-		return $this->access;
-	}
+    /**
+     * Return access for LDAP interaction.
+     * @param string $uid
+     * @return Access instance of Access for LDAP interaction
+     */
+    public function getLDAPAccess($uid) {
+        return $this->access;
+    }
 	
-	/**
-	 * Return LDAP connection resource from a cloned connection.
-	 * The cloned connection needs to be closed manually.
-	 * of the current access.
-	 * @param string $uid
-	 * @return resource of the LDAP connection
-	 */
-	public function getNewLDAPConnection($uid) {
-		$connection = clone $this->access->getConnection();
-		return $connection->getConnectionResource();
-	}
+    /**
+     * Return LDAP connection resource from a cloned connection.
+     * The cloned connection needs to be closed manually.
+     * of the current access.
+     * @param string $uid
+     * @return resource of the LDAP connection
+     */
+    public function getNewLDAPConnection($uid) {
+        $connection = clone $this->access->getConnection();
+        return $connection->getConnectionResource();
+    }
 }

Spacing +51 added lines, -51 removed lines

@@ -72,10 +72,10 @@ 
 	 */
 	public function canChangeAvatar($uid) {
 		$user = $this->access->userManager->get($uid);
-		if(!$user instanceof User) {
+		if (!$user instanceof User) {
 			return false;
 		}
-		if($user->getAvatarImage() === false) {
+		if ($user->getAvatarImage() === false) {
 			return true;
 		}
 
@@ -91,14 +91,14 @@ 
 	public function loginName2UserName($loginName) {
 		$cacheKey = 'loginName2UserName-'.$loginName;
 		$username = $this->access->connection->getFromCache($cacheKey);
-		if(!is_null($username)) {
+		if (!is_null($username)) {
 			return $username;
 		}
 
 		try {
 			$ldapRecord = $this->getLDAPUserByLoginName($loginName);
 			$user = $this->access->userManager->get($ldapRecord['dn'][0]);
-			if($user instanceof OfflineUser) {
+			if ($user instanceof OfflineUser) {
 				// this path is not really possible, however get() is documented
 				// to return User or OfflineUser so we are very defensive here.
 				$this->access->connection->writeToCache($cacheKey, false);
@@ -134,9 +134,9 @@ 
 		//find out dn of the user name
 		$attrs = $this->access->userManager->getAttributes();
 		$users = $this->access->fetchUsersByLoginName($loginName, $attrs);
-		if(count($users) < 1) {
-			throw new NotOnLDAP('No user available for the given login name on ' .
-				$this->access->connection->ldapHost . ':' . $this->access->connection->ldapPort);
+		if (count($users) < 1) {
+			throw new NotOnLDAP('No user available for the given login name on '.
+				$this->access->connection->ldapHost.':'.$this->access->connection->ldapPort);
 		}
 		return $users[0];
 	}
@@ -151,8 +151,8 @@ 
 	public function checkPassword($uid, $password) {
 		try {
 			$ldapRecord = $this->getLDAPUserByLoginName($uid);
-		} catch(NotOnLDAP $e) {
-			if($this->ocConfig->getSystemValue('loglevel', Util::WARN) === Util::DEBUG) {
+		} catch (NotOnLDAP $e) {
+			if ($this->ocConfig->getSystemValue('loglevel', Util::WARN) === Util::DEBUG) {
 				\OC::$server->getLogger()->logException($e, ['app' => 'user_ldap']);
 			}
 			return false;
@@ -160,16 +160,16 @@ 
 		$dn = $ldapRecord['dn'][0];
 		$user = $this->access->userManager->get($dn);
 
-		if(!$user instanceof User) {
+		if (!$user instanceof User) {
 			Util::writeLog('user_ldap',
-				'LDAP Login: Could not get user object for DN ' . $dn .
+				'LDAP Login: Could not get user object for DN '.$dn.
 				'. Maybe the LDAP entry has no set display name attribute?',
 				Util::WARN);
 			return false;
 		}
-		if($user->getUsername() !== false) {
+		if ($user->getUsername() !== false) {
 			//are the credentials OK?
-			if(!$this->access->areCredentialsValid($dn, $password)) {
+			if (!$this->access->areCredentialsValid($dn, $password)) {
 				return false;
 			}
 
@@ -192,11 +192,11 @@ 
 	public function setPassword($uid, $password) {
 		$user = $this->access->userManager->get($uid);
 
-		if(!$user instanceof User) {
-			throw new \Exception('LDAP setPassword: Could not get user object for uid ' . $uid .
+		if (!$user instanceof User) {
+			throw new \Exception('LDAP setPassword: Could not get user object for uid '.$uid.
 				'. Maybe the LDAP entry has no set display name attribute?');
 		}
-		if($user->getUsername() !== false && $this->access->setPassword($user->getDN(), $password)) {
+		if ($user->getUsername() !== false && $this->access->setPassword($user->getDN(), $password)) {
 			$ldapDefaultPPolicyDN = $this->access->connection->ldapDefaultPPolicyDN;
 			$turnOnPasswordChange = $this->access->connection->turnOnPasswordChange;
 			if (!empty($ldapDefaultPPolicyDN) && (intval($turnOnPasswordChange) === 1)) {
@@ -228,18 +228,18 @@ 
 
 		//check if users are cached, if so return
 		$ldap_users = $this->access->connection->getFromCache($cachekey);
-		if(!is_null($ldap_users)) {
+		if (!is_null($ldap_users)) {
 			return $ldap_users;
 		}
 
 		// if we'd pass -1 to LDAP search, we'd end up in a Protocol
 		// error. With a limit of 0, we get 0 results. So we pass null.
-		if($limit <= 0) {
+		if ($limit <= 0) {
 			$limit = null;
 		}
 		$filter = $this->access->combineFilterWithAnd(array(
 			$this->access->connection->ldapUserFilter,
-			$this->access->connection->ldapUserDisplayName . '=*',
+			$this->access->connection->ldapUserDisplayName.'=*',
 			$this->access->getFilterPartForUserSearch($search)
 		));
 
@@ -252,7 +252,7 @@ 
 			$this->access->userManager->getAttributes(true),
 			$limit, $offset);
 		$ldap_users = $this->access->nextcloudUserNames($ldap_users);
-		Util::writeLog('user_ldap', 'getUsers: '.count($ldap_users). ' Users found', Util::DEBUG);
+		Util::writeLog('user_ldap', 'getUsers: '.count($ldap_users).' Users found', Util::DEBUG);
 
 		$this->access->connection->writeToCache($cachekey, $ldap_users);
 		return $ldap_users;
@@ -268,29 +268,29 @@ 
 	 * @throws \OC\ServerNotAvailableException
 	 */
 	public function userExistsOnLDAP($user) {
-		if(is_string($user)) {
+		if (is_string($user)) {
 			$user = $this->access->userManager->get($user);
 		}
-		if(is_null($user)) {
+		if (is_null($user)) {
 			return false;
 		}
 
 		$dn = $user->getDN();
 		//check if user really still exists by reading its entry
-		if(!is_array($this->access->readAttribute($dn, '', $this->access->connection->ldapUserFilter))) {
+		if (!is_array($this->access->readAttribute($dn, '', $this->access->connection->ldapUserFilter))) {
 			$lcr = $this->access->connection->getConnectionResource();
-			if(is_null($lcr)) {
-				throw new \Exception('No LDAP Connection to server ' . $this->access->connection->ldapHost);
+			if (is_null($lcr)) {
+				throw new \Exception('No LDAP Connection to server '.$this->access->connection->ldapHost);
 			}
 
 			try {
 				$uuid = $this->access->getUserMapper()->getUUIDByDN($dn);
-				if(!$uuid) {
+				if (!$uuid) {
 					return false;
 				}
 				$newDn = $this->access->getUserDnByUuid($uuid);
 				//check if renamed user is still valid by reapplying the ldap filter
-				if(!is_array($this->access->readAttribute($newDn, '', $this->access->connection->ldapUserFilter))) {
+				if (!is_array($this->access->readAttribute($newDn, '', $this->access->connection->ldapUserFilter))) {
 					return false;
 				}
 				$this->access->getUserMapper()->setDNbyUUID($newDn, $uuid);
@@ -300,7 +300,7 @@ 
 			}
 		}
 
-		if($user instanceof OfflineUser) {
+		if ($user instanceof OfflineUser) {
 			$user->unmark();
 		}
 
@@ -315,18 +315,18 @@ 
 	 */
 	public function userExists($uid) {
 		$userExists = $this->access->connection->getFromCache('userExists'.$uid);
-		if(!is_null($userExists)) {
-			return (bool)$userExists;
+		if (!is_null($userExists)) {
+			return (bool) $userExists;
 		}
 		//getting dn, if false the user does not exist. If dn, he may be mapped only, requires more checking.
 		$user = $this->access->userManager->get($uid);
 
-		if(is_null($user)) {
+		if (is_null($user)) {
 			Util::writeLog('user_ldap', 'No DN found for '.$uid.' on '.
 				$this->access->connection->ldapHost, Util::DEBUG);
 			$this->access->connection->writeToCache('userExists'.$uid, false);
 			return false;
-		} else if($user instanceof OfflineUser) {
+		} else if ($user instanceof OfflineUser) {
 			//express check for users marked as deleted. Returning true is
 			//necessary for cleanup
 			return true;
@@ -334,7 +334,7 @@ 
 
 		$result = $this->userExistsOnLDAP($user);
 		$this->access->connection->writeToCache('userExists'.$uid, $result);
-		if($result === true) {
+		if ($result === true) {
 			$user->update();
 		}
 		return $result;
@@ -348,13 +348,13 @@ 
 	*/
 	public function deleteUser($uid) {
 		$marked = $this->ocConfig->getUserValue($uid, 'user_ldap', 'isDeleted', 0);
-		if(intval($marked) === 0) {
+		if (intval($marked) === 0) {
 			\OC::$server->getLogger()->notice(
-				'User '.$uid . ' is not marked as deleted, not cleaning up.',
+				'User '.$uid.' is not marked as deleted, not cleaning up.',
 				array('app' => 'user_ldap'));
 			return false;
 		}
-		\OC::$server->getLogger()->info('Cleaning up after user ' . $uid,
+		\OC::$server->getLogger()->info('Cleaning up after user '.$uid,
 			array('app' => 'user_ldap'));
 
 		//Get Home Directory out of user preferences so we can return it later,
@@ -375,27 +375,27 @@ 
 	 * @throws \Exception
 	 */
 	public function getHome($uid) {
-		if(isset($this->homesToKill[$uid]) && !empty($this->homesToKill[$uid])) {
+		if (isset($this->homesToKill[$uid]) && !empty($this->homesToKill[$uid])) {
 			//a deleted user who needs some clean up
 			return $this->homesToKill[$uid];
 		}
 
 		// user Exists check required as it is not done in user proxy!
-		if(!$this->userExists($uid)) {
+		if (!$this->userExists($uid)) {
 			return false;
 		}
 
 		$cacheKey = 'getHome'.$uid;
 		$path = $this->access->connection->getFromCache($cacheKey);
-		if(!is_null($path)) {
+		if (!is_null($path)) {
 			return $path;
 		}
 
 		$user = $this->access->userManager->get($uid);
-		if(is_null($user) || ($user instanceof OfflineUser && !$this->userExistsOnLDAP($user->getOCName()))) {
-			throw new NoUserException($uid . ' is not a valid user anymore');
+		if (is_null($user) || ($user instanceof OfflineUser && !$this->userExistsOnLDAP($user->getOCName()))) {
+			throw new NoUserException($uid.' is not a valid user anymore');
 		}
-		if($user instanceof OfflineUser) {
+		if ($user instanceof OfflineUser) {
 			// apparently this user survived the userExistsOnLDAP check,
 			// we request the user instance again in order to retrieve a User
 			// instance instead
@@ -413,12 +413,12 @@ 
 	 * @return string|false display name
 	 */
 	public function getDisplayName($uid) {
-		if(!$this->userExists($uid)) {
+		if (!$this->userExists($uid)) {
 			return false;
 		}
 
 		$cacheKey = 'getDisplayName'.$uid;
-		if(!is_null($displayName = $this->access->connection->getFromCache($cacheKey))) {
+		if (!is_null($displayName = $this->access->connection->getFromCache($cacheKey))) {
 			return $displayName;
 		}
 
@@ -435,10 +435,10 @@ 
 			$this->access->username2dn($uid),
 			$this->access->connection->ldapUserDisplayName);
 
-		if($displayName && (count($displayName) > 0)) {
+		if ($displayName && (count($displayName) > 0)) {
 			$displayName = $displayName[0];
 
-			if (is_array($displayName2)){
+			if (is_array($displayName2)) {
 				$displayName2 = count($displayName2) > 0 ? $displayName2[0] : '';
 			}
 
@@ -467,7 +467,7 @@ 
 	 */
 	public function getDisplayNames($search = '', $limit = null, $offset = null) {
 		$cacheKey = 'getDisplayNames-'.$search.'-'.$limit.'-'.$offset;
-		if(!is_null($displayNames = $this->access->connection->getFromCache($cacheKey))) {
+		if (!is_null($displayNames = $this->access->connection->getFromCache($cacheKey))) {
 			return $displayNames;
 		}
 
@@ -489,12 +489,12 @@ 
 	* compared with \OC\User\Backend::CREATE_USER etc.
 	*/
 	public function implementsActions($actions) {
-		return (bool)((Backend::CHECK_PASSWORD
+		return (bool) ((Backend::CHECK_PASSWORD
 			| Backend::GET_HOME
 			| Backend::GET_DISPLAYNAME
 			| Backend::PROVIDE_AVATAR
 			| Backend::COUNT_USERS
-			| ((intval($this->access->connection->turnOnPasswordChange) === 1)?(Backend::SET_PASSWORD):0))
+			| ((intval($this->access->connection->turnOnPasswordChange) === 1) ? (Backend::SET_PASSWORD) : 0))
 			& $actions);
 	}
 
@@ -513,7 +513,7 @@ 
 	public function countUsers() {
 		$filter = $this->access->getFilterForUserCount();
 		$cacheKey = 'countUsers-'.$filter;
-		if(!is_null($entries = $this->access->connection->getFromCache($cacheKey))) {
+		if (!is_null($entries = $this->access->connection->getFromCache($cacheKey))) {
 			return $entries;
 		}
 		$entries = $this->access->countUsers($filter);
@@ -525,7 +525,7 @@ 
 	 * Backend name to be shown in user management
 	 * @return string the name of the backend to be shown
 	 */
-	public function getBackendName(){
+	public function getBackendName() {
 		return 'LDAP';
 	}
 	

apps/user_ldap/lib/User_Proxy.php

Indentation +261 added lines, -261 removed lines

@@ -34,286 +34,286 @@
 use OCP\Notification\IManager as INotificationManager;
 
 class User_Proxy extends Proxy implements \OCP\IUserBackend, \OCP\UserInterface, IUserLDAP {
-	private $backends = array();
-	private $refBackend = null;
+    private $backends = array();
+    private $refBackend = null;
 
-	/**
-	 * Constructor
-	 * @param array $serverConfigPrefixes array containing the config Prefixes
-	 */
-	public function __construct(array $serverConfigPrefixes, ILDAPWrapper $ldap, IConfig $ocConfig,
-		INotificationManager $notificationManager) {
-		parent::__construct($ldap);
-		foreach($serverConfigPrefixes as $configPrefix) {
-			$this->backends[$configPrefix] =
-				new User_LDAP($this->getAccess($configPrefix), $ocConfig, $notificationManager);
-			if(is_null($this->refBackend)) {
-				$this->refBackend = &$this->backends[$configPrefix];
-			}
-		}
-	}
+    /**
+     * Constructor
+     * @param array $serverConfigPrefixes array containing the config Prefixes
+     */
+    public function __construct(array $serverConfigPrefixes, ILDAPWrapper $ldap, IConfig $ocConfig,
+        INotificationManager $notificationManager) {
+        parent::__construct($ldap);
+        foreach($serverConfigPrefixes as $configPrefix) {
+            $this->backends[$configPrefix] =
+                new User_LDAP($this->getAccess($configPrefix), $ocConfig, $notificationManager);
+            if(is_null($this->refBackend)) {
+                $this->refBackend = &$this->backends[$configPrefix];
+            }
+        }
+    }
 
-	/**
-	 * Tries the backends one after the other until a positive result is returned from the specified method
-	 * @param string $uid the uid connected to the request
-	 * @param string $method the method of the user backend that shall be called
-	 * @param array $parameters an array of parameters to be passed
-	 * @return mixed the result of the method or false
-	 */
-	protected function walkBackends($uid, $method, $parameters) {
-		$cacheKey = $this->getUserCacheKey($uid);
-		foreach($this->backends as $configPrefix => $backend) {
-			$instance = $backend;
-			if(!method_exists($instance, $method)
-				&& method_exists($this->getAccess($configPrefix), $method)) {
-				$instance = $this->getAccess($configPrefix);
-			}
-			if($result = call_user_func_array(array($instance, $method), $parameters)) {
-				$this->writeToCache($cacheKey, $configPrefix);
-				return $result;
-			}
-		}
-		return false;
-	}
+    /**
+     * Tries the backends one after the other until a positive result is returned from the specified method
+     * @param string $uid the uid connected to the request
+     * @param string $method the method of the user backend that shall be called
+     * @param array $parameters an array of parameters to be passed
+     * @return mixed the result of the method or false
+     */
+    protected function walkBackends($uid, $method, $parameters) {
+        $cacheKey = $this->getUserCacheKey($uid);
+        foreach($this->backends as $configPrefix => $backend) {
+            $instance = $backend;
+            if(!method_exists($instance, $method)
+                && method_exists($this->getAccess($configPrefix), $method)) {
+                $instance = $this->getAccess($configPrefix);
+            }
+            if($result = call_user_func_array(array($instance, $method), $parameters)) {
+                $this->writeToCache($cacheKey, $configPrefix);
+                return $result;
+            }
+        }
+        return false;
+    }
 
