nextcloud / server

apps/user_ldap/lib/Group_LDAP.php

Indentation +1225 added lines, -1225 removed lines

@@ -54,1229 +54,1229 @@
 use OCP\ILogger;
 
 class Group_LDAP extends BackendUtility implements GroupInterface, IGroupLDAP, IGetDisplayNameBackend {
-	protected $enabled = false;
-
-	/** @var string[] $cachedGroupMembers array of users with gid as key */
-	protected $cachedGroupMembers;
-	/** @var string[] $cachedGroupsByMember array of groups with uid as key */
-	protected $cachedGroupsByMember;
-	/** @var string[] $cachedNestedGroups array of groups with gid (DN) as key */
-	protected $cachedNestedGroups;
-	/** @var GroupPluginManager */
-	protected $groupPluginManager;
-	/** @var ILogger */
-	protected $logger;
-
-	/**
-	 * @var string $ldapGroupMemberAssocAttr contains the LDAP setting (in lower case) with the same name
-	 */
-	protected $ldapGroupMemberAssocAttr;
-
-	public function __construct(Access $access, GroupPluginManager $groupPluginManager) {
-		parent::__construct($access);
-		$filter = $this->access->connection->ldapGroupFilter;
-		$gAssoc = $this->access->connection->ldapGroupMemberAssocAttr;
-		if (!empty($filter) && !empty($gAssoc)) {
-			$this->enabled = true;
-		}
-
-		$this->cachedGroupMembers = new CappedMemoryCache();
-		$this->cachedGroupsByMember = new CappedMemoryCache();
-		$this->cachedNestedGroups = new CappedMemoryCache();
-		$this->groupPluginManager = $groupPluginManager;
-		$this->logger = OC::$server->getLogger();
-		$this->ldapGroupMemberAssocAttr = strtolower($gAssoc);
-	}
-
-	/**
-	 * is user in group?
-	 *
-	 * @param string $uid uid of the user
-	 * @param string $gid gid of the group
-	 * @return bool
-	 * @throws Exception
-	 * @throws ServerNotAvailableException
-	 */
-	public function inGroup($uid, $gid) {
-		if (!$this->enabled) {
-			return false;
-		}
-		$cacheKey = 'inGroup' . $uid . ':' . $gid;
-		$inGroup = $this->access->connection->getFromCache($cacheKey);
-		if (!is_null($inGroup)) {
-			return (bool)$inGroup;
-		}
-
-		$userDN = $this->access->username2dn($uid);
-
-		if (isset($this->cachedGroupMembers[$gid])) {
-			return in_array($userDN, $this->cachedGroupMembers[$gid]);
-		}
-
-		$cacheKeyMembers = 'inGroup-members:' . $gid;
-		$members = $this->access->connection->getFromCache($cacheKeyMembers);
-		if (!is_null($members)) {
-			$this->cachedGroupMembers[$gid] = $members;
-			$isInGroup = in_array($userDN, $members, true);
-			$this->access->connection->writeToCache($cacheKey, $isInGroup);
-			return $isInGroup;
-		}
-
-		$groupDN = $this->access->groupname2dn($gid);
-		// just in case
-		if (!$groupDN || !$userDN) {
-			$this->access->connection->writeToCache($cacheKey, false);
-			return false;
-		}
-
-		//check primary group first
-		if ($gid === $this->getUserPrimaryGroup($userDN)) {
-			$this->access->connection->writeToCache($cacheKey, true);
-			return true;
-		}
-
-		//usually, LDAP attributes are said to be case insensitive. But there are exceptions of course.
-		$members = $this->_groupMembers($groupDN);
-		if (!is_array($members) || count($members) === 0) {
-			$this->access->connection->writeToCache($cacheKey, false);
-			return false;
-		}
-
-		//extra work if we don't get back user DNs
-		switch ($this->ldapGroupMemberAssocAttr) {
-			case 'memberuid':
-			case 'zimbramailforwardingaddress':
-				$requestAttributes = $this->access->userManager->getAttributes(true);
-				$dns = [];
-				$filterParts = [];
-				$bytes = 0;
-				foreach ($members as $mid) {
-					if ($this->ldapGroupMemberAssocAttr === 'zimbramailforwardingaddress') {
-						$parts = explode('@', $mid); //making sure we get only the uid
-						$mid = $parts[0];
-					}
-					$filter = str_replace('%uid', $mid, $this->access->connection->ldapLoginFilter);
-					$filterParts[] = $filter;
-					$bytes += strlen($filter);
-					if ($bytes >= 9000000) {
-						// AD has a default input buffer of 10 MB, we do not want
-						// to take even the chance to exceed it
-						$filter = $this->access->combineFilterWithOr($filterParts);
-						$users = $this->access->fetchListOfUsers($filter, $requestAttributes, count($filterParts));
-						$bytes = 0;
-						$filterParts = [];
-						$dns = array_merge($dns, $users);
-					}
-				}
-				if (count($filterParts) > 0) {
-					$filter = $this->access->combineFilterWithOr($filterParts);
-					$users = $this->access->fetchListOfUsers($filter, $requestAttributes, count($filterParts));
-					$dns = array_merge($dns, $users);
-				}
-				$members = $dns;
-				break;
-		}
-
-		$isInGroup = in_array($userDN, $members);
-		$this->access->connection->writeToCache($cacheKey, $isInGroup);
-		$this->access->connection->writeToCache($cacheKeyMembers, $members);
-		$this->cachedGroupMembers[$gid] = $members;
-
-		return $isInGroup;
-	}
-
-	/**
-	 * For a group that has user membership defined by an LDAP search url
-	 * attribute returns the users that match the search url otherwise returns
-	 * an empty array.
-	 *
-	 * @throws ServerNotAvailableException
-	 */
-	public function getDynamicGroupMembers(string $dnGroup): array {
-		$dynamicGroupMemberURL = strtolower($this->access->connection->ldapDynamicGroupMemberURL);
-
-		if (empty($dynamicGroupMemberURL)) {
-			return [];
-		}
-
-		$dynamicMembers = [];
-		$memberURLs = $this->access->readAttribute(
-			$dnGroup,
-			$dynamicGroupMemberURL,
-			$this->access->connection->ldapGroupFilter
-		);
-		if ($memberURLs !== false) {
-			// this group has the 'memberURL' attribute so this is a dynamic group
-			// example 1: ldap:///cn=users,cn=accounts,dc=dcsubbase,dc=dcbase??one?(o=HeadOffice)
-			// example 2: ldap:///cn=users,cn=accounts,dc=dcsubbase,dc=dcbase??one?(&(o=HeadOffice)(uidNumber>=500))
-			$pos = strpos($memberURLs[0], '(');
-			if ($pos !== false) {
-				$memberUrlFilter = substr($memberURLs[0], $pos);
-				$foundMembers = $this->access->searchUsers($memberUrlFilter, 'dn');
-				$dynamicMembers = [];
-				foreach ($foundMembers as $value) {
-					$dynamicMembers[$value['dn'][0]] = 1;
-				}
-			} else {
-				$this->logger->debug('No search filter found on member url of group {dn}',
-					[
-						'app' => 'user_ldap',
-						'dn' => $dnGroup,
-					]
-				);
-			}
-		}
-		return $dynamicMembers;
-	}
-
-	/**
-	 * @throws ServerNotAvailableException
-	 */
-	private function _groupMembers(string $dnGroup, ?array &$seen = null): array {
-		if ($seen === null) {
-			$seen = [];
-		}
-		$allMembers = [];
-		if (array_key_exists($dnGroup, $seen)) {
-			return [];
-		}
-		// used extensively in cron job, caching makes sense for nested groups
-		$cacheKey = '_groupMembers' . $dnGroup;
-		$groupMembers = $this->access->connection->getFromCache($cacheKey);
-		if ($groupMembers !== null) {
-			return $groupMembers;
-		}
-		$seen[$dnGroup] = 1;
-		$members = $this->access->readAttribute($dnGroup, $this->access->connection->ldapGroupMemberAssocAttr);
-		if (is_array($members)) {
-			$fetcher = function ($memberDN, &$seen) {
-				return $this->_groupMembers($memberDN, $seen);
-			};
-			$allMembers = $this->walkNestedGroups($dnGroup, $fetcher, $members);
-		}
-
-		$allMembers += $this->getDynamicGroupMembers($dnGroup);
-
-		$this->access->connection->writeToCache($cacheKey, $allMembers);
-		return $allMembers;
-	}
-
-	/**
-	 * @throws ServerNotAvailableException
-	 */
-	private function _getGroupDNsFromMemberOf(string $dn): array {
-		$groups = $this->access->readAttribute($dn, 'memberOf');
-		if (!is_array($groups)) {
-			return [];
-		}
-
-		$fetcher = function ($groupDN) {
-			if (isset($this->cachedNestedGroups[$groupDN])) {
-				$nestedGroups = $this->cachedNestedGroups[$groupDN];
-			} else {
-				$nestedGroups = $this->access->readAttribute($groupDN, 'memberOf');
-				if (!is_array($nestedGroups)) {
-					$nestedGroups = [];
-				}
-				$this->cachedNestedGroups[$groupDN] = $nestedGroups;
-			}
-			return $nestedGroups;
-		};
-
-		$groups = $this->walkNestedGroups($dn, $fetcher, $groups);
-		return $this->filterValidGroups($groups);
-	}
-
-	private function walkNestedGroups(string $dn, Closure $fetcher, array $list): array {
-		$nesting = (int)$this->access->connection->ldapNestedGroups;
-		// depending on the input, we either have a list of DNs or a list of LDAP records
-		// also, the output expects either DNs or records. Testing the first element should suffice.
-		$recordMode = is_array($list) && isset($list[0]) && is_array($list[0]) && isset($list[0]['dn'][0]);
-
-		if ($nesting !== 1) {
-			if ($recordMode) {
-				// the keys are numeric, but should hold the DN
-				return array_reduce($list, function ($transformed, $record) use ($dn) {
-					if ($record['dn'][0] != $dn) {
-						$transformed[$record['dn'][0]] = $record;
-					}
-					return $transformed;
-				}, []);
-			}
-			return $list;
-		}
-
-		$seen = [];
-		while ($record = array_pop($list)) {
-			$recordDN = $recordMode ? $record['dn'][0] : $record;
-			if ($recordDN === $dn || array_key_exists($recordDN, $seen)) {
-				// Prevent loops
-				continue;
-			}
-			$fetched = $fetcher($record, $seen);
-			$list = array_merge($list, $fetched);
-			$seen[$recordDN] = $record;
-		}
-
-		return $recordMode ? $seen : array_keys($seen);
-	}
-
-	/**
-	 * translates a gidNumber into an ownCloud internal name
-	 *
-	 * @return string|bool
-	 * @throws Exception
-	 * @throws ServerNotAvailableException
-	 */
-	public function gidNumber2Name(string $gid, string $dn) {
-		$cacheKey = 'gidNumberToName' . $gid;
-		$groupName = $this->access->connection->getFromCache($cacheKey);
-		if (!is_null($groupName) && isset($groupName)) {
-			return $groupName;
-		}
-
-		//we need to get the DN from LDAP
-		$filter = $this->access->combineFilterWithAnd([
-			$this->access->connection->ldapGroupFilter,
-			'objectClass=posixGroup',
-			$this->access->connection->ldapGidNumber . '=' . $gid
-		]);
-		return $this->getNameOfGroup($filter, $cacheKey) ?? false;
-	}
-
-	/**
-	 * @throws ServerNotAvailableException
-	 * @throws Exception
-	 */
-	private function getNameOfGroup(string $filter, string $cacheKey) {
-		$result = $this->access->searchGroups($filter, ['dn'], 1);
-		if (empty($result)) {
-			return null;
-		}
-		$dn = $result[0]['dn'][0];
-
-		//and now the group name
-		//NOTE once we have separate Nextcloud group IDs and group names we can
-		//directly read the display name attribute instead of the DN
-		$name = $this->access->dn2groupname($dn);
-
-		$this->access->connection->writeToCache($cacheKey, $name);
-
-		return $name;
-	}
-
-	/**
-	 * returns the entry's gidNumber
-	 *
-	 * @return string|bool
-	 * @throws ServerNotAvailableException
-	 */
-	private function getEntryGidNumber(string $dn, string $attribute) {
-		$value = $this->access->readAttribute($dn, $attribute);
-		if (is_array($value) && !empty($value)) {
-			return $value[0];
-		}
-		return false;
-	}
-
-	/**
-	 * @return string|bool
-	 * @throws ServerNotAvailableException
-	 */
-	public function getGroupGidNumber(string $dn) {
-		return $this->getEntryGidNumber($dn, 'gidNumber');
-	}
-
-	/**
-	 * returns the user's gidNumber
-	 *
-	 * @return string|bool
-	 * @throws ServerNotAvailableException
-	 */
-	public function getUserGidNumber(string $dn) {
-		$gidNumber = false;
-		if ($this->access->connection->hasGidNumber) {
-			$gidNumber = $this->getEntryGidNumber($dn, $this->access->connection->ldapGidNumber);
-			if ($gidNumber === false) {
-				$this->access->connection->hasGidNumber = false;
-			}
-		}
-		return $gidNumber;
-	}
-
-	/**
-	 * @throws ServerNotAvailableException
-	 * @throws Exception
-	 */
-	private function prepareFilterForUsersHasGidNumber(string $groupDN, string $search = ''): string {
-		$groupID = $this->getGroupGidNumber($groupDN);
-		if ($groupID === false) {
-			throw new Exception('Not a valid group');
-		}
-
-		$filterParts = [];
-		$filterParts[] = $this->access->getFilterForUserCount();
-		if ($search !== '') {
-			$filterParts[] = $this->access->getFilterPartForUserSearch($search);
-		}
-		$filterParts[] = $this->access->connection->ldapGidNumber . '=' . $groupID;
-
-		return $this->access->combineFilterWithAnd($filterParts);
-	}
-
-	/**
-	 * returns a list of users that have the given group as gid number
-	 *
-	 * @throws ServerNotAvailableException
-	 */
-	public function getUsersInGidNumber(
-		string $groupDN,
-		string $search = '',
-		?int $limit = -1,
-		?int $offset = 0
-	): array {
-		try {
-			$filter = $this->prepareFilterForUsersHasGidNumber($groupDN, $search);
-			$users = $this->access->fetchListOfUsers(
-				$filter,
-				[$this->access->connection->ldapUserDisplayName, 'dn'],
-				$limit,
-				$offset
-			);
-			return $this->access->nextcloudUserNames($users);
-		} catch (ServerNotAvailableException $e) {
-			throw $e;
-		} catch (Exception $e) {
-			return [];
-		}
-	}
-
-	/**
-	 * @throws ServerNotAvailableException
-	 * @return bool
-	 */
-	public function getUserGroupByGid(string $dn) {
-		$groupID = $this->getUserGidNumber($dn);
-		if ($groupID !== false) {
-			$groupName = $this->gidNumber2Name($groupID, $dn);
-			if ($groupName !== false) {
-				return $groupName;
-			}
-		}
-
-		return false;
-	}
-
-	/**
-	 * translates a primary group ID into an Nextcloud internal name
-	 *
-	 * @return string|bool
-	 * @throws Exception
-	 * @throws ServerNotAvailableException
-	 */
-	public function primaryGroupID2Name(string $gid, string $dn) {
-		$cacheKey = 'primaryGroupIDtoName';
-		$groupNames = $this->access->connection->getFromCache($cacheKey);
-		if (!is_null($groupNames) && isset($groupNames[$gid])) {
-			return $groupNames[$gid];
-		}
-
-		$domainObjectSid = $this->access->getSID($dn);
-		if ($domainObjectSid === false) {
-			return false;
-		}
-
-		//we need to get the DN from LDAP
-		$filter = $this->access->combineFilterWithAnd([
-			$this->access->connection->ldapGroupFilter,
-			'objectsid=' . $domainObjectSid . '-' . $gid
-		]);
-		return $this->getNameOfGroup($filter, $cacheKey) ?? false;
-	}
-
-	/**
-	 * returns the entry's primary group ID
-	 *
-	 * @return string|bool
-	 * @throws ServerNotAvailableException
-	 */
-	private function getEntryGroupID(string $dn, string $attribute) {
-		$value = $this->access->readAttribute($dn, $attribute);
-		if (is_array($value) && !empty($value)) {
-			return $value[0];
-		}
-		return false;
-	}
-
-	/**
-	 * @return string|bool
-	 * @throws ServerNotAvailableException
-	 */
-	public function getGroupPrimaryGroupID(string $dn) {
-		return $this->getEntryGroupID($dn, 'primaryGroupToken');
-	}
-
-	/**
-	 * @return string|bool
-	 * @throws ServerNotAvailableException
-	 */
-	public function getUserPrimaryGroupIDs(string $dn) {
-		$primaryGroupID = false;
-		if ($this->access->connection->hasPrimaryGroups) {
-			$primaryGroupID = $this->getEntryGroupID($dn, 'primaryGroupID');
-			if ($primaryGroupID === false) {
-				$this->access->connection->hasPrimaryGroups = false;
-			}
-		}
-		return $primaryGroupID;
-	}
-
-	/**
-	 * @throws Exception
-	 * @throws ServerNotAvailableException
-	 */
-	private function prepareFilterForUsersInPrimaryGroup(string $groupDN, string $search = ''): string {
-		$groupID = $this->getGroupPrimaryGroupID($groupDN);
-		if ($groupID === false) {
-			throw new Exception('Not a valid group');
-		}
-
-		$filterParts = [];
-		$filterParts[] = $this->access->getFilterForUserCount();
-		if ($search !== '') {
-			$filterParts[] = $this->access->getFilterPartForUserSearch($search);
-		}
-		$filterParts[] = 'primaryGroupID=' . $groupID;
-
-		return $this->access->combineFilterWithAnd($filterParts);
-	}
-
-	/**
-	 * @throws ServerNotAvailableException
-	 */
-	public function getUsersInPrimaryGroup(
-		string $groupDN,
-		string $search = '',
-		?int $limit = -1,
-		?int $offset = 0
-	): array {
-		try {
-			$filter = $this->prepareFilterForUsersInPrimaryGroup($groupDN, $search);
-			$users = $this->access->fetchListOfUsers(
-				$filter,
-				[$this->access->connection->ldapUserDisplayName, 'dn'],
-				$limit,
-				$offset
-			);
-			return $this->access->nextcloudUserNames($users);
-		} catch (ServerNotAvailableException $e) {
-			throw $e;
-		} catch (Exception $e) {
-			return [];
-		}
-	}
-
-	/**
-	 * @throws ServerNotAvailableException
-	 */
-	public function countUsersInPrimaryGroup(
-		string $groupDN,
-		string $search = '',
-		int $limit = -1,
-		int $offset = 0
-	): int {
-		try {
-			$filter = $this->prepareFilterForUsersInPrimaryGroup($groupDN, $search);
-			$users = $this->access->countUsers($filter, ['dn'], $limit, $offset);
-			return (int)$users;
-		} catch (ServerNotAvailableException $e) {
-			throw $e;
-		} catch (Exception $e) {
-			return 0;
-		}
-	}
-
-	/**
-	 * @return string|bool
-	 * @throws ServerNotAvailableException
-	 */
-	public function getUserPrimaryGroup(string $dn) {
-		$groupID = $this->getUserPrimaryGroupIDs($dn);
-		if ($groupID !== false) {
-			$groupName = $this->primaryGroupID2Name($groupID, $dn);
-			if ($groupName !== false) {
-				return $groupName;
-			}
-		}
-
-		return false;
-	}
-
-	/**
-	 * This function fetches all groups a user belongs to. It does not check
-	 * if the user exists at all.
-	 *
-	 * This function includes groups based on dynamic group membership.
-	 *
-	 * @param string $uid Name of the user
-	 * @return array with group names
-	 * @throws Exception
-	 * @throws ServerNotAvailableException
-	 */
-	public function getUserGroups($uid) {
-		if (!$this->enabled) {
-			return [];
-		}
-		$cacheKey = 'getUserGroups' . $uid;
-		$userGroups = $this->access->connection->getFromCache($cacheKey);
-		if (!is_null($userGroups)) {
-			return $userGroups;
-		}
-		$userDN = $this->access->username2dn($uid);
-		if (!$userDN) {
-			$this->access->connection->writeToCache($cacheKey, []);
-			return [];
-		}
-
-		$groups = [];
-		$primaryGroup = $this->getUserPrimaryGroup($userDN);
-		$gidGroupName = $this->getUserGroupByGid($userDN);
-
-		$dynamicGroupMemberURL = strtolower($this->access->connection->ldapDynamicGroupMemberURL);
-
-		if (!empty($dynamicGroupMemberURL)) {
-			// look through dynamic groups to add them to the result array if needed
-			$groupsToMatch = $this->access->fetchListOfGroups(
-				$this->access->connection->ldapGroupFilter, ['dn', $dynamicGroupMemberURL]);
-			foreach ($groupsToMatch as $dynamicGroup) {
-				if (!array_key_exists($dynamicGroupMemberURL, $dynamicGroup)) {
-					continue;
-				}
-				$pos = strpos($dynamicGroup[$dynamicGroupMemberURL][0], '(');
-				if ($pos !== false) {
-					$memberUrlFilter = substr($dynamicGroup[$dynamicGroupMemberURL][0], $pos);
-					// apply filter via ldap search to see if this user is in this
-					// dynamic group
-					$userMatch = $this->access->readAttribute(
-						$userDN,
-						$this->access->connection->ldapUserDisplayName,
-						$memberUrlFilter
-					);
-					if ($userMatch !== false) {
-						// match found so this user is in this group
-						$groupName = $this->access->dn2groupname($dynamicGroup['dn'][0]);
-						if (is_string($groupName)) {
-							// be sure to never return false if the dn could not be
-							// resolved to a name, for whatever reason.
-							$groups[] = $groupName;
-						}
-					}
-				} else {
-					$this->logger->debug('No search filter found on member url of group {dn}',
-						[
-							'app' => 'user_ldap',
-							'dn' => $dynamicGroup,
-						]
-					);
-				}
-			}
-		}
-
-		// if possible, read out membership via memberOf. It's far faster than
-		// performing a search, which still is a fallback later.
-		// memberof doesn't support memberuid, so skip it here.
-		if ((int)$this->access->connection->hasMemberOfFilterSupport === 1
-			&& (int)$this->access->connection->useMemberOfToDetectMembership === 1
-			&& $this->ldapGroupMemberAssocAttr !== 'memberuid'
-			&& $this->ldapGroupMemberAssocAttr !== 'zimbramailforwardingaddress') {
-			$groupDNs = $this->_getGroupDNsFromMemberOf($userDN);
-			if (is_array($groupDNs)) {
-				foreach ($groupDNs as $dn) {
-					$groupName = $this->access->dn2groupname($dn);
-					if (is_string($groupName)) {
-						// be sure to never return false if the dn could not be
-						// resolved to a name, for whatever reason.
-						$groups[] = $groupName;
-					}
-				}
-			}
-
-			if ($primaryGroup !== false) {
-				$groups[] = $primaryGroup;
-			}
-			if ($gidGroupName !== false) {
-				$groups[] = $gidGroupName;
-			}
-			$this->access->connection->writeToCache($cacheKey, $groups);
-			return $groups;
-		}
-
-		//uniqueMember takes DN, memberuid the uid, so we need to distinguish
-		switch ($this->ldapGroupMemberAssocAttr) {
-			case 'uniquemember':
-			case 'member':
-				$uid = $userDN;
-				break;
-
-			case 'memberuid':
-			case 'zimbramailforwardingaddress':
-				$result = $this->access->readAttribute($userDN, 'uid');
-				if ($result === false) {
-					$this->logger->debug('No uid attribute found for DN {dn} on {host}',
-						[
-							'app' => 'user_ldap',
-							'dn' => $userDN,
-							'host' => $this->access->connection->ldapHost,
-						]
-					);
-					$uid = false;
-				} else {
-					$uid = $result[0];
-				}
-				break;
-
-			default:
-				// just in case
-				$uid = $userDN;
-				break;
-		}
-
-		if ($uid !== false) {
-			if (isset($this->cachedGroupsByMember[$uid])) {
-				$groups = array_merge($groups, $this->cachedGroupsByMember[$uid]);
-			} else {
-				$groupsByMember = array_values($this->getGroupsByMember($uid));
-				$groupsByMember = $this->access->nextcloudGroupNames($groupsByMember);
-				$this->cachedGroupsByMember[$uid] = $groupsByMember;
-				$groups = array_merge($groups, $groupsByMember);
-			}
-		}
-
-		if ($primaryGroup !== false) {
-			$groups[] = $primaryGroup;
-		}
-		if ($gidGroupName !== false) {
-			$groups[] = $gidGroupName;
-		}
-
-		$groups = array_unique($groups, SORT_LOCALE_STRING);
-		$this->access->connection->writeToCache($cacheKey, $groups);
-
-		return $groups;
-	}
-
-	/**
-	 * @throws ServerNotAvailableException
-	 */
-	private function getGroupsByMember(string $dn, array &$seen = null): array {
-		if ($seen === null) {
-			$seen = [];
-		}
-		if (array_key_exists($dn, $seen)) {
-			// avoid loops
-			return [];
-		}
-		$allGroups = [];
-		$seen[$dn] = true;
-		$filter = $this->access->connection->ldapGroupMemberAssocAttr . '=' . $dn;
-
-		if ($this->ldapGroupMemberAssocAttr === 'zimbramailforwardingaddress') {
-			//in this case the member entries are email addresses
-			$filter .= '@*';
-		}
-
-		$groups = $this->access->fetchListOfGroups($filter,
-			[strtolower($this->access->connection->ldapGroupMemberAssocAttr), $this->access->connection->ldapGroupDisplayName, 'dn']);
-		if (is_array($groups)) {
-			$fetcher = function ($dn, &$seen) {
-				if (is_array($dn) && isset($dn['dn'][0])) {
-					$dn = $dn['dn'][0];
-				}
-				return $this->getGroupsByMember($dn, $seen);
-			};
-
-			if (empty($dn)) {
-				$dn = "";
-			}
-
-			$allGroups = $this->walkNestedGroups($dn, $fetcher, $groups);
-		}
-		$visibleGroups = $this->filterValidGroups($allGroups);
-		return array_intersect_key($allGroups, $visibleGroups);
-	}
-
-	/**
-	 * get a list of all users in a group
-	 *
-	 * @param string $gid
-	 * @param string $search
-	 * @param int $limit
-	 * @param int $offset
-	 * @return array with user ids
-	 * @throws Exception
-	 * @throws ServerNotAvailableException
-	 */
-	public function usersInGroup($gid, $search = '', $limit = -1, $offset = 0) {
-		if (!$this->enabled) {
-			return [];
-		}
-		if (!$this->groupExists($gid)) {
-			return [];
-		}
-		$search = $this->access->escapeFilterPart($search, true);
-		$cacheKey = 'usersInGroup-' . $gid . '-' . $search . '-' . $limit . '-' . $offset;
-		// check for cache of the exact query
-		$groupUsers = $this->access->connection->getFromCache($cacheKey);
-		if (!is_null($groupUsers)) {
-			return $groupUsers;
-		}
-
-		if ($limit === -1) {
-			$limit = null;
-		}
-		// check for cache of the query without limit and offset
-		$groupUsers = $this->access->connection->getFromCache('usersInGroup-' . $gid . '-' . $search);
-		if (!is_null($groupUsers)) {
-			$groupUsers = array_slice($groupUsers, $offset, $limit);
-			$this->access->connection->writeToCache($cacheKey, $groupUsers);
-			return $groupUsers;
-		}
-
-		$groupDN = $this->access->groupname2dn($gid);
-		if (!$groupDN) {
-			// group couldn't be found, return empty resultset
-			$this->access->connection->writeToCache($cacheKey, []);
-			return [];
-		}
-
-		$primaryUsers = $this->getUsersInPrimaryGroup($groupDN, $search, $limit, $offset);
-		$posixGroupUsers = $this->getUsersInGidNumber($groupDN, $search, $limit, $offset);
-		$members = $this->_groupMembers($groupDN);
-		if (!$members && empty($posixGroupUsers) && empty($primaryUsers)) {
-			//in case users could not be retrieved, return empty result set
-			$this->access->connection->writeToCache($cacheKey, []);
-			return [];
-		}
-
-		$groupUsers = [];
-		$attrs = $this->access->userManager->getAttributes(true);
-		foreach ($members as $member) {
-			switch ($this->ldapGroupMemberAssocAttr) {
-				case 'zimbramailforwardingaddress':
-					//we get email addresses and need to convert them to uids
-					$parts = explode('@', $member);
-					$member = $parts[0];
-					//no break needed because we just needed to remove the email part and now we have uids
-				case 'memberuid':
-					//we got uids, need to get their DNs to 'translate' them to user names
-					$filter = $this->access->combineFilterWithAnd([
-						str_replace('%uid', trim($member), $this->access->connection->ldapLoginFilter),
-						$this->access->combineFilterWithAnd([
-							$this->access->getFilterPartForUserSearch($search),
-							$this->access->connection->ldapUserFilter
-						])
-					]);
-					$ldap_users = $this->access->fetchListOfUsers($filter, $attrs, 1);
-					if (count($ldap_users) < 1) {
-						continue;
-					}
-					$groupUsers[] = $this->access->dn2username($ldap_users[0]['dn'][0]);
-					break;
-				default:
-					//we got DNs, check if we need to filter by search or we can give back all of them
-					$uid = $this->access->dn2username($member);
-					if (!$uid) {
-						continue;
-					}
-
-					$cacheKey = 'userExistsOnLDAP' . $uid;
-					$userExists = $this->access->connection->getFromCache($cacheKey);
-					if ($userExists === false) {
-						continue;
-					}
-					if ($userExists === null || $search !== '') {
-						if (!$this->access->readAttribute($member,
-							$this->access->connection->ldapUserDisplayName,
-							$this->access->combineFilterWithAnd([
-								$this->access->getFilterPartForUserSearch($search),
-								$this->access->connection->ldapUserFilter
-							]))) {
-							if ($search === '') {
-								$this->access->connection->writeToCache($cacheKey, false);
-							}
-							continue;
-						}
-						$this->access->connection->writeToCache($cacheKey, true);
-					}
-					$groupUsers[] = $uid;
-					break;
-			}
-		}
-
-		$groupUsers = array_unique(array_merge($groupUsers, $primaryUsers, $posixGroupUsers));
-		natsort($groupUsers);
-		$this->access->connection->writeToCache('usersInGroup-' . $gid . '-' . $search, $groupUsers);
-		$groupUsers = array_slice($groupUsers, $offset, $limit);
-
-		$this->access->connection->writeToCache($cacheKey, $groupUsers);
-
-		return $groupUsers;
-	}
-
-	/**
-	 * returns the number of users in a group, who match the search term
-	 *
-	 * @param string $gid the internal group name
-	 * @param string $search optional, a search string
-	 * @return int|bool
-	 * @throws Exception
-	 * @throws ServerNotAvailableException
-	 */
-	public function countUsersInGroup($gid, $search = '') {
-		if ($this->groupPluginManager->implementsActions(GroupInterface::COUNT_USERS)) {
-			return $this->groupPluginManager->countUsersInGroup($gid, $search);
-		}
-
-		$cacheKey = 'countUsersInGroup-' . $gid . '-' . $search;
-		if (!$this->enabled || !$this->groupExists($gid)) {
-			return false;
-		}
-		$groupUsers = $this->access->connection->getFromCache($cacheKey);
-		if (!is_null($groupUsers)) {
-			return $groupUsers;
-		}
-
-		$groupDN = $this->access->groupname2dn($gid);
-		if (!$groupDN) {
-			// group couldn't be found, return empty result set
-			$this->access->connection->writeToCache($cacheKey, false);
-			return false;
-		}
-
-		$members = $this->_groupMembers($groupDN);
-		$primaryUserCount = $this->countUsersInPrimaryGroup($groupDN, '');
-		if (!$members && $primaryUserCount === 0) {
-			//in case users could not be retrieved, return empty result set
-			$this->access->connection->writeToCache($cacheKey, false);
-			return false;
-		}
-
-		if ($search === '') {
-			$groupUsers = count($members) + $primaryUserCount;
-			$this->access->connection->writeToCache($cacheKey, $groupUsers);
-			return $groupUsers;
-		}
-		$search = $this->access->escapeFilterPart($search, true);
-		$isMemberUid =
-			($this->ldapGroupMemberAssocAttr === 'memberuid' ||
-				$this->ldapGroupMemberAssocAttr === 'zimbramailforwardingaddress');
-
-		//we need to apply the search filter
-		//alternatives that need to be checked:
-		//a) get all users by search filter and array_intersect them
-		//b) a, but only when less than 1k 10k ?k users like it is
-		//c) put all DNs|uids in a LDAP filter, combine with the search string
-		//   and let it count.
-		//For now this is not important, because the only use of this method
-		//does not supply a search string
-		$groupUsers = [];
-		foreach ($members as $member) {
-			if ($isMemberUid) {
-				if ($this->ldapGroupMemberAssocAttr === 'zimbramailforwardingaddress') {
-					//we get email addresses and need to convert them to uids
-					$parts = explode('@', $member);
-					$member = $parts[0];
-				}
-				//we got uids, need to get their DNs to 'translate' them to user names
-				$filter = $this->access->combineFilterWithAnd([
-					str_replace('%uid', $member, $this->access->connection->ldapLoginFilter),
-					$this->access->getFilterPartForUserSearch($search)
-				]);
-				$ldap_users = $this->access->fetchListOfUsers($filter, ['dn'], 1);
-				if (count($ldap_users) < 1) {
-					continue;
-				}
-				$groupUsers[] = $this->access->dn2username($ldap_users[0]);
-			} else {
-				//we need to apply the search filter now
-				if (!$this->access->readAttribute($member,
-					$this->access->connection->ldapUserDisplayName,
-					$this->access->getFilterPartForUserSearch($search))) {
-					continue;
-				}
-				// dn2username will also check if the users belong to the allowed base
-				if ($ncGroupId = $this->access->dn2username($member)) {
-					$groupUsers[] = $ncGroupId;
-				}
-			}
-		}
-
-		//and get users that have the group as primary
-		$primaryUsers = $this->countUsersInPrimaryGroup($groupDN, $search);
-
-		return count($groupUsers) + $primaryUsers;
-	}
-
-	/**
-	 * get a list of all groups using a paged search
-	 *
-	 * @param string $search
-	 * @param int $limit
-	 * @param int $offset
-	 * @return array with group names
-	 *
-	 * Returns a list with all groups
-	 * Uses a paged search if available to override a
-	 * server side search limit.
-	 * (active directory has a limit of 1000 by default)
-	 * @throws Exception
-	 */
-	public function getGroups($search = '', $limit = -1, $offset = 0) {
-		if (!$this->enabled) {
-			return [];
-		}
-		$cacheKey = 'getGroups-' . $search . '-' . $limit . '-' . $offset;
-
-		//Check cache before driving unnecessary searches
-		$ldap_groups = $this->access->connection->getFromCache($cacheKey);
-		if (!is_null($ldap_groups)) {
-			return $ldap_groups;
-		}
-
-		// if we'd pass -1 to LDAP search, we'd end up in a Protocol
-		// error. With a limit of 0, we get 0 results. So we pass null.
-		if ($limit <= 0) {
-			$limit = null;
-		}
-		$filter = $this->access->combineFilterWithAnd([
-			$this->access->connection->ldapGroupFilter,
-			$this->access->getFilterPartForGroupSearch($search)
-		]);
-		$ldap_groups = $this->access->fetchListOfGroups($filter,
-			[$this->access->connection->ldapGroupDisplayName, 'dn'],
-			$limit,
-			$offset);
-		$ldap_groups = $this->access->nextcloudGroupNames($ldap_groups);
-
-		$this->access->connection->writeToCache($cacheKey, $ldap_groups);
-		return $ldap_groups;
-	}
-
-	/**
-	 * check if a group exists
-	 *
-	 * @param string $gid
-	 * @return bool
-	 * @throws ServerNotAvailableException
-	 */
-	public function groupExists($gid) {
-		$groupExists = $this->access->connection->getFromCache('groupExists' . $gid);
-		if (!is_null($groupExists)) {
-			return (bool)$groupExists;
-		}
-
-		//getting dn, if false the group does not exist. If dn, it may be mapped
-		//only, requires more checking.
-		$dn = $this->access->groupname2dn($gid);
-		if (!$dn) {
-			$this->access->connection->writeToCache('groupExists' . $gid, false);
-			return false;
-		}
-
-		if (!$this->access->isDNPartOfBase($dn, $this->access->connection->ldapBaseGroups)) {
-			$this->access->connection->writeToCache('groupExists' . $gid, false);
-			return false;
-		}
-
-		//if group really still exists, we will be able to read its objectClass
-		if (!is_array($this->access->readAttribute($dn, '', $this->access->connection->ldapGroupFilter))) {
-			$this->access->connection->writeToCache('groupExists' . $gid, false);
-			return false;
-		}
-
-		$this->access->connection->writeToCache('groupExists' . $gid, true);
-		return true;
-	}
-
-	/**
-	 * @throws ServerNotAvailableException
-	 * @throws Exception
-	 */
-	protected function filterValidGroups(array $listOfGroups): array {
-		$validGroupDNs = [];
-		foreach ($listOfGroups as $key => $item) {
-			$dn = is_string($item) ? $item : $item['dn'][0];
-			$gid = $this->access->dn2groupname($dn);
-			if (!$gid) {
-				continue;
-			}
-			if ($this->groupExists($gid)) {
-				$validGroupDNs[$key] = $item;
-			}
-		}
-		return $validGroupDNs;
-	}
-
-	/**
-	 * Check if backend implements actions
-	 *
-	 * @param int $actions bitwise-or'ed actions
-	 * @return boolean
-	 *
-	 * Returns the supported actions as int to be
-	 * compared with GroupInterface::CREATE_GROUP etc.
-	 */
-	public function implementsActions($actions) {
-		return (bool)((GroupInterface::COUNT_USERS |
-				$this->groupPluginManager->getImplementedActions()) & $actions);
-	}
-
-	/**
-	 * Return access for LDAP interaction.
-	 *
-	 * @return Access instance of Access for LDAP interaction
-	 */
-	public function getLDAPAccess($gid) {
-		return $this->access;
-	}
-
-	/**
-	 * create a group
-	 *
-	 * @param string $gid
-	 * @return bool
-	 * @throws Exception
-	 * @throws ServerNotAvailableException
-	 */
-	public function createGroup($gid) {
-		if ($this->groupPluginManager->implementsActions(GroupInterface::CREATE_GROUP)) {
-			if ($dn = $this->groupPluginManager->createGroup($gid)) {
-				//updates group mapping
-				$uuid = $this->access->getUUID($dn, false);
-				if (is_string($uuid)) {
-					$this->access->mapAndAnnounceIfApplicable(
-						$this->access->getGroupMapper(),
-						$dn,
-						$gid,
-						$uuid,
-						false
-					);
-					$this->access->cacheGroupExists($gid);
-				}
-			}
-			return $dn != null;
-		}
-		throw new Exception('Could not create group in LDAP backend.');
-	}
-
-	/**
-	 * delete a group
-	 *
-	 * @param string $gid gid of the group to delete
-	 * @return bool
-	 * @throws Exception
-	 */
-	public function deleteGroup($gid) {
-		if ($this->groupPluginManager->implementsActions(GroupInterface::DELETE_GROUP)) {
-			if ($ret = $this->groupPluginManager->deleteGroup($gid)) {
-				#delete group in nextcloud internal db
-				$this->access->getGroupMapper()->unmap($gid);
-				$this->access->connection->writeToCache("groupExists" . $gid, false);
-			}
-			return $ret;
-		}
-		throw new Exception('Could not delete group in LDAP backend.');
-	}
-
-	/**
-	 * Add a user to a group
-	 *
-	 * @param string $uid Name of the user to add to group
-	 * @param string $gid Name of the group in which add the user
-	 * @return bool
-	 * @throws Exception
-	 */
-	public function addToGroup($uid, $gid) {
-		if ($this->groupPluginManager->implementsActions(GroupInterface::ADD_TO_GROUP)) {
-			if ($ret = $this->groupPluginManager->addToGroup($uid, $gid)) {
-				$this->access->connection->clearCache();
-				unset($this->cachedGroupMembers[$gid]);
-			}
-			return $ret;
-		}
-		throw new Exception('Could not add user to group in LDAP backend.');
-	}
-
-	/**
-	 * Removes a user from a group
-	 *
-	 * @param string $uid Name of the user to remove from group
-	 * @param string $gid Name of the group from which remove the user
-	 * @return bool
-	 * @throws Exception
-	 */
-	public function removeFromGroup($uid, $gid) {
-		if ($this->groupPluginManager->implementsActions(GroupInterface::REMOVE_FROM_GROUP)) {
-			if ($ret = $this->groupPluginManager->removeFromGroup($uid, $gid)) {
-				$this->access->connection->clearCache();
-				unset($this->cachedGroupMembers[$gid]);
-			}
-			return $ret;
-		}
-		throw new Exception('Could not remove user from group in LDAP backend.');
-	}
-
-	/**
-	 * Gets group details
-	 *
-	 * @param string $gid Name of the group
-	 * @return array|false
-	 * @throws Exception
-	 */
-	public function getGroupDetails($gid) {
-		if ($this->groupPluginManager->implementsActions(GroupInterface::GROUP_DETAILS)) {
-			return $this->groupPluginManager->getGroupDetails($gid);
-		}
-		throw new Exception('Could not get group details in LDAP backend.');
-	}
-
-	/**
-	 * Return LDAP connection resource from a cloned connection.
-	 * The cloned connection needs to be closed manually.
-	 * of the current access.
-	 *
-	 * @param string $gid
-	 * @return resource of the LDAP connection
-	 * @throws ServerNotAvailableException
-	 */
-	public function getNewLDAPConnection($gid) {
-		$connection = clone $this->access->getConnection();
-		return $connection->getConnectionResource();
-	}
-
-	/**
-	 * @throws ServerNotAvailableException
-	 */
-	public function getDisplayName(string $gid): string {
-		if ($this->groupPluginManager instanceof IGetDisplayNameBackend) {
-			return $this->groupPluginManager->getDisplayName($gid);
-		}
-
-		$cacheKey = 'group_getDisplayName' . $gid;
-		if (!is_null($displayName = $this->access->connection->getFromCache($cacheKey))) {
-			return $displayName;
-		}
-
-		$displayName = $this->access->readAttribute(
-			$this->access->groupname2dn($gid),
-			$this->access->connection->ldapGroupDisplayName);
-
-		if ($displayName && (count($displayName) > 0)) {
-			$displayName = $displayName[0];
-			$this->access->connection->writeToCache($cacheKey, $displayName);
-			return $displayName;
-		}
-
-		return '';
-	}
+    protected $enabled = false;
+
+    /** @var string[] $cachedGroupMembers array of users with gid as key */
+    protected $cachedGroupMembers;
+    /** @var string[] $cachedGroupsByMember array of groups with uid as key */
+    protected $cachedGroupsByMember;
+    /** @var string[] $cachedNestedGroups array of groups with gid (DN) as key */
+    protected $cachedNestedGroups;
+    /** @var GroupPluginManager */
+    protected $groupPluginManager;
+    /** @var ILogger */
+    protected $logger;
+
+    /**
+     * @var string $ldapGroupMemberAssocAttr contains the LDAP setting (in lower case) with the same name
+     */
+    protected $ldapGroupMemberAssocAttr;
+
+    public function __construct(Access $access, GroupPluginManager $groupPluginManager) {
+        parent::__construct($access);
+        $filter = $this->access->connection->ldapGroupFilter;
+        $gAssoc = $this->access->connection->ldapGroupMemberAssocAttr;
+        if (!empty($filter) && !empty($gAssoc)) {
+            $this->enabled = true;
+        }
+
+        $this->cachedGroupMembers = new CappedMemoryCache();
+        $this->cachedGroupsByMember = new CappedMemoryCache();
+        $this->cachedNestedGroups = new CappedMemoryCache();
+        $this->groupPluginManager = $groupPluginManager;
+        $this->logger = OC::$server->getLogger();
+        $this->ldapGroupMemberAssocAttr = strtolower($gAssoc);
+    }
+
+    /**
+     * is user in group?
+     *
+     * @param string $uid uid of the user
+     * @param string $gid gid of the group
+     * @return bool
+     * @throws Exception
+     * @throws ServerNotAvailableException
+     */
+    public function inGroup($uid, $gid) {
+        if (!$this->enabled) {
+            return false;
+        }
+        $cacheKey = 'inGroup' . $uid . ':' . $gid;
+        $inGroup = $this->access->connection->getFromCache($cacheKey);
+        if (!is_null($inGroup)) {
+            return (bool)$inGroup;
+        }
+
+        $userDN = $this->access->username2dn($uid);
+
+        if (isset($this->cachedGroupMembers[$gid])) {
+            return in_array($userDN, $this->cachedGroupMembers[$gid]);
+        }
+
+        $cacheKeyMembers = 'inGroup-members:' . $gid;
+        $members = $this->access->connection->getFromCache($cacheKeyMembers);
+        if (!is_null($members)) {
+            $this->cachedGroupMembers[$gid] = $members;
+            $isInGroup = in_array($userDN, $members, true);
+            $this->access->connection->writeToCache($cacheKey, $isInGroup);
+            return $isInGroup;
+        }
+
+        $groupDN = $this->access->groupname2dn($gid);
+        // just in case
+        if (!$groupDN || !$userDN) {
+            $this->access->connection->writeToCache($cacheKey, false);
+            return false;
+        }
+
+        //check primary group first
+        if ($gid === $this->getUserPrimaryGroup($userDN)) {
+            $this->access->connection->writeToCache($cacheKey, true);
+            return true;
+        }
+
+        //usually, LDAP attributes are said to be case insensitive. But there are exceptions of course.
+        $members = $this->_groupMembers($groupDN);
+        if (!is_array($members) || count($members) === 0) {
+            $this->access->connection->writeToCache($cacheKey, false);
+            return false;
+        }
+
+        //extra work if we don't get back user DNs
+        switch ($this->ldapGroupMemberAssocAttr) {
+            case 'memberuid':
+            case 'zimbramailforwardingaddress':
+                $requestAttributes = $this->access->userManager->getAttributes(true);
+                $dns = [];
+                $filterParts = [];
+                $bytes = 0;
+                foreach ($members as $mid) {
+                    if ($this->ldapGroupMemberAssocAttr === 'zimbramailforwardingaddress') {
+                        $parts = explode('@', $mid); //making sure we get only the uid
+                        $mid = $parts[0];
+                    }
+                    $filter = str_replace('%uid', $mid, $this->access->connection->ldapLoginFilter);
