nextcloud / server

apps/user_ldap/lib/Mapping/AbstractMapping.php

Indentation +239 added lines, -239 removed lines

@@ -30,293 +30,293 @@
 * @package OCA\User_LDAP\Mapping
 */
 abstract class AbstractMapping {
-	/**
-	 * @var \OCP\IDBConnection $dbc
-	 */
-	protected $dbc;
+    /**
+     * @var \OCP\IDBConnection $dbc
+     */
+    protected $dbc;
 
-	/**
-	 * returns the DB table name which holds the mappings
-	 * @return string
-	 */
-	abstract protected function getTableName();
+    /**
+     * returns the DB table name which holds the mappings
+     * @return string
+     */
+    abstract protected function getTableName();
 
-	/**
-	 * @param \OCP\IDBConnection $dbc
-	 */
-	public function __construct(\OCP\IDBConnection $dbc) {
-		$this->dbc = $dbc;
-	}
+    /**
+     * @param \OCP\IDBConnection $dbc
+     */
+    public function __construct(\OCP\IDBConnection $dbc) {
+        $this->dbc = $dbc;
+    }
 
-	/**
-	 * checks whether a provided string represents an existing table col
-	 * @param string $col
-	 * @return bool
-	 */
-	public function isColNameValid($col) {
-		switch($col) {
-			case 'ldap_dn':
-			case 'owncloud_name':
-			case 'directory_uuid':
-				return true;
-			default:
-				return false;
-		}
-	}
+    /**
+     * checks whether a provided string represents an existing table col
+     * @param string $col
+     * @return bool
+     */
+    public function isColNameValid($col) {
+        switch($col) {
+            case 'ldap_dn':
+            case 'owncloud_name':
+            case 'directory_uuid':
+                return true;
+            default:
+                return false;
+        }
+    }
 
-	/**
-	 * Gets the value of one column based on a provided value of another column
-	 * @param string $fetchCol
-	 * @param string $compareCol
-	 * @param string $search
-	 * @throws \Exception
-	 * @return string|false
-	 */
-	protected function getXbyY($fetchCol, $compareCol, $search) {
-		if(!$this->isColNameValid($fetchCol)) {
-			//this is used internally only, but we don't want to risk
-			//having SQL injection at all.
-			throw new \Exception('Invalid Column Name');
-		}
-		$query = $this->dbc->prepare('
+    /**
+     * Gets the value of one column based on a provided value of another column
+     * @param string $fetchCol
+     * @param string $compareCol
+     * @param string $search
+     * @throws \Exception
+     * @return string|false
+     */
+    protected function getXbyY($fetchCol, $compareCol, $search) {
+        if(!$this->isColNameValid($fetchCol)) {
+            //this is used internally only, but we don't want to risk
+            //having SQL injection at all.
+            throw new \Exception('Invalid Column Name');
+        }
+        $query = $this->dbc->prepare('
 			SELECT `' . $fetchCol . '`
 			FROM `'. $this->getTableName() .'`
 			WHERE `' . $compareCol . '` = ?
 		');
 
-		$res = $query->execute([$search]);
-		if($res !== false) {
-			return $query->fetchColumn();
-		}
+        $res = $query->execute([$search]);
+        if($res !== false) {
+            return $query->fetchColumn();
+        }
 
-		return false;
-	}
+        return false;
+    }
 
-	/**
-	 * Performs a DELETE or UPDATE query to the database.
-	 * @param \Doctrine\DBAL\Driver\Statement $query
-	 * @param array $parameters
-	 * @return bool true if at least one row was modified, false otherwise
-	 */
-	protected function modify($query, $parameters) {
-		$result = $query->execute($parameters);
-		return ($result === true && $query->rowCount() > 0);
-	}
+    /**
+     * Performs a DELETE or UPDATE query to the database.
+     * @param \Doctrine\DBAL\Driver\Statement $query
+     * @param array $parameters
+     * @return bool true if at least one row was modified, false otherwise
+     */
+    protected function modify($query, $parameters) {
+        $result = $query->execute($parameters);
+        return ($result === true && $query->rowCount() > 0);
+    }
 