-	/**
-	 * Asks the backend connected to the server that supposely takes care of the uid from the request.
-	 * @param string $uid the uid connected to the request
-	 * @param string $method the method of the user backend that shall be called
-	 * @param array $parameters an array of parameters to be passed
-	 * @param mixed $passOnWhen the result matches this variable
-	 * @return mixed the result of the method or false
-	 */
-	protected function callOnLastSeenOn($uid, $method, $parameters, $passOnWhen) {
-		$cacheKey = $this->getUserCacheKey($uid);
-		$prefix = $this->getFromCache($cacheKey);
-		//in case the uid has been found in the past, try this stored connection first
-		if(!is_null($prefix)) {
-			if(isset($this->backends[$prefix])) {
-				$instance = $this->backends[$prefix];
-				if(!method_exists($instance, $method)
-					&& method_exists($this->getAccess($prefix), $method)) {
-					$instance = $this->getAccess($prefix);
-				}
-				$result = call_user_func_array(array($instance, $method), $parameters);
-				if($result === $passOnWhen) {
-					//not found here, reset cache to null if user vanished
-					//because sometimes methods return false with a reason
-					$userExists = call_user_func_array(
-						array($this->backends[$prefix], 'userExists'),
-						array($uid)
-					);
-					if(!$userExists) {
-						$this->writeToCache($cacheKey, null);
-					}
-				}
-				return $result;
-			}
-		}
-		return false;
-	}
+    /**
+     * Asks the backend connected to the server that supposely takes care of the uid from the request.
+     * @param string $uid the uid connected to the request
+     * @param string $method the method of the user backend that shall be called
+     * @param array $parameters an array of parameters to be passed
+     * @param mixed $passOnWhen the result matches this variable
+     * @return mixed the result of the method or false
+     */
+    protected function callOnLastSeenOn($uid, $method, $parameters, $passOnWhen) {
+        $cacheKey = $this->getUserCacheKey($uid);
+        $prefix = $this->getFromCache($cacheKey);
+        //in case the uid has been found in the past, try this stored connection first
+        if(!is_null($prefix)) {
+            if(isset($this->backends[$prefix])) {
+                $instance = $this->backends[$prefix];
+                if(!method_exists($instance, $method)
+                    && method_exists($this->getAccess($prefix), $method)) {
+                    $instance = $this->getAccess($prefix);
+                }
+                $result = call_user_func_array(array($instance, $method), $parameters);
+                if($result === $passOnWhen) {
+                    //not found here, reset cache to null if user vanished
+                    //because sometimes methods return false with a reason
+                    $userExists = call_user_func_array(
+                        array($this->backends[$prefix], 'userExists'),
+                        array($uid)
+                    );
+                    if(!$userExists) {
+                        $this->writeToCache($cacheKey, null);
+                    }
+                }
+                return $result;
+            }
+        }
+        return false;
+    }
 
-	/**
-	 * Check if backend implements actions
-	 * @param int $actions bitwise-or'ed actions
-	 * @return boolean
-	 *
-	 * Returns the supported actions as int to be
-	 * compared with \OC\User\Backend::CREATE_USER etc.
-	 */
-	public function implementsActions($actions) {
-		//it's the same across all our user backends obviously
-		return $this->refBackend->implementsActions($actions);
-	}
+    /**
+     * Check if backend implements actions
+     * @param int $actions bitwise-or'ed actions
+     * @return boolean
+     *
+     * Returns the supported actions as int to be
+     * compared with \OC\User\Backend::CREATE_USER etc.
+     */
+    public function implementsActions($actions) {
+        //it's the same across all our user backends obviously
+        return $this->refBackend->implementsActions($actions);
+    }
 
-	/**
-	 * Backend name to be shown in user management
-	 * @return string the name of the backend to be shown
-	 */
-	public function getBackendName() {
-		return $this->refBackend->getBackendName();
-	}
+    /**
+     * Backend name to be shown in user management
+     * @return string the name of the backend to be shown
+     */
+    public function getBackendName() {
+        return $this->refBackend->getBackendName();
+    }
 
-	/**
-	 * Get a list of all users
-	 *
-	 * @param string $search
-	 * @param null|int $limit
-	 * @param null|int $offset
-	 * @return string[] an array of all uids
-	 */
-	public function getUsers($search = '', $limit = 10, $offset = 0) {
-		//we do it just as the /OC_User implementation: do not play around with limit and offset but ask all backends
-		$users = array();
-		foreach($this->backends as $backend) {
-			$backendUsers = $backend->getUsers($search, $limit, $offset);
-			if (is_array($backendUsers)) {
-				$users = array_merge($users, $backendUsers);
-			}
-		}
-		return $users;
-	}
+    /**
+     * Get a list of all users
+     *
+     * @param string $search
+     * @param null|int $limit
+     * @param null|int $offset
+     * @return string[] an array of all uids
+     */
+    public function getUsers($search = '', $limit = 10, $offset = 0) {
+        //we do it just as the /OC_User implementation: do not play around with limit and offset but ask all backends
+        $users = array();
+        foreach($this->backends as $backend) {
+            $backendUsers = $backend->getUsers($search, $limit, $offset);
+            if (is_array($backendUsers)) {
+                $users = array_merge($users, $backendUsers);
+            }
+        }
+        return $users;
+    }
 
-	/**
-	 * check if a user exists
-	 * @param string $uid the username
-	 * @return boolean
-	 */
-	public function userExists($uid) {
-		return $this->handleRequest($uid, 'userExists', array($uid));
-	}
+    /**
+     * check if a user exists
+     * @param string $uid the username
+     * @return boolean
+     */
+    public function userExists($uid) {
+        return $this->handleRequest($uid, 'userExists', array($uid));
+    }
 
-	/**
-	 * check if a user exists on LDAP
-	 * @param string|\OCA\User_LDAP\User\User $user either the Nextcloud user
-	 * name or an instance of that user
-	 * @return boolean
-	 */
-	public function userExistsOnLDAP($user) {
-		$id = ($user instanceof User) ? $user->getUsername() : $user;
-		return $this->handleRequest($id, 'userExistsOnLDAP', array($user));
-	}
+    /**
+     * check if a user exists on LDAP
+     * @param string|\OCA\User_LDAP\User\User $user either the Nextcloud user
+     * name or an instance of that user
+     * @return boolean
+     */
+    public function userExistsOnLDAP($user) {
+        $id = ($user instanceof User) ? $user->getUsername() : $user;
+        return $this->handleRequest($id, 'userExistsOnLDAP', array($user));
+    }
 
-	/**
-	 * Check if the password is correct
-	 * @param string $uid The username
-	 * @param string $password The password
-	 * @return bool
-	 *
-	 * Check if the password is correct without logging in the user
-	 */
-	public function checkPassword($uid, $password) {
-		return $this->handleRequest($uid, 'checkPassword', array($uid, $password));
-	}
+    /**
+     * Check if the password is correct
+     * @param string $uid The username
+     * @param string $password The password
+     * @return bool
+     *
+     * Check if the password is correct without logging in the user
+     */
+    public function checkPassword($uid, $password) {
+        return $this->handleRequest($uid, 'checkPassword', array($uid, $password));
+    }
 
-	/**
-	 * returns the username for the given login name, if available
-	 *
-	 * @param string $loginName
-	 * @return string|false
-	 */
-	public function loginName2UserName($loginName) {
-		$id = 'LOGINNAME,' . $loginName;
-		return $this->handleRequest($id, 'loginName2UserName', array($loginName));
-	}
+    /**
+     * returns the username for the given login name, if available
+     *
+     * @param string $loginName
+     * @return string|false
+     */
+    public function loginName2UserName($loginName) {
+        $id = 'LOGINNAME,' . $loginName;
+        return $this->handleRequest($id, 'loginName2UserName', array($loginName));
+    }
 	
-	/**
-	 * returns the username for the given LDAP DN, if available
-	 *
-	 * @param string $dn
-	 * @return string|false with the username
-	 */
-	public function dn2UserName($dn) {
-		$id = 'DN,' . $dn;
-		return $this->handleRequest($id, 'dn2UserName', array($dn));
-	}
+    /**
+     * returns the username for the given LDAP DN, if available
+     *
+     * @param string $dn
+     * @return string|false with the username
+     */
+    public function dn2UserName($dn) {
+        $id = 'DN,' . $dn;
+        return $this->handleRequest($id, 'dn2UserName', array($dn));
+    }
 
-	/**
-	 * get the user's home directory
-	 * @param string $uid the username
-	 * @return boolean
-	 */
-	public function getHome($uid) {
-		return $this->handleRequest($uid, 'getHome', array($uid));
-	}
+    /**
+     * get the user's home directory
+     * @param string $uid the username
+     * @return boolean
+     */
+    public function getHome($uid) {
+        return $this->handleRequest($uid, 'getHome', array($uid));
+    }
 
-	/**
-	 * get display name of the user
-	 * @param string $uid user ID of the user
-	 * @return string display name
-	 */
-	public function getDisplayName($uid) {
-		return $this->handleRequest($uid, 'getDisplayName', array($uid));
-	}
+    /**
+     * get display name of the user
+     * @param string $uid user ID of the user
+     * @return string display name
+     */
+    public function getDisplayName($uid) {
+        return $this->handleRequest($uid, 'getDisplayName', array($uid));
+    }
 
-	/**
-	 * checks whether the user is allowed to change his avatar in Nextcloud
-	 * @param string $uid the Nextcloud user name
-	 * @return boolean either the user can or cannot
-	 */
-	public function canChangeAvatar($uid) {
-		return $this->handleRequest($uid, 'canChangeAvatar', array($uid), true);
-	}
+    /**
+     * checks whether the user is allowed to change his avatar in Nextcloud
+     * @param string $uid the Nextcloud user name
+     * @return boolean either the user can or cannot
+     */
+    public function canChangeAvatar($uid) {
+        return $this->handleRequest($uid, 'canChangeAvatar', array($uid), true);
+    }
 
-	/**
-	 * Get a list of all display names and user ids.
-	 * @param string $search
-	 * @param string|null $limit
-	 * @param string|null $offset
-	 * @return array an array of all displayNames (value) and the corresponding uids (key)
-	 */
-	public function getDisplayNames($search = '', $limit = null, $offset = null) {
-		//we do it just as the /OC_User implementation: do not play around with limit and offset but ask all backends
-		$users = array();
-		foreach($this->backends as $backend) {
-			$backendUsers = $backend->getDisplayNames($search, $limit, $offset);
-			if (is_array($backendUsers)) {
-				$users = $users + $backendUsers;
-			}
-		}
-		return $users;
-	}
+    /**
+     * Get a list of all display names and user ids.
+     * @param string $search
+     * @param string|null $limit
+     * @param string|null $offset
+     * @return array an array of all displayNames (value) and the corresponding uids (key)
+     */
+    public function getDisplayNames($search = '', $limit = null, $offset = null) {
+        //we do it just as the /OC_User implementation: do not play around with limit and offset but ask all backends
+        $users = array();
+        foreach($this->backends as $backend) {
+            $backendUsers = $backend->getDisplayNames($search, $limit, $offset);
+            if (is_array($backendUsers)) {
+                $users = $users + $backendUsers;
+            }
+        }
+        return $users;
+    }
 
-	/**
-	 * delete a user
-	 * @param string $uid The username of the user to delete
-	 * @return bool
-	 *
-	 * Deletes a user
-	 */
-	public function deleteUser($uid) {
-		return $this->handleRequest($uid, 'deleteUser', array($uid));
-	}
+    /**
+     * delete a user
+     * @param string $uid The username of the user to delete
+     * @return bool
+     *
+     * Deletes a user
+     */
+    public function deleteUser($uid) {
+        return $this->handleRequest($uid, 'deleteUser', array($uid));
+    }
 	
-	/**
-	 * Set password
-	 * @param string $uid The username
-	 * @param string $password The new password
-	 * @return bool
-	 *
-	 */
-	public function setPassword($uid, $password) {
-		return $this->handleRequest($uid, 'setPassword', array($uid, $password));
-	}
+    /**
+     * Set password
+     * @param string $uid The username
+     * @param string $password The new password
+     * @return bool
+     *
+     */
+    public function setPassword($uid, $password) {
+        return $this->handleRequest($uid, 'setPassword', array($uid, $password));
+    }
 
-	/**
-	 * @return bool
-	 */
-	public function hasUserListings() {
-		return $this->refBackend->hasUserListings();
-	}
+    /**
+     * @return bool
+     */
+    public function hasUserListings() {
+        return $this->refBackend->hasUserListings();
+    }
 
-	/**
-	 * Count the number of users
-	 * @return int|bool
-	 */
-	public function countUsers() {
-		$users = false;
-		foreach($this->backends as $backend) {
-			$backendUsers = $backend->countUsers();
-			if ($backendUsers !== false) {
-				$users += $backendUsers;
-			}
-		}
-		return $users;
-	}
+    /**
+     * Count the number of users
+     * @return int|bool
+     */
+    public function countUsers() {
+        $users = false;
+        foreach($this->backends as $backend) {
+            $backendUsers = $backend->countUsers();
+            if ($backendUsers !== false) {
+                $users += $backendUsers;
+            }
+        }
+        return $users;
+    }
 
-	/**
-	 * Return access for LDAP interaction.
-	 * @param string $uid
-	 * @return Access instance of Access for LDAP interaction
-	 */
-	public function getLDAPAccess($uid) {
-		return $this->handleRequest($uid, 'getLDAPAccess', array($uid));
-	}
+    /**
+     * Return access for LDAP interaction.
+     * @param string $uid
+     * @return Access instance of Access for LDAP interaction
+     */
+    public function getLDAPAccess($uid) {
+        return $this->handleRequest($uid, 'getLDAPAccess', array($uid));
+    }
 	
-	/**
-	 * Return a new LDAP connection for the specified user.
-	 * The connection needs to be closed manually.
-	 * @param string $uid
-	 * @return resource of the LDAP connection
-	 */
-	public function getNewLDAPConnection($uid) {
-		return $this->handleRequest($uid, 'getNewLDAPConnection', array($uid));
-	}
+    /**
+     * Return a new LDAP connection for the specified user.
+     * The connection needs to be closed manually.
+     * @param string $uid
+     * @return resource of the LDAP connection
+     */
+    public function getNewLDAPConnection($uid) {
+        return $this->handleRequest($uid, 'getNewLDAPConnection', array($uid));
+    }
 }

apps/user_ldap/lib/Group_Proxy.php

Indentation +178 added lines, -178 removed lines

@@ -27,182 +27,182 @@
 namespace OCA\User_LDAP;
 