+                    $filterParts[] = $filter;
+                    $bytes += strlen($filter);
+                    if ($bytes >= 9000000) {
+                        // AD has a default input buffer of 10 MB, we do not want
+                        // to take even the chance to exceed it
+                        $filter = $this->access->combineFilterWithOr($filterParts);
+                        $users = $this->access->fetchListOfUsers($filter, $requestAttributes, count($filterParts));
+                        $bytes = 0;
+                        $filterParts = [];
+                        $dns = array_merge($dns, $users);
+                    }
+                }
+                if (count($filterParts) > 0) {
+                    $filter = $this->access->combineFilterWithOr($filterParts);
+                    $users = $this->access->fetchListOfUsers($filter, $requestAttributes, count($filterParts));
+                    $dns = array_merge($dns, $users);
+                }
+                $members = $dns;
+                break;
+        }
+
+        $isInGroup = in_array($userDN, $members);
+        $this->access->connection->writeToCache($cacheKey, $isInGroup);
+        $this->access->connection->writeToCache($cacheKeyMembers, $members);
+        $this->cachedGroupMembers[$gid] = $members;
+
+        return $isInGroup;
+    }
+
+    /**
+     * For a group that has user membership defined by an LDAP search url
+     * attribute returns the users that match the search url otherwise returns
+     * an empty array.
+     *
+     * @throws ServerNotAvailableException
+     */
+    public function getDynamicGroupMembers(string $dnGroup): array {
+        $dynamicGroupMemberURL = strtolower($this->access->connection->ldapDynamicGroupMemberURL);
+
+        if (empty($dynamicGroupMemberURL)) {
+            return [];
+        }
+
+        $dynamicMembers = [];
+        $memberURLs = $this->access->readAttribute(
+            $dnGroup,
+            $dynamicGroupMemberURL,
+            $this->access->connection->ldapGroupFilter
+        );
+        if ($memberURLs !== false) {
+            // this group has the 'memberURL' attribute so this is a dynamic group
+            // example 1: ldap:///cn=users,cn=accounts,dc=dcsubbase,dc=dcbase??one?(o=HeadOffice)
+            // example 2: ldap:///cn=users,cn=accounts,dc=dcsubbase,dc=dcbase??one?(&(o=HeadOffice)(uidNumber>=500))
+            $pos = strpos($memberURLs[0], '(');
+            if ($pos !== false) {
+                $memberUrlFilter = substr($memberURLs[0], $pos);
+                $foundMembers = $this->access->searchUsers($memberUrlFilter, 'dn');
+                $dynamicMembers = [];
+                foreach ($foundMembers as $value) {
+                    $dynamicMembers[$value['dn'][0]] = 1;
+                }
+            } else {
+                $this->logger->debug('No search filter found on member url of group {dn}',
+                    [
+                        'app' => 'user_ldap',
+                        'dn' => $dnGroup,
+                    ]
+                );
+            }
+        }
+        return $dynamicMembers;
+    }
+
+    /**
+     * @throws ServerNotAvailableException
+     */
+    private function _groupMembers(string $dnGroup, ?array &$seen = null): array {
+        if ($seen === null) {
+            $seen = [];
+        }
+        $allMembers = [];
+        if (array_key_exists($dnGroup, $seen)) {
+            return [];
+        }
+        // used extensively in cron job, caching makes sense for nested groups
+        $cacheKey = '_groupMembers' . $dnGroup;
+        $groupMembers = $this->access->connection->getFromCache($cacheKey);
+        if ($groupMembers !== null) {
+            return $groupMembers;
+        }
+        $seen[$dnGroup] = 1;
+        $members = $this->access->readAttribute($dnGroup, $this->access->connection->ldapGroupMemberAssocAttr);
+        if (is_array($members)) {
+            $fetcher = function ($memberDN, &$seen) {
+                return $this->_groupMembers($memberDN, $seen);
+            };
+            $allMembers = $this->walkNestedGroups($dnGroup, $fetcher, $members);
+        }
+
+        $allMembers += $this->getDynamicGroupMembers($dnGroup);
+
+        $this->access->connection->writeToCache($cacheKey, $allMembers);
+        return $allMembers;
+    }
+
+    /**
+     * @throws ServerNotAvailableException
+     */
+    private function _getGroupDNsFromMemberOf(string $dn): array {
+        $groups = $this->access->readAttribute($dn, 'memberOf');
+        if (!is_array($groups)) {
+            return [];
+        }
+
+        $fetcher = function ($groupDN) {
+            if (isset($this->cachedNestedGroups[$groupDN])) {
+                $nestedGroups = $this->cachedNestedGroups[$groupDN];
+            } else {
+                $nestedGroups = $this->access->readAttribute($groupDN, 'memberOf');
+                if (!is_array($nestedGroups)) {
+                    $nestedGroups = [];
+                }
+                $this->cachedNestedGroups[$groupDN] = $nestedGroups;
+            }
+            return $nestedGroups;
+        };
+
+        $groups = $this->walkNestedGroups($dn, $fetcher, $groups);
+        return $this->filterValidGroups($groups);
+    }
+
+    private function walkNestedGroups(string $dn, Closure $fetcher, array $list): array {
+        $nesting = (int)$this->access->connection->ldapNestedGroups;
+        // depending on the input, we either have a list of DNs or a list of LDAP records
+        // also, the output expects either DNs or records. Testing the first element should suffice.
+        $recordMode = is_array($list) && isset($list[0]) && is_array($list[0]) && isset($list[0]['dn'][0]);
+
+        if ($nesting !== 1) {
+            if ($recordMode) {
+                // the keys are numeric, but should hold the DN
+                return array_reduce($list, function ($transformed, $record) use ($dn) {
+                    if ($record['dn'][0] != $dn) {
+                        $transformed[$record['dn'][0]] = $record;
+                    }
+                    return $transformed;
+                }, []);
+            }
+            return $list;
+        }
+
+        $seen = [];
+        while ($record = array_pop($list)) {
+            $recordDN = $recordMode ? $record['dn'][0] : $record;
+            if ($recordDN === $dn || array_key_exists($recordDN, $seen)) {
+                // Prevent loops
+                continue;
+            }
+            $fetched = $fetcher($record, $seen);
+            $list = array_merge($list, $fetched);
+            $seen[$recordDN] = $record;
+        }
+
+        return $recordMode ? $seen : array_keys($seen);
+    }
+
+    /**
+     * translates a gidNumber into an ownCloud internal name
+     *
+     * @return string|bool
+     * @throws Exception
+     * @throws ServerNotAvailableException
+     */
+    public function gidNumber2Name(string $gid, string $dn) {
+        $cacheKey = 'gidNumberToName' . $gid;
+        $groupName = $this->access->connection->getFromCache($cacheKey);
+        if (!is_null($groupName) && isset($groupName)) {
+            return $groupName;
+        }
+
+        //we need to get the DN from LDAP
+        $filter = $this->access->combineFilterWithAnd([
+            $this->access->connection->ldapGroupFilter,
+            'objectClass=posixGroup',
+            $this->access->connection->ldapGidNumber . '=' . $gid
+        ]);
+        return $this->getNameOfGroup($filter, $cacheKey) ?? false;
+    }
+
+    /**
+     * @throws ServerNotAvailableException
+     * @throws Exception
+     */
+    private function getNameOfGroup(string $filter, string $cacheKey) {
+        $result = $this->access->searchGroups($filter, ['dn'], 1);
+        if (empty($result)) {
+            return null;
+        }
+        $dn = $result[0]['dn'][0];
+
+        //and now the group name
+        //NOTE once we have separate Nextcloud group IDs and group names we can
+        //directly read the display name attribute instead of the DN
+        $name = $this->access->dn2groupname($dn);
+
+        $this->access->connection->writeToCache($cacheKey, $name);
+
+        return $name;
+    }
+
+    /**
+     * returns the entry's gidNumber
+     *
+     * @return string|bool
+     * @throws ServerNotAvailableException
+     */
+    private function getEntryGidNumber(string $dn, string $attribute) {
+        $value = $this->access->readAttribute($dn, $attribute);
+        if (is_array($value) && !empty($value)) {
+            return $value[0];
+        }
+        return false;
+    }
+
+    /**
+     * @return string|bool
+     * @throws ServerNotAvailableException
+     */
+    public function getGroupGidNumber(string $dn) {
+        return $this->getEntryGidNumber($dn, 'gidNumber');
+    }
+
+    /**
+     * returns the user's gidNumber
+     *
+     * @return string|bool
+     * @throws ServerNotAvailableException
+     */
+    public function getUserGidNumber(string $dn) {
+        $gidNumber = false;
+        if ($this->access->connection->hasGidNumber) {
+            $gidNumber = $this->getEntryGidNumber($dn, $this->access->connection->ldapGidNumber);
+            if ($gidNumber === false) {
+                $this->access->connection->hasGidNumber = false;
+            }
+        }
+        return $gidNumber;
+    }
+
+    /**
+     * @throws ServerNotAvailableException
+     * @throws Exception
+     */
+    private function prepareFilterForUsersHasGidNumber(string $groupDN, string $search = ''): string {
+        $groupID = $this->getGroupGidNumber($groupDN);
+        if ($groupID === false) {
+            throw new Exception('Not a valid group');
+        }
+
+        $filterParts = [];
+        $filterParts[] = $this->access->getFilterForUserCount();
+        if ($search !== '') {
+            $filterParts[] = $this->access->getFilterPartForUserSearch($search);
+        }
+        $filterParts[] = $this->access->connection->ldapGidNumber . '=' . $groupID;
+
+        return $this->access->combineFilterWithAnd($filterParts);
+    }
+
+    /**
+     * returns a list of users that have the given group as gid number
+     *
+     * @throws ServerNotAvailableException
+     */
+    public function getUsersInGidNumber(
+        string $groupDN,
+        string $search = '',
+        ?int $limit = -1,
+        ?int $offset = 0
+    ): array {
+        try {
+            $filter = $this->prepareFilterForUsersHasGidNumber($groupDN, $search);
+            $users = $this->access->fetchListOfUsers(
+                $filter,
+                [$this->access->connection->ldapUserDisplayName, 'dn'],
+                $limit,
+                $offset
+            );
+            return $this->access->nextcloudUserNames($users);
+        } catch (ServerNotAvailableException $e) {
+            throw $e;
+        } catch (Exception $e) {
+            return [];
+        }
+    }
+
+    /**
+     * @throws ServerNotAvailableException
+     * @return bool
+     */
+    public function getUserGroupByGid(string $dn) {
+        $groupID = $this->getUserGidNumber($dn);
+        if ($groupID !== false) {
+            $groupName = $this->gidNumber2Name($groupID, $dn);
+            if ($groupName !== false) {
+                return $groupName;
+            }
+        }
+
+        return false;
+    }
+
+    /**
+     * translates a primary group ID into an Nextcloud internal name
+     *
+     * @return string|bool
+     * @throws Exception
+     * @throws ServerNotAvailableException
+     */
+    public function primaryGroupID2Name(string $gid, string $dn) {
+        $cacheKey = 'primaryGroupIDtoName';
+        $groupNames = $this->access->connection->getFromCache($cacheKey);
+        if (!is_null($groupNames) && isset($groupNames[$gid])) {
+            return $groupNames[$gid];
+        }
+
+        $domainObjectSid = $this->access->getSID($dn);
+        if ($domainObjectSid === false) {
+            return false;
+        }
+
+        //we need to get the DN from LDAP
+        $filter = $this->access->combineFilterWithAnd([
+            $this->access->connection->ldapGroupFilter,
+            'objectsid=' . $domainObjectSid . '-' . $gid
+        ]);
+        return $this->getNameOfGroup($filter, $cacheKey) ?? false;
+    }
+
+    /**
+     * returns the entry's primary group ID
+     *
+     * @return string|bool
+     * @throws ServerNotAvailableException
+     */
+    private function getEntryGroupID(string $dn, string $attribute) {
+        $value = $this->access->readAttribute($dn, $attribute);
+        if (is_array($value) && !empty($value)) {
+            return $value[0];
+        }
+        return false;
+    }
+
+    /**
+     * @return string|bool
+     * @throws ServerNotAvailableException
+     */
+    public function getGroupPrimaryGroupID(string $dn) {
+        return $this->getEntryGroupID($dn, 'primaryGroupToken');
+    }
+
+    /**
+     * @return string|bool
+     * @throws ServerNotAvailableException
+     */
+    public function getUserPrimaryGroupIDs(string $dn) {
+        $primaryGroupID = false;
+        if ($this->access->connection->hasPrimaryGroups) {
+            $primaryGroupID = $this->getEntryGroupID($dn, 'primaryGroupID');
+            if ($primaryGroupID === false) {
+                $this->access->connection->hasPrimaryGroups = false;
+            }
+        }
+        return $primaryGroupID;
+    }
+
+    /**
+     * @throws Exception
+     * @throws ServerNotAvailableException
+     */
+    private function prepareFilterForUsersInPrimaryGroup(string $groupDN, string $search = ''): string {
+        $groupID = $this->getGroupPrimaryGroupID($groupDN);
+        if ($groupID === false) {
+            throw new Exception('Not a valid group');
+        }
+
+        $filterParts = [];
+        $filterParts[] = $this->access->getFilterForUserCount();
+        if ($search !== '') {
+            $filterParts[] = $this->access->getFilterPartForUserSearch($search);
+        }
+        $filterParts[] = 'primaryGroupID=' . $groupID;
+
+        return $this->access->combineFilterWithAnd($filterParts);
+    }
+
+    /**
+     * @throws ServerNotAvailableException
+     */
+    public function getUsersInPrimaryGroup(
+        string $groupDN,
+        string $search = '',
+        ?int $limit = -1,
+        ?int $offset = 0
+    ): array {
+        try {
+            $filter = $this->prepareFilterForUsersInPrimaryGroup($groupDN, $search);
+            $users = $this->access->fetchListOfUsers(
+                $filter,
+                [$this->access->connection->ldapUserDisplayName, 'dn'],
+                $limit,
+                $offset
+            );
+            return $this->access->nextcloudUserNames($users);
+        } catch (ServerNotAvailableException $e) {
+            throw $e;
+        } catch (Exception $e) {
+            return [];
+        }
+    }
+
+    /**
+     * @throws ServerNotAvailableException
+     */
+    public function countUsersInPrimaryGroup(
+        string $groupDN,
+        string $search = '',
+        int $limit = -1,
+        int $offset = 0
+    ): int {
+        try {
+            $filter = $this->prepareFilterForUsersInPrimaryGroup($groupDN, $search);
+            $users = $this->access->countUsers($filter, ['dn'], $limit, $offset);
+            return (int)$users;
+        } catch (ServerNotAvailableException $e) {
+            throw $e;
+        } catch (Exception $e) {
+            return 0;
+        }
+    }
+
+    /**
+     * @return string|bool
+     * @throws ServerNotAvailableException
+     */
+    public function getUserPrimaryGroup(string $dn) {
+        $groupID = $this->getUserPrimaryGroupIDs($dn);
+        if ($groupID !== false) {
+            $groupName = $this->primaryGroupID2Name($groupID, $dn);
+            if ($groupName !== false) {
+                return $groupName;
+            }
+        }
+
+        return false;
+    }
+
+    /**
+     * This function fetches all groups a user belongs to. It does not check
+     * if the user exists at all.
+     *
+     * This function includes groups based on dynamic group membership.
+     *
+     * @param string $uid Name of the user
+     * @return array with group names
+     * @throws Exception
+     * @throws ServerNotAvailableException
+     */
+    public function getUserGroups($uid) {
+        if (!$this->enabled) {
+            return [];
+        }
+        $cacheKey = 'getUserGroups' . $uid;
+        $userGroups = $this->access->connection->getFromCache($cacheKey);
+        if (!is_null($userGroups)) {
+            return $userGroups;
+        }
+        $userDN = $this->access->username2dn($uid);
+        if (!$userDN) {
+            $this->access->connection->writeToCache($cacheKey, []);
+            return [];
+        }
+
+        $groups = [];
+        $primaryGroup = $this->getUserPrimaryGroup($userDN);
+        $gidGroupName = $this->getUserGroupByGid($userDN);
+
+        $dynamicGroupMemberURL = strtolower($this->access->connection->ldapDynamicGroupMemberURL);
+
+        if (!empty($dynamicGroupMemberURL)) {
+            // look through dynamic groups to add them to the result array if needed
+            $groupsToMatch = $this->access->fetchListOfGroups(
+                $this->access->connection->ldapGroupFilter, ['dn', $dynamicGroupMemberURL]);
+            foreach ($groupsToMatch as $dynamicGroup) {
+                if (!array_key_exists($dynamicGroupMemberURL, $dynamicGroup)) {
+                    continue;
+                }
+                $pos = strpos($dynamicGroup[$dynamicGroupMemberURL][0], '(');
+                if ($pos !== false) {
+                    $memberUrlFilter = substr($dynamicGroup[$dynamicGroupMemberURL][0], $pos);
+                    // apply filter via ldap search to see if this user is in this
+                    // dynamic group
+                    $userMatch = $this->access->readAttribute(
+                        $userDN,
+                        $this->access->connection->ldapUserDisplayName,
+                        $memberUrlFilter
+                    );
+                    if ($userMatch !== false) {
+                        // match found so this user is in this group
+                        $groupName = $this->access->dn2groupname($dynamicGroup['dn'][0]);
+                        if (is_string($groupName)) {
+                            // be sure to never return false if the dn could not be
+                            // resolved to a name, for whatever reason.
+                            $groups[] = $groupName;
+                        }
+                    }
+                } else {
+                    $this->logger->debug('No search filter found on member url of group {dn}',
+                        [
+                            'app' => 'user_ldap',
+                            'dn' => $dynamicGroup,
+                        ]
+                    );
+                }
+            }
+        }
+
+        // if possible, read out membership via memberOf. It's far faster than
+        // performing a search, which still is a fallback later.
+        // memberof doesn't support memberuid, so skip it here.
+        if ((int)$this->access->connection->hasMemberOfFilterSupport === 1
+            && (int)$this->access->connection->useMemberOfToDetectMembership === 1
+            && $this->ldapGroupMemberAssocAttr !== 'memberuid'
+            && $this->ldapGroupMemberAssocAttr !== 'zimbramailforwardingaddress') {
+            $groupDNs = $this->_getGroupDNsFromMemberOf($userDN);
+            if (is_array($groupDNs)) {
+                foreach ($groupDNs as $dn) {
+                    $groupName = $this->access->dn2groupname($dn);
+                    if (is_string($groupName)) {
+                        // be sure to never return false if the dn could not be
+                        // resolved to a name, for whatever reason.
+                        $groups[] = $groupName;
+                    }
+                }
+            }
+
+            if ($primaryGroup !== false) {
+                $groups[] = $primaryGroup;
+            }
+            if ($gidGroupName !== false) {
+                $groups[] = $gidGroupName;
+            }
+            $this->access->connection->writeToCache($cacheKey, $groups);
+            return $groups;
+        }
+
+        //uniqueMember takes DN, memberuid the uid, so we need to distinguish
+        switch ($this->ldapGroupMemberAssocAttr) {
+            case 'uniquemember':
+            case 'member':
+                $uid = $userDN;
+                break;
+
+            case 'memberuid':
+            case 'zimbramailforwardingaddress':
+                $result = $this->access->readAttribute($userDN, 'uid');
+                if ($result === false) {
+                    $this->logger->debug('No uid attribute found for DN {dn} on {host}',
+                        [
+                            'app' => 'user_ldap',
+                            'dn' => $userDN,
+                            'host' => $this->access->connection->ldapHost,
+                        ]
+                    );
+                    $uid = false;
+                } else {
+                    $uid = $result[0];
+                }
+                break;
+
+            default:
+                // just in case
+                $uid = $userDN;
+                break;
+        }
+
+        if ($uid !== false) {
+            if (isset($this->cachedGroupsByMember[$uid])) {
+                $groups = array_merge($groups, $this->cachedGroupsByMember[$uid]);
+            } else {
+                $groupsByMember = array_values($this->getGroupsByMember($uid));
+                $groupsByMember = $this->access->nextcloudGroupNames($groupsByMember);
+                $this->cachedGroupsByMember[$uid] = $groupsByMember;
+                $groups = array_merge($groups, $groupsByMember);
+            }
+        }
+
+        if ($primaryGroup !== false) {
+            $groups[] = $primaryGroup;
+        }
+        if ($gidGroupName !== false) {
+            $groups[] = $gidGroupName;
+        }
+
+        $groups = array_unique($groups, SORT_LOCALE_STRING);
+        $this->access->connection->writeToCache($cacheKey, $groups);
+
+        return $groups;
+    }
+
+    /**
+     * @throws ServerNotAvailableException
+     */
+    private function getGroupsByMember(string $dn, array &$seen = null): array {
+        if ($seen === null) {
+            $seen = [];
+        }
+        if (array_key_exists($dn, $seen)) {
+            // avoid loops
+            return [];
+        }
+        $allGroups = [];
+        $seen[$dn] = true;
+        $filter = $this->access->connection->ldapGroupMemberAssocAttr . '=' . $dn;
+
+        if ($this->ldapGroupMemberAssocAttr === 'zimbramailforwardingaddress') {
+            //in this case the member entries are email addresses
+            $filter .= '@*';
+        }
+
+        $groups = $this->access->fetchListOfGroups($filter,
+            [strtolower($this->access->connection->ldapGroupMemberAssocAttr), $this->access->connection->ldapGroupDisplayName, 'dn']);
+        if (is_array($groups)) {
+            $fetcher = function ($dn, &$seen) {
+                if (is_array($dn) && isset($dn['dn'][0])) {
+                    $dn = $dn['dn'][0];
+                }
+                return $this->getGroupsByMember($dn, $seen);
+            };
+
+            if (empty($dn)) {
+                $dn = "";
+            }
+
+            $allGroups = $this->walkNestedGroups($dn, $fetcher, $groups);
+        }
+        $visibleGroups = $this->filterValidGroups($allGroups);
+        return array_intersect_key($allGroups, $visibleGroups);
+    }
+
+    /**
+     * get a list of all users in a group
+     *
+     * @param string $gid
+     * @param string $search
+     * @param int $limit
+     * @param int $offset
+     * @return array with user ids
+     * @throws Exception
+     * @throws ServerNotAvailableException
+     */
+    public function usersInGroup($gid, $search = '', $limit = -1, $offset = 0) {
+        if (!$this->enabled) {
+            return [];
+        }
+        if (!$this->groupExists($gid)) {
+            return [];
+        }
+        $search = $this->access->escapeFilterPart($search, true);
+        $cacheKey = 'usersInGroup-' . $gid . '-' . $search . '-' . $limit . '-' . $offset;
+        // check for cache of the exact query
+        $groupUsers = $this->access->connection->getFromCache($cacheKey);
+        if (!is_null($groupUsers)) {
+            return $groupUsers;
+        }
+
+        if ($limit === -1) {
+            $limit = null;
+        }
+        // check for cache of the query without limit and offset
+        $groupUsers = $this->access->connection->getFromCache('usersInGroup-' . $gid . '-' . $search);
+        if (!is_null($groupUsers)) {
+            $groupUsers = array_slice($groupUsers, $offset, $limit);
+            $this->access->connection->writeToCache($cacheKey, $groupUsers);
+            return $groupUsers;
+        }
+
+        $groupDN = $this->access->groupname2dn($gid);
+        if (!$groupDN) {
+            // group couldn't be found, return empty resultset
+            $this->access->connection->writeToCache($cacheKey, []);
+            return [];
+        }
+
+        $primaryUsers = $this->getUsersInPrimaryGroup($groupDN, $search, $limit, $offset);
+        $posixGroupUsers = $this->getUsersInGidNumber($groupDN, $search, $limit, $offset);
+        $members = $this->_groupMembers($groupDN);
+        if (!$members && empty($posixGroupUsers) && empty($primaryUsers)) {
+            //in case users could not be retrieved, return empty result set
+            $this->access->connection->writeToCache($cacheKey, []);
+            return [];
+        }
+
+        $groupUsers = [];
+        $attrs = $this->access->userManager->getAttributes(true);
+        foreach ($members as $member) {
+            switch ($this->ldapGroupMemberAssocAttr) {
+                case 'zimbramailforwardingaddress':
+                    //we get email addresses and need to convert them to uids
+                    $parts = explode('@', $member);
+                    $member = $parts[0];
+                    //no break needed because we just needed to remove the email part and now we have uids
+                case 'memberuid':
+                    //we got uids, need to get their DNs to 'translate' them to user names
+                    $filter = $this->access->combineFilterWithAnd([
+                        str_replace('%uid', trim($member), $this->access->connection->ldapLoginFilter),
+                        $this->access->combineFilterWithAnd([
+                            $this->access->getFilterPartForUserSearch($search),
+                            $this->access->connection->ldapUserFilter
+                        ])
+                    ]);
+                    $ldap_users = $this->access->fetchListOfUsers($filter, $attrs, 1);
+                    if (count($ldap_users) < 1) {
+                        continue;
+                    }
+                    $groupUsers[] = $this->access->dn2username($ldap_users[0]['dn'][0]);
+                    break;
+                default:
+                    //we got DNs, check if we need to filter by search or we can give back all of them
+                    $uid = $this->access->dn2username($member);
+                    if (!$uid) {
+                        continue;
+                    }
+
+                    $cacheKey = 'userExistsOnLDAP' . $uid;
+                    $userExists = $this->access->connection->getFromCache($cacheKey);
+                    if ($userExists === false) {
+                        continue;
+                    }
+                    if ($userExists === null || $search !== '') {
+                        if (!$this->access->readAttribute($member,
+                            $this->access->connection->ldapUserDisplayName,
+                            $this->access->combineFilterWithAnd([
+                                $this->access->getFilterPartForUserSearch($search),
+                                $this->access->connection->ldapUserFilter
+                            ]))) {
+                            if ($search === '') {
+                                $this->access->connection->writeToCache($cacheKey, false);
+                            }
+                            continue;
+                        }
+                        $this->access->connection->writeToCache($cacheKey, true);
+                    }
+                    $groupUsers[] = $uid;
+                    break;
+            }
+        }
+
+        $groupUsers = array_unique(array_merge($groupUsers, $primaryUsers, $posixGroupUsers));
+        natsort($groupUsers);
+        $this->access->connection->writeToCache('usersInGroup-' . $gid . '-' . $search, $groupUsers);
+        $groupUsers = array_slice($groupUsers, $offset, $limit);
+
+        $this->access->connection->writeToCache($cacheKey, $groupUsers);
+
+        return $groupUsers;
+    }
+
+    /**
+     * returns the number of users in a group, who match the search term
+     *
+     * @param string $gid the internal group name
+     * @param string $search optional, a search string
+     * @return int|bool
+     * @throws Exception
+     * @throws ServerNotAvailableException
+     */
+    public function countUsersInGroup($gid, $search = '') {
+        if ($this->groupPluginManager->implementsActions(GroupInterface::COUNT_USERS)) {
+            return $this->groupPluginManager->countUsersInGroup($gid, $search);
+        }
+
+        $cacheKey = 'countUsersInGroup-' . $gid . '-' . $search;
+        if (!$this->enabled || !$this->groupExists($gid)) {
+            return false;
+        }
+        $groupUsers = $this->access->connection->getFromCache($cacheKey);
+        if (!is_null($groupUsers)) {
+            return $groupUsers;
+        }
+
+        $groupDN = $this->access->groupname2dn($gid);
+        if (!$groupDN) {
+            // group couldn't be found, return empty result set
+            $this->access->connection->writeToCache($cacheKey, false);
+            return false;
+        }
+
+        $members = $this->_groupMembers($groupDN);
+        $primaryUserCount = $this->countUsersInPrimaryGroup($groupDN, '');
+        if (!$members && $primaryUserCount === 0) {
+            //in case users could not be retrieved, return empty result set
+            $this->access->connection->writeToCache($cacheKey, false);
+            return false;
+        }
+
+        if ($search === '') {
+            $groupUsers = count($members) + $primaryUserCount;
+            $this->access->connection->writeToCache($cacheKey, $groupUsers);
+            return $groupUsers;
+        }
+        $search = $this->access->escapeFilterPart($search, true);
+        $isMemberUid =
+            ($this->ldapGroupMemberAssocAttr === 'memberuid' ||
+                $this->ldapGroupMemberAssocAttr === 'zimbramailforwardingaddress');
+
+        //we need to apply the search filter
+        //alternatives that need to be checked:
+        //a) get all users by search filter and array_intersect them
+        //b) a, but only when less than 1k 10k ?k users like it is
+        //c) put all DNs|uids in a LDAP filter, combine with the search string
+        //   and let it count.
+        //For now this is not important, because the only use of this method
+        //does not supply a search string
+        $groupUsers = [];
+        foreach ($members as $member) {
+            if ($isMemberUid) {
+                if ($this->ldapGroupMemberAssocAttr === 'zimbramailforwardingaddress') {
+                    //we get email addresses and need to convert them to uids
+                    $parts = explode('@', $member);
+                    $member = $parts[0];
+                }
+                //we got uids, need to get their DNs to 'translate' them to user names
+                $filter = $this->access->combineFilterWithAnd([
+                    str_replace('%uid', $member, $this->access->connection->ldapLoginFilter),
+                    $this->access->getFilterPartForUserSearch($search)
+                ]);
+                $ldap_users = $this->access->fetchListOfUsers($filter, ['dn'], 1);
+                if (count($ldap_users) < 1) {
+                    continue;
+                }
+                $groupUsers[] = $this->access->dn2username($ldap_users[0]);
+            } else {
+                //we need to apply the search filter now
+                if (!$this->access->readAttribute($member,
+                    $this->access->connection->ldapUserDisplayName,
+                    $this->access->getFilterPartForUserSearch($search))) {
+                    continue;
+                }
+                // dn2username will also check if the users belong to the allowed base
+                if ($ncGroupId = $this->access->dn2username($member)) {
+                    $groupUsers[] = $ncGroupId;
+                }
+            }
+        }
+
+        //and get users that have the group as primary
+        $primaryUsers = $this->countUsersInPrimaryGroup($groupDN, $search);
+
+        return count($groupUsers) + $primaryUsers;
+    }
+
+    /**
+     * get a list of all groups using a paged search
+     *
+     * @param string $search
+     * @param int $limit
+     * @param int $offset
+     * @return array with group names
+     *
+     * Returns a list with all groups
+     * Uses a paged search if available to override a
+     * server side search limit.
+     * (active directory has a limit of 1000 by default)
+     * @throws Exception
+     */
+    public function getGroups($search = '', $limit = -1, $offset = 0) {
+        if (!$this->enabled) {
+            return [];
+        }
+        $cacheKey = 'getGroups-' . $search . '-' . $limit . '-' . $offset;
+
+        //Check cache before driving unnecessary searches
+        $ldap_groups = $this->access->connection->getFromCache($cacheKey);
+        if (!is_null($ldap_groups)) {
+            return $ldap_groups;
+        }
+
+        // if we'd pass -1 to LDAP search, we'd end up in a Protocol
+        // error. With a limit of 0, we get 0 results. So we pass null.
+        if ($limit <= 0) {
+            $limit = null;
+        }
+        $filter = $this->access->combineFilterWithAnd([
+            $this->access->connection->ldapGroupFilter,
+            $this->access->getFilterPartForGroupSearch($search)
+        ]);
+        $ldap_groups = $this->access->fetchListOfGroups($filter,
+            [$this->access->connection->ldapGroupDisplayName, 'dn'],
+            $limit,
+            $offset);
+        $ldap_groups = $this->access->nextcloudGroupNames($ldap_groups);
+
+        $this->access->connection->writeToCache($cacheKey, $ldap_groups);
+        return $ldap_groups;
+    }
+
+    /**
+     * check if a group exists
+     *
+     * @param string $gid
+     * @return bool
+     * @throws ServerNotAvailableException
+     */
+    public function groupExists($gid) {
+        $groupExists = $this->access->connection->getFromCache('groupExists' . $gid);
+        if (!is_null($groupExists)) {
+            return (bool)$groupExists;
+        }
+
+        //getting dn, if false the group does not exist. If dn, it may be mapped
+        //only, requires more checking.
+        $dn = $this->access->groupname2dn($gid);
+        if (!$dn) {
+            $this->access->connection->writeToCache('groupExists' . $gid, false);
+            return false;
+        }
+
+        if (!$this->access->isDNPartOfBase($dn, $this->access->connection->ldapBaseGroups)) {
+            $this->access->connection->writeToCache('groupExists' . $gid, false);
+            return false;
+        }
+
+        //if group really still exists, we will be able to read its objectClass
+        if (!is_array($this->access->readAttribute($dn, '', $this->access->connection->ldapGroupFilter))) {
+            $this->access->connection->writeToCache('groupExists' . $gid, false);
+            return false;
+        }
+
+        $this->access->connection->writeToCache('groupExists' . $gid, true);
+        return true;
+    }
+
+    /**
+     * @throws ServerNotAvailableException
+     * @throws Exception
+     */
+    protected function filterValidGroups(array $listOfGroups): array {
+        $validGroupDNs = [];
+        foreach ($listOfGroups as $key => $item) {
+            $dn = is_string($item) ? $item : $item['dn'][0];
+            $gid = $this->access->dn2groupname($dn);
+            if (!$gid) {
+                continue;
+            }
+            if ($this->groupExists($gid)) {
+                $validGroupDNs[$key] = $item;
+            }
+        }
+        return $validGroupDNs;
+    }
+
+    /**
+     * Check if backend implements actions
+     *
+     * @param int $actions bitwise-or'ed actions
+     * @return boolean
+     *
+     * Returns the supported actions as int to be
+     * compared with GroupInterface::CREATE_GROUP etc.
+     */
+    public function implementsActions($actions) {
+        return (bool)((GroupInterface::COUNT_USERS |
+                $this->groupPluginManager->getImplementedActions()) & $actions);
+    }
+
+    /**
+     * Return access for LDAP interaction.
+     *
+     * @return Access instance of Access for LDAP interaction
+     */
+    public function getLDAPAccess($gid) {
+        return $this->access;
+    }
+
+    /**
+     * create a group
+     *
+     * @param string $gid
+     * @return bool
+     * @throws Exception
+     * @throws ServerNotAvailableException
+     */
+    public function createGroup($gid) {
+        if ($this->groupPluginManager->implementsActions(GroupInterface::CREATE_GROUP)) {
+            if ($dn = $this->groupPluginManager->createGroup($gid)) {
+                //updates group mapping
+                $uuid = $this->access->getUUID($dn, false);
+                if (is_string($uuid)) {
+                    $this->access->mapAndAnnounceIfApplicable(
+                        $this->access->getGroupMapper(),
+                        $dn,
+                        $gid,
+                        $uuid,
+                        false
+                    );
+                    $this->access->cacheGroupExists($gid);
+                }
+            }
+            return $dn != null;
+        }
+        throw new Exception('Could not create group in LDAP backend.');
+    }
+
+    /**
+     * delete a group
+     *
+     * @param string $gid gid of the group to delete
+     * @return bool
+     * @throws Exception
+     */
+    public function deleteGroup($gid) {
+        if ($this->groupPluginManager->implementsActions(GroupInterface::DELETE_GROUP)) {
+            if ($ret = $this->groupPluginManager->deleteGroup($gid)) {
+                #delete group in nextcloud internal db
+                $this->access->getGroupMapper()->unmap($gid);
+                $this->access->connection->writeToCache("groupExists" . $gid, false);
+            }
+            return $ret;
+        }
+        throw new Exception('Could not delete group in LDAP backend.');
+    }
+
+    /**
+     * Add a user to a group
+     *
+     * @param string $uid Name of the user to add to group
+     * @param string $gid Name of the group in which add the user
+     * @return bool
+     * @throws Exception
+     */
+    public function addToGroup($uid, $gid) {
+        if ($this->groupPluginManager->implementsActions(GroupInterface::ADD_TO_GROUP)) {
+            if ($ret = $this->groupPluginManager->addToGroup($uid, $gid)) {
+                $this->access->connection->clearCache();
+                unset($this->cachedGroupMembers[$gid]);
+            }
+            return $ret;
+        }
+        throw new Exception('Could not add user to group in LDAP backend.');
+    }
+
+    /**
+     * Removes a user from a group
+     *
+     * @param string $uid Name of the user to remove from group
+     * @param string $gid Name of the group from which remove the user
+     * @return bool
+     * @throws Exception
+     */
+    public function removeFromGroup($uid, $gid) {
+        if ($this->groupPluginManager->implementsActions(GroupInterface::REMOVE_FROM_GROUP)) {
+            if ($ret = $this->groupPluginManager->removeFromGroup($uid, $gid)) {
+                $this->access->connection->clearCache();
+                unset($this->cachedGroupMembers[$gid]);
+            }
+            return $ret;
+        }
+        throw new Exception('Could not remove user from group in LDAP backend.');
+    }
+
+    /**
+     * Gets group details
+     *
+     * @param string $gid Name of the group
+     * @return array|false
+     * @throws Exception
+     */
+    public function getGroupDetails($gid) {
+        if ($this->groupPluginManager->implementsActions(GroupInterface::GROUP_DETAILS)) {
+            return $this->groupPluginManager->getGroupDetails($gid);
+        }
+        throw new Exception('Could not get group details in LDAP backend.');
+    }
+
+    /**
+     * Return LDAP connection resource from a cloned connection.
+     * The cloned connection needs to be closed manually.
+     * of the current access.
+     *
+     * @param string $gid
+     * @return resource of the LDAP connection
+     * @throws ServerNotAvailableException
+     */
+    public function getNewLDAPConnection($gid) {
+        $connection = clone $this->access->getConnection();
+        return $connection->getConnectionResource();
+    }
+
+    /**
+     * @throws ServerNotAvailableException
+     */
+    public function getDisplayName(string $gid): string {
+        if ($this->groupPluginManager instanceof IGetDisplayNameBackend) {
+            return $this->groupPluginManager->getDisplayName($gid);
+        }
+
+        $cacheKey = 'group_getDisplayName' . $gid;
+        if (!is_null($displayName = $this->access->connection->getFromCache($cacheKey))) {
+            return $displayName;
+        }
+
+        $displayName = $this->access->readAttribute(
+            $this->access->groupname2dn($gid),
+            $this->access->connection->ldapGroupDisplayName);
+
+        if ($displayName && (count($displayName) > 0)) {
+            $displayName = $displayName[0];
+            $this->access->connection->writeToCache($cacheKey, $displayName);
+            return $displayName;
+        }
+
+        return '';
+    }
 }