-	/**
-	 * Gets the LDAP DN based on the provided name.
-	 * Replaces Access::ocname2dn
-	 * @param string $name
-	 * @return string|false
-	 */
-	public function getDNByName($name) {
-		return $this->getXbyY('ldap_dn', 'owncloud_name', $name);
-	}
+    /**
+     * Gets the LDAP DN based on the provided name.
+     * Replaces Access::ocname2dn
+     * @param string $name
+     * @return string|false
+     */
+    public function getDNByName($name) {
+        return $this->getXbyY('ldap_dn', 'owncloud_name', $name);
+    }
 
-	/**
-	 * Updates the DN based on the given UUID
-	 * @param string $fdn
-	 * @param string $uuid
-	 * @return bool
-	 */
-	public function setDNbyUUID($fdn, $uuid) {
-		$query = $this->dbc->prepare('
+    /**
+     * Updates the DN based on the given UUID
+     * @param string $fdn
+     * @param string $uuid
+     * @return bool
+     */
+    public function setDNbyUUID($fdn, $uuid) {
+        $query = $this->dbc->prepare('
 			UPDATE `' . $this->getTableName() . '`
 			SET `ldap_dn` = ?
 			WHERE `directory_uuid` = ?
 		');
 
-		return $this->modify($query, [$fdn, $uuid]);
-	}
+        return $this->modify($query, [$fdn, $uuid]);
+    }
 
-	/**
-	 * Updates the UUID based on the given DN
-	 *
-	 * required by Migration/UUIDFix
-	 *
-	 * @param $uuid
-	 * @param $fdn
-	 * @return bool
-	 */
-	public function setUUIDbyDN($uuid, $fdn) {
-		$query = $this->dbc->prepare('
+    /**
+     * Updates the UUID based on the given DN
+     *
+     * required by Migration/UUIDFix
+     *
+     * @param $uuid
+     * @param $fdn
+     * @return bool
+     */
+    public function setUUIDbyDN($uuid, $fdn) {
+        $query = $this->dbc->prepare('
 			UPDATE `' . $this->getTableName() . '`
 			SET `directory_uuid` = ?
 			WHERE `ldap_dn` = ?
 		');
 
-		return $this->modify($query, [$uuid, $fdn]);
-	}
+        return $this->modify($query, [$uuid, $fdn]);
+    }
 
-	/**
-	 * Gets the name based on the provided LDAP DN.
-	 * @param string $fdn
-	 * @return string|false
-	 */
-	public function getNameByDN($fdn) {
-		return $this->getXbyY('owncloud_name', 'ldap_dn', $fdn);
-	}
+    /**
+     * Gets the name based on the provided LDAP DN.
+     * @param string $fdn
+     * @return string|false
+     */
+    public function getNameByDN($fdn) {
+        return $this->getXbyY('owncloud_name', 'ldap_dn', $fdn);
+    }
 
-	/**
-	 * Searches mapped names by the giving string in the name column
-	 * @param string $search
-	 * @param string $prefixMatch
-	 * @param string $postfixMatch
-	 * @return string[]
-	 */
-	public function getNamesBySearch($search, $prefixMatch = "", $postfixMatch = "") {
-		$query = $this->dbc->prepare('
+    /**
+     * Searches mapped names by the giving string in the name column
+     * @param string $search
+     * @param string $prefixMatch
+     * @param string $postfixMatch
+     * @return string[]
+     */
+    public function getNamesBySearch($search, $prefixMatch = "", $postfixMatch = "") {
+        $query = $this->dbc->prepare('
 			SELECT `owncloud_name`
 			FROM `'. $this->getTableName() .'`
 			WHERE `owncloud_name` LIKE ?
 		');
 