 class Group_Proxy extends Proxy implements \OCP\GroupInterface {
-	private $backends = array();
-	private $refBackend = null;
-
-	/**
-	 * Constructor
-	 * @param string[] $serverConfigPrefixes array containing the config Prefixes
-	 */
-	public function __construct($serverConfigPrefixes, ILDAPWrapper $ldap) {
-		parent::__construct($ldap);
-		foreach($serverConfigPrefixes as $configPrefix) {
-			$this->backends[$configPrefix] =
-				new \OCA\User_LDAP\Group_LDAP($this->getAccess($configPrefix));
-			if(is_null($this->refBackend)) {
-				$this->refBackend = &$this->backends[$configPrefix];
-			}
-		}
-	}
-
-	/**
-	 * Tries the backends one after the other until a positive result is returned from the specified method
-	 * @param string $gid the gid connected to the request
-	 * @param string $method the method of the group backend that shall be called
-	 * @param array $parameters an array of parameters to be passed
-	 * @return mixed, the result of the method or false
-	 */
-	protected function walkBackends($gid, $method, $parameters) {
-		$cacheKey = $this->getGroupCacheKey($gid);
-		foreach($this->backends as $configPrefix => $backend) {
-			if($result = call_user_func_array(array($backend, $method), $parameters)) {
-				$this->writeToCache($cacheKey, $configPrefix);
-				return $result;
-			}
-		}
-		return false;
-	}
-
-	/**
-	 * Asks the backend connected to the server that supposely takes care of the gid from the request.
-	 * @param string $gid the gid connected to the request
-	 * @param string $method the method of the group backend that shall be called
-	 * @param array $parameters an array of parameters to be passed
-	 * @param mixed $passOnWhen the result matches this variable
-	 * @return mixed, the result of the method or false
-	 */
-	protected function callOnLastSeenOn($gid, $method, $parameters, $passOnWhen) {
-		$cacheKey = $this->getGroupCacheKey($gid);;
-		$prefix = $this->getFromCache($cacheKey);
-		//in case the uid has been found in the past, try this stored connection first
-		if(!is_null($prefix)) {
-			if(isset($this->backends[$prefix])) {
-				$result = call_user_func_array(array($this->backends[$prefix], $method), $parameters);
-				if($result === $passOnWhen) {
-					//not found here, reset cache to null if group vanished
-					//because sometimes methods return false with a reason
-					$groupExists = call_user_func_array(
-						array($this->backends[$prefix], 'groupExists'),
-						array($gid)
-					);
-					if(!$groupExists) {
-						$this->writeToCache($cacheKey, null);
-					}
-				}
-				return $result;
-			}
-		}
-		return false;
-	}
-
-	/**
-	 * is user in group?
-	 * @param string $uid uid of the user
-	 * @param string $gid gid of the group
-	 * @return bool
-	 *
-	 * Checks whether the user is member of a group or not.
-	 */
-	public function inGroup($uid, $gid) {
-		return $this->handleRequest($gid, 'inGroup', array($uid, $gid));
-	}
-
-	/**
-	 * Get all groups a user belongs to
-	 * @param string $uid Name of the user
-	 * @return string[] with group names
-	 *
-	 * This function fetches all groups a user belongs to. It does not check
-	 * if the user exists at all.
-	 */
-	public function getUserGroups($uid) {
-		$groups = array();
-
-		foreach($this->backends as $backend) {
-			$backendGroups = $backend->getUserGroups($uid);
-			if (is_array($backendGroups)) {
-				$groups = array_merge($groups, $backendGroups);
-			}
-		}
-
-		return $groups;
-	}
-
-	/**
-	 * get a list of all users in a group
-	 * @return string[] with user ids
-	 */
-	public function usersInGroup($gid, $search = '', $limit = -1, $offset = 0) {
-		$users = array();
-
-		foreach($this->backends as $backend) {
-			$backendUsers = $backend->usersInGroup($gid, $search, $limit, $offset);
-			if (is_array($backendUsers)) {
-				$users = array_merge($users, $backendUsers);
-			}
-		}
-
-		return $users;
-	}
-
-	/**
-	 * returns the number of users in a group, who match the search term
-	 * @param string $gid the internal group name
-	 * @param string $search optional, a search string
-	 * @return int|bool
-	 */
-	public function countUsersInGroup($gid, $search = '') {
-		return $this->handleRequest(
-			$gid, 'countUsersInGroup', array($gid, $search));
-	}
-
-	/**
-	 * get a list of all groups
-	 * @return string[] with group names
-	 *
-	 * Returns a list with all groups
-	 */
-	public function getGroups($search = '', $limit = -1, $offset = 0) {
-		$groups = array();
-
-		foreach($this->backends as $backend) {
-			$backendGroups = $backend->getGroups($search, $limit, $offset);
-			if (is_array($backendGroups)) {
-				$groups = array_merge($groups, $backendGroups);
-			}
-		}
-
-		return $groups;
-	}
-
-	/**
-	 * check if a group exists
-	 * @param string $gid
-	 * @return bool
-	 */
-	public function groupExists($gid) {
-		return $this->handleRequest($gid, 'groupExists', array($gid));
-	}
-
-	/**
-	 * Check if backend implements actions
-	 * @param int $actions bitwise-or'ed actions
-	 * @return boolean
-	 *
-	 * Returns the supported actions as int to be
-	 * compared with \OC\User\Backend::CREATE_USER etc.
-	 */
-	public function implementsActions($actions) {
-		//it's the same across all our user backends obviously
-		return $this->refBackend->implementsActions($actions);
-	}
-
-	/**
-	 * Return access for LDAP interaction.
-	 * @param string $gid
-	 * @return Access instance of Access for LDAP interaction
-	 */
-	public function getLDAPAccess($gid) {
-		return $this->handleRequest($gid, 'getLDAPAccess', []);
-	}
+    private $backends = array();
+    private $refBackend = null;
+
+    /**
+     * Constructor
+     * @param string[] $serverConfigPrefixes array containing the config Prefixes
+     */
+    public function __construct($serverConfigPrefixes, ILDAPWrapper $ldap) {
+        parent::__construct($ldap);
+        foreach($serverConfigPrefixes as $configPrefix) {
+            $this->backends[$configPrefix] =
+                new \OCA\User_LDAP\Group_LDAP($this->getAccess($configPrefix));
+            if(is_null($this->refBackend)) {
+                $this->refBackend = &$this->backends[$configPrefix];
+            }
+        }
+    }
+
+    /**
+     * Tries the backends one after the other until a positive result is returned from the specified method
+     * @param string $gid the gid connected to the request
+     * @param string $method the method of the group backend that shall be called
+     * @param array $parameters an array of parameters to be passed
+     * @return mixed, the result of the method or false
+     */
+    protected function walkBackends($gid, $method, $parameters) {
+        $cacheKey = $this->getGroupCacheKey($gid);
+        foreach($this->backends as $configPrefix => $backend) {
+            if($result = call_user_func_array(array($backend, $method), $parameters)) {
+                $this->writeToCache($cacheKey, $configPrefix);
+                return $result;
+            }
+        }
+        return false;
+    }
+
+    /**
+     * Asks the backend connected to the server that supposely takes care of the gid from the request.
+     * @param string $gid the gid connected to the request
+     * @param string $method the method of the group backend that shall be called
+     * @param array $parameters an array of parameters to be passed
+     * @param mixed $passOnWhen the result matches this variable
+     * @return mixed, the result of the method or false
+     */
+    protected function callOnLastSeenOn($gid, $method, $parameters, $passOnWhen) {
+        $cacheKey = $this->getGroupCacheKey($gid);;
+        $prefix = $this->getFromCache($cacheKey);
+        //in case the uid has been found in the past, try this stored connection first
+        if(!is_null($prefix)) {
+            if(isset($this->backends[$prefix])) {
+                $result = call_user_func_array(array($this->backends[$prefix], $method), $parameters);
+                if($result === $passOnWhen) {
+                    //not found here, reset cache to null if group vanished
+                    //because sometimes methods return false with a reason
+                    $groupExists = call_user_func_array(
+                        array($this->backends[$prefix], 'groupExists'),
+                        array($gid)
+                    );
+                    if(!$groupExists) {
+                        $this->writeToCache($cacheKey, null);
+                    }
+                }
+                return $result;
+            }
+        }
+        return false;
+    }
+
+    /**
+     * is user in group?
+     * @param string $uid uid of the user
+     * @param string $gid gid of the group
+     * @return bool
+     *
+     * Checks whether the user is member of a group or not.
+     */
+    public function inGroup($uid, $gid) {
+        return $this->handleRequest($gid, 'inGroup', array($uid, $gid));
+    }
+
+    /**
+     * Get all groups a user belongs to
+     * @param string $uid Name of the user
+     * @return string[] with group names
+     *
+     * This function fetches all groups a user belongs to. It does not check
+     * if the user exists at all.
+     */
+    public function getUserGroups($uid) {
+        $groups = array();
+
+        foreach($this->backends as $backend) {
+            $backendGroups = $backend->getUserGroups($uid);
+            if (is_array($backendGroups)) {
+                $groups = array_merge($groups, $backendGroups);
+            }
+        }
+
+        return $groups;
+    }
+
+    /**
+     * get a list of all users in a group
+     * @return string[] with user ids
+     */
+    public function usersInGroup($gid, $search = '', $limit = -1, $offset = 0) {
+        $users = array();
+
+        foreach($this->backends as $backend) {
+            $backendUsers = $backend->usersInGroup($gid, $search, $limit, $offset);
+            if (is_array($backendUsers)) {
+                $users = array_merge($users, $backendUsers);
+            }
+        }
+
+        return $users;
+    }
+
+    /**
+     * returns the number of users in a group, who match the search term
+     * @param string $gid the internal group name
+     * @param string $search optional, a search string
+     * @return int|bool
+     */
+    public function countUsersInGroup($gid, $search = '') {
+        return $this->handleRequest(
+            $gid, 'countUsersInGroup', array($gid, $search));
+    }
+
+    /**
+     * get a list of all groups
+     * @return string[] with group names
+     *
+     * Returns a list with all groups
+     */
+    public function getGroups($search = '', $limit = -1, $offset = 0) {
+        $groups = array();
+
+        foreach($this->backends as $backend) {
+            $backendGroups = $backend->getGroups($search, $limit, $offset);
+            if (is_array($backendGroups)) {
+                $groups = array_merge($groups, $backendGroups);
+            }
+        }
+
+        return $groups;
+    }
+
+    /**
+     * check if a group exists
+     * @param string $gid
+     * @return bool
+     */
+    public function groupExists($gid) {
+        return $this->handleRequest($gid, 'groupExists', array($gid));
+    }
+
+    /**
+     * Check if backend implements actions
+     * @param int $actions bitwise-or'ed actions
+     * @return boolean
+     *
+     * Returns the supported actions as int to be
+     * compared with \OC\User\Backend::CREATE_USER etc.
+     */
+    public function implementsActions($actions) {
+        //it's the same across all our user backends obviously
+        return $this->refBackend->implementsActions($actions);
+    }
+
+    /**
+     * Return access for LDAP interaction.
+     * @param string $gid
+     * @return Access instance of Access for LDAP interaction
+     */
+    public function getLDAPAccess($gid) {
+        return $this->handleRequest($gid, 'getLDAPAccess', []);
+    }
 }

apps/user_ldap/lib/Group_LDAP.php

Indentation +1039 added lines, -1039 removed lines

@@ -41,1043 +41,1043 @@
 use OC\Cache\CappedMemoryCache;
 