Spacing +34 added lines, -34 removed lines

@@ -101,10 +101,10 @@ 
 		if (!$this->enabled) {
 			return false;
 		}
-		$cacheKey = 'inGroup' . $uid . ':' . $gid;
+		$cacheKey = 'inGroup'.$uid.':'.$gid;
 		$inGroup = $this->access->connection->getFromCache($cacheKey);
 		if (!is_null($inGroup)) {
-			return (bool)$inGroup;
+			return (bool) $inGroup;
 		}
 
 		$userDN = $this->access->username2dn($uid);
@@ -113,7 +113,7 @@ 
 			return in_array($userDN, $this->cachedGroupMembers[$gid]);
 		}
 
-		$cacheKeyMembers = 'inGroup-members:' . $gid;
+		$cacheKeyMembers = 'inGroup-members:'.$gid;
 		$members = $this->access->connection->getFromCache($cacheKeyMembers);
 		if (!is_null($members)) {
 			$this->cachedGroupMembers[$gid] = $members;
@@ -241,7 +241,7 @@ 
 			return [];
 		}
 		// used extensively in cron job, caching makes sense for nested groups
-		$cacheKey = '_groupMembers' . $dnGroup;
+		$cacheKey = '_groupMembers'.$dnGroup;
 		$groupMembers = $this->access->connection->getFromCache($cacheKey);
 		if ($groupMembers !== null) {
 			return $groupMembers;
@@ -249,7 +249,7 @@ 
 		$seen[$dnGroup] = 1;
 		$members = $this->access->readAttribute($dnGroup, $this->access->connection->ldapGroupMemberAssocAttr);
 		if (is_array($members)) {
-			$fetcher = function ($memberDN, &$seen) {
+			$fetcher = function($memberDN, &$seen) {
 				return $this->_groupMembers($memberDN, $seen);
 			};
 			$allMembers = $this->walkNestedGroups($dnGroup, $fetcher, $members);
@@ -270,7 +270,7 @@ 
 			return [];
 		}
 
-		$fetcher = function ($groupDN) {
+		$fetcher = function($groupDN) {
 			if (isset($this->cachedNestedGroups[$groupDN])) {
 				$nestedGroups = $this->cachedNestedGroups[$groupDN];
 			} else {
@@ -288,7 +288,7 @@ 
 	}
 
 	private function walkNestedGroups(string $dn, Closure $fetcher, array $list): array {
-		$nesting = (int)$this->access->connection->ldapNestedGroups;
+		$nesting = (int) $this->access->connection->ldapNestedGroups;
 		// depending on the input, we either have a list of DNs or a list of LDAP records
 		// also, the output expects either DNs or records. Testing the first element should suffice.
 		$recordMode = is_array($list) && isset($list[0]) && is_array($list[0]) && isset($list[0]['dn'][0]);
@@ -296,7 +296,7 @@ 
 		if ($nesting !== 1) {
 			if ($recordMode) {
 				// the keys are numeric, but should hold the DN
-				return array_reduce($list, function ($transformed, $record) use ($dn) {
+				return array_reduce($list, function($transformed, $record) use ($dn) {
 					if ($record['dn'][0] != $dn) {
 						$transformed[$record['dn'][0]] = $record;
 					}
@@ -329,7 +329,7 @@ 
 	 * @throws ServerNotAvailableException
 	 */
 	public function gidNumber2Name(string $gid, string $dn) {
-		$cacheKey = 'gidNumberToName' . $gid;
+		$cacheKey = 'gidNumberToName'.$gid;
 		$groupName = $this->access->connection->getFromCache($cacheKey);
 		if (!is_null($groupName) && isset($groupName)) {
 			return $groupName;
@@ -339,7 +339,7 @@ 
 		$filter = $this->access->combineFilterWithAnd([
 			$this->access->connection->ldapGroupFilter,
 			'objectClass=posixGroup',
-			$this->access->connection->ldapGidNumber . '=' . $gid
+			$this->access->connection->ldapGidNumber.'='.$gid
 		]);
 		return $this->getNameOfGroup($filter, $cacheKey) ?? false;
 	}
@@ -419,7 +419,7 @@ 
 		if ($search !== '') {
 			$filterParts[] = $this->access->getFilterPartForUserSearch($search);
 		}
-		$filterParts[] = $this->access->connection->ldapGidNumber . '=' . $groupID;
+		$filterParts[] = $this->access->connection->ldapGidNumber.'='.$groupID;
 
 		return $this->access->combineFilterWithAnd($filterParts);
 	}
@@ -489,7 +489,7 @@ 
 		//we need to get the DN from LDAP
 		$filter = $this->access->combineFilterWithAnd([
 			$this->access->connection->ldapGroupFilter,
-			'objectsid=' . $domainObjectSid . '-' . $gid
+			'objectsid='.$domainObjectSid.'-'.$gid
 		]);
 		return $this->getNameOfGroup($filter, $cacheKey) ?? false;
 	}
@@ -546,7 +546,7 @@ 
 		if ($search !== '') {
 			$filterParts[] = $this->access->getFilterPartForUserSearch($search);
 		}
-		$filterParts[] = 'primaryGroupID=' . $groupID;
+		$filterParts[] = 'primaryGroupID='.$groupID;
 
 		return $this->access->combineFilterWithAnd($filterParts);
 	}
@@ -588,7 +588,7 @@ 
 		try {
 			$filter = $this->prepareFilterForUsersInPrimaryGroup($groupDN, $search);
 			$users = $this->access->countUsers($filter, ['dn'], $limit, $offset);
-			return (int)$users;
+			return (int) $users;
 		} catch (ServerNotAvailableException $e) {
 			throw $e;
 		} catch (Exception $e) {
@@ -627,7 +627,7 @@ 
 		if (!$this->enabled) {
 			return [];
 		}
-		$cacheKey = 'getUserGroups' . $uid;
+		$cacheKey = 'getUserGroups'.$uid;
 		$userGroups = $this->access->connection->getFromCache($cacheKey);
 		if (!is_null($userGroups)) {
 			return $userGroups;
@@ -685,8 +685,8 @@ 
 		// if possible, read out membership via memberOf. It's far faster than
 		// performing a search, which still is a fallback later.
 		// memberof doesn't support memberuid, so skip it here.
-		if ((int)$this->access->connection->hasMemberOfFilterSupport === 1
-			&& (int)$this->access->connection->useMemberOfToDetectMembership === 1
+		if ((int) $this->access->connection->hasMemberOfFilterSupport === 1
+			&& (int) $this->access->connection->useMemberOfToDetectMembership === 1
 			&& $this->ldapGroupMemberAssocAttr !== 'memberuid'
 			&& $this->ldapGroupMemberAssocAttr !== 'zimbramailforwardingaddress') {
 			$groupDNs = $this->_getGroupDNsFromMemberOf($userDN);
@@ -778,7 +778,7 @@ 
 		}
 		$allGroups = [];
 		$seen[$dn] = true;
-		$filter = $this->access->connection->ldapGroupMemberAssocAttr . '=' . $dn;
+		$filter = $this->access->connection->ldapGroupMemberAssocAttr.'='.$dn;
 
 		if ($this->ldapGroupMemberAssocAttr === 'zimbramailforwardingaddress') {
 			//in this case the member entries are email addresses
@@ -788,7 +788,7 @@ 
 		$groups = $this->access->fetchListOfGroups($filter,
 			[strtolower($this->access->connection->ldapGroupMemberAssocAttr), $this->access->connection->ldapGroupDisplayName, 'dn']);
 		if (is_array($groups)) {
-			$fetcher = function ($dn, &$seen) {
+			$fetcher = function($dn, &$seen) {
 				if (is_array($dn) && isset($dn['dn'][0])) {
 					$dn = $dn['dn'][0];
 				}
@@ -824,7 +824,7 @@ 
 			return [];
 		}
 		$search = $this->access->escapeFilterPart($search, true);
-		$cacheKey = 'usersInGroup-' . $gid . '-' . $search . '-' . $limit . '-' . $offset;
+		$cacheKey = 'usersInGroup-'.$gid.'-'.$search.'-'.$limit.'-'.$offset;
 		// check for cache of the exact query
 		$groupUsers = $this->access->connection->getFromCache($cacheKey);
 		if (!is_null($groupUsers)) {
@@ -835,7 +835,7 @@ 
 			$limit = null;
 		}
 		// check for cache of the query without limit and offset
-		$groupUsers = $this->access->connection->getFromCache('usersInGroup-' . $gid . '-' . $search);
+		$groupUsers = $this->access->connection->getFromCache('usersInGroup-'.$gid.'-'.$search);
 		if (!is_null($groupUsers)) {
 			$groupUsers = array_slice($groupUsers, $offset, $limit);
 			$this->access->connection->writeToCache($cacheKey, $groupUsers);
@@ -889,7 +889,7 @@ 
 						continue;
 					}
 
-					$cacheKey = 'userExistsOnLDAP' . $uid;
+					$cacheKey = 'userExistsOnLDAP'.$uid;
 					$userExists = $this->access->connection->getFromCache($cacheKey);
 					if ($userExists === false) {
 						continue;
@@ -915,7 +915,7 @@ 
 
 		$groupUsers = array_unique(array_merge($groupUsers, $primaryUsers, $posixGroupUsers));
 		natsort($groupUsers);
-		$this->access->connection->writeToCache('usersInGroup-' . $gid . '-' . $search, $groupUsers);
+		$this->access->connection->writeToCache('usersInGroup-'.$gid.'-'.$search, $groupUsers);
 		$groupUsers = array_slice($groupUsers, $offset, $limit);
 
 		$this->access->connection->writeToCache($cacheKey, $groupUsers);
@@ -937,7 +937,7 @@ 
 			return $this->groupPluginManager->countUsersInGroup($gid, $search);
 		}
 
-		$cacheKey = 'countUsersInGroup-' . $gid . '-' . $search;
+		$cacheKey = 'countUsersInGroup-'.$gid.'-'.$search;
 		if (!$this->enabled || !$this->groupExists($gid)) {
 			return false;
 		}
@@ -1035,7 +1035,7 @@ 
 		if (!$this->enabled) {
 			return [];
 		}
-		$cacheKey = 'getGroups-' . $search . '-' . $limit . '-' . $offset;
+		$cacheKey = 'getGroups-'.$search.'-'.$limit.'-'.$offset;
 
 		//Check cache before driving unnecessary searches
 		$ldap_groups = $this->access->connection->getFromCache($cacheKey);
@@ -1070,31 +1070,31 @@ 
 	 * @throws ServerNotAvailableException
 	 */
 	public function groupExists($gid) {
-		$groupExists = $this->access->connection->getFromCache('groupExists' . $gid);
+		$groupExists = $this->access->connection->getFromCache('groupExists'.$gid);
 		if (!is_null($groupExists)) {
-			return (bool)$groupExists;
+			return (bool) $groupExists;
 		}
 
 		//getting dn, if false the group does not exist. If dn, it may be mapped
 		//only, requires more checking.
 		$dn = $this->access->groupname2dn($gid);
 		if (!$dn) {
-			$this->access->connection->writeToCache('groupExists' . $gid, false);
+			$this->access->connection->writeToCache('groupExists'.$gid, false);
 			return false;
 		}
 
 		if (!$this->access->isDNPartOfBase($dn, $this->access->connection->ldapBaseGroups)) {
-			$this->access->connection->writeToCache('groupExists' . $gid, false);
+			$this->access->connection->writeToCache('groupExists'.$gid, false);
 			return false;
 		}
 
 		//if group really still exists, we will be able to read its objectClass
 		if (!is_array($this->access->readAttribute($dn, '', $this->access->connection->ldapGroupFilter))) {
-			$this->access->connection->writeToCache('groupExists' . $gid, false);
+			$this->access->connection->writeToCache('groupExists'.$gid, false);
 			return false;
 		}
 
-		$this->access->connection->writeToCache('groupExists' . $gid, true);
+		$this->access->connection->writeToCache('groupExists'.$gid, true);
 		return true;
 	}
 
@@ -1127,7 +1127,7 @@ 
 	 * compared with GroupInterface::CREATE_GROUP etc.
 	 */
 	public function implementsActions($actions) {
-		return (bool)((GroupInterface::COUNT_USERS |
+		return (bool) ((GroupInterface::COUNT_USERS |
 				$this->groupPluginManager->getImplementedActions()) & $actions);
 	}
 
@@ -1181,7 +1181,7 @@ 
 			if ($ret = $this->groupPluginManager->deleteGroup($gid)) {
 				#delete group in nextcloud internal db
 				$this->access->getGroupMapper()->unmap($gid);
-				$this->access->connection->writeToCache("groupExists" . $gid, false);
+				$this->access->connection->writeToCache("groupExists".$gid, false);
 			}
 			return $ret;
 		}
@@ -1262,7 +1262,7 @@ 
 			return $this->groupPluginManager->getDisplayName($gid);
 		}
 
-		$cacheKey = 'group_getDisplayName' . $gid;
+		$cacheKey = 'group_getDisplayName'.$gid;
 		if (!is_null($displayName = $this->access->connection->getFromCache($cacheKey))) {
 			return $displayName;
 		}

apps/user_ldap/lib/Wizard.php

Indentation +1314 added lines, -1314 removed lines

@@ -42,1318 +42,1318 @@
 use OCP\ILogger;
 