-		$res = $query->execute([$prefixMatch.$this->dbc->escapeLikeParameter($search).$postfixMatch]);
-		$names = [];
-		if($res !== false) {
-			while($row = $query->fetch()) {
-				$names[] = $row['owncloud_name'];
-			}
-		}
-		return $names;
-	}
+        $res = $query->execute([$prefixMatch.$this->dbc->escapeLikeParameter($search).$postfixMatch]);
+        $names = [];
+        if($res !== false) {
+            while($row = $query->fetch()) {
+                $names[] = $row['owncloud_name'];
+            }
+        }
+        return $names;
+    }
 
-	/**
-	 * Gets the name based on the provided LDAP UUID.
-	 * @param string $uuid
-	 * @return string|false
-	 */
-	public function getNameByUUID($uuid) {
-		return $this->getXbyY('owncloud_name', 'directory_uuid', $uuid);
-	}
+    /**
+     * Gets the name based on the provided LDAP UUID.
+     * @param string $uuid
+     * @return string|false
+     */
+    public function getNameByUUID($uuid) {
+        return $this->getXbyY('owncloud_name', 'directory_uuid', $uuid);
+    }
 
-	/**
-	 * Gets the UUID based on the provided LDAP DN
-	 * @param string $dn
-	 * @return false|string
-	 * @throws \Exception
-	 */
-	public function getUUIDByDN($dn) {
-		return $this->getXbyY('directory_uuid', 'ldap_dn', $dn);
-	}
+    /**
+     * Gets the UUID based on the provided LDAP DN
+     * @param string $dn
+     * @return false|string
+     * @throws \Exception
+     */
+    public function getUUIDByDN($dn) {
+        return $this->getXbyY('directory_uuid', 'ldap_dn', $dn);
+    }
 
-	/**
-	 * gets a piece of the mapping list
-	 * @param int $offset
-	 * @param int $limit
-	 * @return array
-	 */
-	public function getList($offset = null, $limit = null) {
-		$query = $this->dbc->prepare('
+    /**
+     * gets a piece of the mapping list
+     * @param int $offset
+     * @param int $limit
+     * @return array
+     */
+    public function getList($offset = null, $limit = null) {
+        $query = $this->dbc->prepare('
 			SELECT
 				`ldap_dn` AS `dn`,
 				`owncloud_name` AS `name`,
 				`directory_uuid` AS `uuid`
 			FROM `' . $this->getTableName() . '`',
-			$limit,
-			$offset
-		);
+            $limit,
+            $offset
+        );
 
-		$query->execute();
-		return $query->fetchAll();
-	}
+        $query->execute();
+        return $query->fetchAll();
+    }
 
-	/**
-	 * attempts to map the given entry
-	 * @param string $fdn fully distinguished name (from LDAP)
-	 * @param string $name
-	 * @param string $uuid a unique identifier as used in LDAP
-	 * @return bool
-	 */
-	public function map($fdn, $name, $uuid) {
-		if(mb_strlen($fdn) > 255) {
-			\OC::$server->getLogger()->error(
-				'Cannot map, because the DN exceeds 255 characters: {dn}',
-				[
-					'app' => 'user_ldap',
-					'dn' => $fdn,
-				]
-			);
-			return false;
-		}
+    /**
+     * attempts to map the given entry
+     * @param string $fdn fully distinguished name (from LDAP)
+     * @param string $name
+     * @param string $uuid a unique identifier as used in LDAP
+     * @return bool
+     */
+    public function map($fdn, $name, $uuid) {
+        if(mb_strlen($fdn) > 255) {
+            \OC::$server->getLogger()->error(
+                'Cannot map, because the DN exceeds 255 characters: {dn}',
+                [
+                    'app' => 'user_ldap',
+                    'dn' => $fdn,
+                ]
+            );
+            return false;
+        }
 