 class Group_LDAP extends BackendUtility implements \OCP\GroupInterface {
-	protected $enabled = false;
-
-	/**
-	 * @var string[] $cachedGroupMembers array of users with gid as key
-	 */
-	protected $cachedGroupMembers;
-
-	/**
-	 * @var string[] $cachedGroupsByMember array of groups with uid as key
-	 */
-	protected $cachedGroupsByMember;
-
-	public function __construct(Access $access) {
-		parent::__construct($access);
-		$filter = $this->access->connection->ldapGroupFilter;
-		$gassoc = $this->access->connection->ldapGroupMemberAssocAttr;
-		if(!empty($filter) && !empty($gassoc)) {
-			$this->enabled = true;
-		}
-
-		$this->cachedGroupMembers = new CappedMemoryCache();
-		$this->cachedGroupsByMember = new CappedMemoryCache();
-	}
-
-	/**
-	 * is user in group?
-	 * @param string $uid uid of the user
-	 * @param string $gid gid of the group
-	 * @return bool
-	 *
-	 * Checks whether the user is member of a group or not.
-	 */
-	public function inGroup($uid, $gid) {
-		if(!$this->enabled) {
-			return false;
-		}
-		$cacheKey = 'inGroup'.$uid.':'.$gid;
-		$inGroup = $this->access->connection->getFromCache($cacheKey);
-		if(!is_null($inGroup)) {
-			return (bool)$inGroup;
-		}
-
-		$userDN = $this->access->username2dn($uid);
-
-		if(isset($this->cachedGroupMembers[$gid])) {
-			$isInGroup = in_array($userDN, $this->cachedGroupMembers[$gid]);
-			return $isInGroup;
-		}
-
-		$cacheKeyMembers = 'inGroup-members:'.$gid;
-		$members = $this->access->connection->getFromCache($cacheKeyMembers);
-		if(!is_null($members)) {
-			$this->cachedGroupMembers[$gid] = $members;
-			$isInGroup = in_array($userDN, $members);
-			$this->access->connection->writeToCache($cacheKey, $isInGroup);
-			return $isInGroup;
-		}
-
-		$groupDN = $this->access->groupname2dn($gid);
-		// just in case
-		if(!$groupDN || !$userDN) {
-			$this->access->connection->writeToCache($cacheKey, false);
-			return false;
-		}
-
-		//check primary group first
-		if($gid === $this->getUserPrimaryGroup($userDN)) {
-			$this->access->connection->writeToCache($cacheKey, true);
-			return true;
-		}
-
-		//usually, LDAP attributes are said to be case insensitive. But there are exceptions of course.
-		$members = $this->_groupMembers($groupDN);
-		$members = array_keys($members); // uids are returned as keys
-		if(!is_array($members) || count($members) === 0) {
-			$this->access->connection->writeToCache($cacheKey, false);
-			return false;
-		}
-
-		//extra work if we don't get back user DNs
-		if(strtolower($this->access->connection->ldapGroupMemberAssocAttr) === 'memberuid') {
-			$dns = array();
-			$filterParts = array();
-			$bytes = 0;
-			foreach($members as $mid) {
-				$filter = str_replace('%uid', $mid, $this->access->connection->ldapLoginFilter);
-				$filterParts[] = $filter;
-				$bytes += strlen($filter);
-				if($bytes >= 9000000) {
-					// AD has a default input buffer of 10 MB, we do not want
-					// to take even the chance to exceed it
-					$filter = $this->access->combineFilterWithOr($filterParts);
-					$bytes = 0;
-					$filterParts = array();
-					$users = $this->access->fetchListOfUsers($filter, 'dn', count($filterParts));
-					$dns = array_merge($dns, $users);
-				}
-			}
-			if(count($filterParts) > 0) {
-				$filter = $this->access->combineFilterWithOr($filterParts);
-				$users = $this->access->fetchListOfUsers($filter, 'dn', count($filterParts));
-				$dns = array_merge($dns, $users);
-			}
-			$members = $dns;
-		}
-
-		$isInGroup = in_array($userDN, $members);
-		$this->access->connection->writeToCache($cacheKey, $isInGroup);
-		$this->access->connection->writeToCache($cacheKeyMembers, $members);
-		$this->cachedGroupMembers[$gid] = $members;
-
-		return $isInGroup;
-	}
-
-	/**
-	 * @param string $dnGroup
-	 * @return array
-	 *
-	 * For a group that has user membership defined by an LDAP search url attribute returns the users
-	 * that match the search url otherwise returns an empty array.
-	 */
-	public function getDynamicGroupMembers($dnGroup) {
-		$dynamicGroupMemberURL = strtolower($this->access->connection->ldapDynamicGroupMemberURL);
-
-		if (empty($dynamicGroupMemberURL)) {
-			return array();
-		}
-
-		$dynamicMembers = array();
-		$memberURLs = $this->access->readAttribute(
-			$dnGroup,
-			$dynamicGroupMemberURL,
-			$this->access->connection->ldapGroupFilter
-		);
-		if ($memberURLs !== false) {
-			// this group has the 'memberURL' attribute so this is a dynamic group
-			// example 1: ldap:///cn=users,cn=accounts,dc=dcsubbase,dc=dcbase??one?(o=HeadOffice)
-			// example 2: ldap:///cn=users,cn=accounts,dc=dcsubbase,dc=dcbase??one?(&(o=HeadOffice)(uidNumber>=500))
-			$pos = strpos($memberURLs[0], '(');
-			if ($pos !== false) {
-				$memberUrlFilter = substr($memberURLs[0], $pos);
-				$foundMembers = $this->access->searchUsers($memberUrlFilter,'dn');
-				$dynamicMembers = array();
-				foreach($foundMembers as $value) {
-					$dynamicMembers[$value['dn'][0]] = 1;
-				}
-			} else {
-				\OCP\Util::writeLog('user_ldap', 'No search filter found on member url '.
-					'of group ' . $dnGroup, \OCP\Util::DEBUG);
-			}
-		}
-		return $dynamicMembers;
-	}
-
-	/**
-	 * @param string $dnGroup
-	 * @param array|null &$seen
-	 * @return array|mixed|null
-	 */
-	private function _groupMembers($dnGroup, &$seen = null) {
-		if ($seen === null) {
-			$seen = array();
-		}
-		$allMembers = array();
-		if (array_key_exists($dnGroup, $seen)) {
-			// avoid loops
-			return array();
-		}
-		// used extensively in cron job, caching makes sense for nested groups
-		$cacheKey = '_groupMembers'.$dnGroup;
-		$groupMembers = $this->access->connection->getFromCache($cacheKey);
-		if(!is_null($groupMembers)) {
-			return $groupMembers;
-		}
-		$seen[$dnGroup] = 1;
-		$members = $this->access->readAttribute($dnGroup, $this->access->connection->ldapGroupMemberAssocAttr,
-												$this->access->connection->ldapGroupFilter);
-		if (is_array($members)) {
-			foreach ($members as $memberDN) {
-				$allMembers[$memberDN] = 1;
-				$nestedGroups = $this->access->connection->ldapNestedGroups;
-				if (!empty($nestedGroups)) {
-					$subMembers = $this->_groupMembers($memberDN, $seen);
-					if ($subMembers) {
-						$allMembers = array_merge($allMembers, $subMembers);
-					}
-				}
-			}
-		}
-
-		$allMembers = array_merge($allMembers, $this->getDynamicGroupMembers($dnGroup));
-
-		$this->access->connection->writeToCache($cacheKey, $allMembers);
-		return $allMembers;
-	}
-
-	/**
-	 * @param string $DN
-	 * @param array|null &$seen
-	 * @return array
-	 */
-	private function _getGroupDNsFromMemberOf($DN, &$seen = null) {
-		if ($seen === null) {
-			$seen = array();
-		}
-		if (array_key_exists($DN, $seen)) {
-			// avoid loops
-			return array();
-		}
-		$seen[$DN] = 1;
-		$groups = $this->access->readAttribute($DN, 'memberOf');
-		if (!is_array($groups)) {
-			return array();
-		}
-		$groups = $this->access->groupsMatchFilter($groups);
-		$allGroups =  $groups;
-		$nestedGroups = $this->access->connection->ldapNestedGroups;
-		if (intval($nestedGroups) === 1) {
-			foreach ($groups as $group) {
-				$subGroups = $this->_getGroupDNsFromMemberOf($group, $seen);
-				$allGroups = array_merge($allGroups, $subGroups);
-			}
-		}
-		return $allGroups;
-	}
-
-	/**
-	 * translates a gidNumber into an ownCloud internal name
-	 * @param string $gid as given by gidNumber on POSIX LDAP
-	 * @param string $dn a DN that belongs to the same domain as the group
-	 * @return string|bool
-	 */
-	public function gidNumber2Name($gid, $dn) {
-		$cacheKey = 'gidNumberToName' . $gid;
-		$groupName = $this->access->connection->getFromCache($cacheKey);
-		if(!is_null($groupName) && isset($groupName)) {
-			return $groupName;
-		}
-
-		//we need to get the DN from LDAP
-		$filter = $this->access->combineFilterWithAnd([
-			$this->access->connection->ldapGroupFilter,
-			'objectClass=posixGroup',
-			$this->access->connection->ldapGidNumber . '=' . $gid
-		]);
-		$result = $this->access->searchGroups($filter, array('dn'), 1);
-		if(empty($result)) {
-			return false;
-		}
-		$dn = $result[0]['dn'][0];
-
-		//and now the group name
-		//NOTE once we have separate ownCloud group IDs and group names we can
-		//directly read the display name attribute instead of the DN
-		$name = $this->access->dn2groupname($dn);
-
-		$this->access->connection->writeToCache($cacheKey, $name);
-
-		return $name;
-	}
-
-	/**
-	 * returns the entry's gidNumber
-	 * @param string $dn
-	 * @param string $attribute
-	 * @return string|bool
-	 */
-	private function getEntryGidNumber($dn, $attribute) {
-		$value = $this->access->readAttribute($dn, $attribute);
-		if(is_array($value) && !empty($value)) {
-			return $value[0];
-		}
-		return false;
-	}
-
-	/**
-	 * returns the group's primary ID
-	 * @param string $dn
-	 * @return string|bool
-	 */
-	public function getGroupGidNumber($dn) {
-		return $this->getEntryGidNumber($dn, 'gidNumber');
-	}
-
-	/**
-	 * returns the user's gidNumber
-	 * @param string $dn
-	 * @return string|bool
-	 */
-	public function getUserGidNumber($dn) {
-		$gidNumber = false;
-		if($this->access->connection->hasGidNumber) {
-			$gidNumber = $this->getEntryGidNumber($dn, 'gidNumber');
-			if($gidNumber === false) {
-				$this->access->connection->hasGidNumber = false;
-			}
-		}
-		return $gidNumber;
-	}
-
-	/**
-	 * returns a filter for a "users has specific gid" search or count operation
-	 *
-	 * @param string $groupDN
-	 * @param string $search
-	 * @return string
-	 * @throws \Exception
-	 */
-	private function prepareFilterForUsersHasGidNumber($groupDN, $search = '') {
-		$groupID = $this->getGroupGidNumber($groupDN);
-		if($groupID === false) {
-			throw new \Exception('Not a valid group');
-		}
-
-		$filterParts = [];
-		$filterParts[] = $this->access->getFilterForUserCount();
-		if ($search !== '') {
-			$filterParts[] = $this->access->getFilterPartForUserSearch($search);
-		}
-		$filterParts[] = $this->access->connection->ldapGidNumber .'=' . $groupID;
-
-		$filter = $this->access->combineFilterWithAnd($filterParts);
-
-		return $filter;
-	}
-
-	/**
-	 * returns a list of users that have the given group as gid number
-	 *
-	 * @param string $groupDN
-	 * @param string $search
-	 * @param int $limit
-	 * @param int $offset
-	 * @return string[]
-	 */
-	public function getUsersInGidNumber($groupDN, $search = '', $limit = -1, $offset = 0) {
-		try {
-			$filter = $this->prepareFilterForUsersHasGidNumber($groupDN, $search);
-			$users = $this->access->fetchListOfUsers(
-				$filter,
-				[$this->access->connection->ldapUserDisplayName, 'dn'],
-				$limit,
-				$offset
-			);
-			return $this->access->nextcloudUserNames($users);
-		} catch (\Exception $e) {
-			return [];
-		}
-	}
-
-	/**
-	 * returns the number of users that have the given group as gid number
-	 *
-	 * @param string $groupDN
-	 * @param string $search
-	 * @param int $limit
-	 * @param int $offset
-	 * @return int
-	 */
-	public function countUsersInGidNumber($groupDN, $search = '', $limit = -1, $offset = 0) {
-		try {
-			$filter = $this->prepareFilterForUsersHasGidNumber($groupDN, $search);
-			$users = $this->access->countUsers($filter, ['dn'], $limit, $offset);
-			return (int)$users;
-		} catch (\Exception $e) {
-			return 0;
-		}
-	}
-
-	/**
-	 * gets the gidNumber of a user
-	 * @param string $dn
-	 * @return string
-	 */
-	public function getUserGroupByGid($dn) {
-		$groupID = $this->getUserGidNumber($dn);
-		if($groupID !== false) {
-			$groupName = $this->gidNumber2Name($groupID, $dn);
-			if($groupName !== false) {
-				return $groupName;
-			}
-		}
-
-		return false;
-	}
-
-	/**
-	 * translates a primary group ID into an Nextcloud internal name
-	 * @param string $gid as given by primaryGroupID on AD
-	 * @param string $dn a DN that belongs to the same domain as the group
-	 * @return string|bool
-	 */
-	public function primaryGroupID2Name($gid, $dn) {
-		$cacheKey = 'primaryGroupIDtoName';
-		$groupNames = $this->access->connection->getFromCache($cacheKey);
-		if(!is_null($groupNames) && isset($groupNames[$gid])) {
-			return $groupNames[$gid];
-		}
-
-		$domainObjectSid = $this->access->getSID($dn);
-		if($domainObjectSid === false) {
-			return false;
-		}
-
-		//we need to get the DN from LDAP
-		$filter = $this->access->combineFilterWithAnd(array(
-			$this->access->connection->ldapGroupFilter,
-			'objectsid=' . $domainObjectSid . '-' . $gid
-		));
-		$result = $this->access->searchGroups($filter, array('dn'), 1);
-		if(empty($result)) {
-			return false;
-		}
-		$dn = $result[0]['dn'][0];
-
-		//and now the group name
-		//NOTE once we have separate Nextcloud group IDs and group names we can
-		//directly read the display name attribute instead of the DN
-		$name = $this->access->dn2groupname($dn);
-
-		$this->access->connection->writeToCache($cacheKey, $name);
-
-		return $name;
-	}
-
-	/**
-	 * returns the entry's primary group ID
-	 * @param string $dn
-	 * @param string $attribute
-	 * @return string|bool
-	 */
-	private function getEntryGroupID($dn, $attribute) {
-		$value = $this->access->readAttribute($dn, $attribute);
-		if(is_array($value) && !empty($value)) {
-			return $value[0];
-		}
-		return false;
-	}
-
-	/**
-	 * returns the group's primary ID
-	 * @param string $dn
-	 * @return string|bool
-	 */
-	public function getGroupPrimaryGroupID($dn) {
-		return $this->getEntryGroupID($dn, 'primaryGroupToken');
-	}
-
-	/**
-	 * returns the user's primary group ID
-	 * @param string $dn
-	 * @return string|bool
-	 */
-	public function getUserPrimaryGroupIDs($dn) {
-		$primaryGroupID = false;
-		if($this->access->connection->hasPrimaryGroups) {
-			$primaryGroupID = $this->getEntryGroupID($dn, 'primaryGroupID');
-			if($primaryGroupID === false) {
-				$this->access->connection->hasPrimaryGroups = false;
-			}
-		}
-		return $primaryGroupID;
-	}
-
-	/**
-	 * returns a filter for a "users in primary group" search or count operation
-	 *
-	 * @param string $groupDN
-	 * @param string $search
-	 * @return string
-	 * @throws \Exception
-	 */
-	private function prepareFilterForUsersInPrimaryGroup($groupDN, $search = '') {
-		$groupID = $this->getGroupPrimaryGroupID($groupDN);
-		if($groupID === false) {
-			throw new \Exception('Not a valid group');
-		}
-
-		$filterParts = [];
-		$filterParts[] = $this->access->getFilterForUserCount();
-		if ($search !== '') {
-			$filterParts[] = $this->access->getFilterPartForUserSearch($search);
-		}
-		$filterParts[] = 'primaryGroupID=' . $groupID;
-
-		$filter = $this->access->combineFilterWithAnd($filterParts);
-
-		return $filter;
-	}
-
-	/**
-	 * returns a list of users that have the given group as primary group
-	 *
-	 * @param string $groupDN
-	 * @param string $search
-	 * @param int $limit
-	 * @param int $offset
-	 * @return string[]
-	 */
-	public function getUsersInPrimaryGroup($groupDN, $search = '', $limit = -1, $offset = 0) {
-		try {
-			$filter = $this->prepareFilterForUsersInPrimaryGroup($groupDN, $search);
-			$users = $this->access->fetchListOfUsers(
-				$filter,
-				array($this->access->connection->ldapUserDisplayName, 'dn'),
-				$limit,
-				$offset
-			);
-			return $this->access->nextcloudUserNames($users);
-		} catch (\Exception $e) {
-			return array();
-		}
-	}
-
-	/**
-	 * returns the number of users that have the given group as primary group
-	 *
-	 * @param string $groupDN
-	 * @param string $search
-	 * @param int $limit
-	 * @param int $offset
-	 * @return int
-	 */
-	public function countUsersInPrimaryGroup($groupDN, $search = '', $limit = -1, $offset = 0) {
-		try {
-			$filter = $this->prepareFilterForUsersInPrimaryGroup($groupDN, $search);
-			$users = $this->access->countUsers($filter, array('dn'), $limit, $offset);
-			return (int)$users;
-		} catch (\Exception $e) {
-			return 0;
-		}
-	}
-
-	/**
-	 * gets the primary group of a user
-	 * @param string $dn
-	 * @return string
-	 */
-	public function getUserPrimaryGroup($dn) {
-		$groupID = $this->getUserPrimaryGroupIDs($dn);
-		if($groupID !== false) {
-			$groupName = $this->primaryGroupID2Name($groupID, $dn);
-			if($groupName !== false) {
-				return $groupName;
-			}
-		}
-
-		return false;
-	}
-
-	/**
-	 * Get all groups a user belongs to
-	 * @param string $uid Name of the user
-	 * @return array with group names
-	 *
-	 * This function fetches all groups a user belongs to. It does not check
-	 * if the user exists at all.
-	 *
-	 * This function includes groups based on dynamic group membership.
-	 */
-	public function getUserGroups($uid) {
-		if(!$this->enabled) {
-			return array();
-		}
-		$cacheKey = 'getUserGroups'.$uid;
-		$userGroups = $this->access->connection->getFromCache($cacheKey);
-		if(!is_null($userGroups)) {
-			return $userGroups;
-		}
-		$userDN = $this->access->username2dn($uid);
-		if(!$userDN) {
-			$this->access->connection->writeToCache($cacheKey, array());
-			return array();
-		}
-
-		$groups = [];
-		$primaryGroup = $this->getUserPrimaryGroup($userDN);
-		$gidGroupName = $this->getUserGroupByGid($userDN);
-
-		$dynamicGroupMemberURL = strtolower($this->access->connection->ldapDynamicGroupMemberURL);
-
-		if (!empty($dynamicGroupMemberURL)) {
-			// look through dynamic groups to add them to the result array if needed
-			$groupsToMatch = $this->access->fetchListOfGroups(
-				$this->access->connection->ldapGroupFilter,array('dn',$dynamicGroupMemberURL));
-			foreach($groupsToMatch as $dynamicGroup) {
-				if (!array_key_exists($dynamicGroupMemberURL, $dynamicGroup)) {
-					continue;
-				}
-				$pos = strpos($dynamicGroup[$dynamicGroupMemberURL][0], '(');
-				if ($pos !== false) {
-					$memberUrlFilter = substr($dynamicGroup[$dynamicGroupMemberURL][0],$pos);
-					// apply filter via ldap search to see if this user is in this
-					// dynamic group
-					$userMatch = $this->access->readAttribute(
-						$userDN,
-						$this->access->connection->ldapUserDisplayName,
-						$memberUrlFilter
-					);
-					if ($userMatch !== false) {
-						// match found so this user is in this group
-						$groupName = $this->access->dn2groupname($dynamicGroup['dn'][0]);
-						if(is_string($groupName)) {
-							// be sure to never return false if the dn could not be
-							// resolved to a name, for whatever reason.
-							$groups[] = $groupName;
-						}
-					}
-				} else {
-					\OCP\Util::writeLog('user_ldap', 'No search filter found on member url '.
-						'of group ' . print_r($dynamicGroup, true), \OCP\Util::DEBUG);
-				}
-			}
-		}
-
-		// if possible, read out membership via memberOf. It's far faster than
-		// performing a search, which still is a fallback later.
-		// memberof doesn't support memberuid, so skip it here.
-		if(intval($this->access->connection->hasMemberOfFilterSupport) === 1
-			&& intval($this->access->connection->useMemberOfToDetectMembership) === 1
-		    && strtolower($this->access->connection->ldapGroupMemberAssocAttr) !== 'memberuid'
-		    ) {
-			$groupDNs = $this->_getGroupDNsFromMemberOf($userDN);
-			if (is_array($groupDNs)) {
-				foreach ($groupDNs as $dn) {
-					$groupName = $this->access->dn2groupname($dn);
-					if(is_string($groupName)) {
-						// be sure to never return false if the dn could not be
-						// resolved to a name, for whatever reason.
-						$groups[] = $groupName;
-					}
-				}
-			}
-
-			if($primaryGroup !== false) {
-				$groups[] = $primaryGroup;
-			}
-			if($gidGroupName !== false) {
-				$groups[] = $gidGroupName;
-			}
-			$this->access->connection->writeToCache($cacheKey, $groups);
-			return $groups;
-		}
-
-		//uniqueMember takes DN, memberuid the uid, so we need to distinguish
-		if((strtolower($this->access->connection->ldapGroupMemberAssocAttr) === 'uniquemember')
-			|| (strtolower($this->access->connection->ldapGroupMemberAssocAttr) === 'member')
-		) {
-			$uid = $userDN;
-		} else if(strtolower($this->access->connection->ldapGroupMemberAssocAttr) === 'memberuid') {
-			$result = $this->access->readAttribute($userDN, 'uid');
-			if ($result === false) {
-				\OCP\Util::writeLog('user_ldap', 'No uid attribute found for DN ' . $userDN . ' on '.
-					$this->access->connection->ldapHost, \OCP\Util::DEBUG);
-			}
-			$uid = $result[0];
-		} else {
-			// just in case
-			$uid = $userDN;
-		}
-
-		if(isset($this->cachedGroupsByMember[$uid])) {
-			$groups = array_merge($groups, $this->cachedGroupsByMember[$uid]);
-		} else {
-			$groupsByMember = array_values($this->getGroupsByMember($uid));
-			$groupsByMember = $this->access->nextcloudGroupNames($groupsByMember);
-			$this->cachedGroupsByMember[$uid] = $groupsByMember;
-			$groups = array_merge($groups, $groupsByMember);
-		}
-
-		if($primaryGroup !== false) {
-			$groups[] = $primaryGroup;
-		}
-		if($gidGroupName !== false) {
-			$groups[] = $gidGroupName;
-		}
-
-		$groups = array_unique($groups, SORT_LOCALE_STRING);
-		$this->access->connection->writeToCache($cacheKey, $groups);
-
-		return $groups;
-	}
-
-	/**
-	 * @param string $dn
-	 * @param array|null &$seen
-	 * @return array
-	 */
-	private function getGroupsByMember($dn, &$seen = null) {
-		if ($seen === null) {
-			$seen = array();
-		}
-		$allGroups = array();
-		if (array_key_exists($dn, $seen)) {
-			// avoid loops
-			return array();
-		}
-		$seen[$dn] = true;
-		$filter = $this->access->combineFilterWithAnd(array(
-			$this->access->connection->ldapGroupFilter,
-			$this->access->connection->ldapGroupMemberAssocAttr.'='.$dn
-		));
-		$groups = $this->access->fetchListOfGroups($filter,
-			array($this->access->connection->ldapGroupDisplayName, 'dn'));
-		if (is_array($groups)) {
-			foreach ($groups as $groupobj) {
-				$groupDN = $groupobj['dn'][0];
-				$allGroups[$groupDN] = $groupobj;
-				$nestedGroups = $this->access->connection->ldapNestedGroups;
-				if (!empty($nestedGroups)) {
-					$supergroups = $this->getGroupsByMember($groupDN, $seen);
-					if (is_array($supergroups) && (count($supergroups)>0)) {
-						$allGroups = array_merge($allGroups, $supergroups);
-					}
-				}
-			}
-		}
-		return $allGroups;
-	}
-
-	/**
-	 * get a list of all users in a group
-	 *
-	 * @param string $gid
-	 * @param string $search
-	 * @param int $limit
-	 * @param int $offset
-	 * @return array with user ids
-	 */
-	public function usersInGroup($gid, $search = '', $limit = -1, $offset = 0) {
-		if(!$this->enabled) {
-			return array();
-		}
-		if(!$this->groupExists($gid)) {
-			return array();
-		}
-		$search = $this->access->escapeFilterPart($search, true);
-		$cacheKey = 'usersInGroup-'.$gid.'-'.$search.'-'.$limit.'-'.$offset;
-		// check for cache of the exact query
-		$groupUsers = $this->access->connection->getFromCache($cacheKey);
-		if(!is_null($groupUsers)) {
-			return $groupUsers;
-		}
-
-		// check for cache of the query without limit and offset
-		$groupUsers = $this->access->connection->getFromCache('usersInGroup-'.$gid.'-'.$search);
-		if(!is_null($groupUsers)) {
-			$groupUsers = array_slice($groupUsers, $offset, $limit);
-			$this->access->connection->writeToCache($cacheKey, $groupUsers);
-			return $groupUsers;
-		}
-
-		if($limit === -1) {
-			$limit = null;
-		}
-		$groupDN = $this->access->groupname2dn($gid);
-		if(!$groupDN) {
-			// group couldn't be found, return empty resultset
-			$this->access->connection->writeToCache($cacheKey, array());
-			return array();
-		}
-
-		$primaryUsers = $this->getUsersInPrimaryGroup($groupDN, $search, $limit, $offset);
-		$posixGroupUsers = $this->getUsersInGidNumber($groupDN, $search, $limit, $offset);
-		$members = array_keys($this->_groupMembers($groupDN));
-		if(!$members && empty($posixGroupUsers) && empty($primaryUsers)) {
-			//in case users could not be retrieved, return empty result set
-			$this->access->connection->writeToCache($cacheKey, []);
-			return [];
-		}
-
-		$groupUsers = array();
-		$isMemberUid = (strtolower($this->access->connection->ldapGroupMemberAssocAttr) === 'memberuid');
-		$attrs = $this->access->userManager->getAttributes(true);
-		foreach($members as $member) {
-			if($isMemberUid) {
-				//we got uids, need to get their DNs to 'translate' them to user names