 class Wizard extends LDAPUtility {
-	/** @var \OCP\IL10N */
-	protected static $l;
-	protected $access;
-	protected $cr;
-	protected $configuration;
-	protected $result;
-	protected $resultCache = [];
-
-	public const LRESULT_PROCESSED_OK = 2;
-	public const LRESULT_PROCESSED_INVALID = 3;
-	public const LRESULT_PROCESSED_SKIP = 4;
-
-	public const LFILTER_LOGIN      = 2;
-	public const LFILTER_USER_LIST  = 3;
-	public const LFILTER_GROUP_LIST = 4;
-
-	public const LFILTER_MODE_ASSISTED = 2;
-	public const LFILTER_MODE_RAW = 1;
-
-	public const LDAP_NW_TIMEOUT = 4;
-
-	/**
-	 * Constructor
-	 * @param Configuration $configuration an instance of Configuration
-	 * @param ILDAPWrapper $ldap an instance of ILDAPWrapper
-	 * @param Access $access
-	 */
-	public function __construct(Configuration $configuration, ILDAPWrapper $ldap, Access $access) {
-		parent::__construct($ldap);
-		$this->configuration = $configuration;
-		if (is_null(Wizard::$l)) {
-			Wizard::$l = \OC::$server->getL10N('user_ldap');
-		}
-		$this->access = $access;
-		$this->result = new WizardResult();
-	}
-
-	public function __destruct() {
-		if ($this->result->hasChanges()) {
-			$this->configuration->saveConfiguration();
-		}
-	}
-
-	/**
-	 * counts entries in the LDAP directory
-	 *
-	 * @param string $filter the LDAP search filter
-	 * @param string $type a string being either 'users' or 'groups';
-	 * @return int
-	 * @throws \Exception
-	 */
-	public function countEntries(string $filter, string $type): int {
-		$reqs = ['ldapHost', 'ldapPort', 'ldapBase'];
-		if ($type === 'users') {
-			$reqs[] = 'ldapUserFilter';
-		}
-		if (!$this->checkRequirements($reqs)) {
-			throw new \Exception('Requirements not met', 400);
-		}
-
-		$attr = ['dn']; // default
-		$limit = 1001;
-		if ($type === 'groups') {
-			$result =  $this->access->countGroups($filter, $attr, $limit);
-		} elseif ($type === 'users') {
-			$result = $this->access->countUsers($filter, $attr, $limit);
-		} elseif ($type === 'objects') {
-			$result = $this->access->countObjects($limit);
-		} else {
-			throw new \Exception('Internal error: Invalid object type', 500);
-		}
-
-		return (int)$result;
-	}
-
-	/**
-	 * formats the return value of a count operation to the string to be
-	 * inserted.
-	 *
-	 * @param int $count
-	 * @return string
-	 */
-	private function formatCountResult(int $count): string {
-		if ($count > 1000) {
-			return '> 1000';
-		}
-		return (string)$count;
-	}
-
-	public function countGroups() {
-		$filter = $this->configuration->ldapGroupFilter;
-
-		if (empty($filter)) {
-			$output = self::$l->n('%s group found', '%s groups found', 0, [0]);
-			$this->result->addChange('ldap_group_count', $output);
-			return $this->result;
-		}
-
-		try {
-			$groupsTotal = $this->countEntries($filter, 'groups');
-		} catch (\Exception $e) {
-			//400 can be ignored, 500 is forwarded
-			if ($e->getCode() === 500) {
-				throw $e;
-			}
-			return false;
-		}
-		$output = self::$l->n(
-			'%s group found',
-			'%s groups found',
-			$groupsTotal,
-			[$this->formatCountResult($groupsTotal)]
-		);
-		$this->result->addChange('ldap_group_count', $output);
-		return $this->result;
-	}
-
-	/**
-	 * @return WizardResult
-	 * @throws \Exception
-	 */
-	public function countUsers() {
-		$filter = $this->access->getFilterForUserCount();
-
-		$usersTotal = $this->countEntries($filter, 'users');
-		$output = self::$l->n(
-			'%s user found',
-			'%s users found',
-			$usersTotal,
-			[$this->formatCountResult($usersTotal)]
-		);
-		$this->result->addChange('ldap_user_count', $output);
-		return $this->result;
-	}
-
-	/**
-	 * counts any objects in the currently set base dn
-	 *
-	 * @return WizardResult
-	 * @throws \Exception
-	 */
-	public function countInBaseDN() {
-		// we don't need to provide a filter in this case
-		$total = $this->countEntries('', 'objects');
-		if ($total === false) {
-			throw new \Exception('invalid results received');
-		}
-		$this->result->addChange('ldap_test_base', $total);
-		return $this->result;
-	}
-
-	/**
-	 * counts users with a specified attribute
-	 * @param string $attr
-	 * @param bool $existsCheck
-	 * @return int|bool
-	 */
-	public function countUsersWithAttribute($attr, $existsCheck = false) {
-		if (!$this->checkRequirements(['ldapHost',
-			'ldapPort',
-			'ldapBase',
-			'ldapUserFilter',
-		])) {
-			return  false;
-		}
-
-		$filter = $this->access->combineFilterWithAnd([
-			$this->configuration->ldapUserFilter,
-			$attr . '=*'
-		]);
-
-		$limit = ($existsCheck === false) ? null : 1;
-
-		return $this->access->countUsers($filter, ['dn'], $limit);
-	}
-
-	/**
-	 * detects the display name attribute. If a setting is already present that
-	 * returns at least one hit, the detection will be canceled.
-	 * @return WizardResult|bool
-	 * @throws \Exception
-	 */
-	public function detectUserDisplayNameAttribute() {
-		if (!$this->checkRequirements(['ldapHost',
-			'ldapPort',
-			'ldapBase',
-			'ldapUserFilter',
-		])) {
-			return  false;
-		}
-
-		$attr = $this->configuration->ldapUserDisplayName;
-		if ($attr !== '' && $attr !== 'displayName') {
-			// most likely not the default value with upper case N,
-			// verify it still produces a result
-			$count = (int)$this->countUsersWithAttribute($attr, true);
-			if ($count > 0) {
-				//no change, but we sent it back to make sure the user interface
-				//is still correct, even if the ajax call was cancelled meanwhile
-				$this->result->addChange('ldap_display_name', $attr);
-				return $this->result;
-			}
-		}
-
-		// first attribute that has at least one result wins
-		$displayNameAttrs = ['displayname', 'cn'];
-		foreach ($displayNameAttrs as $attr) {
-			$count = (int)$this->countUsersWithAttribute($attr, true);
-
-			if ($count > 0) {
-				$this->applyFind('ldap_display_name', $attr);
-				return $this->result;
-			}
-		}
-
-		throw new \Exception(self::$l->t('Could not detect user display name attribute. Please specify it yourself in advanced LDAP settings.'));
-	}
-
-	/**
-	 * detects the most often used email attribute for users applying to the
-	 * user list filter. If a setting is already present that returns at least
-	 * one hit, the detection will be canceled.
-	 * @return WizardResult|bool
-	 */
-	public function detectEmailAttribute() {
-		if (!$this->checkRequirements(['ldapHost',
-			'ldapPort',
-			'ldapBase',
-			'ldapUserFilter',
-		])) {
-			return  false;
-		}
-
-		$attr = $this->configuration->ldapEmailAttribute;
-		if ($attr !== '') {
-			$count = (int)$this->countUsersWithAttribute($attr, true);
-			if ($count > 0) {
-				return false;
-			}
-			$writeLog = true;
-		} else {
-			$writeLog = false;
-		}
-
-		$emailAttributes = ['mail', 'mailPrimaryAddress'];
-		$winner = '';
-		$maxUsers = 0;
-		foreach ($emailAttributes as $attr) {
-			$count = $this->countUsersWithAttribute($attr);
-			if ($count > $maxUsers) {
-				$maxUsers = $count;
-				$winner = $attr;
-			}
-		}
-
-		if ($winner !== '') {
-			$this->applyFind('ldap_email_attr', $winner);
-			if ($writeLog) {
-				\OCP\Util::writeLog('user_ldap', 'The mail attribute has ' .
-					'automatically been reset, because the original value ' .
-					'did not return any results.', ILogger::INFO);
-			}
-		}
-
-		return $this->result;
-	}
-
-	/**
-	 * @return WizardResult
-	 * @throws \Exception
-	 */
-	public function determineAttributes() {
-		if (!$this->checkRequirements(['ldapHost',
-			'ldapPort',
-			'ldapBase',
-			'ldapUserFilter',
-		])) {
-			return  false;
-		}
-
-		$attributes = $this->getUserAttributes();
-
-		natcasesort($attributes);
-		$attributes = array_values($attributes);
-
-		$this->result->addOptions('ldap_loginfilter_attributes', $attributes);
-
-		$selected = $this->configuration->ldapLoginFilterAttributes;
-		if (is_array($selected) && !empty($selected)) {
-			$this->result->addChange('ldap_loginfilter_attributes', $selected);
-		}
-
-		return $this->result;
-	}
-
-	/**
-	 * detects the available LDAP attributes
-	 * @return array|false The instance's WizardResult instance
-	 * @throws \Exception
-	 */
-	private function getUserAttributes() {
-		if (!$this->checkRequirements(['ldapHost',
-			'ldapPort',
-			'ldapBase',
-			'ldapUserFilter',
-		])) {
-			return  false;
-		}
-		$cr = $this->getConnection();
-		if (!$cr) {
-			throw new \Exception('Could not connect to LDAP');
-		}
-
-		$base = $this->configuration->ldapBase[0];
-		$filter = $this->configuration->ldapUserFilter;
-		$rr = $this->ldap->search($cr, $base, $filter, [], 1, 1);
-		if (!$this->ldap->isResource($rr)) {
-			return false;
-		}
-		$er = $this->ldap->firstEntry($cr, $rr);
-		$attributes = $this->ldap->getAttributes($cr, $er);
-		$pureAttributes = [];
-		for ($i = 0; $i < $attributes['count']; $i++) {
-			$pureAttributes[] = $attributes[$i];
-		}
-
-		return $pureAttributes;
-	}
-
-	/**
-	 * detects the available LDAP groups
-	 * @return WizardResult|false the instance's WizardResult instance
-	 */
-	public function determineGroupsForGroups() {
-		return $this->determineGroups('ldap_groupfilter_groups',
-									  'ldapGroupFilterGroups',
-									  false);
-	}
-
-	/**
-	 * detects the available LDAP groups
-	 * @return WizardResult|false the instance's WizardResult instance
-	 */
-	public function determineGroupsForUsers() {
-		return $this->determineGroups('ldap_userfilter_groups',
-									  'ldapUserFilterGroups');
-	}
-
-	/**
-	 * detects the available LDAP groups
-	 * @param string $dbKey
-	 * @param string $confKey
-	 * @param bool $testMemberOf
-	 * @return WizardResult|false the instance's WizardResult instance
-	 * @throws \Exception
-	 */
-	private function determineGroups($dbKey, $confKey, $testMemberOf = true) {
-		if (!$this->checkRequirements(['ldapHost',
-			'ldapPort',
-			'ldapBase',
-		])) {
-			return  false;
-		}
-		$cr = $this->getConnection();
-		if (!$cr) {
-			throw new \Exception('Could not connect to LDAP');
-		}
-
-		$this->fetchGroups($dbKey, $confKey);
-
-		if ($testMemberOf) {
-			$this->configuration->hasMemberOfFilterSupport = $this->testMemberOf();
-			$this->result->markChange();
-			if (!$this->configuration->hasMemberOfFilterSupport) {
-				throw new \Exception('memberOf is not supported by the server');
-			}
-		}
-
-		return $this->result;
-	}
-
-	/**
-	 * fetches all groups from LDAP and adds them to the result object
-	 *
-	 * @param string $dbKey
-	 * @param string $confKey
-	 * @return array $groupEntries
-	 * @throws \Exception
-	 */
-	public function fetchGroups($dbKey, $confKey) {
-		$obclasses = ['posixGroup', 'group', 'zimbraDistributionList', 'groupOfNames', 'groupOfUniqueNames'];
-
-		$filterParts = [];
-		foreach ($obclasses as $obclass) {
-			$filterParts[] = 'objectclass='.$obclass;
-		}
-		//we filter for everything
-		//- that looks like a group and
-		//- has the group display name set
-		$filter = $this->access->combineFilterWithOr($filterParts);
-		$filter = $this->access->combineFilterWithAnd([$filter, 'cn=*']);
-
-		$groupNames = [];
-		$groupEntries = [];
-		$limit = 400;
-		$offset = 0;
-		do {
-			// we need to request dn additionally here, otherwise memberOf
-			// detection will fail later
-			$result = $this->access->searchGroups($filter, ['cn', 'dn'], $limit, $offset);
-			foreach ($result as $item) {
-				if (!isset($item['cn']) && !is_array($item['cn']) && !isset($item['cn'][0])) {
-					// just in case - no issue known
-					continue;
-				}
-				$groupNames[] = $item['cn'][0];
-				$groupEntries[] = $item;
-			}
-			$offset += $limit;
-		} while ($this->access->hasMoreResults());
-
-		if (count($groupNames) > 0) {
-			natsort($groupNames);
-			$this->result->addOptions($dbKey, array_values($groupNames));
-		} else {
-			throw new \Exception(self::$l->t('Could not find the desired feature'));
-		}
-
-		$setFeatures = $this->configuration->$confKey;
-		if (is_array($setFeatures) && !empty($setFeatures)) {
-			//something is already configured? pre-select it.
-			$this->result->addChange($dbKey, $setFeatures);
-		}
-		return $groupEntries;
-	}
-
-	public function determineGroupMemberAssoc() {
-		if (!$this->checkRequirements(['ldapHost',
-			'ldapPort',
-			'ldapGroupFilter',
-		])) {
-			return  false;
-		}
-		$attribute = $this->detectGroupMemberAssoc();
-		if ($attribute === false) {
-			return false;
-		}
-		$this->configuration->setConfiguration(['ldapGroupMemberAssocAttr' => $attribute]);
-		$this->result->addChange('ldap_group_member_assoc_attribute', $attribute);
-
-		return $this->result;
-	}
-
-	/**
-	 * Detects the available object classes
-	 * @return WizardResult|false the instance's WizardResult instance
-	 * @throws \Exception
-	 */
-	public function determineGroupObjectClasses() {
-		if (!$this->checkRequirements(['ldapHost',
-			'ldapPort',
-			'ldapBase',
-		])) {
-			return  false;
-		}
-		$cr = $this->getConnection();
-		if (!$cr) {
-			throw new \Exception('Could not connect to LDAP');
-		}
-
-		$obclasses = ['groupOfNames', 'groupOfUniqueNames', 'group', 'posixGroup', '*'];
-		$this->determineFeature($obclasses,
-								'objectclass',
-								'ldap_groupfilter_objectclass',
-								'ldapGroupFilterObjectclass',
-								false);
-
-		return $this->result;
-	}
-
-	/**
-	 * detects the available object classes
-	 * @return WizardResult
-	 * @throws \Exception
-	 */
-	public function determineUserObjectClasses() {
-		if (!$this->checkRequirements(['ldapHost',
-			'ldapPort',
-			'ldapBase',
-		])) {
-			return  false;
-		}
-		$cr = $this->getConnection();
-		if (!$cr) {
-			throw new \Exception('Could not connect to LDAP');
-		}
-
-		$obclasses = ['inetOrgPerson', 'person', 'organizationalPerson',
-			'user', 'posixAccount', '*'];
-		$filter = $this->configuration->ldapUserFilter;
-		//if filter is empty, it is probably the first time the wizard is called
-		//then, apply suggestions.
-		$this->determineFeature($obclasses,
-								'objectclass',
-								'ldap_userfilter_objectclass',
-								'ldapUserFilterObjectclass',
-								empty($filter));
-
-		return $this->result;
-	}
-
-	/**
-	 * @return WizardResult|false
-	 * @throws \Exception
-	 */
-	public function getGroupFilter() {
-		if (!$this->checkRequirements(['ldapHost',
-			'ldapPort',
-			'ldapBase',
-		])) {
-			return false;
-		}
-		//make sure the use display name is set
-		$displayName = $this->configuration->ldapGroupDisplayName;
-		if ($displayName === '') {
-			$d = $this->configuration->getDefaults();
-			$this->applyFind('ldap_group_display_name',
-							 $d['ldap_group_display_name']);
-		}
-		$filter = $this->composeLdapFilter(self::LFILTER_GROUP_LIST);
-
-		$this->applyFind('ldap_group_filter', $filter);
-		return $this->result;
-	}
-
-	/**
-	 * @return WizardResult|false
-	 * @throws \Exception
-	 */
-	public function getUserListFilter() {
-		if (!$this->checkRequirements(['ldapHost',
-			'ldapPort',
-			'ldapBase',
-		])) {
-			return false;
-		}
-		//make sure the use display name is set
-		$displayName = $this->configuration->ldapUserDisplayName;
-		if ($displayName === '') {
-			$d = $this->configuration->getDefaults();
-			$this->applyFind('ldap_display_name', $d['ldap_display_name']);
-		}
-		$filter = $this->composeLdapFilter(self::LFILTER_USER_LIST);
-		if (!$filter) {
-			throw new \Exception('Cannot create filter');
-		}
-
-		$this->applyFind('ldap_userlist_filter', $filter);
-		return $this->result;
-	}
-
-	/**
-	 * @return bool|WizardResult
-	 * @throws \Exception
-	 */
-	public function getUserLoginFilter() {
-		if (!$this->checkRequirements(['ldapHost',
-			'ldapPort',
-			'ldapBase',
-			'ldapUserFilter',
-		])) {
-			return false;
-		}
-
-		$filter = $this->composeLdapFilter(self::LFILTER_LOGIN);
-		if (!$filter) {
-			throw new \Exception('Cannot create filter');
-		}
-
-		$this->applyFind('ldap_login_filter', $filter);
-		return $this->result;
-	}
-
-	/**
-	 * @return bool|WizardResult
-	 * @param string $loginName
-	 * @throws \Exception
-	 */
-	public function testLoginName($loginName) {
-		if (!$this->checkRequirements(['ldapHost',
-			'ldapPort',
-			'ldapBase',
-			'ldapLoginFilter',
-		])) {
-			return false;
-		}
-
-		$cr = $this->access->connection->getConnectionResource();
-		if (!$this->ldap->isResource($cr)) {
-			throw new \Exception('connection error');
-		}
-
-		if (mb_strpos($this->access->connection->ldapLoginFilter, '%uid', 0, 'UTF-8')
-			=== false) {
-			throw new \Exception('missing placeholder');
-		}
-
-		$users = $this->access->countUsersByLoginName($loginName);
-		if ($this->ldap->errno($cr) !== 0) {
-			throw new \Exception($this->ldap->error($cr));
-		}
-		$filter = str_replace('%uid', $loginName, $this->access->connection->ldapLoginFilter);
-		$this->result->addChange('ldap_test_loginname', $users);
-		$this->result->addChange('ldap_test_effective_filter', $filter);
-		return $this->result;
-	}
-
-	/**
-	 * Tries to determine the port, requires given Host, User DN and Password
-	 * @return WizardResult|false WizardResult on success, false otherwise
-	 * @throws \Exception
-	 */
-	public function guessPortAndTLS() {
-		if (!$this->checkRequirements(['ldapHost',
-		])) {
-			return false;
-		}
-		$this->checkHost();
-		$portSettings = $this->getPortSettingsToTry();
-
-		if (!is_array($portSettings)) {
-			throw new \Exception(print_r($portSettings, true));
-		}
-
-		//proceed from the best configuration and return on first success
-		foreach ($portSettings as $setting) {
-			$p = $setting['port'];
-			$t = $setting['tls'];
-			\OCP\Util::writeLog('user_ldap', 'Wiz: trying port '. $p . ', TLS '. $t, ILogger::DEBUG);
-			//connectAndBind may throw Exception, it needs to be catched by the
-			//callee of this method
-
-			try {
-				$settingsFound = $this->connectAndBind($p, $t);
-			} catch (\Exception $e) {
-				// any reply other than -1 (= cannot connect) is already okay,
-				// because then we found the server
-				// unavailable startTLS returns -11
-				if ($e->getCode() > 0) {
-					$settingsFound = true;
-				} else {
-					throw $e;
-				}
-			}
-
-			if ($settingsFound === true) {
-				$config = [
-					'ldapPort' => $p,
-					'ldapTLS' => (int)$t
-				];
-				$this->configuration->setConfiguration($config);
-				\OCP\Util::writeLog('user_ldap', 'Wiz: detected Port ' . $p, ILogger::DEBUG);
-				$this->result->addChange('ldap_port', $p);
-				return $this->result;
-			}
-		}
-
-		//custom port, undetected (we do not brute force)
-		return false;
-	}
-
-	/**
-	 * tries to determine a base dn from User DN or LDAP Host
-	 * @return WizardResult|false WizardResult on success, false otherwise
-	 */
-	public function guessBaseDN() {
-		if (!$this->checkRequirements(['ldapHost',
-			'ldapPort',
-		])) {
-			return false;
-		}
-
-		//check whether a DN is given in the agent name (99.9% of all cases)
-		$base = null;
-		$i = stripos($this->configuration->ldapAgentName, 'dc=');
-		if ($i !== false) {
-			$base = substr($this->configuration->ldapAgentName, $i);
-			if ($this->testBaseDN($base)) {
-				$this->applyFind('ldap_base', $base);
-				return $this->result;
-			}
-		}
-
-		//this did not help :(
-		//Let's see whether we can parse the Host URL and convert the domain to
-		//a base DN
-		$helper = new Helper(\OC::$server->getConfig());
-		$domain = $helper->getDomainFromURL($this->configuration->ldapHost);
-		if (!$domain) {
-			return false;
-		}
-
-		$dparts = explode('.', $domain);
-		while (count($dparts) > 0) {
-			$base2 = 'dc=' . implode(',dc=', $dparts);
-			if ($base !== $base2 && $this->testBaseDN($base2)) {
-				$this->applyFind('ldap_base', $base2);
-				return $this->result;
-			}
-			array_shift($dparts);
-		}
-
-		return false;
-	}
-
-	/**
-	 * sets the found value for the configuration key in the WizardResult
-	 * as well as in the Configuration instance
-	 * @param string $key the configuration key
-	 * @param string $value the (detected) value
-	 *
-	 */
-	private function applyFind($key, $value) {
-		$this->result->addChange($key, $value);
-		$this->configuration->setConfiguration([$key => $value]);
-	}
-
-	/**
-	 * Checks, whether a port was entered in the Host configuration
-	 * field. In this case the port will be stripped off, but also stored as
-	 * setting.
-	 */
-	private function checkHost() {
-		$host = $this->configuration->ldapHost;
-		$hostInfo = parse_url($host);
-
-		//removes Port from Host
-		if (is_array($hostInfo) && isset($hostInfo['port'])) {
-			$port = $hostInfo['port'];
-			$host = str_replace(':'.$port, '', $host);
-			$this->applyFind('ldap_host', $host);
-			$this->applyFind('ldap_port', $port);
-		}
-	}
-
-	/**
-	 * tries to detect the group member association attribute which is
-	 * one of 'uniqueMember', 'memberUid', 'member', 'gidNumber'
-	 * @return string|false, string with the attribute name, false on error
-	 * @throws \Exception
-	 */
-	private function detectGroupMemberAssoc() {
-		$possibleAttrs = ['uniqueMember', 'memberUid', 'member', 'gidNumber', 'zimbraMailForwardingAddress'];
-		$filter = $this->configuration->ldapGroupFilter;
-		if (empty($filter)) {
-			return false;
-		}
-		$cr = $this->getConnection();
-		if (!$cr) {
-			throw new \Exception('Could not connect to LDAP');
-		}
-		$base = $this->configuration->ldapBaseGroups[0] ?: $this->configuration->ldapBase[0];
-		$rr = $this->ldap->search($cr, $base, $filter, $possibleAttrs, 0, 1000);
-		if (!$this->ldap->isResource($rr)) {
-			return false;
-		}
-		$er = $this->ldap->firstEntry($cr, $rr);
-		while (is_resource($er)) {
-			$this->ldap->getDN($cr, $er);
-			$attrs = $this->ldap->getAttributes($cr, $er);
-			$result = [];
-			$possibleAttrsCount = count($possibleAttrs);
-			for ($i = 0; $i < $possibleAttrsCount; $i++) {
-				if (isset($attrs[$possibleAttrs[$i]])) {
-					$result[$possibleAttrs[$i]] = $attrs[$possibleAttrs[$i]]['count'];
-				}
-			}
-			if (!empty($result)) {
-				natsort($result);
-				return key($result);
-			}
-
-			$er = $this->ldap->nextEntry($cr, $er);
-		}
-
-		return false;
-	}
-
-	/**
-	 * Checks whether for a given BaseDN results will be returned
-	 * @param string $base the BaseDN to test
-	 * @return bool true on success, false otherwise
-	 * @throws \Exception
-	 */
-	private function testBaseDN($base) {
-		$cr = $this->getConnection();
-		if (!$cr) {
-			throw new \Exception('Could not connect to LDAP');
-		}
-
-		//base is there, let's validate it. If we search for anything, we should
-		//get a result set > 0 on a proper base
-		$rr = $this->ldap->search($cr, $base, 'objectClass=*', ['dn'], 0, 1);
-		if (!$this->ldap->isResource($rr)) {
-			$errorNo  = $this->ldap->errno($cr);
-			$errorMsg = $this->ldap->error($cr);
-			\OCP\Util::writeLog('user_ldap', 'Wiz: Could not search base '.$base.
-							' Error '.$errorNo.': '.$errorMsg, ILogger::INFO);
-			return false;
-		}
-		$entries = $this->ldap->countEntries($cr, $rr);
-		return ($entries !== false) && ($entries > 0);
-	}
-
-	/**
-	 * Checks whether the server supports memberOf in LDAP Filter.
-	 * Note: at least in OpenLDAP, availability of memberOf is dependent on
-	 * a configured objectClass. I.e. not necessarily for all available groups
-	 * memberOf does work.
-	 *
-	 * @return bool true if it does, false otherwise
-	 * @throws \Exception
-	 */
-	private function testMemberOf() {
-		$cr = $this->getConnection();
-		if (!$cr) {
-			throw new \Exception('Could not connect to LDAP');
-		}
-		$result = $this->access->countUsers('memberOf=*', ['memberOf'], 1);
-		if (is_int($result) &&  $result > 0) {
-			return true;
-		}
-		return false;
-	}
-
-	/**
-	 * creates an LDAP Filter from given configuration
-	 * @param integer $filterType int, for which use case the filter shall be created
-	 * can be any of self::LFILTER_USER_LIST, self::LFILTER_LOGIN or
-	 * self::LFILTER_GROUP_LIST
-	 * @return string|false string with the filter on success, false otherwise
-	 * @throws \Exception
-	 */
-	private function composeLdapFilter($filterType) {
-		$filter = '';
-		$parts = 0;
-		switch ($filterType) {
-			case self::LFILTER_USER_LIST:
-				$objcs = $this->configuration->ldapUserFilterObjectclass;
-				//glue objectclasses
-				if (is_array($objcs) && count($objcs) > 0) {
-					$filter .= '(|';
-					foreach ($objcs as $objc) {
-						$filter .= '(objectclass=' . $objc . ')';
-					}
-					$filter .= ')';
-					$parts++;
-				}
-				//glue group memberships
-				if ($this->configuration->hasMemberOfFilterSupport) {
-					$cns = $this->configuration->ldapUserFilterGroups;
-					if (is_array($cns) && count($cns) > 0) {
-						$filter .= '(|';
-						$cr = $this->getConnection();
-						if (!$cr) {
-							throw new \Exception('Could not connect to LDAP');
-						}
-						$base = $this->configuration->ldapBase[0];
-						foreach ($cns as $cn) {
-							$rr = $this->ldap->search($cr, $base, 'cn=' . $cn, ['dn', 'primaryGroupToken']);
-							if (!$this->ldap->isResource($rr)) {
-								continue;
-							}
-							$er = $this->ldap->firstEntry($cr, $rr);
-							$attrs = $this->ldap->getAttributes($cr, $er);
-							$dn = $this->ldap->getDN($cr, $er);
-							if ($dn === false || $dn === '') {
-								continue;
-							}
-							$filterPart = '(memberof=' . $dn . ')';
-							if (isset($attrs['primaryGroupToken'])) {
-								$pgt = $attrs['primaryGroupToken'][0];
-								$primaryFilterPart = '(primaryGroupID=' . $pgt .')';
-								$filterPart = '(|' . $filterPart . $primaryFilterPart . ')';
-							}
-							$filter .= $filterPart;
-						}
-						$filter .= ')';
-					}
-					$parts++;
-				}
-				//wrap parts in AND condition
-				if ($parts > 1) {
-					$filter = '(&' . $filter . ')';
-				}
-				if ($filter === '') {
-					$filter = '(objectclass=*)';
-				}
-				break;
-
-			case self::LFILTER_GROUP_LIST:
-				$objcs = $this->configuration->ldapGroupFilterObjectclass;
-				//glue objectclasses
-				if (is_array($objcs) && count($objcs) > 0) {
-					$filter .= '(|';
-					foreach ($objcs as $objc) {
-						$filter .= '(objectclass=' . $objc . ')';
-					}
-					$filter .= ')';
-					$parts++;
-				}
-				//glue group memberships
-				$cns = $this->configuration->ldapGroupFilterGroups;
-				if (is_array($cns) && count($cns) > 0) {
-					$filter .= '(|';
-					foreach ($cns as $cn) {
-						$filter .= '(cn=' . $cn . ')';
-					}
-					$filter .= ')';
-				}
-				$parts++;
-				//wrap parts in AND condition
-				if ($parts > 1) {
-					$filter = '(&' . $filter . ')';
-				}
-				break;
-
-			case self::LFILTER_LOGIN:
-				$ulf = $this->configuration->ldapUserFilter;
-				$loginpart = '=%uid';
-				$filterUsername = '';
-				$userAttributes = $this->getUserAttributes();
-				$userAttributes = array_change_key_case(array_flip($userAttributes));
-				$parts = 0;
-
-				if ($this->configuration->ldapLoginFilterUsername === '1') {
-					$attr = '';
-					if (isset($userAttributes['uid'])) {
-						$attr = 'uid';
-					} elseif (isset($userAttributes['samaccountname'])) {
-						$attr = 'samaccountname';
-					} elseif (isset($userAttributes['cn'])) {
-						//fallback
-						$attr = 'cn';
-					}
-					if ($attr !== '') {
-						$filterUsername = '(' . $attr . $loginpart . ')';
-						$parts++;
-					}
-				}
-
-				$filterEmail = '';
-				if ($this->configuration->ldapLoginFilterEmail === '1') {
-					$filterEmail = '(|(mailPrimaryAddress=%uid)(mail=%uid))';
-					$parts++;
-				}
-
-				$filterAttributes = '';
-				$attrsToFilter = $this->configuration->ldapLoginFilterAttributes;
-				if (is_array($attrsToFilter) && count($attrsToFilter) > 0) {
-					$filterAttributes = '(|';
-					foreach ($attrsToFilter as $attribute) {
-						$filterAttributes .= '(' . $attribute . $loginpart . ')';
-					}
-					$filterAttributes .= ')';
-					$parts++;
-				}
-
-				$filterLogin = '';
-				if ($parts > 1) {
-					$filterLogin = '(|';
-				}
-				$filterLogin .= $filterUsername;
-				$filterLogin .= $filterEmail;
-				$filterLogin .= $filterAttributes;
-				if ($parts > 1) {
-					$filterLogin .= ')';
-				}
-
-				$filter = '(&'.$ulf.$filterLogin.')';
-				break;
-		}
-
-		\OCP\Util::writeLog('user_ldap', 'Wiz: Final filter '.$filter, ILogger::DEBUG);
-
-		return $filter;
-	}
-
-	/**
-	 * Connects and Binds to an LDAP Server
-	 *
-	 * @param int $port the port to connect with
-	 * @param bool $tls whether startTLS is to be used
-	 * @return bool
-	 * @throws \Exception
-	 */
-	private function connectAndBind($port, $tls) {
-		//connect, does not really trigger any server communication
-		$host = $this->configuration->ldapHost;
-		$hostInfo = parse_url($host);
-		if (!$hostInfo) {
-			throw new \Exception(self::$l->t('Invalid Host'));
-		}