-		$row = [
-			'ldap_dn'        => $fdn,
-			'owncloud_name'  => $name,
-			'directory_uuid' => $uuid
-		];
+        $row = [
+            'ldap_dn'        => $fdn,
+            'owncloud_name'  => $name,
+            'directory_uuid' => $uuid
+        ];
 
-		try {
-			$result = $this->dbc->insertIfNotExist($this->getTableName(), $row);
-			// insertIfNotExist returns values as int
-			return (bool)$result;
-		} catch (\Exception $e) {
-			return false;
-		}
-	}
+        try {
+            $result = $this->dbc->insertIfNotExist($this->getTableName(), $row);
+            // insertIfNotExist returns values as int
+            return (bool)$result;
+        } catch (\Exception $e) {
+            return false;
+        }
+    }
 
-	/**
-	 * removes a mapping based on the owncloud_name of the entry
-	 * @param string $name
-	 * @return bool
-	 */
-	public function unmap($name) {
-		$query = $this->dbc->prepare('
+    /**
+     * removes a mapping based on the owncloud_name of the entry
+     * @param string $name
+     * @return bool
+     */
+    public function unmap($name) {
+        $query = $this->dbc->prepare('
 			DELETE FROM `'. $this->getTableName() .'`
 			WHERE `owncloud_name` = ?');
 
-		return $this->modify($query, [$name]);
-	}
+        return $this->modify($query, [$name]);
+    }
 
-	/**
-	 * Truncate's the mapping table
-	 * @return bool
-	 */
-	public function clear() {
-		$sql = $this->dbc
-			->getDatabasePlatform()
-			->getTruncateTableSQL('`' . $this->getTableName() . '`');
-		return $this->dbc->prepare($sql)->execute();
-	}
+    /**
+     * Truncate's the mapping table
+     * @return bool
+     */
+    public function clear() {
+        $sql = $this->dbc
+            ->getDatabasePlatform()
+            ->getTruncateTableSQL('`' . $this->getTableName() . '`');
+        return $this->dbc->prepare($sql)->execute();
+    }
 
-	/**
-	 * clears the mapping table one by one and executing a callback with
-	 * each row's id (=owncloud_name col)
-	 *
-	 * @param callable $preCallback
-	 * @param callable $postCallback
-	 * @return bool true on success, false when at least one row was not
-	 * deleted
-	 */
-	public function clearCb(Callable $preCallback, Callable $postCallback): bool {
-		$picker = $this->dbc->getQueryBuilder();
-		$picker->select('owncloud_name')
-			->from($this->getTableName());
-		$cursor = $picker->execute();
-		$result = true;
-		while($id = $cursor->fetchColumn(0)) {
-			$preCallback($id);
-			if($isUnmapped = $this->unmap($id)) {
-				$postCallback($id);
-			}
-			$result &= $isUnmapped;
-		}
-		$cursor->closeCursor();
-		return $result;
-	}
+    /**
+     * clears the mapping table one by one and executing a callback with
+     * each row's id (=owncloud_name col)
+     *
+     * @param callable $preCallback
+     * @param callable $postCallback
+     * @return bool true on success, false when at least one row was not
+     * deleted
+     */
+    public function clearCb(Callable $preCallback, Callable $postCallback): bool {
+        $picker = $this->dbc->getQueryBuilder();
+        $picker->select('owncloud_name')
+            ->from($this->getTableName());
+        $cursor = $picker->execute();
+        $result = true;
+        while($id = $cursor->fetchColumn(0)) {
+            $preCallback($id);
+            if($isUnmapped = $this->unmap($id)) {
+                $postCallback($id);
+            }
+            $result &= $isUnmapped;
+        }
+        $cursor->closeCursor();
+        return $result;
+    }
 