-				$filter = $this->access->combineFilterWithAnd(array(
-					str_replace('%uid', $member, $this->access->connection->ldapLoginFilter),
-					$this->access->getFilterPartForUserSearch($search)
-				));
-				$ldap_users = $this->access->fetchListOfUsers($filter, $attrs, 1);
-				if(count($ldap_users) < 1) {
-					continue;
-				}
-				$groupUsers[] = $this->access->dn2username($ldap_users[0]['dn'][0]);
-			} else {
-				//we got DNs, check if we need to filter by search or we can give back all of them
-				if ($search !== '') {
-					if(!$this->access->readAttribute($member,
-						$this->access->connection->ldapUserDisplayName,
-						$this->access->getFilterPartForUserSearch($search))) {
-						continue;
-					}
-				}
-				// dn2username will also check if the users belong to the allowed base
-				if($ocname = $this->access->dn2username($member)) {
-					$groupUsers[] = $ocname;
-				}
-			}
-		}
-
-		$groupUsers = array_unique(array_merge($groupUsers, $primaryUsers, $posixGroupUsers));
-		natsort($groupUsers);
-		$this->access->connection->writeToCache('usersInGroup-'.$gid.'-'.$search, $groupUsers);
-		$groupUsers = array_slice($groupUsers, $offset, $limit);
-
-		$this->access->connection->writeToCache($cacheKey, $groupUsers);
-
-		return $groupUsers;
-	}
-
-	/**
-	 * returns the number of users in a group, who match the search term
-	 * @param string $gid the internal group name
-	 * @param string $search optional, a search string
-	 * @return int|bool
-	 */
-	public function countUsersInGroup($gid, $search = '') {
-		$cacheKey = 'countUsersInGroup-'.$gid.'-'.$search;
-		if(!$this->enabled || !$this->groupExists($gid)) {
-			return false;
-		}
-		$groupUsers = $this->access->connection->getFromCache($cacheKey);
-		if(!is_null($groupUsers)) {
-			return $groupUsers;
-		}
-
-		$groupDN = $this->access->groupname2dn($gid);
-		if(!$groupDN) {
-			// group couldn't be found, return empty result set
-			$this->access->connection->writeToCache($cacheKey, false);
-			return false;
-		}
-
-		$members = array_keys($this->_groupMembers($groupDN));
-		$primaryUserCount = $this->countUsersInPrimaryGroup($groupDN, '');
-		if(!$members && $primaryUserCount === 0) {
-			//in case users could not be retrieved, return empty result set
-			$this->access->connection->writeToCache($cacheKey, false);
-			return false;
-		}
-
-		if ($search === '') {
-			$groupUsers = count($members) + $primaryUserCount;
-			$this->access->connection->writeToCache($cacheKey, $groupUsers);
-			return $groupUsers;
-		}
-		$search = $this->access->escapeFilterPart($search, true);
-		$isMemberUid =
-			(strtolower($this->access->connection->ldapGroupMemberAssocAttr)
-			=== 'memberuid');
-
-		//we need to apply the search filter
-		//alternatives that need to be checked:
-		//a) get all users by search filter and array_intersect them
-		//b) a, but only when less than 1k 10k ?k users like it is
-		//c) put all DNs|uids in a LDAP filter, combine with the search string
-		//   and let it count.
-		//For now this is not important, because the only use of this method
-		//does not supply a search string
-		$groupUsers = array();
-		foreach($members as $member) {
-			if($isMemberUid) {
-				//we got uids, need to get their DNs to 'translate' them to user names
-				$filter = $this->access->combineFilterWithAnd(array(
-					str_replace('%uid', $member, $this->access->connection->ldapLoginFilter),
-					$this->access->getFilterPartForUserSearch($search)
-				));
-				$ldap_users = $this->access->fetchListOfUsers($filter, 'dn', 1);
-				if(count($ldap_users) < 1) {
-					continue;
-				}
-				$groupUsers[] = $this->access->dn2username($ldap_users[0]);
-			} else {
-				//we need to apply the search filter now
-				if(!$this->access->readAttribute($member,
-					$this->access->connection->ldapUserDisplayName,
-					$this->access->getFilterPartForUserSearch($search))) {
-					continue;
-				}
-				// dn2username will also check if the users belong to the allowed base
-				if($ocname = $this->access->dn2username($member)) {
-					$groupUsers[] = $ocname;
-				}
-			}
-		}
-
-		//and get users that have the group as primary
-		$primaryUsers = $this->countUsersInPrimaryGroup($groupDN, $search);
-
-		return count($groupUsers) + $primaryUsers;
-	}
-
-	/**
-	 * get a list of all groups
-	 *
-	 * @param string $search
-	 * @param $limit
-	 * @param int $offset
-	 * @return array with group names
-	 *
-	 * Returns a list with all groups (used by getGroups)
-	 */
-	protected function getGroupsChunk($search = '', $limit = -1, $offset = 0) {
-		if(!$this->enabled) {
-			return array();
-		}
-		$cacheKey = 'getGroups-'.$search.'-'.$limit.'-'.$offset;
-
-		//Check cache before driving unnecessary searches
-		\OCP\Util::writeLog('user_ldap', 'getGroups '.$cacheKey, \OCP\Util::DEBUG);
-		$ldap_groups = $this->access->connection->getFromCache($cacheKey);
-		if(!is_null($ldap_groups)) {
-			return $ldap_groups;
-		}
-
-		// if we'd pass -1 to LDAP search, we'd end up in a Protocol
-		// error. With a limit of 0, we get 0 results. So we pass null.
-		if($limit <= 0) {
-			$limit = null;
-		}
-		$filter = $this->access->combineFilterWithAnd(array(
-			$this->access->connection->ldapGroupFilter,
-			$this->access->getFilterPartForGroupSearch($search)
-		));
-		\OCP\Util::writeLog('user_ldap', 'getGroups Filter '.$filter, \OCP\Util::DEBUG);
-		$ldap_groups = $this->access->fetchListOfGroups($filter,
-				array($this->access->connection->ldapGroupDisplayName, 'dn'),
-				$limit,
-				$offset);
-		$ldap_groups = $this->access->nextcloudGroupNames($ldap_groups);
-
-		$this->access->connection->writeToCache($cacheKey, $ldap_groups);
-		return $ldap_groups;
-	}
-
-	/**
-	 * get a list of all groups using a paged search
-	 *
-	 * @param string $search
-	 * @param int $limit
-	 * @param int $offset
-	 * @return array with group names
-	 *
-	 * Returns a list with all groups
-	 * Uses a paged search if available to override a
-	 * server side search limit.
-	 * (active directory has a limit of 1000 by default)
-	 */
-	public function getGroups($search = '', $limit = -1, $offset = 0) {
-		if(!$this->enabled) {
-			return array();
-		}
-		$search = $this->access->escapeFilterPart($search, true);
-		$pagingSize = intval($this->access->connection->ldapPagingSize);
-		if (!$this->access->connection->hasPagedResultSupport || $pagingSize <= 0) {
-			return $this->getGroupsChunk($search, $limit, $offset);
-		}
-		$maxGroups = 100000; // limit max results (just for safety reasons)
-		if ($limit > -1) {
-		   $overallLimit = min($limit + $offset, $maxGroups);
-		} else {
-		   $overallLimit = $maxGroups;
-		}
-		$chunkOffset = $offset;
-		$allGroups = array();
-		while ($chunkOffset < $overallLimit) {
-			$chunkLimit = min($pagingSize, $overallLimit - $chunkOffset);
-			$ldapGroups = $this->getGroupsChunk($search, $chunkLimit, $chunkOffset);
-			$nread = count($ldapGroups);
-			\OCP\Util::writeLog('user_ldap', 'getGroups('.$search.'): read '.$nread.' at offset '.$chunkOffset.' (limit: '.$chunkLimit.')', \OCP\Util::DEBUG);
-			if ($nread) {
-				$allGroups = array_merge($allGroups, $ldapGroups);
-				$chunkOffset += $nread;
-			}
-			if ($nread < $chunkLimit) {
-				break;
-			}
-		}
-		return $allGroups;
-	}
-
-	/**
-	 * @param string $group
-	 * @return bool
-	 */
-	public function groupMatchesFilter($group) {
-		return (strripos($group, $this->groupSearch) !== false);
-	}
-
-	/**
-	 * check if a group exists
-	 * @param string $gid
-	 * @return bool
-	 */
-	public function groupExists($gid) {
-		$groupExists = $this->access->connection->getFromCache('groupExists'.$gid);
-		if(!is_null($groupExists)) {
-			return (bool)$groupExists;
-		}
-
-		//getting dn, if false the group does not exist. If dn, it may be mapped
-		//only, requires more checking.
-		$dn = $this->access->groupname2dn($gid);
-		if(!$dn) {
-			$this->access->connection->writeToCache('groupExists'.$gid, false);
-			return false;
-		}
-
-		//if group really still exists, we will be able to read its objectclass
-		if(!is_array($this->access->readAttribute($dn, ''))) {
-			$this->access->connection->writeToCache('groupExists'.$gid, false);
-			return false;
-		}
-
-		$this->access->connection->writeToCache('groupExists'.$gid, true);
-		return true;
-	}
-
-	/**
-	* Check if backend implements actions
-	* @param int $actions bitwise-or'ed actions
-	* @return boolean
-	*
-	* Returns the supported actions as int to be
-	* compared with \OC\User\Backend::CREATE_USER etc.
-	*/
-	public function implementsActions($actions) {
-		return (bool)(\OC\Group\Backend::COUNT_USERS & $actions);
-	}
-
-	/**
-	 * Return access for LDAP interaction.
-	 * @return Access instance of Access for LDAP interaction
-	 */
-	public function getLDAPAccess() {
-		return $this->access;
-	}
+    protected $enabled = false;
+
+    /**
+     * @var string[] $cachedGroupMembers array of users with gid as key
+     */
+    protected $cachedGroupMembers;
+
+    /**
+     * @var string[] $cachedGroupsByMember array of groups with uid as key
+     */
+    protected $cachedGroupsByMember;
+
+    public function __construct(Access $access) {
+        parent::__construct($access);
+        $filter = $this->access->connection->ldapGroupFilter;
+        $gassoc = $this->access->connection->ldapGroupMemberAssocAttr;
+        if(!empty($filter) && !empty($gassoc)) {
+            $this->enabled = true;
+        }
+
+        $this->cachedGroupMembers = new CappedMemoryCache();
+        $this->cachedGroupsByMember = new CappedMemoryCache();
+    }
+
+    /**
+     * is user in group?
+     * @param string $uid uid of the user
+     * @param string $gid gid of the group
+     * @return bool
+     *
+     * Checks whether the user is member of a group or not.
+     */
+    public function inGroup($uid, $gid) {
+        if(!$this->enabled) {
+            return false;
+        }
+        $cacheKey = 'inGroup'.$uid.':'.$gid;
+        $inGroup = $this->access->connection->getFromCache($cacheKey);
+        if(!is_null($inGroup)) {
+            return (bool)$inGroup;
+        }
+
+        $userDN = $this->access->username2dn($uid);
+
+        if(isset($this->cachedGroupMembers[$gid])) {
+            $isInGroup = in_array($userDN, $this->cachedGroupMembers[$gid]);
+            return $isInGroup;
+        }
+
+        $cacheKeyMembers = 'inGroup-members:'.$gid;
+        $members = $this->access->connection->getFromCache($cacheKeyMembers);
+        if(!is_null($members)) {
+            $this->cachedGroupMembers[$gid] = $members;
+            $isInGroup = in_array($userDN, $members);
+            $this->access->connection->writeToCache($cacheKey, $isInGroup);
+            return $isInGroup;
+        }
+
+        $groupDN = $this->access->groupname2dn($gid);
+        // just in case
+        if(!$groupDN || !$userDN) {
+            $this->access->connection->writeToCache($cacheKey, false);
+            return false;
+        }
+
+        //check primary group first
+        if($gid === $this->getUserPrimaryGroup($userDN)) {
+            $this->access->connection->writeToCache($cacheKey, true);
+            return true;
+        }
+
+        //usually, LDAP attributes are said to be case insensitive. But there are exceptions of course.
+        $members = $this->_groupMembers($groupDN);
+        $members = array_keys($members); // uids are returned as keys
+        if(!is_array($members) || count($members) === 0) {
+            $this->access->connection->writeToCache($cacheKey, false);
+            return false;
+        }
+
+        //extra work if we don't get back user DNs
+        if(strtolower($this->access->connection->ldapGroupMemberAssocAttr) === 'memberuid') {
+            $dns = array();
+            $filterParts = array();
+            $bytes = 0;
+            foreach($members as $mid) {
+                $filter = str_replace('%uid', $mid, $this->access->connection->ldapLoginFilter);
+                $filterParts[] = $filter;
+                $bytes += strlen($filter);
+                if($bytes >= 9000000) {
+                    // AD has a default input buffer of 10 MB, we do not want
+                    // to take even the chance to exceed it
+                    $filter = $this->access->combineFilterWithOr($filterParts);
+                    $bytes = 0;
+                    $filterParts = array();
+                    $users = $this->access->fetchListOfUsers($filter, 'dn', count($filterParts));
+                    $dns = array_merge($dns, $users);
+                }
+            }
+            if(count($filterParts) > 0) {
+                $filter = $this->access->combineFilterWithOr($filterParts);
+                $users = $this->access->fetchListOfUsers($filter, 'dn', count($filterParts));
+                $dns = array_merge($dns, $users);
+            }
+            $members = $dns;
+        }
+
+        $isInGroup = in_array($userDN, $members);
+        $this->access->connection->writeToCache($cacheKey, $isInGroup);
+        $this->access->connection->writeToCache($cacheKeyMembers, $members);
+        $this->cachedGroupMembers[$gid] = $members;
+
+        return $isInGroup;
+    }
+
+    /**
+     * @param string $dnGroup
+     * @return array
+     *
+     * For a group that has user membership defined by an LDAP search url attribute returns the users
+     * that match the search url otherwise returns an empty array.
+     */
+    public function getDynamicGroupMembers($dnGroup) {
+        $dynamicGroupMemberURL = strtolower($this->access->connection->ldapDynamicGroupMemberURL);
+
+        if (empty($dynamicGroupMemberURL)) {
+            return array();
+        }
+
+        $dynamicMembers = array();
+        $memberURLs = $this->access->readAttribute(
+            $dnGroup,
+            $dynamicGroupMemberURL,
+            $this->access->connection->ldapGroupFilter
+        );
+        if ($memberURLs !== false) {
+            // this group has the 'memberURL' attribute so this is a dynamic group
+            // example 1: ldap:///cn=users,cn=accounts,dc=dcsubbase,dc=dcbase??one?(o=HeadOffice)
+            // example 2: ldap:///cn=users,cn=accounts,dc=dcsubbase,dc=dcbase??one?(&(o=HeadOffice)(uidNumber>=500))
+            $pos = strpos($memberURLs[0], '(');
+            if ($pos !== false) {
+                $memberUrlFilter = substr($memberURLs[0], $pos);
+                $foundMembers = $this->access->searchUsers($memberUrlFilter,'dn');
+                $dynamicMembers = array();
+                foreach($foundMembers as $value) {
+                    $dynamicMembers[$value['dn'][0]] = 1;
+                }
+            } else {
+                \OCP\Util::writeLog('user_ldap', 'No search filter found on member url '.
+                    'of group ' . $dnGroup, \OCP\Util::DEBUG);
+            }
+        }
+        return $dynamicMembers;
+    }
+
+    /**
+     * @param string $dnGroup
+     * @param array|null &$seen
+     * @return array|mixed|null
+     */
+    private function _groupMembers($dnGroup, &$seen = null) {
+        if ($seen === null) {
+            $seen = array();
+        }
+        $allMembers = array();
+        if (array_key_exists($dnGroup, $seen)) {
+            // avoid loops
+            return array();
+        }
+        // used extensively in cron job, caching makes sense for nested groups
+        $cacheKey = '_groupMembers'.$dnGroup;
+        $groupMembers = $this->access->connection->getFromCache($cacheKey);
+        if(!is_null($groupMembers)) {
+            return $groupMembers;
+        }
+        $seen[$dnGroup] = 1;
+        $members = $this->access->readAttribute($dnGroup, $this->access->connection->ldapGroupMemberAssocAttr,
+                                                $this->access->connection->ldapGroupFilter);
+        if (is_array($members)) {
+            foreach ($members as $memberDN) {
+                $allMembers[$memberDN] = 1;
+                $nestedGroups = $this->access->connection->ldapNestedGroups;
+                if (!empty($nestedGroups)) {
+                    $subMembers = $this->_groupMembers($memberDN, $seen);
+                    if ($subMembers) {
+                        $allMembers = array_merge($allMembers, $subMembers);
+                    }
+                }
+            }
+        }
+
+        $allMembers = array_merge($allMembers, $this->getDynamicGroupMembers($dnGroup));
+
+        $this->access->connection->writeToCache($cacheKey, $allMembers);
+        return $allMembers;
+    }
+
+    /**
+     * @param string $DN
+     * @param array|null &$seen
+     * @return array
+     */
+    private function _getGroupDNsFromMemberOf($DN, &$seen = null) {
+        if ($seen === null) {
+            $seen = array();
+        }
+        if (array_key_exists($DN, $seen)) {
+            // avoid loops
+            return array();
+        }
+        $seen[$DN] = 1;
+        $groups = $this->access->readAttribute($DN, 'memberOf');
+        if (!is_array($groups)) {
+            return array();
+        }
+        $groups = $this->access->groupsMatchFilter($groups);
+        $allGroups =  $groups;
+        $nestedGroups = $this->access->connection->ldapNestedGroups;
+        if (intval($nestedGroups) === 1) {
+            foreach ($groups as $group) {
+                $subGroups = $this->_getGroupDNsFromMemberOf($group, $seen);
+                $allGroups = array_merge($allGroups, $subGroups);
+            }
+        }
+        return $allGroups;
+    }
+
+    /**
+     * translates a gidNumber into an ownCloud internal name
+     * @param string $gid as given by gidNumber on POSIX LDAP
+     * @param string $dn a DN that belongs to the same domain as the group
+     * @return string|bool
+     */
+    public function gidNumber2Name($gid, $dn) {
+        $cacheKey = 'gidNumberToName' . $gid;
+        $groupName = $this->access->connection->getFromCache($cacheKey);
+        if(!is_null($groupName) && isset($groupName)) {
+            return $groupName;
+        }
+
+        //we need to get the DN from LDAP
+        $filter = $this->access->combineFilterWithAnd([
+            $this->access->connection->ldapGroupFilter,
+            'objectClass=posixGroup',
+            $this->access->connection->ldapGidNumber . '=' . $gid
+        ]);
+        $result = $this->access->searchGroups($filter, array('dn'), 1);
+        if(empty($result)) {
+            return false;
+        }
+        $dn = $result[0]['dn'][0];
+
+        //and now the group name
+        //NOTE once we have separate ownCloud group IDs and group names we can
+        //directly read the display name attribute instead of the DN
+        $name = $this->access->dn2groupname($dn);
+
+        $this->access->connection->writeToCache($cacheKey, $name);
+
+        return $name;
+    }
+
+    /**
+     * returns the entry's gidNumber
+     * @param string $dn
+     * @param string $attribute
+     * @return string|bool
+     */
+    private function getEntryGidNumber($dn, $attribute) {
+        $value = $this->access->readAttribute($dn, $attribute);
+        if(is_array($value) && !empty($value)) {
+            return $value[0];
+        }
+        return false;
+    }
+
+    /**
+     * returns the group's primary ID
+     * @param string $dn
+     * @return string|bool
+     */
+    public function getGroupGidNumber($dn) {
+        return $this->getEntryGidNumber($dn, 'gidNumber');
+    }
+
+    /**
+     * returns the user's gidNumber
+     * @param string $dn
+     * @return string|bool
+     */
+    public function getUserGidNumber($dn) {
+        $gidNumber = false;
+        if($this->access->connection->hasGidNumber) {
+            $gidNumber = $this->getEntryGidNumber($dn, 'gidNumber');
+            if($gidNumber === false) {
+                $this->access->connection->hasGidNumber = false;
+            }
+        }
+        return $gidNumber;
+    }
+
+    /**
+     * returns a filter for a "users has specific gid" search or count operation
+     *
+     * @param string $groupDN
+     * @param string $search
+     * @return string
+     * @throws \Exception
+     */
+    private function prepareFilterForUsersHasGidNumber($groupDN, $search = '') {
+        $groupID = $this->getGroupGidNumber($groupDN);
+        if($groupID === false) {
+            throw new \Exception('Not a valid group');
+        }
+
+        $filterParts = [];
+        $filterParts[] = $this->access->getFilterForUserCount();
+        if ($search !== '') {
+            $filterParts[] = $this->access->getFilterPartForUserSearch($search);
+        }
+        $filterParts[] = $this->access->connection->ldapGidNumber .'=' . $groupID;
+
+        $filter = $this->access->combineFilterWithAnd($filterParts);
+
+        return $filter;
+    }
+
+    /**
+     * returns a list of users that have the given group as gid number
+     *
+     * @param string $groupDN
+     * @param string $search
+     * @param int $limit
+     * @param int $offset
+     * @return string[]
+     */
+    public function getUsersInGidNumber($groupDN, $search = '', $limit = -1, $offset = 0) {
+        try {
+            $filter = $this->prepareFilterForUsersHasGidNumber($groupDN, $search);
+            $users = $this->access->fetchListOfUsers(
+                $filter,
+                [$this->access->connection->ldapUserDisplayName, 'dn'],
+                $limit,
+                $offset
+            );
+            return $this->access->nextcloudUserNames($users);
+        } catch (\Exception $e) {
+            return [];
+        }
+    }
+
+    /**
+     * returns the number of users that have the given group as gid number
+     *
+     * @param string $groupDN
+     * @param string $search
+     * @param int $limit
+     * @param int $offset
+     * @return int
+     */
+    public function countUsersInGidNumber($groupDN, $search = '', $limit = -1, $offset = 0) {
+        try {
+            $filter = $this->prepareFilterForUsersHasGidNumber($groupDN, $search);
+            $users = $this->access->countUsers($filter, ['dn'], $limit, $offset);
+            return (int)$users;
+        } catch (\Exception $e) {
+            return 0;
+        }
+    }
+
+    /**
+     * gets the gidNumber of a user
+     * @param string $dn
+     * @return string
+     */
+    public function getUserGroupByGid($dn) {
+        $groupID = $this->getUserGidNumber($dn);
+        if($groupID !== false) {
+            $groupName = $this->gidNumber2Name($groupID, $dn);
+            if($groupName !== false) {
+                return $groupName;
+            }
+        }
+
+        return false;
+    }
+
+    /**
+     * translates a primary group ID into an Nextcloud internal name
+     * @param string $gid as given by primaryGroupID on AD
+     * @param string $dn a DN that belongs to the same domain as the group
+     * @return string|bool
+     */
+    public function primaryGroupID2Name($gid, $dn) {
+        $cacheKey = 'primaryGroupIDtoName';
+        $groupNames = $this->access->connection->getFromCache($cacheKey);
+        if(!is_null($groupNames) && isset($groupNames[$gid])) {
+            return $groupNames[$gid];
+        }
+
+        $domainObjectSid = $this->access->getSID($dn);
+        if($domainObjectSid === false) {
+            return false;
+        }
+
+        //we need to get the DN from LDAP
+        $filter = $this->access->combineFilterWithAnd(array(
+            $this->access->connection->ldapGroupFilter,
+            'objectsid=' . $domainObjectSid . '-' . $gid
+        ));
+        $result = $this->access->searchGroups($filter, array('dn'), 1);
+        if(empty($result)) {
+            return false;
+        }
+        $dn = $result[0]['dn'][0];
+
+        //and now the group name
+        //NOTE once we have separate Nextcloud group IDs and group names we can
+        //directly read the display name attribute instead of the DN
+        $name = $this->access->dn2groupname($dn);
+
+        $this->access->connection->writeToCache($cacheKey, $name);
+
+        return $name;
+    }
+
+    /**