-		\OCP\Util::writeLog('user_ldap', 'Wiz: Attempting to connect ', ILogger::DEBUG);
-		$cr = $this->ldap->connect($host, $port);
-		if (!is_resource($cr)) {
-			throw new \Exception(self::$l->t('Invalid Host'));
-		}
-
-		//set LDAP options
-		$this->ldap->setOption($cr, LDAP_OPT_PROTOCOL_VERSION, 3);
-		$this->ldap->setOption($cr, LDAP_OPT_REFERRALS, 0);
-		$this->ldap->setOption($cr, LDAP_OPT_NETWORK_TIMEOUT, self::LDAP_NW_TIMEOUT);
-
-		try {
-			if ($tls) {
-				$isTlsWorking = @$this->ldap->startTls($cr);
-				if (!$isTlsWorking) {
-					return false;
-				}
-			}
-
-			\OCP\Util::writeLog('user_ldap', 'Wiz: Attemping to Bind ', ILogger::DEBUG);
-			//interesting part: do the bind!
-			$login = $this->ldap->bind($cr,
-				$this->configuration->ldapAgentName,
-				$this->configuration->ldapAgentPassword
-			);
-			$errNo = $this->ldap->errno($cr);
-			$error = ldap_error($cr);
-			$this->ldap->unbind($cr);
-		} catch (ServerNotAvailableException $e) {
-			return false;
-		}
-
-		if ($login === true) {
-			$this->ldap->unbind($cr);
-			\OCP\Util::writeLog('user_ldap', 'Wiz: Bind successful to Port '. $port . ' TLS ' . (int)$tls, ILogger::DEBUG);
-			return true;
-		}
-
-		if ($errNo === -1) {
-			//host, port or TLS wrong
-			return false;
-		}
-		throw new \Exception($error, $errNo);
-	}
-
-	/**
-	 * checks whether a valid combination of agent and password has been
-	 * provided (either two values or nothing for anonymous connect)
-	 * @return bool, true if everything is fine, false otherwise
-	 */
-	private function checkAgentRequirements() {
-		$agent = $this->configuration->ldapAgentName;
-		$pwd = $this->configuration->ldapAgentPassword;
-
-		return
-			($agent !== '' && $pwd !== '')
-			||  ($agent === '' && $pwd === '')
-		;
-	}
-
-	/**
-	 * @param array $reqs
-	 * @return bool
-	 */
-	private function checkRequirements($reqs) {
-		$this->checkAgentRequirements();
-		foreach ($reqs as $option) {
-			$value = $this->configuration->$option;
-			if (empty($value)) {
-				return false;
-			}
-		}
-		return true;
-	}
-
-	/**
-	 * does a cumulativeSearch on LDAP to get different values of a
-	 * specified attribute
-	 * @param string[] $filters array, the filters that shall be used in the search
-	 * @param string $attr the attribute of which a list of values shall be returned
-	 * @param int $dnReadLimit the amount of how many DNs should be analyzed.
-	 * The lower, the faster
-	 * @param string $maxF string. if not null, this variable will have the filter that
-	 * yields most result entries
-	 * @return array|false an array with the values on success, false otherwise
-	 */
-	public function cumulativeSearchOnAttribute($filters, $attr, $dnReadLimit = 3, &$maxF = null) {
-		$dnRead = [];
-		$foundItems = [];
-		$maxEntries = 0;
-		if (!is_array($this->configuration->ldapBase)
-		   || !isset($this->configuration->ldapBase[0])) {
-			return false;
-		}
-		$base = $this->configuration->ldapBase[0];
-		$cr = $this->getConnection();
-		if (!$this->ldap->isResource($cr)) {
-			return false;
-		}
-		$lastFilter = null;
-		if (isset($filters[count($filters)-1])) {
-			$lastFilter = $filters[count($filters)-1];
-		}
-		foreach ($filters as $filter) {
-			if ($lastFilter === $filter && count($foundItems) > 0) {
-				//skip when the filter is a wildcard and results were found
-				continue;
-			}
-			// 20k limit for performance and reason
-			$rr = $this->ldap->search($cr, $base, $filter, [$attr], 0, 20000);
-			if (!$this->ldap->isResource($rr)) {
-				continue;
-			}
-			$entries = $this->ldap->countEntries($cr, $rr);
-			$getEntryFunc = 'firstEntry';
-			if (($entries !== false) && ($entries > 0)) {
-				if (!is_null($maxF) && $entries > $maxEntries) {
-					$maxEntries = $entries;
-					$maxF = $filter;
-				}
-				$dnReadCount = 0;
-				do {
-					$entry = $this->ldap->$getEntryFunc($cr, $rr);
-					$getEntryFunc = 'nextEntry';
-					if (!$this->ldap->isResource($entry)) {
-						continue 2;
-					}
-					$rr = $entry; //will be expected by nextEntry next round
-					$attributes = $this->ldap->getAttributes($cr, $entry);
-					$dn = $this->ldap->getDN($cr, $entry);
-					if ($dn === false || in_array($dn, $dnRead)) {
-						continue;
-					}
-					$newItems = [];
-					$state = $this->getAttributeValuesFromEntry($attributes,
-																$attr,
-																$newItems);
-					$dnReadCount++;
-					$foundItems = array_merge($foundItems, $newItems);
-					$this->resultCache[$dn][$attr] = $newItems;
-					$dnRead[] = $dn;
-				} while (($state === self::LRESULT_PROCESSED_SKIP
-						|| $this->ldap->isResource($entry))
-						&& ($dnReadLimit === 0 || $dnReadCount < $dnReadLimit));
-			}
-		}
-
-		return array_unique($foundItems);
-	}
-
-	/**
-	 * determines if and which $attr are available on the LDAP server
-	 * @param string[] $objectclasses the objectclasses to use as search filter
-	 * @param string $attr the attribute to look for
-	 * @param string $dbkey the dbkey of the setting the feature is connected to
-	 * @param string $confkey the confkey counterpart for the $dbkey as used in the
-	 * Configuration class
-	 * @param bool $po whether the objectClass with most result entries
-	 * shall be pre-selected via the result
-	 * @return array|false list of found items.
-	 * @throws \Exception
-	 */
-	private function determineFeature($objectclasses, $attr, $dbkey, $confkey, $po = false) {
-		$cr = $this->getConnection();
-		if (!$cr) {
-			throw new \Exception('Could not connect to LDAP');
-		}
-		$p = 'objectclass=';
-		foreach ($objectclasses as $key => $value) {
-			$objectclasses[$key] = $p.$value;
-		}
-		$maxEntryObjC = '';
-
-		//how deep to dig?
-		//When looking for objectclasses, testing few entries is sufficient,
-		$dig = 3;
-
-		$availableFeatures =
-			$this->cumulativeSearchOnAttribute($objectclasses, $attr,
-											   $dig, $maxEntryObjC);
-		if (is_array($availableFeatures)
-		   && count($availableFeatures) > 0) {
-			natcasesort($availableFeatures);
-			//natcasesort keeps indices, but we must get rid of them for proper
-			//sorting in the web UI. Therefore: array_values
-			$this->result->addOptions($dbkey, array_values($availableFeatures));
-		} else {
-			throw new \Exception(self::$l->t('Could not find the desired feature'));
-		}
-
-		$setFeatures = $this->configuration->$confkey;
-		if (is_array($setFeatures) && !empty($setFeatures)) {
-			//something is already configured? pre-select it.
-			$this->result->addChange($dbkey, $setFeatures);
-		} elseif ($po && $maxEntryObjC !== '') {
-			//pre-select objectclass with most result entries
-			$maxEntryObjC = str_replace($p, '', $maxEntryObjC);
-			$this->applyFind($dbkey, $maxEntryObjC);
-			$this->result->addChange($dbkey, $maxEntryObjC);
-		}
-
-		return $availableFeatures;
-	}
-
-	/**
-	 * appends a list of values fr
-	 * @param resource $result the return value from ldap_get_attributes
-	 * @param string $attribute the attribute values to look for
-	 * @param array &$known new values will be appended here
-	 * @return int, state on of the class constants LRESULT_PROCESSED_OK,
-	 * LRESULT_PROCESSED_INVALID or LRESULT_PROCESSED_SKIP
-	 */
-	private function getAttributeValuesFromEntry($result, $attribute, &$known) {
-		if (!is_array($result)
-		   || !isset($result['count'])
-		   || !$result['count'] > 0) {
-			return self::LRESULT_PROCESSED_INVALID;
-		}
-
-		// strtolower on all keys for proper comparison
-		$result = \OCP\Util::mb_array_change_key_case($result);
-		$attribute = strtolower($attribute);
-		if (isset($result[$attribute])) {
-			foreach ($result[$attribute] as $key => $val) {
-				if ($key === 'count') {
-					continue;
-				}
-				if (!in_array($val, $known)) {
-					$known[] = $val;
-				}
-			}
-			return self::LRESULT_PROCESSED_OK;
-		} else {
-			return self::LRESULT_PROCESSED_SKIP;
-		}
-	}
-
-	/**
-	 * @return bool|mixed
-	 */
-	private function getConnection() {
-		if (!is_null($this->cr)) {
-			return $this->cr;
-		}
-
-		$cr = $this->ldap->connect(
-			$this->configuration->ldapHost,
-			$this->configuration->ldapPort
-		);
-
-		$this->ldap->setOption($cr, LDAP_OPT_PROTOCOL_VERSION, 3);
-		$this->ldap->setOption($cr, LDAP_OPT_REFERRALS, 0);
-		$this->ldap->setOption($cr, LDAP_OPT_NETWORK_TIMEOUT, self::LDAP_NW_TIMEOUT);
-		if ($this->configuration->ldapTLS === 1) {
-			$this->ldap->startTls($cr);
-		}
-
-		$lo = @$this->ldap->bind($cr,
-								 $this->configuration->ldapAgentName,
-								 $this->configuration->ldapAgentPassword);
-		if ($lo === true) {
-			$this->$cr = $cr;
-			return $cr;
-		}
-
-		return false;
-	}
-
-	/**
-	 * @return array
-	 */
-	private function getDefaultLdapPortSettings() {
-		static $settings = [
-			['port' => 7636, 'tls' => false],
-			['port' =>  636, 'tls' => false],
-			['port' => 7389, 'tls' => true],
-			['port' =>  389, 'tls' => true],
-			['port' => 7389, 'tls' => false],
-			['port' =>  389, 'tls' => false],
-		];
-		return $settings;
-	}
-
-	/**
-	 * @return array
-	 */
-	private function getPortSettingsToTry() {
-		//389 ← LDAP / Unencrypted or StartTLS
-		//636 ← LDAPS / SSL
-		//7xxx ← UCS. need to be checked first, because both ports may be open
-		$host = $this->configuration->ldapHost;
-		$port = (int)$this->configuration->ldapPort;
-		$portSettings = [];
-
-		//In case the port is already provided, we will check this first
-		if ($port > 0) {
-			$hostInfo = parse_url($host);
-			if (!(is_array($hostInfo)
-				&& isset($hostInfo['scheme'])
-				&& stripos($hostInfo['scheme'], 'ldaps') !== false)) {
-				$portSettings[] = ['port' => $port, 'tls' => true];
-			}
-			$portSettings[] =['port' => $port, 'tls' => false];
-		}
-
-		//default ports
-		$portSettings = array_merge($portSettings,
-									$this->getDefaultLdapPortSettings());
-
-		return $portSettings;
-	}
+    /** @var \OCP\IL10N */
+    protected static $l;
+    protected $access;
+    protected $cr;
+    protected $configuration;
+    protected $result;
+    protected $resultCache = [];
+
+    public const LRESULT_PROCESSED_OK = 2;
+    public const LRESULT_PROCESSED_INVALID = 3;
+    public const LRESULT_PROCESSED_SKIP = 4;
+
+    public const LFILTER_LOGIN      = 2;
+    public const LFILTER_USER_LIST  = 3;
+    public const LFILTER_GROUP_LIST = 4;
+
+    public const LFILTER_MODE_ASSISTED = 2;
+    public const LFILTER_MODE_RAW = 1;
+
+    public const LDAP_NW_TIMEOUT = 4;
+
+    /**
+     * Constructor
+     * @param Configuration $configuration an instance of Configuration
+     * @param ILDAPWrapper $ldap an instance of ILDAPWrapper
+     * @param Access $access
+     */
+    public function __construct(Configuration $configuration, ILDAPWrapper $ldap, Access $access) {
+        parent::__construct($ldap);
+        $this->configuration = $configuration;
+        if (is_null(Wizard::$l)) {
+            Wizard::$l = \OC::$server->getL10N('user_ldap');
+        }
+        $this->access = $access;
+        $this->result = new WizardResult();
+    }
+
+    public function __destruct() {
+        if ($this->result->hasChanges()) {
+            $this->configuration->saveConfiguration();
+        }
+    }
+
+    /**
+     * counts entries in the LDAP directory
+     *
+     * @param string $filter the LDAP search filter
+     * @param string $type a string being either 'users' or 'groups';
+     * @return int
+     * @throws \Exception
+     */
+    public function countEntries(string $filter, string $type): int {
+        $reqs = ['ldapHost', 'ldapPort', 'ldapBase'];
+        if ($type === 'users') {
+            $reqs[] = 'ldapUserFilter';
+        }
+        if (!$this->checkRequirements($reqs)) {
+            throw new \Exception('Requirements not met', 400);
+        }
+
+        $attr = ['dn']; // default
+        $limit = 1001;
+        if ($type === 'groups') {
+            $result =  $this->access->countGroups($filter, $attr, $limit);
+        } elseif ($type === 'users') {
+            $result = $this->access->countUsers($filter, $attr, $limit);
+        } elseif ($type === 'objects') {
+            $result = $this->access->countObjects($limit);
+        } else {
+            throw new \Exception('Internal error: Invalid object type', 500);
+        }
+
+        return (int)$result;
+    }
+
+    /**
+     * formats the return value of a count operation to the string to be
+     * inserted.
+     *
+     * @param int $count
+     * @return string
+     */
+    private function formatCountResult(int $count): string {
+        if ($count > 1000) {
+            return '> 1000';
+        }
+        return (string)$count;
+    }
+
+    public function countGroups() {
+        $filter = $this->configuration->ldapGroupFilter;
+
+        if (empty($filter)) {
+            $output = self::$l->n('%s group found', '%s groups found', 0, [0]);
+            $this->result->addChange('ldap_group_count', $output);
+            return $this->result;
+        }
+
+        try {
+            $groupsTotal = $this->countEntries($filter, 'groups');
+        } catch (\Exception $e) {
+            //400 can be ignored, 500 is forwarded
+            if ($e->getCode() === 500) {
+                throw $e;
+            }
+            return false;
+        }
+        $output = self::$l->n(
+            '%s group found',
+            '%s groups found',
+            $groupsTotal,
+            [$this->formatCountResult($groupsTotal)]
+        );
+        $this->result->addChange('ldap_group_count', $output);
+        return $this->result;
+    }
+
+    /**
+     * @return WizardResult
+     * @throws \Exception
+     */
+    public function countUsers() {
+        $filter = $this->access->getFilterForUserCount();
+
+        $usersTotal = $this->countEntries($filter, 'users');
+        $output = self::$l->n(
+            '%s user found',
+            '%s users found',
+            $usersTotal,
+            [$this->formatCountResult($usersTotal)]
+        );
+        $this->result->addChange('ldap_user_count', $output);
+        return $this->result;
+    }
+
+    /**
+     * counts any objects in the currently set base dn
+     *
+     * @return WizardResult
+     * @throws \Exception
+     */
+    public function countInBaseDN() {
+        // we don't need to provide a filter in this case
+        $total = $this->countEntries('', 'objects');
+        if ($total === false) {
+            throw new \Exception('invalid results received');
+        }
+        $this->result->addChange('ldap_test_base', $total);
+        return $this->result;
+    }
+
+    /**
+     * counts users with a specified attribute
+     * @param string $attr
+     * @param bool $existsCheck
+     * @return int|bool
+     */
+    public function countUsersWithAttribute($attr, $existsCheck = false) {
+        if (!$this->checkRequirements(['ldapHost',
+            'ldapPort',
+            'ldapBase',
+            'ldapUserFilter',
+        ])) {
+            return  false;
+        }
+
+        $filter = $this->access->combineFilterWithAnd([
+            $this->configuration->ldapUserFilter,
+            $attr . '=*'
+        ]);
+
+        $limit = ($existsCheck === false) ? null : 1;
+
+        return $this->access->countUsers($filter, ['dn'], $limit);
+    }
+
+    /**
+     * detects the display name attribute. If a setting is already present that
+     * returns at least one hit, the detection will be canceled.
+     * @return WizardResult|bool
+     * @throws \Exception
+     */
+    public function detectUserDisplayNameAttribute() {
+        if (!$this->checkRequirements(['ldapHost',
+            'ldapPort',
+            'ldapBase',
+            'ldapUserFilter',
+        ])) {
+            return  false;
+        }
+
+        $attr = $this->configuration->ldapUserDisplayName;
+        if ($attr !== '' && $attr !== 'displayName') {
+            // most likely not the default value with upper case N,
+            // verify it still produces a result
+            $count = (int)$this->countUsersWithAttribute($attr, true);
+            if ($count > 0) {
+                //no change, but we sent it back to make sure the user interface
+                //is still correct, even if the ajax call was cancelled meanwhile
+                $this->result->addChange('ldap_display_name', $attr);
+                return $this->result;
+            }
+        }
+
+        // first attribute that has at least one result wins
+        $displayNameAttrs = ['displayname', 'cn'];
+        foreach ($displayNameAttrs as $attr) {
+            $count = (int)$this->countUsersWithAttribute($attr, true);
+
+            if ($count > 0) {
+                $this->applyFind('ldap_display_name', $attr);
+                return $this->result;
+            }
+        }
+
+        throw new \Exception(self::$l->t('Could not detect user display name attribute. Please specify it yourself in advanced LDAP settings.'));
+    }
+
+    /**
+     * detects the most often used email attribute for users applying to the
+     * user list filter. If a setting is already present that returns at least
+     * one hit, the detection will be canceled.
+     * @return WizardResult|bool
+     */
+    public function detectEmailAttribute() {
+        if (!$this->checkRequirements(['ldapHost',
+            'ldapPort',
+            'ldapBase',
+            'ldapUserFilter',
+        ])) {
+            return  false;
+        }
+
+        $attr = $this->configuration->ldapEmailAttribute;
+        if ($attr !== '') {
+            $count = (int)$this->countUsersWithAttribute($attr, true);
+            if ($count > 0) {
+                return false;
+            }
+            $writeLog = true;
+        } else {
+            $writeLog = false;
+        }
+
+        $emailAttributes = ['mail', 'mailPrimaryAddress'];
+        $winner = '';
+        $maxUsers = 0;
+        foreach ($emailAttributes as $attr) {
+            $count = $this->countUsersWithAttribute($attr);
+            if ($count > $maxUsers) {
+                $maxUsers = $count;
+                $winner = $attr;
+            }
+        }
+
+        if ($winner !== '') {
+            $this->applyFind('ldap_email_attr', $winner);
+            if ($writeLog) {
+                \OCP\Util::writeLog('user_ldap', 'The mail attribute has ' .
+                    'automatically been reset, because the original value ' .
+                    'did not return any results.', ILogger::INFO);
+            }
+        }
+
+        return $this->result;
+    }
+
+    /**
+     * @return WizardResult
+     * @throws \Exception
+     */
+    public function determineAttributes() {
+        if (!$this->checkRequirements(['ldapHost',
+            'ldapPort',
+            'ldapBase',
+            'ldapUserFilter',
+        ])) {
+            return  false;
+        }
+
+        $attributes = $this->getUserAttributes();
+
+        natcasesort($attributes);
+        $attributes = array_values($attributes);
+
+        $this->result->addOptions('ldap_loginfilter_attributes', $attributes);
+
+        $selected = $this->configuration->ldapLoginFilterAttributes;
+        if (is_array($selected) && !empty($selected)) {
+            $this->result->addChange('ldap_loginfilter_attributes', $selected);
+        }
+
+        return $this->result;
+    }
+
+    /**
+     * detects the available LDAP attributes
+     * @return array|false The instance's WizardResult instance
+     * @throws \Exception
+     */
+    private function getUserAttributes() {
+        if (!$this->checkRequirements(['ldapHost',
+            'ldapPort',
+            'ldapBase',
+            'ldapUserFilter',
+        ])) {
+            return  false;
+        }
+        $cr = $this->getConnection();
+        if (!$cr) {
+            throw new \Exception('Could not connect to LDAP');
+        }
+
+        $base = $this->configuration->ldapBase[0];
+        $filter = $this->configuration->ldapUserFilter;
+        $rr = $this->ldap->search($cr, $base, $filter, [], 1, 1);
+        if (!$this->ldap->isResource($rr)) {
+            return false;
+        }
+        $er = $this->ldap->firstEntry($cr, $rr);
+        $attributes = $this->ldap->getAttributes($cr, $er);
+        $pureAttributes = [];
+        for ($i = 0; $i < $attributes['count']; $i++) {
+            $pureAttributes[] = $attributes[$i];
+        }
+
+        return $pureAttributes;
+    }
+
+    /**
+     * detects the available LDAP groups
+     * @return WizardResult|false the instance's WizardResult instance
+     */
+    public function determineGroupsForGroups() {
+        return $this->determineGroups('ldap_groupfilter_groups',
+                                        'ldapGroupFilterGroups',
+                                        false);
+    }
+
+    /**
+     * detects the available LDAP groups
+     * @return WizardResult|false the instance's WizardResult instance
+     */
+    public function determineGroupsForUsers() {
+        return $this->determineGroups('ldap_userfilter_groups',
+                                        'ldapUserFilterGroups');
+    }
+
+    /**
+     * detects the available LDAP groups
+     * @param string $dbKey
+     * @param string $confKey
+     * @param bool $testMemberOf
+     * @return WizardResult|false the instance's WizardResult instance
+     * @throws \Exception
+     */
+    private function determineGroups($dbKey, $confKey, $testMemberOf = true) {
+        if (!$this->checkRequirements(['ldapHost',
+            'ldapPort',
+            'ldapBase',
+        ])) {
+            return  false;
+        }
+        $cr = $this->getConnection();
+        if (!$cr) {
+            throw new \Exception('Could not connect to LDAP');
+        }
+
+        $this->fetchGroups($dbKey, $confKey);
+
+        if ($testMemberOf) {
+            $this->configuration->hasMemberOfFilterSupport = $this->testMemberOf();
+            $this->result->markChange();
+            if (!$this->configuration->hasMemberOfFilterSupport) {
+                throw new \Exception('memberOf is not supported by the server');
+            }
+        }
+
+        return $this->result;
+    }
+
+    /**
+     * fetches all groups from LDAP and adds them to the result object
+     *
+     * @param string $dbKey
+     * @param string $confKey
+     * @return array $groupEntries
+     * @throws \Exception
+     */
+    public function fetchGroups($dbKey, $confKey) {
+        $obclasses = ['posixGroup', 'group', 'zimbraDistributionList', 'groupOfNames', 'groupOfUniqueNames'];
+
+        $filterParts = [];
+        foreach ($obclasses as $obclass) {
+            $filterParts[] = 'objectclass='.$obclass;
+        }
+        //we filter for everything
+        //- that looks like a group and
+        //- has the group display name set
+        $filter = $this->access->combineFilterWithOr($filterParts);
+        $filter = $this->access->combineFilterWithAnd([$filter, 'cn=*']);
+
+        $groupNames = [];
+        $groupEntries = [];
+        $limit = 400;
+        $offset = 0;
+        do {
+            // we need to request dn additionally here, otherwise memberOf
+            // detection will fail later
+            $result = $this->access->searchGroups($filter, ['cn', 'dn'], $limit, $offset);
+            foreach ($result as $item) {
+                if (!isset($item['cn']) && !is_array($item['cn']) && !isset($item['cn'][0])) {
+                    // just in case - no issue known
+                    continue;
+                }
+                $groupNames[] = $item['cn'][0];
+                $groupEntries[] = $item;
+            }
+            $offset += $limit;
+        } while ($this->access->hasMoreResults());
+
+        if (count($groupNames) > 0) {
+            natsort($groupNames);
+            $this->result->addOptions($dbKey, array_values($groupNames));
+        } else {
+            throw new \Exception(self::$l->t('Could not find the desired feature'));
+        }
+
+        $setFeatures = $this->configuration->$confKey;
+        if (is_array($setFeatures) && !empty($setFeatures)) {
+            //something is already configured? pre-select it.
+            $this->result->addChange($dbKey, $setFeatures);
+        }
+        return $groupEntries;
+    }
+
+    public function determineGroupMemberAssoc() {
+        if (!$this->checkRequirements(['ldapHost',
+            'ldapPort',
+            'ldapGroupFilter',
+        ])) {
+            return  false;
+        }
+        $attribute = $this->detectGroupMemberAssoc();
+        if ($attribute === false) {
+            return false;
+        }
+        $this->configuration->setConfiguration(['ldapGroupMemberAssocAttr' => $attribute]);
+        $this->result->addChange('ldap_group_member_assoc_attribute', $attribute);
+
+        return $this->result;
+    }
+
+    /**
+     * Detects the available object classes
+     * @return WizardResult|false the instance's WizardResult instance
+     * @throws \Exception
+     */
+    public function determineGroupObjectClasses() {
+        if (!$this->checkRequirements(['ldapHost',
+            'ldapPort',
+            'ldapBase',
+        ])) {
+            return  false;
+        }
+        $cr = $this->getConnection();
+        if (!$cr) {
+            throw new \Exception('Could not connect to LDAP');
+        }
+
+        $obclasses = ['groupOfNames', 'groupOfUniqueNames', 'group', 'posixGroup', '*'];
+        $this->determineFeature($obclasses,
+                                'objectclass',
+                                'ldap_groupfilter_objectclass',
+                                'ldapGroupFilterObjectclass',
+                                false);
+
+        return $this->result;
+    }
+
+    /**
+     * detects the available object classes
+     * @return WizardResult
+     * @throws \Exception
+     */
+    public function determineUserObjectClasses() {
+        if (!$this->checkRequirements(['ldapHost',
+            'ldapPort',
+            'ldapBase',
+        ])) {
+            return  false;
+        }
+        $cr = $this->getConnection();
+        if (!$cr) {
+            throw new \Exception('Could not connect to LDAP');
+        }
+
+        $obclasses = ['inetOrgPerson', 'person', 'organizationalPerson',
+            'user', 'posixAccount', '*'];
+        $filter = $this->configuration->ldapUserFilter;
+        //if filter is empty, it is probably the first time the wizard is called
+        //then, apply suggestions.
+        $this->determineFeature($obclasses,
+                                'objectclass',
+                                'ldap_userfilter_objectclass',
+                                'ldapUserFilterObjectclass',
+                                empty($filter));
+
+        return $this->result;
+    }
+
+    /**
+     * @return WizardResult|false
+     * @throws \Exception
+     */
+    public function getGroupFilter() {
+        if (!$this->checkRequirements(['ldapHost',
+            'ldapPort',
+            'ldapBase',
+        ])) {
+            return false;
+        }
+        //make sure the use display name is set
+        $displayName = $this->configuration->ldapGroupDisplayName;
+        if ($displayName === '') {
+            $d = $this->configuration->getDefaults();
+            $this->applyFind('ldap_group_display_name',
+                                $d['ldap_group_display_name']);
+        }
+        $filter = $this->composeLdapFilter(self::LFILTER_GROUP_LIST);
+
+        $this->applyFind('ldap_group_filter', $filter);
+        return $this->result;
+    }
+
+    /**
+     * @return WizardResult|false
+     * @throws \Exception
+     */
+    public function getUserListFilter() {
+        if (!$this->checkRequirements(['ldapHost',
+            'ldapPort',
+            'ldapBase',
+        ])) {
+            return false;
+        }
+        //make sure the use display name is set
+        $displayName = $this->configuration->ldapUserDisplayName;
+        if ($displayName === '') {
+            $d = $this->configuration->getDefaults();
+            $this->applyFind('ldap_display_name', $d['ldap_display_name']);
+        }
+        $filter = $this->composeLdapFilter(self::LFILTER_USER_LIST);
+        if (!$filter) {
+            throw new \Exception('Cannot create filter');
+        }
+
+        $this->applyFind('ldap_userlist_filter', $filter);
+        return $this->result;
+    }
+
+    /**
+     * @return bool|WizardResult
+     * @throws \Exception
+     */
+    public function getUserLoginFilter() {
+        if (!$this->checkRequirements(['ldapHost',
+            'ldapPort',
+            'ldapBase',
+            'ldapUserFilter',
+        ])) {
+            return false;