-	/**
-	 * returns the number of entries in the mappings table
-	 *
-	 * @return int
-	 */
-	public function count() {
-		$qb = $this->dbc->getQueryBuilder();
-		$query = $qb->select($qb->func()->count('ldap_dn'))
-			->from($this->getTableName());
-		$res = $query->execute();
-		$count = $res->fetchColumn();
-		$res->closeCursor();
-		return (int)$count;
-	}
+    /**
+     * returns the number of entries in the mappings table
+     *
+     * @return int
+     */
+    public function count() {
+        $qb = $this->dbc->getQueryBuilder();
+        $query = $qb->select($qb->func()->count('ldap_dn'))
+            ->from($this->getTableName());
+        $res = $query->execute();
+        $count = $res->fetchColumn();
+        $res->closeCursor();
+        return (int)$count;
+    }
 }

Spacing +19 added lines, -19 removed lines

@@ -54,7 +54,7 @@ 
 	 * @return bool
 	 */
 	public function isColNameValid($col) {
-		switch($col) {
+		switch ($col) {
 			case 'ldap_dn':
 			case 'owncloud_name':
 			case 'directory_uuid':
@@ -73,19 +73,19 @@ 
 	 * @return string|false
 	 */
 	protected function getXbyY($fetchCol, $compareCol, $search) {
-		if(!$this->isColNameValid($fetchCol)) {
+		if (!$this->isColNameValid($fetchCol)) {
 			//this is used internally only, but we don't want to risk
 			//having SQL injection at all.
 			throw new \Exception('Invalid Column Name');
 		}
 		$query = $this->dbc->prepare('
-			SELECT `' . $fetchCol . '`
-			FROM `'. $this->getTableName() .'`
-			WHERE `' . $compareCol . '` = ?
+			SELECT `' . $fetchCol.'`
+			FROM `'. $this->getTableName().'`
+			WHERE `' . $compareCol.'` = ?
 		');
 
 		$res = $query->execute([$search]);
-		if($res !== false) {
+		if ($res !== false) {
 			return $query->fetchColumn();
 		}
 
@@ -121,7 +121,7 @@ 
 	 */
 	public function setDNbyUUID($fdn, $uuid) {
 		$query = $this->dbc->prepare('
-			UPDATE `' . $this->getTableName() . '`
+			UPDATE `' . $this->getTableName().'`
 			SET `ldap_dn` = ?
 			WHERE `directory_uuid` = ?
 		');
@@ -140,7 +140,7 @@ 
 	 */
 	public function setUUIDbyDN($uuid, $fdn) {
 		$query = $this->dbc->prepare('
-			UPDATE `' . $this->getTableName() . '`
+			UPDATE `' . $this->getTableName().'`
 			SET `directory_uuid` = ?
 			WHERE `ldap_dn` = ?
 		');
@@ -167,14 +167,14 @@ 
 	public function getNamesBySearch($search, $prefixMatch = "", $postfixMatch = "") {
 		$query = $this->dbc->prepare('
 			SELECT `owncloud_name`
-			FROM `'. $this->getTableName() .'`
+			FROM `'. $this->getTableName().'`
 			WHERE `owncloud_name` LIKE ?
 		');
 
 		$res = $query->execute([$prefixMatch.$this->dbc->escapeLikeParameter($search).$postfixMatch]);
 		$names = [];
-		if($res !== false) {
-			while($row = $query->fetch()) {
+		if ($res !== false) {
+			while ($row = $query->fetch()) {
 				$names[] = $row['owncloud_name'];
 			}
 		}
@@ -212,7 +212,7 @@ 
 				`ldap_dn` AS `dn`,
 				`owncloud_name` AS `name`,
 				`directory_uuid` AS `uuid`
-			FROM `' . $this->getTableName() . '`',
+			FROM `' . $this->getTableName().'`',
 			$limit,
 			$offset
 		);
@@ -229,7 +229,7 @@ 
 	 * @return bool
 	 */
 	public function map($fdn, $name, $uuid) {
-		if(mb_strlen($fdn) > 255) {
+		if (mb_strlen($fdn) > 255) {
 			\OC::$server->getLogger()->error(
 				'Cannot map, because the DN exceeds 255 characters: {dn}',
 				[
@@ -249,7 +249,7 @@ 
 		try {
 			$result = $this->dbc->insertIfNotExist($this->getTableName(), $row);
 			// insertIfNotExist returns values as int
-			return (bool)$result;
+			return (bool) $result;
 		} catch (\Exception $e) {
 			return false;
 		}
@@ -262,7 +262,7 @@ 
 	 */
 	public function unmap($name) {
 		$query = $this->dbc->prepare('
-			DELETE FROM `'. $this->getTableName() .'`
+			DELETE FROM `'. $this->getTableName().'`
 			WHERE `owncloud_name` = ?');
 