+     * returns the entry's primary group ID
+     * @param string $dn
+     * @param string $attribute
+     * @return string|bool
+     */
+    private function getEntryGroupID($dn, $attribute) {
+        $value = $this->access->readAttribute($dn, $attribute);
+        if(is_array($value) && !empty($value)) {
+            return $value[0];
+        }
+        return false;
+    }
+
+    /**
+     * returns the group's primary ID
+     * @param string $dn
+     * @return string|bool
+     */
+    public function getGroupPrimaryGroupID($dn) {
+        return $this->getEntryGroupID($dn, 'primaryGroupToken');
+    }
+
+    /**
+     * returns the user's primary group ID
+     * @param string $dn
+     * @return string|bool
+     */
+    public function getUserPrimaryGroupIDs($dn) {
+        $primaryGroupID = false;
+        if($this->access->connection->hasPrimaryGroups) {
+            $primaryGroupID = $this->getEntryGroupID($dn, 'primaryGroupID');
+            if($primaryGroupID === false) {
+                $this->access->connection->hasPrimaryGroups = false;
+            }
+        }
+        return $primaryGroupID;
+    }
+
+    /**
+     * returns a filter for a "users in primary group" search or count operation
+     *
+     * @param string $groupDN
+     * @param string $search
+     * @return string
+     * @throws \Exception
+     */
+    private function prepareFilterForUsersInPrimaryGroup($groupDN, $search = '') {
+        $groupID = $this->getGroupPrimaryGroupID($groupDN);
+        if($groupID === false) {
+            throw new \Exception('Not a valid group');
+        }
+
+        $filterParts = [];
+        $filterParts[] = $this->access->getFilterForUserCount();
+        if ($search !== '') {
+            $filterParts[] = $this->access->getFilterPartForUserSearch($search);
+        }
+        $filterParts[] = 'primaryGroupID=' . $groupID;
+
+        $filter = $this->access->combineFilterWithAnd($filterParts);
+
+        return $filter;
+    }
+
+    /**
+     * returns a list of users that have the given group as primary group
+     *
+     * @param string $groupDN
+     * @param string $search
+     * @param int $limit
+     * @param int $offset
+     * @return string[]
+     */
+    public function getUsersInPrimaryGroup($groupDN, $search = '', $limit = -1, $offset = 0) {
+        try {
+            $filter = $this->prepareFilterForUsersInPrimaryGroup($groupDN, $search);
+            $users = $this->access->fetchListOfUsers(
+                $filter,
+                array($this->access->connection->ldapUserDisplayName, 'dn'),
+                $limit,
+                $offset
+            );
+            return $this->access->nextcloudUserNames($users);
+        } catch (\Exception $e) {
+            return array();
+        }
+    }
+
+    /**
+     * returns the number of users that have the given group as primary group
+     *
+     * @param string $groupDN
+     * @param string $search
+     * @param int $limit
+     * @param int $offset
+     * @return int
+     */
+    public function countUsersInPrimaryGroup($groupDN, $search = '', $limit = -1, $offset = 0) {
+        try {
+            $filter = $this->prepareFilterForUsersInPrimaryGroup($groupDN, $search);
+            $users = $this->access->countUsers($filter, array('dn'), $limit, $offset);
+            return (int)$users;
+        } catch (\Exception $e) {
+            return 0;
+        }
+    }
+
+    /**
+     * gets the primary group of a user
+     * @param string $dn
+     * @return string
+     */
+    public function getUserPrimaryGroup($dn) {
+        $groupID = $this->getUserPrimaryGroupIDs($dn);
+        if($groupID !== false) {
+            $groupName = $this->primaryGroupID2Name($groupID, $dn);
+            if($groupName !== false) {
+                return $groupName;
+            }
+        }
+
+        return false;
+    }
+
+    /**
+     * Get all groups a user belongs to
+     * @param string $uid Name of the user
+     * @return array with group names
+     *
+     * This function fetches all groups a user belongs to. It does not check
+     * if the user exists at all.
+     *
+     * This function includes groups based on dynamic group membership.
+     */
+    public function getUserGroups($uid) {
+        if(!$this->enabled) {
+            return array();
+        }
+        $cacheKey = 'getUserGroups'.$uid;
+        $userGroups = $this->access->connection->getFromCache($cacheKey);
+        if(!is_null($userGroups)) {
+            return $userGroups;
+        }
+        $userDN = $this->access->username2dn($uid);
+        if(!$userDN) {
+            $this->access->connection->writeToCache($cacheKey, array());
+            return array();
+        }
+
+        $groups = [];
+        $primaryGroup = $this->getUserPrimaryGroup($userDN);
+        $gidGroupName = $this->getUserGroupByGid($userDN);
+
+        $dynamicGroupMemberURL = strtolower($this->access->connection->ldapDynamicGroupMemberURL);
+
+        if (!empty($dynamicGroupMemberURL)) {
+            // look through dynamic groups to add them to the result array if needed
+            $groupsToMatch = $this->access->fetchListOfGroups(
+                $this->access->connection->ldapGroupFilter,array('dn',$dynamicGroupMemberURL));
+            foreach($groupsToMatch as $dynamicGroup) {
+                if (!array_key_exists($dynamicGroupMemberURL, $dynamicGroup)) {
+                    continue;
+                }
+                $pos = strpos($dynamicGroup[$dynamicGroupMemberURL][0], '(');
+                if ($pos !== false) {
+                    $memberUrlFilter = substr($dynamicGroup[$dynamicGroupMemberURL][0],$pos);
+                    // apply filter via ldap search to see if this user is in this
+                    // dynamic group
+                    $userMatch = $this->access->readAttribute(
+                        $userDN,
+                        $this->access->connection->ldapUserDisplayName,
+                        $memberUrlFilter
+                    );
+                    if ($userMatch !== false) {
+                        // match found so this user is in this group
+                        $groupName = $this->access->dn2groupname($dynamicGroup['dn'][0]);
+                        if(is_string($groupName)) {
+                            // be sure to never return false if the dn could not be
+                            // resolved to a name, for whatever reason.
+                            $groups[] = $groupName;
+                        }
+                    }
+                } else {
+                    \OCP\Util::writeLog('user_ldap', 'No search filter found on member url '.
+                        'of group ' . print_r($dynamicGroup, true), \OCP\Util::DEBUG);
+                }
+            }
+        }
+
+        // if possible, read out membership via memberOf. It's far faster than
+        // performing a search, which still is a fallback later.
+        // memberof doesn't support memberuid, so skip it here.
+        if(intval($this->access->connection->hasMemberOfFilterSupport) === 1
+            && intval($this->access->connection->useMemberOfToDetectMembership) === 1
+            && strtolower($this->access->connection->ldapGroupMemberAssocAttr) !== 'memberuid'
+            ) {
+            $groupDNs = $this->_getGroupDNsFromMemberOf($userDN);
+            if (is_array($groupDNs)) {
+                foreach ($groupDNs as $dn) {
+                    $groupName = $this->access->dn2groupname($dn);
+                    if(is_string($groupName)) {
+                        // be sure to never return false if the dn could not be
+                        // resolved to a name, for whatever reason.
+                        $groups[] = $groupName;
+                    }
+                }
+            }
+
+            if($primaryGroup !== false) {
+                $groups[] = $primaryGroup;
+            }
+            if($gidGroupName !== false) {
+                $groups[] = $gidGroupName;
+            }
+            $this->access->connection->writeToCache($cacheKey, $groups);
+            return $groups;
+        }
+
+        //uniqueMember takes DN, memberuid the uid, so we need to distinguish
+        if((strtolower($this->access->connection->ldapGroupMemberAssocAttr) === 'uniquemember')
+            || (strtolower($this->access->connection->ldapGroupMemberAssocAttr) === 'member')
+        ) {
+            $uid = $userDN;
+        } else if(strtolower($this->access->connection->ldapGroupMemberAssocAttr) === 'memberuid') {
+            $result = $this->access->readAttribute($userDN, 'uid');
+            if ($result === false) {
+                \OCP\Util::writeLog('user_ldap', 'No uid attribute found for DN ' . $userDN . ' on '.
+                    $this->access->connection->ldapHost, \OCP\Util::DEBUG);
+            }
+            $uid = $result[0];
+        } else {
+            // just in case
+            $uid = $userDN;
+        }
+
+        if(isset($this->cachedGroupsByMember[$uid])) {
+            $groups = array_merge($groups, $this->cachedGroupsByMember[$uid]);
+        } else {
+            $groupsByMember = array_values($this->getGroupsByMember($uid));
+            $groupsByMember = $this->access->nextcloudGroupNames($groupsByMember);
+            $this->cachedGroupsByMember[$uid] = $groupsByMember;
+            $groups = array_merge($groups, $groupsByMember);
+        }
+
+        if($primaryGroup !== false) {
+            $groups[] = $primaryGroup;
+        }
+        if($gidGroupName !== false) {
+            $groups[] = $gidGroupName;
+        }
+
+        $groups = array_unique($groups, SORT_LOCALE_STRING);
+        $this->access->connection->writeToCache($cacheKey, $groups);
+
+        return $groups;
+    }
+
+    /**
+     * @param string $dn
+     * @param array|null &$seen
+     * @return array
+     */
+    private function getGroupsByMember($dn, &$seen = null) {
+        if ($seen === null) {
+            $seen = array();
+        }
+        $allGroups = array();
+        if (array_key_exists($dn, $seen)) {
+            // avoid loops
+            return array();
+        }
+        $seen[$dn] = true;
+        $filter = $this->access->combineFilterWithAnd(array(
+            $this->access->connection->ldapGroupFilter,
+            $this->access->connection->ldapGroupMemberAssocAttr.'='.$dn
+        ));
+        $groups = $this->access->fetchListOfGroups($filter,
+            array($this->access->connection->ldapGroupDisplayName, 'dn'));
+        if (is_array($groups)) {
+            foreach ($groups as $groupobj) {
+                $groupDN = $groupobj['dn'][0];
+                $allGroups[$groupDN] = $groupobj;
+                $nestedGroups = $this->access->connection->ldapNestedGroups;
+                if (!empty($nestedGroups)) {
+                    $supergroups = $this->getGroupsByMember($groupDN, $seen);
+                    if (is_array($supergroups) && (count($supergroups)>0)) {
+                        $allGroups = array_merge($allGroups, $supergroups);
+                    }
+                }
+            }
+        }
+        return $allGroups;
+    }
+
+    /**
+     * get a list of all users in a group
+     *
+     * @param string $gid
+     * @param string $search
+     * @param int $limit
+     * @param int $offset
+     * @return array with user ids
+     */
+    public function usersInGroup($gid, $search = '', $limit = -1, $offset = 0) {
+        if(!$this->enabled) {
+            return array();
+        }
+        if(!$this->groupExists($gid)) {
+            return array();
+        }
+        $search = $this->access->escapeFilterPart($search, true);
+        $cacheKey = 'usersInGroup-'.$gid.'-'.$search.'-'.$limit.'-'.$offset;
+        // check for cache of the exact query
+        $groupUsers = $this->access->connection->getFromCache($cacheKey);
+        if(!is_null($groupUsers)) {
+            return $groupUsers;
+        }
+
+        // check for cache of the query without limit and offset
+        $groupUsers = $this->access->connection->getFromCache('usersInGroup-'.$gid.'-'.$search);
+        if(!is_null($groupUsers)) {
+            $groupUsers = array_slice($groupUsers, $offset, $limit);
+            $this->access->connection->writeToCache($cacheKey, $groupUsers);
+            return $groupUsers;
+        }
+
+        if($limit === -1) {
+            $limit = null;
+        }
+        $groupDN = $this->access->groupname2dn($gid);
+        if(!$groupDN) {
+            // group couldn't be found, return empty resultset
+            $this->access->connection->writeToCache($cacheKey, array());
+            return array();
+        }
+
+        $primaryUsers = $this->getUsersInPrimaryGroup($groupDN, $search, $limit, $offset);
+        $posixGroupUsers = $this->getUsersInGidNumber($groupDN, $search, $limit, $offset);
+        $members = array_keys($this->_groupMembers($groupDN));
+        if(!$members && empty($posixGroupUsers) && empty($primaryUsers)) {
+            //in case users could not be retrieved, return empty result set
+            $this->access->connection->writeToCache($cacheKey, []);
+            return [];
+        }
+
+        $groupUsers = array();
+        $isMemberUid = (strtolower($this->access->connection->ldapGroupMemberAssocAttr) === 'memberuid');
+        $attrs = $this->access->userManager->getAttributes(true);
+        foreach($members as $member) {
+            if($isMemberUid) {
+                //we got uids, need to get their DNs to 'translate' them to user names
+                $filter = $this->access->combineFilterWithAnd(array(
+                    str_replace('%uid', $member, $this->access->connection->ldapLoginFilter),
+                    $this->access->getFilterPartForUserSearch($search)
+                ));
+                $ldap_users = $this->access->fetchListOfUsers($filter, $attrs, 1);
+                if(count($ldap_users) < 1) {
+                    continue;
+                }
+                $groupUsers[] = $this->access->dn2username($ldap_users[0]['dn'][0]);
+            } else {
+                //we got DNs, check if we need to filter by search or we can give back all of them
+                if ($search !== '') {
+                    if(!$this->access->readAttribute($member,
+                        $this->access->connection->ldapUserDisplayName,
+                        $this->access->getFilterPartForUserSearch($search))) {
+                        continue;
+                    }
+                }
+                // dn2username will also check if the users belong to the allowed base
+                if($ocname = $this->access->dn2username($member)) {
+                    $groupUsers[] = $ocname;
+                }
+            }
+        }
+
+        $groupUsers = array_unique(array_merge($groupUsers, $primaryUsers, $posixGroupUsers));
+        natsort($groupUsers);
+        $this->access->connection->writeToCache('usersInGroup-'.$gid.'-'.$search, $groupUsers);
+        $groupUsers = array_slice($groupUsers, $offset, $limit);
+
+        $this->access->connection->writeToCache($cacheKey, $groupUsers);
+
+        return $groupUsers;
+    }
+
+    /**
+     * returns the number of users in a group, who match the search term
+     * @param string $gid the internal group name
+     * @param string $search optional, a search string
+     * @return int|bool
+     */
+    public function countUsersInGroup($gid, $search = '') {
+        $cacheKey = 'countUsersInGroup-'.$gid.'-'.$search;
+        if(!$this->enabled || !$this->groupExists($gid)) {
+            return false;
+        }
+        $groupUsers = $this->access->connection->getFromCache($cacheKey);
+        if(!is_null($groupUsers)) {
+            return $groupUsers;
+        }
+
+        $groupDN = $this->access->groupname2dn($gid);
+        if(!$groupDN) {
+            // group couldn't be found, return empty result set
+            $this->access->connection->writeToCache($cacheKey, false);
+            return false;
+        }
+
+        $members = array_keys($this->_groupMembers($groupDN));
+        $primaryUserCount = $this->countUsersInPrimaryGroup($groupDN, '');
+        if(!$members && $primaryUserCount === 0) {
+            //in case users could not be retrieved, return empty result set
+            $this->access->connection->writeToCache($cacheKey, false);
+            return false;
+        }
+
+        if ($search === '') {
+            $groupUsers = count($members) + $primaryUserCount;
+            $this->access->connection->writeToCache($cacheKey, $groupUsers);
+            return $groupUsers;
+        }
+        $search = $this->access->escapeFilterPart($search, true);
+        $isMemberUid =
+            (strtolower($this->access->connection->ldapGroupMemberAssocAttr)
+            === 'memberuid');
+
+        //we need to apply the search filter
+        //alternatives that need to be checked:
+        //a) get all users by search filter and array_intersect them
+        //b) a, but only when less than 1k 10k ?k users like it is
+        //c) put all DNs|uids in a LDAP filter, combine with the search string
+        //   and let it count.
+        //For now this is not important, because the only use of this method
+        //does not supply a search string
+        $groupUsers = array();
+        foreach($members as $member) {
+            if($isMemberUid) {
+                //we got uids, need to get their DNs to 'translate' them to user names
+                $filter = $this->access->combineFilterWithAnd(array(
+                    str_replace('%uid', $member, $this->access->connection->ldapLoginFilter),
+                    $this->access->getFilterPartForUserSearch($search)
+                ));
+                $ldap_users = $this->access->fetchListOfUsers($filter, 'dn', 1);
+                if(count($ldap_users) < 1) {
+                    continue;
+                }
+                $groupUsers[] = $this->access->dn2username($ldap_users[0]);
+            } else {
+                //we need to apply the search filter now
+                if(!$this->access->readAttribute($member,
+                    $this->access->connection->ldapUserDisplayName,
+                    $this->access->getFilterPartForUserSearch($search))) {
+                    continue;
+                }
+                // dn2username will also check if the users belong to the allowed base
+                if($ocname = $this->access->dn2username($member)) {
+                    $groupUsers[] = $ocname;
+                }
+            }
+        }
+
+        //and get users that have the group as primary
+        $primaryUsers = $this->countUsersInPrimaryGroup($groupDN, $search);
+
+        return count($groupUsers) + $primaryUsers;
+    }
+
+    /**
+     * get a list of all groups
+     *
+     * @param string $search
+     * @param $limit
+     * @param int $offset
+     * @return array with group names
+     *
+     * Returns a list with all groups (used by getGroups)
+     */
+    protected function getGroupsChunk($search = '', $limit = -1, $offset = 0) {
+        if(!$this->enabled) {
+            return array();
+        }
+        $cacheKey = 'getGroups-'.$search.'-'.$limit.'-'.$offset;
+
+        //Check cache before driving unnecessary searches
+        \OCP\Util::writeLog('user_ldap', 'getGroups '.$cacheKey, \OCP\Util::DEBUG);
+        $ldap_groups = $this->access->connection->getFromCache($cacheKey);
+        if(!is_null($ldap_groups)) {
+            return $ldap_groups;
+        }
+
+        // if we'd pass -1 to LDAP search, we'd end up in a Protocol
+        // error. With a limit of 0, we get 0 results. So we pass null.
+        if($limit <= 0) {
+            $limit = null;
+        }
+        $filter = $this->access->combineFilterWithAnd(array(
+            $this->access->connection->ldapGroupFilter,
+            $this->access->getFilterPartForGroupSearch($search)
+        ));
+        \OCP\Util::writeLog('user_ldap', 'getGroups Filter '.$filter, \OCP\Util::DEBUG);
+        $ldap_groups = $this->access->fetchListOfGroups($filter,
+                array($this->access->connection->ldapGroupDisplayName, 'dn'),
+                $limit,
+                $offset);
+        $ldap_groups = $this->access->nextcloudGroupNames($ldap_groups);
+
+        $this->access->connection->writeToCache($cacheKey, $ldap_groups);
+        return $ldap_groups;
+    }
+
+    /**
+     * get a list of all groups using a paged search
+     *
+     * @param string $search
+     * @param int $limit
+     * @param int $offset
+     * @return array with group names
+     *
+     * Returns a list with all groups
+     * Uses a paged search if available to override a
+     * server side search limit.
+     * (active directory has a limit of 1000 by default)
+     */
+    public function getGroups($search = '', $limit = -1, $offset = 0) {
+        if(!$this->enabled) {
+            return array();
+        }
+        $search = $this->access->escapeFilterPart($search, true);
+        $pagingSize = intval($this->access->connection->ldapPagingSize);
+        if (!$this->access->connection->hasPagedResultSupport || $pagingSize <= 0) {
+            return $this->getGroupsChunk($search, $limit, $offset);
+        }
+        $maxGroups = 100000; // limit max results (just for safety reasons)
+        if ($limit > -1) {
+            $overallLimit = min($limit + $offset, $maxGroups);
+        } else {
+            $overallLimit = $maxGroups;
+        }
+        $chunkOffset = $offset;
+        $allGroups = array();
+        while ($chunkOffset < $overallLimit) {
+            $chunkLimit = min($pagingSize, $overallLimit - $chunkOffset);
+            $ldapGroups = $this->getGroupsChunk($search, $chunkLimit, $chunkOffset);
+            $nread = count($ldapGroups);
+            \OCP\Util::writeLog('user_ldap', 'getGroups('.$search.'): read '.$nread.' at offset '.$chunkOffset.' (limit: '.$chunkLimit.')', \OCP\Util::DEBUG);
+            if ($nread) {
+                $allGroups = array_merge($allGroups, $ldapGroups);
+                $chunkOffset += $nread;
+            }
+            if ($nread < $chunkLimit) {
+                break;
+            }
+        }
+        return $allGroups;
+    }
+
+    /**
+     * @param string $group
+     * @return bool
+     */
+    public function groupMatchesFilter($group) {
+        return (strripos($group, $this->groupSearch) !== false);
+    }
+
+    /**
+     * check if a group exists
+     * @param string $gid
+     * @return bool
+     */
+    public function groupExists($gid) {
+        $groupExists = $this->access->connection->getFromCache('groupExists'.$gid);
+        if(!is_null($groupExists)) {
+            return (bool)$groupExists;
+        }
+
+        //getting dn, if false the group does not exist. If dn, it may be mapped
+        //only, requires more checking.
+        $dn = $this->access->groupname2dn($gid);
+        if(!$dn) {
+            $this->access->connection->writeToCache('groupExists'.$gid, false);
+            return false;
+        }
+
+        //if group really still exists, we will be able to read its objectclass
+        if(!is_array($this->access->readAttribute($dn, ''))) {
+            $this->access->connection->writeToCache('groupExists'.$gid, false);
+            return false;
+        }
+
+        $this->access->connection->writeToCache('groupExists'.$gid, true);
+        return true;
+    }
+
+    /**
+     * Check if backend implements actions
+     * @param int $actions bitwise-or'ed actions
+     * @return boolean
+     *
+     * Returns the supported actions as int to be
+     * compared with \OC\User\Backend::CREATE_USER etc.
+     */
+    public function implementsActions($actions) {
+        return (bool)(\OC\Group\Backend::COUNT_USERS & $actions);
+    }
+
+    /**
+     * Return access for LDAP interaction.
+     * @return Access instance of Access for LDAP interaction
+     */
+    public function getLDAPAccess() {
+        return $this->access;
+    }
 }