+        }
+
+        $filter = $this->composeLdapFilter(self::LFILTER_LOGIN);
+        if (!$filter) {
+            throw new \Exception('Cannot create filter');
+        }
+
+        $this->applyFind('ldap_login_filter', $filter);
+        return $this->result;
+    }
+
+    /**
+     * @return bool|WizardResult
+     * @param string $loginName
+     * @throws \Exception
+     */
+    public function testLoginName($loginName) {
+        if (!$this->checkRequirements(['ldapHost',
+            'ldapPort',
+            'ldapBase',
+            'ldapLoginFilter',
+        ])) {
+            return false;
+        }
+
+        $cr = $this->access->connection->getConnectionResource();
+        if (!$this->ldap->isResource($cr)) {
+            throw new \Exception('connection error');
+        }
+
+        if (mb_strpos($this->access->connection->ldapLoginFilter, '%uid', 0, 'UTF-8')
+            === false) {
+            throw new \Exception('missing placeholder');
+        }
+
+        $users = $this->access->countUsersByLoginName($loginName);
+        if ($this->ldap->errno($cr) !== 0) {
+            throw new \Exception($this->ldap->error($cr));
+        }
+        $filter = str_replace('%uid', $loginName, $this->access->connection->ldapLoginFilter);
+        $this->result->addChange('ldap_test_loginname', $users);
+        $this->result->addChange('ldap_test_effective_filter', $filter);
+        return $this->result;
+    }
+
+    /**
+     * Tries to determine the port, requires given Host, User DN and Password
+     * @return WizardResult|false WizardResult on success, false otherwise
+     * @throws \Exception
+     */
+    public function guessPortAndTLS() {
+        if (!$this->checkRequirements(['ldapHost',
+        ])) {
+            return false;
+        }
+        $this->checkHost();
+        $portSettings = $this->getPortSettingsToTry();
+
+        if (!is_array($portSettings)) {
+            throw new \Exception(print_r($portSettings, true));
+        }
+
+        //proceed from the best configuration and return on first success
+        foreach ($portSettings as $setting) {
+            $p = $setting['port'];
+            $t = $setting['tls'];
+            \OCP\Util::writeLog('user_ldap', 'Wiz: trying port '. $p . ', TLS '. $t, ILogger::DEBUG);
+            //connectAndBind may throw Exception, it needs to be catched by the
+            //callee of this method
+
+            try {
+                $settingsFound = $this->connectAndBind($p, $t);
+            } catch (\Exception $e) {
+                // any reply other than -1 (= cannot connect) is already okay,
+                // because then we found the server
+                // unavailable startTLS returns -11
+                if ($e->getCode() > 0) {
+                    $settingsFound = true;
+                } else {
+                    throw $e;
+                }
+            }
+
+            if ($settingsFound === true) {
+                $config = [
+                    'ldapPort' => $p,
+                    'ldapTLS' => (int)$t
+                ];
+                $this->configuration->setConfiguration($config);
+                \OCP\Util::writeLog('user_ldap', 'Wiz: detected Port ' . $p, ILogger::DEBUG);
+                $this->result->addChange('ldap_port', $p);
+                return $this->result;
+            }
+        }
+
+        //custom port, undetected (we do not brute force)
+        return false;
+    }
+
+    /**
+     * tries to determine a base dn from User DN or LDAP Host
+     * @return WizardResult|false WizardResult on success, false otherwise
+     */
+    public function guessBaseDN() {
+        if (!$this->checkRequirements(['ldapHost',
+            'ldapPort',
+        ])) {
+            return false;
+        }
+
+        //check whether a DN is given in the agent name (99.9% of all cases)
+        $base = null;
+        $i = stripos($this->configuration->ldapAgentName, 'dc=');
+        if ($i !== false) {
+            $base = substr($this->configuration->ldapAgentName, $i);
+            if ($this->testBaseDN($base)) {
+                $this->applyFind('ldap_base', $base);
+                return $this->result;
+            }
+        }
+
+        //this did not help :(
+        //Let's see whether we can parse the Host URL and convert the domain to
+        //a base DN
+        $helper = new Helper(\OC::$server->getConfig());
+        $domain = $helper->getDomainFromURL($this->configuration->ldapHost);
+        if (!$domain) {
+            return false;
+        }
+
+        $dparts = explode('.', $domain);
+        while (count($dparts) > 0) {
+            $base2 = 'dc=' . implode(',dc=', $dparts);
+            if ($base !== $base2 && $this->testBaseDN($base2)) {
+                $this->applyFind('ldap_base', $base2);
+                return $this->result;
+            }
+            array_shift($dparts);
+        }
+
+        return false;
+    }
+
+    /**
+     * sets the found value for the configuration key in the WizardResult
+     * as well as in the Configuration instance
+     * @param string $key the configuration key
+     * @param string $value the (detected) value
+     *
+     */
+    private function applyFind($key, $value) {
+        $this->result->addChange($key, $value);
+        $this->configuration->setConfiguration([$key => $value]);
+    }
+
+    /**
+     * Checks, whether a port was entered in the Host configuration
+     * field. In this case the port will be stripped off, but also stored as
+     * setting.
+     */
+    private function checkHost() {
+        $host = $this->configuration->ldapHost;
+        $hostInfo = parse_url($host);
+
+        //removes Port from Host
+        if (is_array($hostInfo) && isset($hostInfo['port'])) {
+            $port = $hostInfo['port'];
+            $host = str_replace(':'.$port, '', $host);
+            $this->applyFind('ldap_host', $host);
+            $this->applyFind('ldap_port', $port);
+        }
+    }
+
+    /**
+     * tries to detect the group member association attribute which is
+     * one of 'uniqueMember', 'memberUid', 'member', 'gidNumber'
+     * @return string|false, string with the attribute name, false on error
+     * @throws \Exception
+     */
+    private function detectGroupMemberAssoc() {
+        $possibleAttrs = ['uniqueMember', 'memberUid', 'member', 'gidNumber', 'zimbraMailForwardingAddress'];
+        $filter = $this->configuration->ldapGroupFilter;
+        if (empty($filter)) {
+            return false;
+        }
+        $cr = $this->getConnection();
+        if (!$cr) {
+            throw new \Exception('Could not connect to LDAP');
+        }
+        $base = $this->configuration->ldapBaseGroups[0] ?: $this->configuration->ldapBase[0];
+        $rr = $this->ldap->search($cr, $base, $filter, $possibleAttrs, 0, 1000);
+        if (!$this->ldap->isResource($rr)) {
+            return false;
+        }
+        $er = $this->ldap->firstEntry($cr, $rr);
+        while (is_resource($er)) {
+            $this->ldap->getDN($cr, $er);
+            $attrs = $this->ldap->getAttributes($cr, $er);
+            $result = [];
+            $possibleAttrsCount = count($possibleAttrs);
+            for ($i = 0; $i < $possibleAttrsCount; $i++) {
+                if (isset($attrs[$possibleAttrs[$i]])) {
+                    $result[$possibleAttrs[$i]] = $attrs[$possibleAttrs[$i]]['count'];
+                }
+            }
+            if (!empty($result)) {
+                natsort($result);
+                return key($result);
+            }
+
+            $er = $this->ldap->nextEntry($cr, $er);
+        }
+
+        return false;
+    }
+
+    /**
+     * Checks whether for a given BaseDN results will be returned
+     * @param string $base the BaseDN to test
+     * @return bool true on success, false otherwise
+     * @throws \Exception
+     */
+    private function testBaseDN($base) {
+        $cr = $this->getConnection();
+        if (!$cr) {
+            throw new \Exception('Could not connect to LDAP');
+        }
+
+        //base is there, let's validate it. If we search for anything, we should
+        //get a result set > 0 on a proper base
+        $rr = $this->ldap->search($cr, $base, 'objectClass=*', ['dn'], 0, 1);
+        if (!$this->ldap->isResource($rr)) {
+            $errorNo  = $this->ldap->errno($cr);
+            $errorMsg = $this->ldap->error($cr);
+            \OCP\Util::writeLog('user_ldap', 'Wiz: Could not search base '.$base.
+                            ' Error '.$errorNo.': '.$errorMsg, ILogger::INFO);
+            return false;
+        }
+        $entries = $this->ldap->countEntries($cr, $rr);
+        return ($entries !== false) && ($entries > 0);
+    }
+
+    /**
+     * Checks whether the server supports memberOf in LDAP Filter.
+     * Note: at least in OpenLDAP, availability of memberOf is dependent on
+     * a configured objectClass. I.e. not necessarily for all available groups
+     * memberOf does work.
+     *
+     * @return bool true if it does, false otherwise
+     * @throws \Exception
+     */
+    private function testMemberOf() {
+        $cr = $this->getConnection();
+        if (!$cr) {
+            throw new \Exception('Could not connect to LDAP');
+        }
+        $result = $this->access->countUsers('memberOf=*', ['memberOf'], 1);
+        if (is_int($result) &&  $result > 0) {
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * creates an LDAP Filter from given configuration
+     * @param integer $filterType int, for which use case the filter shall be created
+     * can be any of self::LFILTER_USER_LIST, self::LFILTER_LOGIN or
+     * self::LFILTER_GROUP_LIST
+     * @return string|false string with the filter on success, false otherwise
+     * @throws \Exception
+     */
+    private function composeLdapFilter($filterType) {
+        $filter = '';
+        $parts = 0;
+        switch ($filterType) {
+            case self::LFILTER_USER_LIST:
+                $objcs = $this->configuration->ldapUserFilterObjectclass;
+                //glue objectclasses
+                if (is_array($objcs) && count($objcs) > 0) {
+                    $filter .= '(|';
+                    foreach ($objcs as $objc) {
+                        $filter .= '(objectclass=' . $objc . ')';
+                    }
+                    $filter .= ')';
+                    $parts++;
+                }
+                //glue group memberships
+                if ($this->configuration->hasMemberOfFilterSupport) {
+                    $cns = $this->configuration->ldapUserFilterGroups;
+                    if (is_array($cns) && count($cns) > 0) {
+                        $filter .= '(|';
+                        $cr = $this->getConnection();
+                        if (!$cr) {
+                            throw new \Exception('Could not connect to LDAP');
+                        }
+                        $base = $this->configuration->ldapBase[0];
+                        foreach ($cns as $cn) {
+                            $rr = $this->ldap->search($cr, $base, 'cn=' . $cn, ['dn', 'primaryGroupToken']);
+                            if (!$this->ldap->isResource($rr)) {
+                                continue;
+                            }
+                            $er = $this->ldap->firstEntry($cr, $rr);
+                            $attrs = $this->ldap->getAttributes($cr, $er);
+                            $dn = $this->ldap->getDN($cr, $er);
+                            if ($dn === false || $dn === '') {
+                                continue;
+                            }
+                            $filterPart = '(memberof=' . $dn . ')';
+                            if (isset($attrs['primaryGroupToken'])) {
+                                $pgt = $attrs['primaryGroupToken'][0];
+                                $primaryFilterPart = '(primaryGroupID=' . $pgt .')';
+                                $filterPart = '(|' . $filterPart . $primaryFilterPart . ')';
+                            }
+                            $filter .= $filterPart;
+                        }
+                        $filter .= ')';
+                    }
+                    $parts++;
+                }
+                //wrap parts in AND condition
+                if ($parts > 1) {
+                    $filter = '(&' . $filter . ')';
+                }
+                if ($filter === '') {
+                    $filter = '(objectclass=*)';
+                }
+                break;
+
+            case self::LFILTER_GROUP_LIST:
+                $objcs = $this->configuration->ldapGroupFilterObjectclass;
+                //glue objectclasses
+                if (is_array($objcs) && count($objcs) > 0) {
+                    $filter .= '(|';
+                    foreach ($objcs as $objc) {
+                        $filter .= '(objectclass=' . $objc . ')';
+                    }
+                    $filter .= ')';
+                    $parts++;
+                }
+                //glue group memberships
+                $cns = $this->configuration->ldapGroupFilterGroups;
+                if (is_array($cns) && count($cns) > 0) {
+                    $filter .= '(|';
+                    foreach ($cns as $cn) {
+                        $filter .= '(cn=' . $cn . ')';
+                    }
+                    $filter .= ')';
+                }
+                $parts++;
+                //wrap parts in AND condition
+                if ($parts > 1) {
+                    $filter = '(&' . $filter . ')';
+                }
+                break;
+
+            case self::LFILTER_LOGIN:
+                $ulf = $this->configuration->ldapUserFilter;
+                $loginpart = '=%uid';
+                $filterUsername = '';
+                $userAttributes = $this->getUserAttributes();
+                $userAttributes = array_change_key_case(array_flip($userAttributes));
+                $parts = 0;
+
+                if ($this->configuration->ldapLoginFilterUsername === '1') {
+                    $attr = '';
+                    if (isset($userAttributes['uid'])) {
+                        $attr = 'uid';
+                    } elseif (isset($userAttributes['samaccountname'])) {
+                        $attr = 'samaccountname';
+                    } elseif (isset($userAttributes['cn'])) {
+                        //fallback
+                        $attr = 'cn';
+                    }
+                    if ($attr !== '') {
+                        $filterUsername = '(' . $attr . $loginpart . ')';
+                        $parts++;
+                    }
+                }
+
+                $filterEmail = '';
+                if ($this->configuration->ldapLoginFilterEmail === '1') {
+                    $filterEmail = '(|(mailPrimaryAddress=%uid)(mail=%uid))';
+                    $parts++;
+                }
+
+                $filterAttributes = '';
+                $attrsToFilter = $this->configuration->ldapLoginFilterAttributes;
+                if (is_array($attrsToFilter) && count($attrsToFilter) > 0) {
+                    $filterAttributes = '(|';
+                    foreach ($attrsToFilter as $attribute) {
+                        $filterAttributes .= '(' . $attribute . $loginpart . ')';
+                    }
+                    $filterAttributes .= ')';
+                    $parts++;
+                }
+
+                $filterLogin = '';
+                if ($parts > 1) {
+                    $filterLogin = '(|';
+                }
+                $filterLogin .= $filterUsername;
+                $filterLogin .= $filterEmail;
+                $filterLogin .= $filterAttributes;
+                if ($parts > 1) {
+                    $filterLogin .= ')';
+                }
+
+                $filter = '(&'.$ulf.$filterLogin.')';
+                break;
+        }
+
+        \OCP\Util::writeLog('user_ldap', 'Wiz: Final filter '.$filter, ILogger::DEBUG);
+
+        return $filter;
+    }
+
+    /**
+     * Connects and Binds to an LDAP Server
+     *
+     * @param int $port the port to connect with
+     * @param bool $tls whether startTLS is to be used
+     * @return bool
+     * @throws \Exception
+     */
+    private function connectAndBind($port, $tls) {
+        //connect, does not really trigger any server communication
+        $host = $this->configuration->ldapHost;
+        $hostInfo = parse_url($host);
+        if (!$hostInfo) {
+            throw new \Exception(self::$l->t('Invalid Host'));
+        }
+        \OCP\Util::writeLog('user_ldap', 'Wiz: Attempting to connect ', ILogger::DEBUG);
+        $cr = $this->ldap->connect($host, $port);
+        if (!is_resource($cr)) {
+            throw new \Exception(self::$l->t('Invalid Host'));
+        }
+
+        //set LDAP options
+        $this->ldap->setOption($cr, LDAP_OPT_PROTOCOL_VERSION, 3);
+        $this->ldap->setOption($cr, LDAP_OPT_REFERRALS, 0);
+        $this->ldap->setOption($cr, LDAP_OPT_NETWORK_TIMEOUT, self::LDAP_NW_TIMEOUT);
+
+        try {
+            if ($tls) {
+                $isTlsWorking = @$this->ldap->startTls($cr);
+                if (!$isTlsWorking) {
+                    return false;
+                }
+            }
+
+            \OCP\Util::writeLog('user_ldap', 'Wiz: Attemping to Bind ', ILogger::DEBUG);
+            //interesting part: do the bind!
+            $login = $this->ldap->bind($cr,
+                $this->configuration->ldapAgentName,
+                $this->configuration->ldapAgentPassword
+            );
+            $errNo = $this->ldap->errno($cr);
+            $error = ldap_error($cr);
+            $this->ldap->unbind($cr);
+        } catch (ServerNotAvailableException $e) {
+            return false;
+        }
+
+        if ($login === true) {
+            $this->ldap->unbind($cr);
+            \OCP\Util::writeLog('user_ldap', 'Wiz: Bind successful to Port '. $port . ' TLS ' . (int)$tls, ILogger::DEBUG);
+            return true;
+        }
+
+        if ($errNo === -1) {
+            //host, port or TLS wrong
+            return false;
+        }
+        throw new \Exception($error, $errNo);
+    }
+
+    /**
+     * checks whether a valid combination of agent and password has been
+     * provided (either two values or nothing for anonymous connect)
+     * @return bool, true if everything is fine, false otherwise
+     */
+    private function checkAgentRequirements() {
+        $agent = $this->configuration->ldapAgentName;
+        $pwd = $this->configuration->ldapAgentPassword;
+
+        return
+            ($agent !== '' && $pwd !== '')
+            ||  ($agent === '' && $pwd === '')
+        ;
+    }
+
+    /**
+     * @param array $reqs
+     * @return bool
+     */
+    private function checkRequirements($reqs) {
+        $this->checkAgentRequirements();
+        foreach ($reqs as $option) {
+            $value = $this->configuration->$option;
+            if (empty($value)) {
+                return false;
+            }
+        }
+        return true;
+    }
+
+    /**
+     * does a cumulativeSearch on LDAP to get different values of a
+     * specified attribute
+     * @param string[] $filters array, the filters that shall be used in the search
+     * @param string $attr the attribute of which a list of values shall be returned
+     * @param int $dnReadLimit the amount of how many DNs should be analyzed.
+     * The lower, the faster
+     * @param string $maxF string. if not null, this variable will have the filter that
+     * yields most result entries
+     * @return array|false an array with the values on success, false otherwise
+     */
+    public function cumulativeSearchOnAttribute($filters, $attr, $dnReadLimit = 3, &$maxF = null) {
+        $dnRead = [];
+        $foundItems = [];
+        $maxEntries = 0;
+        if (!is_array($this->configuration->ldapBase)
+           || !isset($this->configuration->ldapBase[0])) {
+            return false;
+        }
+        $base = $this->configuration->ldapBase[0];
+        $cr = $this->getConnection();
+        if (!$this->ldap->isResource($cr)) {
+            return false;
+        }
+        $lastFilter = null;
+        if (isset($filters[count($filters)-1])) {
+            $lastFilter = $filters[count($filters)-1];
+        }
+        foreach ($filters as $filter) {
+            if ($lastFilter === $filter && count($foundItems) > 0) {
+                //skip when the filter is a wildcard and results were found
+                continue;
+            }
+            // 20k limit for performance and reason
+            $rr = $this->ldap->search($cr, $base, $filter, [$attr], 0, 20000);
+            if (!$this->ldap->isResource($rr)) {
+                continue;
+            }
+            $entries = $this->ldap->countEntries($cr, $rr);
+            $getEntryFunc = 'firstEntry';
+            if (($entries !== false) && ($entries > 0)) {
+                if (!is_null($maxF) && $entries > $maxEntries) {
+                    $maxEntries = $entries;
+                    $maxF = $filter;
+                }
+                $dnReadCount = 0;
+                do {
+                    $entry = $this->ldap->$getEntryFunc($cr, $rr);
+                    $getEntryFunc = 'nextEntry';
+                    if (!$this->ldap->isResource($entry)) {
+                        continue 2;
+                    }
+                    $rr = $entry; //will be expected by nextEntry next round
+                    $attributes = $this->ldap->getAttributes($cr, $entry);
+                    $dn = $this->ldap->getDN($cr, $entry);
+                    if ($dn === false || in_array($dn, $dnRead)) {
+                        continue;
+                    }
+                    $newItems = [];
+                    $state = $this->getAttributeValuesFromEntry($attributes,
+                                                                $attr,
+                                                                $newItems);
+                    $dnReadCount++;
+                    $foundItems = array_merge($foundItems, $newItems);
+                    $this->resultCache[$dn][$attr] = $newItems;
+                    $dnRead[] = $dn;
+                } while (($state === self::LRESULT_PROCESSED_SKIP
+                        || $this->ldap->isResource($entry))
+                        && ($dnReadLimit === 0 || $dnReadCount < $dnReadLimit));
+            }
+        }
+
+        return array_unique($foundItems);
+    }
+
+    /**
+     * determines if and which $attr are available on the LDAP server
+     * @param string[] $objectclasses the objectclasses to use as search filter
+     * @param string $attr the attribute to look for
+     * @param string $dbkey the dbkey of the setting the feature is connected to
+     * @param string $confkey the confkey counterpart for the $dbkey as used in the
+     * Configuration class
+     * @param bool $po whether the objectClass with most result entries
+     * shall be pre-selected via the result
+     * @return array|false list of found items.
+     * @throws \Exception
+     */
+    private function determineFeature($objectclasses, $attr, $dbkey, $confkey, $po = false) {
+        $cr = $this->getConnection();
+        if (!$cr) {
+            throw new \Exception('Could not connect to LDAP');
+        }
+        $p = 'objectclass=';
+        foreach ($objectclasses as $key => $value) {
+            $objectclasses[$key] = $p.$value;
+        }
+        $maxEntryObjC = '';
+
+        //how deep to dig?
+        //When looking for objectclasses, testing few entries is sufficient,
+        $dig = 3;
+
+        $availableFeatures =
+            $this->cumulativeSearchOnAttribute($objectclasses, $attr,
+                                                $dig, $maxEntryObjC);
+        if (is_array($availableFeatures)
+           && count($availableFeatures) > 0) {
+            natcasesort($availableFeatures);
+            //natcasesort keeps indices, but we must get rid of them for proper
+            //sorting in the web UI. Therefore: array_values
+            $this->result->addOptions($dbkey, array_values($availableFeatures));
+        } else {
+            throw new \Exception(self::$l->t('Could not find the desired feature'));
+        }
+
+        $setFeatures = $this->configuration->$confkey;
+        if (is_array($setFeatures) && !empty($setFeatures)) {
+            //something is already configured? pre-select it.
+            $this->result->addChange($dbkey, $setFeatures);
+        } elseif ($po && $maxEntryObjC !== '') {
+            //pre-select objectclass with most result entries
+            $maxEntryObjC = str_replace($p, '', $maxEntryObjC);
+            $this->applyFind($dbkey, $maxEntryObjC);
+            $this->result->addChange($dbkey, $maxEntryObjC);
+        }
+
+        return $availableFeatures;
+    }
+
+    /**
+     * appends a list of values fr
+     * @param resource $result the return value from ldap_get_attributes
+     * @param string $attribute the attribute values to look for
+     * @param array &$known new values will be appended here
+     * @return int, state on of the class constants LRESULT_PROCESSED_OK,
+     * LRESULT_PROCESSED_INVALID or LRESULT_PROCESSED_SKIP
+     */
+    private function getAttributeValuesFromEntry($result, $attribute, &$known) {
+        if (!is_array($result)
+           || !isset($result['count'])
+           || !$result['count'] > 0) {
+            return self::LRESULT_PROCESSED_INVALID;
+        }
+
+        // strtolower on all keys for proper comparison
+        $result = \OCP\Util::mb_array_change_key_case($result);
+        $attribute = strtolower($attribute);
+        if (isset($result[$attribute])) {
+            foreach ($result[$attribute] as $key => $val) {
+                if ($key === 'count') {
+                    continue;
+                }
+                if (!in_array($val, $known)) {
+                    $known[] = $val;
+                }
+            }
+            return self::LRESULT_PROCESSED_OK;
+        } else {
+            return self::LRESULT_PROCESSED_SKIP;
+        }
+    }
+
+    /**
+     * @return bool|mixed
+     */
+    private function getConnection() {
+        if (!is_null($this->cr)) {
+            return $this->cr;
+        }
+
+        $cr = $this->ldap->connect(
+            $this->configuration->ldapHost,
+            $this->configuration->ldapPort
+        );
+
+        $this->ldap->setOption($cr, LDAP_OPT_PROTOCOL_VERSION, 3);
+        $this->ldap->setOption($cr, LDAP_OPT_REFERRALS, 0);
+        $this->ldap->setOption($cr, LDAP_OPT_NETWORK_TIMEOUT, self::LDAP_NW_TIMEOUT);
+        if ($this->configuration->ldapTLS === 1) {
+            $this->ldap->startTls($cr);
+        }
+
+        $lo = @$this->ldap->bind($cr,
+                                    $this->configuration->ldapAgentName,
+                                    $this->configuration->ldapAgentPassword);
+        if ($lo === true) {
+            $this->$cr = $cr;
+            return $cr;
+        }
+
+        return false;
+    }
+
+    /**
+     * @return array
+     */
+    private function getDefaultLdapPortSettings() {
+        static $settings = [
+            ['port' => 7636, 'tls' => false],
+            ['port' =>  636, 'tls' => false],
+            ['port' => 7389, 'tls' => true],
+            ['port' =>  389, 'tls' => true],
+            ['port' => 7389, 'tls' => false],
+            ['port' =>  389, 'tls' => false],
+        ];
+        return $settings;
+    }
+
+    /**
+     * @return array
+     */
+    private function getPortSettingsToTry() {
+        //389 ← LDAP / Unencrypted or StartTLS
+        //636 ← LDAPS / SSL
+        //7xxx ← UCS. need to be checked first, because both ports may be open
+        $host = $this->configuration->ldapHost;
+        $port = (int)$this->configuration->ldapPort;
+        $portSettings = [];
+
+        //In case the port is already provided, we will check this first
+        if ($port > 0) {
+            $hostInfo = parse_url($host);
+            if (!(is_array($hostInfo)
+                && isset($hostInfo['scheme'])
+                && stripos($hostInfo['scheme'], 'ldaps') !== false)) {
+                $portSettings[] = ['port' => $port, 'tls' => true];
+            }
+            $portSettings[] =['port' => $port, 'tls' => false];
+        }
+
+        //default ports
+        $portSettings = array_merge($portSettings,
+                                    $this->getDefaultLdapPortSettings());
+
+        return $portSettings;
+    }
 }