 		return $this->modify($query, [$name]);
@@ -275,7 +275,7 @@ 
 	public function clear() {
 		$sql = $this->dbc
 			->getDatabasePlatform()
-			->getTruncateTableSQL('`' . $this->getTableName() . '`');
+			->getTruncateTableSQL('`'.$this->getTableName().'`');
 		return $this->dbc->prepare($sql)->execute();
 	}
 
@@ -294,9 +294,9 @@ 
 			->from($this->getTableName());
 		$cursor = $picker->execute();
 		$result = true;
-		while($id = $cursor->fetchColumn(0)) {
+		while ($id = $cursor->fetchColumn(0)) {
 			$preCallback($id);
-			if($isUnmapped = $this->unmap($id)) {
+			if ($isUnmapped = $this->unmap($id)) {
 				$postCallback($id);
 			}
 			$result &= $isUnmapped;
@@ -317,6 +317,6 @@ 
 		$res = $query->execute();
 		$count = $res->fetchColumn();
 		$res->closeCursor();
-		return (int)$count;
+		return (int) $count;
 	}
 }

apps/user_ldap/lib/LDAP.php

Indentation +357 added lines, -357 removed lines

@@ -34,361 +34,361 @@
 use OCA\User_LDAP\Exceptions\ConstraintViolationException;
 