Spacing +91 added lines, -91 removed lines

@@ -57,7 +57,7 @@ 
 		parent::__construct($access);
 		$filter = $this->access->connection->ldapGroupFilter;
 		$gassoc = $this->access->connection->ldapGroupMemberAssocAttr;
-		if(!empty($filter) && !empty($gassoc)) {
+		if (!empty($filter) && !empty($gassoc)) {
 			$this->enabled = true;
 		}
 
@@ -74,25 +74,25 @@ 
 	 * Checks whether the user is member of a group or not.
 	 */
 	public function inGroup($uid, $gid) {
-		if(!$this->enabled) {
+		if (!$this->enabled) {
 			return false;
 		}
 		$cacheKey = 'inGroup'.$uid.':'.$gid;
 		$inGroup = $this->access->connection->getFromCache($cacheKey);
-		if(!is_null($inGroup)) {
-			return (bool)$inGroup;
+		if (!is_null($inGroup)) {
+			return (bool) $inGroup;
 		}
 
 		$userDN = $this->access->username2dn($uid);
 
-		if(isset($this->cachedGroupMembers[$gid])) {
+		if (isset($this->cachedGroupMembers[$gid])) {
 			$isInGroup = in_array($userDN, $this->cachedGroupMembers[$gid]);
 			return $isInGroup;
 		}
 
 		$cacheKeyMembers = 'inGroup-members:'.$gid;
 		$members = $this->access->connection->getFromCache($cacheKeyMembers);
-		if(!is_null($members)) {
+		if (!is_null($members)) {
 			$this->cachedGroupMembers[$gid] = $members;
 			$isInGroup = in_array($userDN, $members);
 			$this->access->connection->writeToCache($cacheKey, $isInGroup);
@@ -101,13 +101,13 @@ 
 
 		$groupDN = $this->access->groupname2dn($gid);
 		// just in case
-		if(!$groupDN || !$userDN) {
+		if (!$groupDN || !$userDN) {
 			$this->access->connection->writeToCache($cacheKey, false);
 			return false;
 		}
 
 		//check primary group first
-		if($gid === $this->getUserPrimaryGroup($userDN)) {
+		if ($gid === $this->getUserPrimaryGroup($userDN)) {
 			$this->access->connection->writeToCache($cacheKey, true);
 			return true;
 		}
@@ -115,21 +115,21 @@ 
 		//usually, LDAP attributes are said to be case insensitive. But there are exceptions of course.
 		$members = $this->_groupMembers($groupDN);
 		$members = array_keys($members); // uids are returned as keys
-		if(!is_array($members) || count($members) === 0) {
+		if (!is_array($members) || count($members) === 0) {
 			$this->access->connection->writeToCache($cacheKey, false);
 			return false;
 		}
 
 		//extra work if we don't get back user DNs
-		if(strtolower($this->access->connection->ldapGroupMemberAssocAttr) === 'memberuid') {
+		if (strtolower($this->access->connection->ldapGroupMemberAssocAttr) === 'memberuid') {
 			$dns = array();
 			$filterParts = array();
 			$bytes = 0;
-			foreach($members as $mid) {
+			foreach ($members as $mid) {
 				$filter = str_replace('%uid', $mid, $this->access->connection->ldapLoginFilter);
 				$filterParts[] = $filter;
 				$bytes += strlen($filter);
-				if($bytes >= 9000000) {
+				if ($bytes >= 9000000) {
 					// AD has a default input buffer of 10 MB, we do not want
 					// to take even the chance to exceed it
 					$filter = $this->access->combineFilterWithOr($filterParts);
@@ -139,7 +139,7 @@ 
 					$dns = array_merge($dns, $users);
 				}
 			}
-			if(count($filterParts) > 0) {
+			if (count($filterParts) > 0) {
 				$filter = $this->access->combineFilterWithOr($filterParts);
 				$users = $this->access->fetchListOfUsers($filter, 'dn', count($filterParts));
 				$dns = array_merge($dns, $users);
@@ -182,14 +182,14 @@ 
 			$pos = strpos($memberURLs[0], '(');
 			if ($pos !== false) {
 				$memberUrlFilter = substr($memberURLs[0], $pos);
-				$foundMembers = $this->access->searchUsers($memberUrlFilter,'dn');
+				$foundMembers = $this->access->searchUsers($memberUrlFilter, 'dn');
 				$dynamicMembers = array();
-				foreach($foundMembers as $value) {
+				foreach ($foundMembers as $value) {
 					$dynamicMembers[$value['dn'][0]] = 1;
 				}
 			} else {
 				\OCP\Util::writeLog('user_ldap', 'No search filter found on member url '.
-					'of group ' . $dnGroup, \OCP\Util::DEBUG);
+					'of group '.$dnGroup, \OCP\Util::DEBUG);
 			}
 		}
 		return $dynamicMembers;
@@ -212,7 +212,7 @@ 
 		// used extensively in cron job, caching makes sense for nested groups
 		$cacheKey = '_groupMembers'.$dnGroup;
 		$groupMembers = $this->access->connection->getFromCache($cacheKey);
-		if(!is_null($groupMembers)) {
+		if (!is_null($groupMembers)) {
 			return $groupMembers;
 		}
 		$seen[$dnGroup] = 1;
@@ -256,7 +256,7 @@ 
 			return array();
 		}
 		$groups = $this->access->groupsMatchFilter($groups);
-		$allGroups =  $groups;
+		$allGroups = $groups;
 		$nestedGroups = $this->access->connection->ldapNestedGroups;
 		if (intval($nestedGroups) === 1) {
 			foreach ($groups as $group) {
@@ -274,9 +274,9 @@ 
 	 * @return string|bool
 	 */
 	public function gidNumber2Name($gid, $dn) {
-		$cacheKey = 'gidNumberToName' . $gid;
+		$cacheKey = 'gidNumberToName'.$gid;
 		$groupName = $this->access->connection->getFromCache($cacheKey);
-		if(!is_null($groupName) && isset($groupName)) {
+		if (!is_null($groupName) && isset($groupName)) {
 			return $groupName;
 		}
 
@@ -284,10 +284,10 @@ 
 		$filter = $this->access->combineFilterWithAnd([
 			$this->access->connection->ldapGroupFilter,
 			'objectClass=posixGroup',
-			$this->access->connection->ldapGidNumber . '=' . $gid
+			$this->access->connection->ldapGidNumber.'='.$gid
 		]);
 		$result = $this->access->searchGroups($filter, array('dn'), 1);
-		if(empty($result)) {
+		if (empty($result)) {
 			return false;
 		}
 		$dn = $result[0]['dn'][0];
@@ -310,7 +310,7 @@ 
 	 */
 	private function getEntryGidNumber($dn, $attribute) {
 		$value = $this->access->readAttribute($dn, $attribute);
-		if(is_array($value) && !empty($value)) {
+		if (is_array($value) && !empty($value)) {
 			return $value[0];
 		}
 		return false;
@@ -332,9 +332,9 @@ 
 	 */
 	public function getUserGidNumber($dn) {
 		$gidNumber = false;
-		if($this->access->connection->hasGidNumber) {
+		if ($this->access->connection->hasGidNumber) {
 			$gidNumber = $this->getEntryGidNumber($dn, 'gidNumber');
-			if($gidNumber === false) {
+			if ($gidNumber === false) {
 				$this->access->connection->hasGidNumber = false;
 			}
 		}
@@ -351,7 +351,7 @@ 
 	 */
 	private function prepareFilterForUsersHasGidNumber($groupDN, $search = '') {
 		$groupID = $this->getGroupGidNumber($groupDN);
-		if($groupID === false) {
+		if ($groupID === false) {
 			throw new \Exception('Not a valid group');
 		}
 
@@ -360,7 +360,7 @@ 
 		if ($search !== '') {
 			$filterParts[] = $this->access->getFilterPartForUserSearch($search);
 		}
-		$filterParts[] = $this->access->connection->ldapGidNumber .'=' . $groupID;
+		$filterParts[] = $this->access->connection->ldapGidNumber.'='.$groupID;
 
 		$filter = $this->access->combineFilterWithAnd($filterParts);
 
@@ -404,7 +404,7 @@ 
 		try {
 			$filter = $this->prepareFilterForUsersHasGidNumber($groupDN, $search);
 			$users = $this->access->countUsers($filter, ['dn'], $limit, $offset);
-			return (int)$users;
+			return (int) $users;
 		} catch (\Exception $e) {
 			return 0;
 		}
@@ -417,9 +417,9 @@ 
 	 */
 	public function getUserGroupByGid($dn) {
 		$groupID = $this->getUserGidNumber($dn);
-		if($groupID !== false) {
+		if ($groupID !== false) {
 			$groupName = $this->gidNumber2Name($groupID, $dn);
-			if($groupName !== false) {
+			if ($groupName !== false) {
 				return $groupName;
 			}
 		}
@@ -436,22 +436,22 @@ 
 	public function primaryGroupID2Name($gid, $dn) {
 		$cacheKey = 'primaryGroupIDtoName';
 		$groupNames = $this->access->connection->getFromCache($cacheKey);
-		if(!is_null($groupNames) && isset($groupNames[$gid])) {
+		if (!is_null($groupNames) && isset($groupNames[$gid])) {
 			return $groupNames[$gid];
 		}
 
 		$domainObjectSid = $this->access->getSID($dn);
-		if($domainObjectSid === false) {
+		if ($domainObjectSid === false) {
 			return false;
 		}
 
 		//we need to get the DN from LDAP
 		$filter = $this->access->combineFilterWithAnd(array(
 			$this->access->connection->ldapGroupFilter,
-			'objectsid=' . $domainObjectSid . '-' . $gid
+			'objectsid='.$domainObjectSid.'-'.$gid
 		));
 		$result = $this->access->searchGroups($filter, array('dn'), 1);
-		if(empty($result)) {
+		if (empty($result)) {
 			return false;
 		}
 		$dn = $result[0]['dn'][0];
@@ -474,7 +474,7 @@ 
 	 */
 	private function getEntryGroupID($dn, $attribute) {
 		$value = $this->access->readAttribute($dn, $attribute);
-		if(is_array($value) && !empty($value)) {
+		if (is_array($value) && !empty($value)) {
 			return $value[0];
 		}
 		return false;
@@ -496,9 +496,9 @@ 
 	 */
 	public function getUserPrimaryGroupIDs($dn) {
 		$primaryGroupID = false;
-		if($this->access->connection->hasPrimaryGroups) {
+		if ($this->access->connection->hasPrimaryGroups) {
 			$primaryGroupID = $this->getEntryGroupID($dn, 'primaryGroupID');
-			if($primaryGroupID === false) {
+			if ($primaryGroupID === false) {
 				$this->access->connection->hasPrimaryGroups = false;
 			}
 		}
@@ -515,7 +515,7 @@ 
 	 */
 	private function prepareFilterForUsersInPrimaryGroup($groupDN, $search = '') {
 		$groupID = $this->getGroupPrimaryGroupID($groupDN);
-		if($groupID === false) {
+		if ($groupID === false) {
 			throw new \Exception('Not a valid group');
 		}
 
@@ -524,7 +524,7 @@ 
 		if ($search !== '') {
 			$filterParts[] = $this->access->getFilterPartForUserSearch($search);
 		}
-		$filterParts[] = 'primaryGroupID=' . $groupID;
+		$filterParts[] = 'primaryGroupID='.$groupID;
 
 		$filter = $this->access->combineFilterWithAnd($filterParts);
 