apps/user_ldap/templates/settings.php

Indentation +54 added lines, -54 removed lines

@@ -5,46 +5,46 @@ 
 vendor_style('user_ldap', 'ui-multiselect/jquery.multiselect');
 
 script('user_ldap', [
-	'wizard/controller',
-	'wizard/configModel',
-	'wizard/view',
-	'wizard/wizardObject',
-	'wizard/wizardTabGeneric',
-	'wizard/wizardTabElementary',
-	'wizard/wizardTabAbstractFilter',
-	'wizard/wizardTabUserFilter',
-	'wizard/wizardTabLoginFilter',
-	'wizard/wizardTabGroupFilter',
-	'wizard/wizardTabAdvanced',
-	'wizard/wizardTabExpert',
-	'wizard/wizardDetectorQueue',
-	'wizard/wizardDetectorGeneric',
-	'wizard/wizardDetectorPort',
-	'wizard/wizardDetectorBaseDN',
-	'wizard/wizardDetectorFeatureAbstract',
-	'wizard/wizardDetectorUserObjectClasses',
-	'wizard/wizardDetectorGroupObjectClasses',
-	'wizard/wizardDetectorGroupsForUsers',
-	'wizard/wizardDetectorGroupsForGroups',
-	'wizard/wizardDetectorSimpleRequestAbstract',
-	'wizard/wizardDetectorFilterUser',
-	'wizard/wizardDetectorFilterLogin',
-	'wizard/wizardDetectorFilterGroup',
-	'wizard/wizardDetectorUserCount',
-	'wizard/wizardDetectorGroupCount',
-	'wizard/wizardDetectorEmailAttribute',
-	'wizard/wizardDetectorUserDisplayNameAttribute',
-	'wizard/wizardDetectorUserGroupAssociation',
-	'wizard/wizardDetectorAvailableAttributes',
-	'wizard/wizardDetectorTestAbstract',
-	'wizard/wizardDetectorTestLoginName',
-	'wizard/wizardDetectorTestBaseDN',
-	'wizard/wizardDetectorTestConfiguration',
-	'wizard/wizardDetectorClearUserMappings',
-	'wizard/wizardDetectorClearGroupMappings',
-	'wizard/wizardFilterOnType',
-	'wizard/wizardFilterOnTypeFactory',
-	'wizard/wizard'
+    'wizard/controller',
+    'wizard/configModel',
+    'wizard/view',
+    'wizard/wizardObject',
+    'wizard/wizardTabGeneric',
+    'wizard/wizardTabElementary',
+    'wizard/wizardTabAbstractFilter',
+    'wizard/wizardTabUserFilter',
+    'wizard/wizardTabLoginFilter',
+    'wizard/wizardTabGroupFilter',
+    'wizard/wizardTabAdvanced',
+    'wizard/wizardTabExpert',
+    'wizard/wizardDetectorQueue',
+    'wizard/wizardDetectorGeneric',
+    'wizard/wizardDetectorPort',
+    'wizard/wizardDetectorBaseDN',
+    'wizard/wizardDetectorFeatureAbstract',
+    'wizard/wizardDetectorUserObjectClasses',
+    'wizard/wizardDetectorGroupObjectClasses',
+    'wizard/wizardDetectorGroupsForUsers',
+    'wizard/wizardDetectorGroupsForGroups',
+    'wizard/wizardDetectorSimpleRequestAbstract',
+    'wizard/wizardDetectorFilterUser',
+    'wizard/wizardDetectorFilterLogin',
+    'wizard/wizardDetectorFilterGroup',
+    'wizard/wizardDetectorUserCount',
+    'wizard/wizardDetectorGroupCount',
+    'wizard/wizardDetectorEmailAttribute',
+    'wizard/wizardDetectorUserDisplayNameAttribute',
+    'wizard/wizardDetectorUserGroupAssociation',
+    'wizard/wizardDetectorAvailableAttributes',
+    'wizard/wizardDetectorTestAbstract',
+    'wizard/wizardDetectorTestLoginName',
+    'wizard/wizardDetectorTestBaseDN',
+    'wizard/wizardDetectorTestConfiguration',
+    'wizard/wizardDetectorClearUserMappings',
+    'wizard/wizardDetectorClearGroupMappings',
+    'wizard/wizardFilterOnType',
+    'wizard/wizardFilterOnTypeFactory',
+    'wizard/wizard'
 ]);
 
 style('user_ldap', 'settings');
@@ -67,10 +67,10 @@ 
 		<li class="ldapSettingsTabs"><a href="#ldapSettings-1"><?php p($l->t('Advanced'));?></a></li>
 	</ul>
 	<?php
-	if (!function_exists('ldap_connect')) {
-		print_unescaped('<p class="ldapwarning">'.$l->t('<b>Warning:</b> The PHP LDAP module is not installed, the backend will not work. Please ask your system administrator to install it.').'</p>');
-	}
-	?>
+    if (!function_exists('ldap_connect')) {
+        print_unescaped('<p class="ldapwarning">'.$l->t('<b>Warning:</b> The PHP LDAP module is not installed, the backend will not work. Please ask your system administrator to install it.').'</p>');
+    }
+    ?>
 	<?php require_once __DIR__ . '/part.wizard-server.php'; ?>
 	<?php require_once __DIR__ . '/part.wizard-userfilter.php'; ?>
 	<?php require_once __DIR__ . '/part.wizard-loginfilter.php'; ?>
@@ -96,16 +96,16 @@ 
 				<p><label for="ldap_base_groups"><?php p($l->t('Base Group Tree'));?></label><textarea id="ldap_base_groups" name="ldap_base_groups" placeholder="<?php p($l->t('One Group Base DN per line'));?>" data-default="<?php p($_['ldap_base_groups_default']); ?>" title="<?php p($l->t('Base Group Tree'));?>"></textarea></p>
 				<p><label for="ldap_attributes_for_group_search"><?php p($l->t('Group Search Attributes'));?></label><textarea id="ldap_attributes_for_group_search" name="ldap_attributes_for_group_search" placeholder="<?php p($l->t('Optional; one attribute per line'));?>" data-default="<?php p($_['ldap_attributes_for_group_search_default']); ?>" title="<?php p($l->t('Group Search Attributes'));?>"></textarea></p>
 				<p><label for="ldap_group_member_assoc_attribute"><?php p($l->t('Group-Member association'));?></label><select id="ldap_group_member_assoc_attribute" name="ldap_group_member_assoc_attribute" data-default="<?php p($_['ldap_group_member_assoc_attribute_default']); ?>" ><option value="uniqueMember"<?php if (isset($_['ldap_group_member_assoc_attribute']) && ($_['ldap_group_member_assoc_attribute'] === 'uniqueMember')) {
-		p(' selected');
-	} ?>>uniqueMember</option><option value="memberUid"<?php if (isset($_['ldap_group_member_assoc_attribute']) && ($_['ldap_group_member_assoc_attribute'] === 'memberUid')) {
-		p(' selected');
-	} ?>>memberUid</option><option value="member"<?php if (isset($_['ldap_group_member_assoc_attribute']) && ($_['ldap_group_member_assoc_attribute'] === 'member')) {
-		p(' selected');
-	} ?>>member (AD)</option><option value="gidNumber"<?php if (isset($_['ldap_group_member_assoc_attribute']) && ($_['ldap_group_member_assoc_attribute'] === 'gidNumber')) {
-		p(' selected');
-	} ?>>gidNumber</option><option value="zimbraMailForwardingAddress"<?php if (isset($_['ldap_group_member_assoc_attribute']) && ($_['ldap_group_member_assoc_attribute'] === 'zimbraMailForwardingAddress')) {
-		p(' selected');
-	} ?>>zimbraMailForwardingAddress</option></select></p>
+        p(' selected');
+    } ?>>uniqueMember</option><option value="memberUid"<?php if (isset($_['ldap_group_member_assoc_attribute']) && ($_['ldap_group_member_assoc_attribute'] === 'memberUid')) {
+        p(' selected');
+    } ?>>memberUid</option><option value="member"<?php if (isset($_['ldap_group_member_assoc_attribute']) && ($_['ldap_group_member_assoc_attribute'] === 'member')) {
+        p(' selected');
+    } ?>>member (AD)</option><option value="gidNumber"<?php if (isset($_['ldap_group_member_assoc_attribute']) && ($_['ldap_group_member_assoc_attribute'] === 'gidNumber')) {
+        p(' selected');
+    } ?>>gidNumber</option><option value="zimbraMailForwardingAddress"<?php if (isset($_['ldap_group_member_assoc_attribute']) && ($_['ldap_group_member_assoc_attribute'] === 'zimbraMailForwardingAddress')) {
+        p(' selected');
+    } ?>>zimbraMailForwardingAddress</option></select></p>
 				<p><label for="ldap_dynamic_group_member_url"><?php p($l->t('Dynamic Group Member URL'));?></label><input type="text" id="ldap_dynamic_group_member_url" name="ldap_dynamic_group_member_url" title="<?php p($l->t('The LDAP attribute that on group objects contains an LDAP search URL that determines what objects belong to the group. (An empty setting disables dynamic group membership functionality.)'));?>" data-default="<?php p($_['ldap_dynamic_group_member_url_default']); ?>" /></p>
 				<p><label for="ldap_nested_groups"><?php p($l->t('Nested Groups'));?></label><input type="checkbox" id="ldap_nested_groups" name="ldap_nested_groups" value="1" data-default="<?php p($_['ldap_nested_groups_default']); ?>"  title="<?php p($l->t('When switched on, groups that contain groups are supported. (Only works if the group member attribute contains DNs.)'));?>" /></p>
 				<p><label for="ldap_paging_size"><?php p($l->t('Paging chunksize'));?></label><input type="number" id="ldap_paging_size" name="ldap_paging_size" title="<?php p($l->t('Chunksize used for paged LDAP searches that may return bulky results like user or group enumeration. (Setting it 0 disables paged LDAP searches in those situations.)'));?>" data-default="<?php p($_['ldap_paging_size_default']); ?>" /></p>