 class LDAP implements ILDAPWrapper {
-	protected $curFunc = '';
-	protected $curArgs = [];
-
-	/**
-	 * @param resource $link
-	 * @param string $dn
-	 * @param string $password
-	 * @return bool|mixed
-	 */
-	public function bind($link, $dn, $password) {
-		return $this->invokeLDAPMethod('bind', $link, $dn, $password);
-	}
-
-	/**
-	 * @param string $host
-	 * @param string $port
-	 * @return mixed
-	 */
-	public function connect($host, $port) {
-		if(strpos($host, '://') === false) {
-			$host = 'ldap://' . $host;
-		}
-		if(strpos($host, ':', strpos($host, '://') + 1) === false) {
-			//ldap_connect ignores port parameter when URLs are passed
-			$host .= ':' . $port;
-		}
-		return $this->invokeLDAPMethod('connect', $host);
-	}
-
-	/**
-	 * @param resource $link
-	 * @param resource $result
-	 * @param string $cookie
-	 * @return bool|LDAP
-	 */
-	public function controlPagedResultResponse($link, $result, &$cookie) {
-		$this->preFunctionCall('ldap_control_paged_result_response',
-			[$link, $result, $cookie]);
-		$result = ldap_control_paged_result_response($link, $result, $cookie);
-		$this->postFunctionCall();
-
-		return $result;
-	}
-
-	/**
-	 * @param LDAP $link
-	 * @param int $pageSize
-	 * @param bool $isCritical
-	 * @param string $cookie
-	 * @return mixed|true
-	 */
-	public function controlPagedResult($link, $pageSize, $isCritical, $cookie) {
-		return $this->invokeLDAPMethod('control_paged_result', $link, $pageSize,
-										$isCritical, $cookie);
-	}
-
-	/**
-	 * @param LDAP $link
-	 * @param LDAP $result
-	 * @return mixed
-	 */
-	public function countEntries($link, $result) {
-		return $this->invokeLDAPMethod('count_entries', $link, $result);
-	}
-
-	/**
-	 * @param LDAP $link
-	 * @return integer
-	 */
-	public function errno($link) {
-		return $this->invokeLDAPMethod('errno', $link);
-	}
-
-	/**
-	 * @param LDAP $link
-	 * @return string
-	 */
-	public function error($link) {
-		return $this->invokeLDAPMethod('error', $link);
-	}
-
-	/**
-	 * Splits DN into its component parts
-	 * @param string $dn
-	 * @param int @withAttrib
-	 * @return array|false
-	 * @link http://www.php.net/manual/en/function.ldap-explode-dn.php
-	 */
-	public function explodeDN($dn, $withAttrib) {
-		return $this->invokeLDAPMethod('explode_dn', $dn, $withAttrib);
-	}
-
-	/**
-	 * @param LDAP $link
-	 * @param LDAP $result
-	 * @return mixed
-	 */
-	public function firstEntry($link, $result) {
-		return $this->invokeLDAPMethod('first_entry', $link, $result);
-	}
-
-	/**
-	 * @param LDAP $link
-	 * @param LDAP $result
-	 * @return array|mixed
-	 */
-	public function getAttributes($link, $result) {
-		return $this->invokeLDAPMethod('get_attributes', $link, $result);
-	}
-
-	/**
-	 * @param LDAP $link
-	 * @param LDAP $result
-	 * @return mixed|string
-	 */
-	public function getDN($link, $result) {
-		return $this->invokeLDAPMethod('get_dn', $link, $result);
-	}
-
-	/**
-	 * @param LDAP $link
-	 * @param LDAP $result
-	 * @return array|mixed
-	 */
-	public function getEntries($link, $result) {
-		return $this->invokeLDAPMethod('get_entries', $link, $result);
-	}
-
-	/**
-	 * @param LDAP $link
-	 * @param resource $result
-	 * @return mixed
-	 */
-	public function nextEntry($link, $result) {
-		return $this->invokeLDAPMethod('next_entry', $link, $result);
-	}
-
-	/**
-	 * @param LDAP $link
-	 * @param string $baseDN
-	 * @param string $filter
-	 * @param array $attr
-	 * @return mixed
-	 */
-	public function read($link, $baseDN, $filter, $attr) {
-		return $this->invokeLDAPMethod('read', $link, $baseDN, $filter, $attr);
-	}
-
-	/**
-	 * @param LDAP $link
-	 * @param string $baseDN
-	 * @param string $filter
-	 * @param array $attr
-	 * @param int $attrsOnly
-	 * @param int $limit
-	 * @return mixed
-	 * @throws \Exception
-	 */
-	public function search($link, $baseDN, $filter, $attr, $attrsOnly = 0, $limit = 0) {
-		$oldHandler = set_error_handler(function($no, $message, $file, $line) use (&$oldHandler) {
-			if(strpos($message, 'Partial search results returned: Sizelimit exceeded') !== false) {
-				return true;
-			}