@@ -568,7 +568,7 @@ 
 		try {
 			$filter = $this->prepareFilterForUsersInPrimaryGroup($groupDN, $search);
 			$users = $this->access->countUsers($filter, array('dn'), $limit, $offset);
-			return (int)$users;
+			return (int) $users;
 		} catch (\Exception $e) {
 			return 0;
 		}
@@ -581,9 +581,9 @@ 
 	 */
 	public function getUserPrimaryGroup($dn) {
 		$groupID = $this->getUserPrimaryGroupIDs($dn);
-		if($groupID !== false) {
+		if ($groupID !== false) {
 			$groupName = $this->primaryGroupID2Name($groupID, $dn);
-			if($groupName !== false) {
+			if ($groupName !== false) {
 				return $groupName;
 			}
 		}
@@ -602,16 +602,16 @@ 
 	 * This function includes groups based on dynamic group membership.
 	 */
 	public function getUserGroups($uid) {
-		if(!$this->enabled) {
+		if (!$this->enabled) {
 			return array();
 		}
 		$cacheKey = 'getUserGroups'.$uid;
 		$userGroups = $this->access->connection->getFromCache($cacheKey);
-		if(!is_null($userGroups)) {
+		if (!is_null($userGroups)) {
 			return $userGroups;
 		}
 		$userDN = $this->access->username2dn($uid);
-		if(!$userDN) {
+		if (!$userDN) {
 			$this->access->connection->writeToCache($cacheKey, array());
 			return array();
 		}
@@ -625,14 +625,14 @@ 
 		if (!empty($dynamicGroupMemberURL)) {
 			// look through dynamic groups to add them to the result array if needed
 			$groupsToMatch = $this->access->fetchListOfGroups(
-				$this->access->connection->ldapGroupFilter,array('dn',$dynamicGroupMemberURL));
-			foreach($groupsToMatch as $dynamicGroup) {
+				$this->access->connection->ldapGroupFilter, array('dn', $dynamicGroupMemberURL));
+			foreach ($groupsToMatch as $dynamicGroup) {
 				if (!array_key_exists($dynamicGroupMemberURL, $dynamicGroup)) {
 					continue;
 				}
 				$pos = strpos($dynamicGroup[$dynamicGroupMemberURL][0], '(');
 				if ($pos !== false) {
-					$memberUrlFilter = substr($dynamicGroup[$dynamicGroupMemberURL][0],$pos);
+					$memberUrlFilter = substr($dynamicGroup[$dynamicGroupMemberURL][0], $pos);
 					// apply filter via ldap search to see if this user is in this
 					// dynamic group
 					$userMatch = $this->access->readAttribute(
@@ -643,7 +643,7 @@ 
 					if ($userMatch !== false) {
 						// match found so this user is in this group
 						$groupName = $this->access->dn2groupname($dynamicGroup['dn'][0]);
-						if(is_string($groupName)) {
+						if (is_string($groupName)) {
 							// be sure to never return false if the dn could not be
 							// resolved to a name, for whatever reason.
 							$groups[] = $groupName;
@@ -651,7 +651,7 @@ 
 					}
 				} else {
 					\OCP\Util::writeLog('user_ldap', 'No search filter found on member url '.
-						'of group ' . print_r($dynamicGroup, true), \OCP\Util::DEBUG);
+						'of group '.print_r($dynamicGroup, true), \OCP\Util::DEBUG);
 				}
 			}
 		}
@@ -659,7 +659,7 @@ 
 		// if possible, read out membership via memberOf. It's far faster than
 		// performing a search, which still is a fallback later.
 		// memberof doesn't support memberuid, so skip it here.
-		if(intval($this->access->connection->hasMemberOfFilterSupport) === 1
+		if (intval($this->access->connection->hasMemberOfFilterSupport) === 1
 			&& intval($this->access->connection->useMemberOfToDetectMembership) === 1
 		    && strtolower($this->access->connection->ldapGroupMemberAssocAttr) !== 'memberuid'
 		    ) {
@@ -667,7 +667,7 @@ 
 			if (is_array($groupDNs)) {
 				foreach ($groupDNs as $dn) {
 					$groupName = $this->access->dn2groupname($dn);
-					if(is_string($groupName)) {
+					if (is_string($groupName)) {
 						// be sure to never return false if the dn could not be
 						// resolved to a name, for whatever reason.
 						$groups[] = $groupName;
@@ -675,10 +675,10 @@ 
 				}
 			}
 
-			if($primaryGroup !== false) {
+			if ($primaryGroup !== false) {
 				$groups[] = $primaryGroup;
 			}
-			if($gidGroupName !== false) {
+			if ($gidGroupName !== false) {
 				$groups[] = $gidGroupName;
 			}
 			$this->access->connection->writeToCache($cacheKey, $groups);
@@ -686,14 +686,14 @@ 
 		}
 
 		//uniqueMember takes DN, memberuid the uid, so we need to distinguish
-		if((strtolower($this->access->connection->ldapGroupMemberAssocAttr) === 'uniquemember')
+		if ((strtolower($this->access->connection->ldapGroupMemberAssocAttr) === 'uniquemember')
 			|| (strtolower($this->access->connection->ldapGroupMemberAssocAttr) === 'member')
 		) {
 			$uid = $userDN;
-		} else if(strtolower($this->access->connection->ldapGroupMemberAssocAttr) === 'memberuid') {
+		} else if (strtolower($this->access->connection->ldapGroupMemberAssocAttr) === 'memberuid') {
 			$result = $this->access->readAttribute($userDN, 'uid');
 			if ($result === false) {
-				\OCP\Util::writeLog('user_ldap', 'No uid attribute found for DN ' . $userDN . ' on '.
+				\OCP\Util::writeLog('user_ldap', 'No uid attribute found for DN '.$userDN.' on '.
 					$this->access->connection->ldapHost, \OCP\Util::DEBUG);
 			}
 			$uid = $result[0];
@@ -702,7 +702,7 @@ 
 			$uid = $userDN;
 		}
 
-		if(isset($this->cachedGroupsByMember[$uid])) {
+		if (isset($this->cachedGroupsByMember[$uid])) {
 			$groups = array_merge($groups, $this->cachedGroupsByMember[$uid]);
 		} else {
 			$groupsByMember = array_values($this->getGroupsByMember($uid));
@@ -711,10 +711,10 @@ 
 			$groups = array_merge($groups, $groupsByMember);
 		}
 
-		if($primaryGroup !== false) {
+		if ($primaryGroup !== false) {
 			$groups[] = $primaryGroup;
 		}
-		if($gidGroupName !== false) {
+		if ($gidGroupName !== false) {
 			$groups[] = $gidGroupName;
 		}
 
@@ -752,7 +752,7 @@ 
 				$nestedGroups = $this->access->connection->ldapNestedGroups;
 				if (!empty($nestedGroups)) {
 					$supergroups = $this->getGroupsByMember($groupDN, $seen);
-					if (is_array($supergroups) && (count($supergroups)>0)) {
+					if (is_array($supergroups) && (count($supergroups) > 0)) {
 						$allGroups = array_merge($allGroups, $supergroups);
 					}
 				}
@@ -771,33 +771,33 @@ 
 	 * @return array with user ids
 	 */
 	public function usersInGroup($gid, $search = '', $limit = -1, $offset = 0) {
-		if(!$this->enabled) {
+		if (!$this->enabled) {
 			return array();
 		}
-		if(!$this->groupExists($gid)) {
+		if (!$this->groupExists($gid)) {
 			return array();
 		}
 		$search = $this->access->escapeFilterPart($search, true);
 		$cacheKey = 'usersInGroup-'.$gid.'-'.$search.'-'.$limit.'-'.$offset;
 		// check for cache of the exact query
 		$groupUsers = $this->access->connection->getFromCache($cacheKey);
-		if(!is_null($groupUsers)) {
+		if (!is_null($groupUsers)) {
 			return $groupUsers;
 		}
 
 		// check for cache of the query without limit and offset
 		$groupUsers = $this->access->connection->getFromCache('usersInGroup-'.$gid.'-'.$search);
-		if(!is_null($groupUsers)) {
+		if (!is_null($groupUsers)) {
 			$groupUsers = array_slice($groupUsers, $offset, $limit);
 			$this->access->connection->writeToCache($cacheKey, $groupUsers);
 			return $groupUsers;
 		}
 
-		if($limit === -1) {
+		if ($limit === -1) {
 			$limit = null;
 		}
 		$groupDN = $this->access->groupname2dn($gid);
-		if(!$groupDN) {
+		if (!$groupDN) {
 			// group couldn't be found, return empty resultset
 			$this->access->connection->writeToCache($cacheKey, array());
 			return array();
@@ -806,7 +806,7 @@ 
 		$primaryUsers = $this->getUsersInPrimaryGroup($groupDN, $search, $limit, $offset);
 		$posixGroupUsers = $this->getUsersInGidNumber($groupDN, $search, $limit, $offset);
 		$members = array_keys($this->_groupMembers($groupDN));
-		if(!$members && empty($posixGroupUsers) && empty($primaryUsers)) {
+		if (!$members && empty($posixGroupUsers) && empty($primaryUsers)) {
 			//in case users could not be retrieved, return empty result set
 			$this->access->connection->writeToCache($cacheKey, []);
 			return [];
@@ -815,29 +815,29 @@ 
 		$groupUsers = array();
 		$isMemberUid = (strtolower($this->access->connection->ldapGroupMemberAssocAttr) === 'memberuid');
 		$attrs = $this->access->userManager->getAttributes(true);
-		foreach($members as $member) {
-			if($isMemberUid) {
+		foreach ($members as $member) {
+			if ($isMemberUid) {
 				//we got uids, need to get their DNs to 'translate' them to user names
 				$filter = $this->access->combineFilterWithAnd(array(
 					str_replace('%uid', $member, $this->access->connection->ldapLoginFilter),
 					$this->access->getFilterPartForUserSearch($search)
 				));
 				$ldap_users = $this->access->fetchListOfUsers($filter, $attrs, 1);
-				if(count($ldap_users) < 1) {
+				if (count($ldap_users) < 1) {
 					continue;
 				}
 				$groupUsers[] = $this->access->dn2username($ldap_users[0]['dn'][0]);
 			} else {
 				//we got DNs, check if we need to filter by search or we can give back all of them
 				if ($search !== '') {
-					if(!$this->access->readAttribute($member,
+					if (!$this->access->readAttribute($member,
 						$this->access->connection->ldapUserDisplayName,
 						$this->access->getFilterPartForUserSearch($search))) {
 						continue;
 					}
 				}
 				// dn2username will also check if the users belong to the allowed base
-				if($ocname = $this->access->dn2username($member)) {
+				if ($ocname = $this->access->dn2username($member)) {
 					$groupUsers[] = $ocname;
 				}
 			}
@@ -861,16 +861,16 @@ 
 	 */
 	public function countUsersInGroup($gid, $search = '') {
 		$cacheKey = 'countUsersInGroup-'.$gid.'-'.$search;
-		if(!$this->enabled || !$this->groupExists($gid)) {
+		if (!$this->enabled || !$this->groupExists($gid)) {
 			return false;
 		}
 		$groupUsers = $this->access->connection->getFromCache($cacheKey);
-		if(!is_null($groupUsers)) {
+		if (!is_null($groupUsers)) {
 			return $groupUsers;
 		}
 
 		$groupDN = $this->access->groupname2dn($gid);
-		if(!$groupDN) {
+		if (!$groupDN) {
 			// group couldn't be found, return empty result set
 			$this->access->connection->writeToCache($cacheKey, false);
 			return false;
@@ -878,7 +878,7 @@ 
 
 		$members = array_keys($this->_groupMembers($groupDN));
 		$primaryUserCount = $this->countUsersInPrimaryGroup($groupDN, '');
-		if(!$members && $primaryUserCount === 0) {
+		if (!$members && $primaryUserCount === 0) {
 			//in case users could not be retrieved, return empty result set
 			$this->access->connection->writeToCache($cacheKey, false);
 			return false;
@@ -903,27 +903,27 @@ 
 		//For now this is not important, because the only use of this method
 		//does not supply a search string
 		$groupUsers = array();
-		foreach($members as $member) {
-			if($isMemberUid) {
+		foreach ($members as $member) {
+			if ($isMemberUid) {
 				//we got uids, need to get their DNs to 'translate' them to user names
 				$filter = $this->access->combineFilterWithAnd(array(
 					str_replace('%uid', $member, $this->access->connection->ldapLoginFilter),
 					$this->access->getFilterPartForUserSearch($search)
 				));
 				$ldap_users = $this->access->fetchListOfUsers($filter, 'dn', 1);
-				if(count($ldap_users) < 1) {
+				if (count($ldap_users) < 1) {
 					continue;
 				}
 				$groupUsers[] = $this->access->dn2username($ldap_users[0]);
 			} else {
 				//we need to apply the search filter now
-				if(!$this->access->readAttribute($member,
+				if (!$this->access->readAttribute($member,
 					$this->access->connection->ldapUserDisplayName,
 					$this->access->getFilterPartForUserSearch($search))) {
 					continue;
 				}
 				// dn2username will also check if the users belong to the allowed base
-				if($ocname = $this->access->dn2username($member)) {
+				if ($ocname = $this->access->dn2username($member)) {
 					$groupUsers[] = $ocname;
 				}
 			}
@@ -946,7 +946,7 @@ 
 	 * Returns a list with all groups (used by getGroups)
 	 */
 	protected function getGroupsChunk($search = '', $limit = -1, $offset = 0) {
-		if(!$this->enabled) {
+		if (!$this->enabled) {
 			return array();
 		}
 		$cacheKey = 'getGroups-'.$search.'-'.$limit.'-'.$offset;
@@ -954,13 +954,13 @@ 
 		//Check cache before driving unnecessary searches
 		\OCP\Util::writeLog('user_ldap', 'getGroups '.$cacheKey, \OCP\Util::DEBUG);
 		$ldap_groups = $this->access->connection->getFromCache($cacheKey);
-		if(!is_null($ldap_groups)) {
+		if (!is_null($ldap_groups)) {
 			return $ldap_groups;
 		}
 
 		// if we'd pass -1 to LDAP search, we'd end up in a Protocol
 		// error. With a limit of 0, we get 0 results. So we pass null.
-		if($limit <= 0) {
+		if ($limit <= 0) {
 			$limit = null;
 		}
 		$filter = $this->access->combineFilterWithAnd(array(
@@ -992,7 +992,7 @@ 
 	 * (active directory has a limit of 1000 by default)
 	 */
 	public function getGroups($search = '', $limit = -1, $offset = 0) {
-		if(!$this->enabled) {
+		if (!$this->enabled) {
 			return array();
 		}
 		$search = $this->access->escapeFilterPart($search, true);
@@ -1039,20 +1039,20 @@ 
 	 */
 	public function groupExists($gid) {
 		$groupExists = $this->access->connection->getFromCache('groupExists'.$gid);
-		if(!is_null($groupExists)) {
-			return (bool)$groupExists;
+		if (!is_null($groupExists)) {
+			return (bool) $groupExists;
 		}
 
 		//getting dn, if false the group does not exist. If dn, it may be mapped
 		//only, requires more checking.
 		$dn = $this->access->groupname2dn($gid);
-		if(!$dn) {
+		if (!$dn) {
 			$this->access->connection->writeToCache('groupExists'.$gid, false);
 			return false;
 		}
 
 		//if group really still exists, we will be able to read its objectclass
-		if(!is_array($this->access->readAttribute($dn, ''))) {
+		if (!is_array($this->access->readAttribute($dn, ''))) {
 			$this->access->connection->writeToCache('groupExists'.$gid, false);
 			return false;
 		}
@@ -1070,7 +1070,7 @@ 
 	* compared with \OC\User\Backend::CREATE_USER etc.
 	*/
 	public function implementsActions($actions) {
-		return (bool)(\OC\Group\Backend::COUNT_USERS & $actions);
+		return (bool) (\OC\Group\Backend::COUNT_USERS & $actions);
 	}
 
 	/**

lib/public/UserInterface.php

Indentation +57 added lines, -57 removed lines

@@ -40,68 +40,68 @@
  */
 interface UserInterface {
 
-	/**
-	 * Check if backend implements actions
-	 * @param int $actions bitwise-or'ed actions
-	 * @return boolean
-	 *
-	 * Returns the supported actions as int to be
-	 * compared with \OC\User\Backend::CREATE_USER etc.
-	 * @since 4.5.0
-	 */
-	public function implementsActions($actions);
+    /**
+     * Check if backend implements actions
+     * @param int $actions bitwise-or'ed actions
+     * @return boolean
+     *
+     * Returns the supported actions as int to be
+     * compared with \OC\User\Backend::CREATE_USER etc.
+     * @since 4.5.0
+     */
+    public function implementsActions($actions);
 
-	/**
-	 * delete a user
-	 * @param string $uid The username of the user to delete
-	 * @return bool
-	 * @since 4.5.0
-	 */
-	public function deleteUser($uid);
+    /**
+     * delete a user
+     * @param string $uid The username of the user to delete
+     * @return bool
+     * @since 4.5.0
+     */
+    public function deleteUser($uid);
 
-	/**
-	 * Get a list of all users
-	 *
-	 * @param string $search
-	 * @param null|int $limit
-	 * @param null|int $offset
-	 * @return string[] an array of all uids
-	 * @since 4.5.0
-	 */
-	public function getUsers($search = '', $limit = null, $offset = null);
+    /**
+     * Get a list of all users
+     *
+     * @param string $search
+     * @param null|int $limit
+     * @param null|int $offset
+     * @return string[] an array of all uids
+     * @since 4.5.0
+     */
+    public function getUsers($search = '', $limit = null, $offset = null);
 
-	/**
-	 * check if a user exists
-	 * @param string $uid the username
-	 * @return boolean
-	 * @since 4.5.0
-	 */
-	public function userExists($uid);
+    /**
+     * check if a user exists
+     * @param string $uid the username
+     * @return boolean
+     * @since 4.5.0
+     */
+    public function userExists($uid);
 
-	/**
-	 * get display name of the user
-	 * @param string $uid user ID of the user
-	 * @return string display name
-	 * @since 4.5.0
-	 */
-	public function getDisplayName($uid);
+    /**
+     * get display name of the user
+     * @param string $uid user ID of the user
+     * @return string display name
+     * @since 4.5.0
+     */
+    public function getDisplayName($uid);
 
-	/**
-	 * Get a list of all display names and user ids.
-	 *
-	 * @param string $search
-	 * @param string|null $limit
-	 * @param string|null $offset
-	 * @return array an array of all displayNames (value) and the corresponding uids (key)
-	 * @since 4.5.0
-	 */
-	public function getDisplayNames($search = '', $limit = null, $offset = null);
+    /**
+     * Get a list of all display names and user ids.
+     *
+     * @param string $search
+     * @param string|null $limit
+     * @param string|null $offset
+     * @return array an array of all displayNames (value) and the corresponding uids (key)
+     * @since 4.5.0
+     */
+    public function getDisplayNames($search = '', $limit = null, $offset = null);
 
-	/**
-	 * Check if a user list is available or not
-	 * @return boolean if users can be listed or not
-	 * @since 4.5.0
-	 */
-	public function hasUserListings();
+    /**
+     * Check if a user list is available or not
+     * @return boolean if users can be listed or not
+     * @since 4.5.0
+     */
+    public function hasUserListings();
 
 }