Spacing +46 added lines, -46 removed lines

@@ -59,43 +59,43 @@ 
 
 	<div id="ldapSettings">
 	<ul>
-		<li id="#ldapWizard1"><a href="#ldapWizard1"><?php p($l->t('Server'));?></a></li>
-		<li id="#ldapWizard2"><a href="#ldapWizard2"><?php p($l->t('Users'));?></a></li>
-		<li id="#ldapWizard3"><a href="#ldapWizard3"><?php p($l->t('Login Attributes'));?></a></li>
-		<li id="#ldapWizard4"><a href="#ldapWizard4"><?php p($l->t('Groups'));?></a></li>
-		<li class="ldapSettingsTabs"><a href="#ldapSettings-2"><?php p($l->t('Expert'));?></a></li>
-		<li class="ldapSettingsTabs"><a href="#ldapSettings-1"><?php p($l->t('Advanced'));?></a></li>
+		<li id="#ldapWizard1"><a href="#ldapWizard1"><?php p($l->t('Server')); ?></a></li>
+		<li id="#ldapWizard2"><a href="#ldapWizard2"><?php p($l->t('Users')); ?></a></li>
+		<li id="#ldapWizard3"><a href="#ldapWizard3"><?php p($l->t('Login Attributes')); ?></a></li>
+		<li id="#ldapWizard4"><a href="#ldapWizard4"><?php p($l->t('Groups')); ?></a></li>
+		<li class="ldapSettingsTabs"><a href="#ldapSettings-2"><?php p($l->t('Expert')); ?></a></li>
+		<li class="ldapSettingsTabs"><a href="#ldapSettings-1"><?php p($l->t('Advanced')); ?></a></li>
 	</ul>
 	<?php
 	if (!function_exists('ldap_connect')) {
 		print_unescaped('<p class="ldapwarning">'.$l->t('<b>Warning:</b> The PHP LDAP module is not installed, the backend will not work. Please ask your system administrator to install it.').'</p>');
 	}
 	?>
-	<?php require_once __DIR__ . '/part.wizard-server.php'; ?>
-	<?php require_once __DIR__ . '/part.wizard-userfilter.php'; ?>
-	<?php require_once __DIR__ . '/part.wizard-loginfilter.php'; ?>
-	<?php require_once __DIR__ . '/part.wizard-groupfilter.php'; ?>
+	<?php require_once __DIR__.'/part.wizard-server.php'; ?>
+	<?php require_once __DIR__.'/part.wizard-userfilter.php'; ?>
+	<?php require_once __DIR__.'/part.wizard-loginfilter.php'; ?>
+	<?php require_once __DIR__.'/part.wizard-groupfilter.php'; ?>
 	<fieldset id="ldapSettings-1">
 		<div id="ldapAdvancedAccordion">
-			<h3><?php p($l->t('Connection Settings'));?></h3>
+			<h3><?php p($l->t('Connection Settings')); ?></h3>
 			<div>
-				<p><label for="ldap_configuration_active"><?php p($l->t('Configuration Active'));?></label><input type="checkbox" id="ldap_configuration_active" name="ldap_configuration_active" value="1" data-default="<?php p($_['ldap_configuration_active_default']); ?>"  title="<?php p($l->t('When unchecked, this configuration will be skipped.'));?>" /></p>
-				<p><label for="ldap_backup_host"><?php p($l->t('Backup (Replica) Host'));?></label><input type="text" id="ldap_backup_host" name="ldap_backup_host" data-default="<?php p($_['ldap_backup_host_default']); ?>" title="<?php p($l->t('Give an optional backup host. It must be a replica of the main LDAP/AD server.'));?>"></p>
-				<p><label for="ldap_backup_port"><?php p($l->t('Backup (Replica) Port'));?></label><input type="number" id="ldap_backup_port" name="ldap_backup_port" data-default="<?php p($_['ldap_backup_port_default']); ?>"  /></p>
-				<p><label for="ldap_override_main_server"><?php p($l->t('Disable Main Server'));?></label><input type="checkbox" id="ldap_override_main_server" name="ldap_override_main_server" value="1" data-default="<?php p($_['ldap_override_main_server_default']); ?>"  title="<?php p($l->t('Only connect to the replica server.'));?>" /></p>
-				<p><label for="ldap_turn_off_cert_check"><?php p($l->t('Turn off SSL certificate validation.'));?></label><input type="checkbox" id="ldap_turn_off_cert_check" name="ldap_turn_off_cert_check" title="<?php p($l->t('Not recommended, use it for testing only! If connection only works with this option, import the LDAP server\'s SSL certificate in your %s server.', [$theme->getName()]));?>" data-default="<?php p($_['ldap_turn_off_cert_check_default']); ?>" value="1"><br/></p>
-				<p><label for="ldap_cache_ttl"><?php p($l->t('Cache Time-To-Live'));?></label><input type="number" id="ldap_cache_ttl" name="ldap_cache_ttl" title="<?php p($l->t('in seconds. A change empties the cache.'));?>" data-default="<?php p($_['ldap_cache_ttl_default']); ?>" /></p>
+				<p><label for="ldap_configuration_active"><?php p($l->t('Configuration Active')); ?></label><input type="checkbox" id="ldap_configuration_active" name="ldap_configuration_active" value="1" data-default="<?php p($_['ldap_configuration_active_default']); ?>"  title="<?php p($l->t('When unchecked, this configuration will be skipped.')); ?>" /></p>
+				<p><label for="ldap_backup_host"><?php p($l->t('Backup (Replica) Host')); ?></label><input type="text" id="ldap_backup_host" name="ldap_backup_host" data-default="<?php p($_['ldap_backup_host_default']); ?>" title="<?php p($l->t('Give an optional backup host. It must be a replica of the main LDAP/AD server.')); ?>"></p>
+				<p><label for="ldap_backup_port"><?php p($l->t('Backup (Replica) Port')); ?></label><input type="number" id="ldap_backup_port" name="ldap_backup_port" data-default="<?php p($_['ldap_backup_port_default']); ?>"  /></p>
+				<p><label for="ldap_override_main_server"><?php p($l->t('Disable Main Server')); ?></label><input type="checkbox" id="ldap_override_main_server" name="ldap_override_main_server" value="1" data-default="<?php p($_['ldap_override_main_server_default']); ?>"  title="<?php p($l->t('Only connect to the replica server.')); ?>" /></p>
+				<p><label for="ldap_turn_off_cert_check"><?php p($l->t('Turn off SSL certificate validation.')); ?></label><input type="checkbox" id="ldap_turn_off_cert_check" name="ldap_turn_off_cert_check" title="<?php p($l->t('Not recommended, use it for testing only! If connection only works with this option, import the LDAP server\'s SSL certificate in your %s server.', [$theme->getName()])); ?>" data-default="<?php p($_['ldap_turn_off_cert_check_default']); ?>" value="1"><br/></p>
+				<p><label for="ldap_cache_ttl"><?php p($l->t('Cache Time-To-Live')); ?></label><input type="number" id="ldap_cache_ttl" name="ldap_cache_ttl" title="<?php p($l->t('in seconds. A change empties the cache.')); ?>" data-default="<?php p($_['ldap_cache_ttl_default']); ?>" /></p>
 			</div>
-			<h3><?php p($l->t('Directory Settings'));?></h3>
+			<h3><?php p($l->t('Directory Settings')); ?></h3>
 			<div>
-				<p><label for="ldap_display_name"><?php p($l->t('User Display Name Field'));?></label><input type="text" id="ldap_display_name" name="ldap_display_name" data-default="<?php p($_['ldap_display_name_default']); ?>" title="<?php p($l->t('The LDAP attribute to use to generate the user\'s display name.'));?>" /></p>
-				<p><label for="ldap_user_display_name_2"><?php p($l->t('2nd User Display Name Field'));?></label><input type="text" id="ldap_user_display_name_2" name="ldap_user_display_name_2" data-default="<?php p($_['ldap_user_display_name_2_default']); ?>" title="<?php p($l->t('Optional. An LDAP attribute to be added to the display name in brackets. Results in e.g. »John Doe (john.doe@example.org)«.'));?>" /></p>
-				<p><label for="ldap_base_users"><?php p($l->t('Base User Tree'));?></label><textarea id="ldap_base_users" name="ldap_base_users" placeholder="<?php p($l->t('One User Base DN per line'));?>" data-default="<?php p($_['ldap_base_users_default']); ?>" title="<?php p($l->t('Base User Tree'));?>"></textarea></p>
-				<p><label for="ldap_attributes_for_user_search"><?php p($l->t('User Search Attributes'));?></label><textarea id="ldap_attributes_for_user_search" name="ldap_attributes_for_user_search" placeholder="<?php p($l->t('Optional; one attribute per line'));?>" data-default="<?php p($_['ldap_attributes_for_user_search_default']); ?>" title="<?php p($l->t('User Search Attributes'));?>"></textarea></p>
-				<p><label for="ldap_group_display_name"><?php p($l->t('Group Display Name Field'));?></label><input type="text" id="ldap_group_display_name" name="ldap_group_display_name" data-default="<?php p($_['ldap_group_display_name_default']); ?>" title="<?php p($l->t('The LDAP attribute to use to generate the groups\'s display name.'));?>" /></p>
-				<p><label for="ldap_base_groups"><?php p($l->t('Base Group Tree'));?></label><textarea id="ldap_base_groups" name="ldap_base_groups" placeholder="<?php p($l->t('One Group Base DN per line'));?>" data-default="<?php p($_['ldap_base_groups_default']); ?>" title="<?php p($l->t('Base Group Tree'));?>"></textarea></p>
-				<p><label for="ldap_attributes_for_group_search"><?php p($l->t('Group Search Attributes'));?></label><textarea id="ldap_attributes_for_group_search" name="ldap_attributes_for_group_search" placeholder="<?php p($l->t('Optional; one attribute per line'));?>" data-default="<?php p($_['ldap_attributes_for_group_search_default']); ?>" title="<?php p($l->t('Group Search Attributes'));?>"></textarea></p>
-				<p><label for="ldap_group_member_assoc_attribute"><?php p($l->t('Group-Member association'));?></label><select id="ldap_group_member_assoc_attribute" name="ldap_group_member_assoc_attribute" data-default="<?php p($_['ldap_group_member_assoc_attribute_default']); ?>" ><option value="uniqueMember"<?php if (isset($_['ldap_group_member_assoc_attribute']) && ($_['ldap_group_member_assoc_attribute'] === 'uniqueMember')) {
+				<p><label for="ldap_display_name"><?php p($l->t('User Display Name Field')); ?></label><input type="text" id="ldap_display_name" name="ldap_display_name" data-default="<?php p($_['ldap_display_name_default']); ?>" title="<?php p($l->t('The LDAP attribute to use to generate the user\'s display name.')); ?>" /></p>
+				<p><label for="ldap_user_display_name_2"><?php p($l->t('2nd User Display Name Field')); ?></label><input type="text" id="ldap_user_display_name_2" name="ldap_user_display_name_2" data-default="<?php p($_['ldap_user_display_name_2_default']); ?>" title="<?php p($l->t('Optional. An LDAP attribute to be added to the display name in brackets. Results in e.g. »John Doe (john.doe@example.org)«.')); ?>" /></p>
+				<p><label for="ldap_base_users"><?php p($l->t('Base User Tree')); ?></label><textarea id="ldap_base_users" name="ldap_base_users" placeholder="<?php p($l->t('One User Base DN per line')); ?>" data-default="<?php p($_['ldap_base_users_default']); ?>" title="<?php p($l->t('Base User Tree')); ?>"></textarea></p>
+				<p><label for="ldap_attributes_for_user_search"><?php p($l->t('User Search Attributes')); ?></label><textarea id="ldap_attributes_for_user_search" name="ldap_attributes_for_user_search" placeholder="<?php p($l->t('Optional; one attribute per line')); ?>" data-default="<?php p($_['ldap_attributes_for_user_search_default']); ?>" title="<?php p($l->t('User Search Attributes')); ?>"></textarea></p>
+				<p><label for="ldap_group_display_name"><?php p($l->t('Group Display Name Field')); ?></label><input type="text" id="ldap_group_display_name" name="ldap_group_display_name" data-default="<?php p($_['ldap_group_display_name_default']); ?>" title="<?php p($l->t('The LDAP attribute to use to generate the groups\'s display name.')); ?>" /></p>
+				<p><label for="ldap_base_groups"><?php p($l->t('Base Group Tree')); ?></label><textarea id="ldap_base_groups" name="ldap_base_groups" placeholder="<?php p($l->t('One Group Base DN per line')); ?>" data-default="<?php p($_['ldap_base_groups_default']); ?>" title="<?php p($l->t('Base Group Tree')); ?>"></textarea></p>
+				<p><label for="ldap_attributes_for_group_search"><?php p($l->t('Group Search Attributes')); ?></label><textarea id="ldap_attributes_for_group_search" name="ldap_attributes_for_group_search" placeholder="<?php p($l->t('Optional; one attribute per line')); ?>" data-default="<?php p($_['ldap_attributes_for_group_search_default']); ?>" title="<?php p($l->t('Group Search Attributes')); ?>"></textarea></p>
+				<p><label for="ldap_group_member_assoc_attribute"><?php p($l->t('Group-Member association')); ?></label><select id="ldap_group_member_assoc_attribute" name="ldap_group_member_assoc_attribute" data-default="<?php p($_['ldap_group_member_assoc_attribute_default']); ?>" ><option value="uniqueMember"<?php if (isset($_['ldap_group_member_assoc_attribute']) && ($_['ldap_group_member_assoc_attribute'] === 'uniqueMember')) {
 		p(' selected');
 	} ?>>uniqueMember</option><option value="memberUid"<?php if (isset($_['ldap_group_member_assoc_attribute']) && ($_['ldap_group_member_assoc_attribute'] === 'memberUid')) {
 		p(' selected');
@@ -106,35 +106,35 @@ 
 	} ?>>gidNumber</option><option value="zimbraMailForwardingAddress"<?php if (isset($_['ldap_group_member_assoc_attribute']) && ($_['ldap_group_member_assoc_attribute'] === 'zimbraMailForwardingAddress')) {
 		p(' selected');
 	} ?>>zimbraMailForwardingAddress</option></select></p>
-				<p><label for="ldap_dynamic_group_member_url"><?php p($l->t('Dynamic Group Member URL'));?></label><input type="text" id="ldap_dynamic_group_member_url" name="ldap_dynamic_group_member_url" title="<?php p($l->t('The LDAP attribute that on group objects contains an LDAP search URL that determines what objects belong to the group. (An empty setting disables dynamic group membership functionality.)'));?>" data-default="<?php p($_['ldap_dynamic_group_member_url_default']); ?>" /></p>
-				<p><label for="ldap_nested_groups"><?php p($l->t('Nested Groups'));?></label><input type="checkbox" id="ldap_nested_groups" name="ldap_nested_groups" value="1" data-default="<?php p($_['ldap_nested_groups_default']); ?>"  title="<?php p($l->t('When switched on, groups that contain groups are supported. (Only works if the group member attribute contains DNs.)'));?>" /></p>
-				<p><label for="ldap_paging_size"><?php p($l->t('Paging chunksize'));?></label><input type="number" id="ldap_paging_size" name="ldap_paging_size" title="<?php p($l->t('Chunksize used for paged LDAP searches that may return bulky results like user or group enumeration. (Setting it 0 disables paged LDAP searches in those situations.)'));?>" data-default="<?php p($_['ldap_paging_size_default']); ?>" /></p>
-				<p><label for="ldap_turn_on_pwd_change"><?php p($l->t('Enable LDAP password changes per user'));?></label><span class="inlinetable"><span class="tablerow left"><input type="checkbox" id="ldap_turn_on_pwd_change" name="ldap_turn_on_pwd_change" value="1" data-default="<?php p($_['ldap_turn_on_pwd_change_default']); ?>" title="<?php p($l->t('Allow LDAP users to change their password and allow Super Administrators and Group Administrators to change the password of their LDAP users. Only works when access control policies are configured accordingly on the LDAP server. As passwords are sent in plaintext to the LDAP server, transport encryption must be used and password hashing should be configured on the LDAP server.'));?>" /><span class="tablecell"><?php p($l->t('(New password is sent as plain text to LDAP)'));?></span></span>
+				<p><label for="ldap_dynamic_group_member_url"><?php p($l->t('Dynamic Group Member URL')); ?></label><input type="text" id="ldap_dynamic_group_member_url" name="ldap_dynamic_group_member_url" title="<?php p($l->t('The LDAP attribute that on group objects contains an LDAP search URL that determines what objects belong to the group. (An empty setting disables dynamic group membership functionality.)')); ?>" data-default="<?php p($_['ldap_dynamic_group_member_url_default']); ?>" /></p>
+				<p><label for="ldap_nested_groups"><?php p($l->t('Nested Groups')); ?></label><input type="checkbox" id="ldap_nested_groups" name="ldap_nested_groups" value="1" data-default="<?php p($_['ldap_nested_groups_default']); ?>"  title="<?php p($l->t('When switched on, groups that contain groups are supported. (Only works if the group member attribute contains DNs.)')); ?>" /></p>
+				<p><label for="ldap_paging_size"><?php p($l->t('Paging chunksize')); ?></label><input type="number" id="ldap_paging_size" name="ldap_paging_size" title="<?php p($l->t('Chunksize used for paged LDAP searches that may return bulky results like user or group enumeration. (Setting it 0 disables paged LDAP searches in those situations.)')); ?>" data-default="<?php p($_['ldap_paging_size_default']); ?>" /></p>
+				<p><label for="ldap_turn_on_pwd_change"><?php p($l->t('Enable LDAP password changes per user')); ?></label><span class="inlinetable"><span class="tablerow left"><input type="checkbox" id="ldap_turn_on_pwd_change" name="ldap_turn_on_pwd_change" value="1" data-default="<?php p($_['ldap_turn_on_pwd_change_default']); ?>" title="<?php p($l->t('Allow LDAP users to change their password and allow Super Administrators and Group Administrators to change the password of their LDAP users. Only works when access control policies are configured accordingly on the LDAP server. As passwords are sent in plaintext to the LDAP server, transport encryption must be used and password hashing should be configured on the LDAP server.')); ?>" /><span class="tablecell"><?php p($l->t('(New password is sent as plain text to LDAP)')); ?></span></span>
 			</span><br/></p>
-				<p><label for="ldap_default_ppolicy_dn"><?php p($l->t('Default password policy DN'));?></label><input type="text" id="ldap_default_ppolicy_dn" name="ldap_default_ppolicy_dn" title="<?php p($l->t('The DN of a default password policy that will be used for password expiry handling. Works only when LDAP password changes per user are enabled and is only supported by OpenLDAP. Leave empty to disable password expiry handling.'));?>" data-default="<?php p($_['ldap_default_ppolicy_dn_default']); ?>" /></p>
+				<p><label for="ldap_default_ppolicy_dn"><?php p($l->t('Default password policy DN')); ?></label><input type="text" id="ldap_default_ppolicy_dn" name="ldap_default_ppolicy_dn" title="<?php p($l->t('The DN of a default password policy that will be used for password expiry handling. Works only when LDAP password changes per user are enabled and is only supported by OpenLDAP. Leave empty to disable password expiry handling.')); ?>" data-default="<?php p($_['ldap_default_ppolicy_dn_default']); ?>" /></p>
 			</div>
-			<h3><?php p($l->t('Special Attributes'));?></h3>
+			<h3><?php p($l->t('Special Attributes')); ?></h3>
 			<div>
-				<p><label for="ldap_quota_attr"><?php p($l->t('Quota Field'));?></label><input type="text" id="ldap_quota_attr" name="ldap_quota_attr" data-default="<?php p($_['ldap_quota_attr_default']); ?>" title="<?php p($l->t('Leave empty for user\'s default quota. Otherwise, specify an LDAP/AD attribute.'));?>" /></p>
-				<p><label for="ldap_quota_def"><?php p($l->t('Quota Default'));?></label><input type="text" id="ldap_quota_def" name="ldap_quota_def" data-default="<?php p($_['ldap_quota_def_default']); ?>" title="<?php p($l->t('Override default quota for LDAP users who do not have a quota set in the Quota Field.'));?>" /></p>
-				<p><label for="ldap_email_attr"><?php p($l->t('Email Field'));?></label><input type="text" id="ldap_email_attr" name="ldap_email_attr" data-default="<?php p($_['ldap_email_attr_default']); ?>" title="<?php p($l->t('Set the user\'s email from their LDAP attribute. Leave it empty for default behaviour.'));?>" /></p>
-				<p><label for="home_folder_naming_rule"><?php p($l->t('User Home Folder Naming Rule'));?></label><input type="text" id="home_folder_naming_rule" name="home_folder_naming_rule" title="<?php p($l->t('Leave empty for username (default). Otherwise, specify an LDAP/AD attribute.'));?>" data-default="<?php p($_['home_folder_naming_rule_default']); ?>" /></p>
+				<p><label for="ldap_quota_attr"><?php p($l->t('Quota Field')); ?></label><input type="text" id="ldap_quota_attr" name="ldap_quota_attr" data-default="<?php p($_['ldap_quota_attr_default']); ?>" title="<?php p($l->t('Leave empty for user\'s default quota. Otherwise, specify an LDAP/AD attribute.')); ?>" /></p>
+				<p><label for="ldap_quota_def"><?php p($l->t('Quota Default')); ?></label><input type="text" id="ldap_quota_def" name="ldap_quota_def" data-default="<?php p($_['ldap_quota_def_default']); ?>" title="<?php p($l->t('Override default quota for LDAP users who do not have a quota set in the Quota Field.')); ?>" /></p>
+				<p><label for="ldap_email_attr"><?php p($l->t('Email Field')); ?></label><input type="text" id="ldap_email_attr" name="ldap_email_attr" data-default="<?php p($_['ldap_email_attr_default']); ?>" title="<?php p($l->t('Set the user\'s email from their LDAP attribute. Leave it empty for default behaviour.')); ?>" /></p>
+				<p><label for="home_folder_naming_rule"><?php p($l->t('User Home Folder Naming Rule')); ?></label><input type="text" id="home_folder_naming_rule" name="home_folder_naming_rule" title="<?php p($l->t('Leave empty for username (default). Otherwise, specify an LDAP/AD attribute.')); ?>" data-default="<?php p($_['home_folder_naming_rule_default']); ?>" /></p>
 				<p><label for="ldap_ext_storage_home_attribute"> <?php p($l->t('"$home" Placeholder Field')); ?></label><input type="text" id="ldap_ext_storage_home_attribute" name="ldap_ext_storage_home_attribute" title="<?php p($l->t('$home in an external storage configuration will be replaced with the value of the specified attribute')); ?>" data-default="<?php p($_['ldap_ext_storage_home_attribute_default']); ?>"></p>
 			</div>
 		</div>
 		<?php print_unescaped($_['settingControls']); ?>
 	</fieldset>
 	<fieldset id="ldapSettings-2">
-		<p><strong><?php p($l->t('Internal Username'));?></strong></p>
-		<p class="ldapIndent"><?php p($l->t('By default the internal username will be created from the UUID attribute. It makes sure that the username is unique and characters do not need to be converted. The internal username has the restriction that only these characters are allowed: [ a-zA-Z0-9_.@- ].  Other characters are replaced with their ASCII correspondence or simply omitted. On collisions a number will be added/increased. The internal username is used to identify a user internally. It is also the default name for the user home folder. It is also a part of remote URLs, for instance for all *DAV services. With this setting, the default behavior can be overridden. Leave it empty for default behavior. Changes will have effect only on newly mapped (added) LDAP users.'));?></p>
-		<p class="ldapIndent"><label for="ldap_expert_username_attr"><?php p($l->t('Internal Username Attribute:'));?></label><input type="text" id="ldap_expert_username_attr" name="ldap_expert_username_attr" data-default="<?php p($_['ldap_expert_username_attr_default']); ?>" /></p>
-		<p><strong><?php p($l->t('Override UUID detection'));?></strong></p>
-		<p class="ldapIndent"><?php p($l->t('By default, the UUID attribute is automatically detected. The UUID attribute is used to doubtlessly identify LDAP users and groups. Also, the internal username will be created based on the UUID, if not specified otherwise above. You can override the setting and pass an attribute of your choice. You must make sure that the attribute of your choice can be fetched for both users and groups and it is unique. Leave it empty for default behavior. Changes will have effect only on newly mapped (added) LDAP users and groups.'));?></p>
-		<p class="ldapIndent"><label for="ldap_expert_uuid_user_attr"><?php p($l->t('UUID Attribute for Users:'));?></label><input type="text" id="ldap_expert_uuid_user_attr" name="ldap_expert_uuid_user_attr" data-default="<?php p($_['ldap_expert_uuid_user_attr_default']); ?>" /></p>
-		<p class="ldapIndent"><label for="ldap_expert_uuid_group_attr"><?php p($l->t('UUID Attribute for Groups:'));?></label><input type="text" id="ldap_expert_uuid_group_attr" name="ldap_expert_uuid_group_attr" data-default="<?php p($_['ldap_expert_uuid_group_attr_default']); ?>" /></p>
-		<p><strong><?php p($l->t('Username-LDAP User Mapping'));?></strong></p>
-		<p class="ldapIndent"><?php p($l->t('Usernames are used to store and assign metadata. In order to precisely identify and recognize users, each LDAP user will have an internal username. This requires a mapping from username to LDAP user. The created username is mapped to the UUID of the LDAP user. Additionally the DN is cached as well to reduce LDAP interaction, but it is not used for identification. If the DN changes, the changes will be found. The internal username is used all over. Clearing the mappings will have leftovers everywhere. Clearing the mappings is not configuration sensitive, it affects all LDAP configurations! Never clear the mappings in a production environment, only in a testing or experimental stage.'));?></p>
-		<p class="ldapIndent"><button type="button" id="ldap_action_clear_user_mappings" name="ldap_action_clear_user_mappings"><?php p($l->t('Clear Username-LDAP User Mapping'));?></button><br/><button type="button" id="ldap_action_clear_group_mappings" name="ldap_action_clear_group_mappings"><?php p($l->t('Clear Groupname-LDAP Group Mapping'));?></button></p>
+		<p><strong><?php p($l->t('Internal Username')); ?></strong></p>
+		<p class="ldapIndent"><?php p($l->t('By default the internal username will be created from the UUID attribute. It makes sure that the username is unique and characters do not need to be converted. The internal username has the restriction that only these characters are allowed: [ a-zA-Z0-9_.@- ].  Other characters are replaced with their ASCII correspondence or simply omitted. On collisions a number will be added/increased. The internal username is used to identify a user internally. It is also the default name for the user home folder. It is also a part of remote URLs, for instance for all *DAV services. With this setting, the default behavior can be overridden. Leave it empty for default behavior. Changes will have effect only on newly mapped (added) LDAP users.')); ?></p>
+		<p class="ldapIndent"><label for="ldap_expert_username_attr"><?php p($l->t('Internal Username Attribute:')); ?></label><input type="text" id="ldap_expert_username_attr" name="ldap_expert_username_attr" data-default="<?php p($_['ldap_expert_username_attr_default']); ?>" /></p>
+		<p><strong><?php p($l->t('Override UUID detection')); ?></strong></p>
+		<p class="ldapIndent"><?php p($l->t('By default, the UUID attribute is automatically detected. The UUID attribute is used to doubtlessly identify LDAP users and groups. Also, the internal username will be created based on the UUID, if not specified otherwise above. You can override the setting and pass an attribute of your choice. You must make sure that the attribute of your choice can be fetched for both users and groups and it is unique. Leave it empty for default behavior. Changes will have effect only on newly mapped (added) LDAP users and groups.')); ?></p>
+		<p class="ldapIndent"><label for="ldap_expert_uuid_user_attr"><?php p($l->t('UUID Attribute for Users:')); ?></label><input type="text" id="ldap_expert_uuid_user_attr" name="ldap_expert_uuid_user_attr" data-default="<?php p($_['ldap_expert_uuid_user_attr_default']); ?>" /></p>
+		<p class="ldapIndent"><label for="ldap_expert_uuid_group_attr"><?php p($l->t('UUID Attribute for Groups:')); ?></label><input type="text" id="ldap_expert_uuid_group_attr" name="ldap_expert_uuid_group_attr" data-default="<?php p($_['ldap_expert_uuid_group_attr_default']); ?>" /></p>
+		<p><strong><?php p($l->t('Username-LDAP User Mapping')); ?></strong></p>
+		<p class="ldapIndent"><?php p($l->t('Usernames are used to store and assign metadata. In order to precisely identify and recognize users, each LDAP user will have an internal username. This requires a mapping from username to LDAP user. The created username is mapped to the UUID of the LDAP user. Additionally the DN is cached as well to reduce LDAP interaction, but it is not used for identification. If the DN changes, the changes will be found. The internal username is used all over. Clearing the mappings will have leftovers everywhere. Clearing the mappings is not configuration sensitive, it affects all LDAP configurations! Never clear the mappings in a production environment, only in a testing or experimental stage.')); ?></p>
+		<p class="ldapIndent"><button type="button" id="ldap_action_clear_user_mappings" name="ldap_action_clear_user_mappings"><?php p($l->t('Clear Username-LDAP User Mapping')); ?></button><br/><button type="button" id="ldap_action_clear_group_mappings" name="ldap_action_clear_group_mappings"><?php p($l->t('Clear Groupname-LDAP Group Mapping')); ?></button></p>
 		<?php print_unescaped($_['settingControls']); ?>
 	</fieldset>
 	</div>