-			$oldHandler($no, $message, $file, $line);
-			return true;
-		});
-		try {
-			$result = $this->invokeLDAPMethod('search', $link, $baseDN, $filter, $attr, $attrsOnly, $limit);
-			restore_error_handler();
-			return $result;
-		} catch (\Exception $e) {
-			restore_error_handler();
-			throw $e;
-		}
-	}
-
-	/**
-	 * @param LDAP $link
-	 * @param string $userDN
-	 * @param string $password
-	 * @return bool
-	 */
-	public function modReplace($link, $userDN, $password) {
-		return $this->invokeLDAPMethod('mod_replace', $link, $userDN, ['userPassword' => $password]);
-	}
-
-	/**
-	 * @param LDAP $link
-	 * @param string $userDN
-	 * @param string $oldPassword
-	 * @param string $password
-	 * @return bool
-	 */
-	public function exopPasswd($link, $userDN, $oldPassword, $password) {
-		return $this->invokeLDAPMethod('exop_passwd', $link, $userDN, $oldPassword, $password);
-	}
-
-	/**
-	 * @param LDAP $link
-	 * @param string $option
-	 * @param int $value
-	 * @return bool|mixed
-	 */
-	public function setOption($link, $option, $value) {
-		return $this->invokeLDAPMethod('set_option', $link, $option, $value);
-	}
-
-	/**
-	 * @param LDAP $link
-	 * @return mixed|true
-	 */
-	public function startTls($link) {
-		return $this->invokeLDAPMethod('start_tls', $link);
-	}
-
-	/**
-	 * @param resource $link
-	 * @return bool|mixed
-	 */
-	public function unbind($link) {
-		return $this->invokeLDAPMethod('unbind', $link);
-	}
-
-	/**
-	 * Checks whether the server supports LDAP
-	 * @return boolean if it the case, false otherwise
-	 * */
-	public function areLDAPFunctionsAvailable() {
-		return function_exists('ldap_connect');
-	}
-
-	/**
-	 * Checks whether the submitted parameter is a resource
-	 * @param Resource $resource the resource variable to check
-	 * @return bool true if it is a resource, false otherwise
-	 */
-	public function isResource($resource) {
-		return is_resource($resource);
-	}
-
-	/**
-	 * Checks whether the return value from LDAP is wrong or not.
-	 *
-	 * When using ldap_search we provide an array, in case multiple bases are
-	 * configured. Thus, we need to check the array elements.
-	 *
-	 * @param $result
-	 * @return bool
-	 */
-	protected function isResultFalse($result) {
-		if($result === false) {
-			return true;
-		}
-
-		if($this->curFunc === 'ldap_search' && is_array($result)) {
-			foreach ($result as $singleResult) {
-				if($singleResult === false) {
-					return true;
-				}
-			}
-		}
-
-		return false;
-	}
-
-	/**
-	 * @return mixed
-	 */
-	protected function invokeLDAPMethod() {
-		$arguments = func_get_args();
-		$func = 'ldap_' . array_shift($arguments);
-		if(function_exists($func)) {
-			$this->preFunctionCall($func, $arguments);
-			$result = call_user_func_array($func, $arguments);
-			if ($this->isResultFalse($result)) {
-				$this->postFunctionCall();
-			}
-			return $result;
-		}
-		return null;
-	}
-
-	/**
-	 * @param string $functionName
-	 * @param array $args
-	 */
-	private function preFunctionCall($functionName, $args) {
-		$this->curFunc = $functionName;
-		$this->curArgs = $args;
-	}
-
-	/**
-	 * Analyzes the returned LDAP error and acts accordingly if not 0
-	 *
-	 * @param resource $resource the LDAP Connection resource
-	 * @throws ConstraintViolationException
-	 * @throws ServerNotAvailableException
-	 * @throws \Exception
-	 */
-	private function processLDAPError($resource) {
-		$errorCode = ldap_errno($resource);
-		if($errorCode === 0) {
-			return;
-		}
-		$errorMsg  = ldap_error($resource);
-
-		if($this->curFunc === 'ldap_get_entries'
-			&& $errorCode === -4) {
-		} else if ($errorCode === 32) {
-			//for now
-		} else if ($errorCode === 10) {
-			//referrals, we switch them off, but then there is AD :)
-		} else if ($errorCode === -1) {
-			throw new ServerNotAvailableException('Lost connection to LDAP server.');
-		} else if ($errorCode === 52) {
-			throw new ServerNotAvailableException('LDAP server is shutting down.');
-		} else if ($errorCode === 48) {
-			throw new \Exception('LDAP authentication method rejected', $errorCode);
-		} else if ($errorCode === 1) {
-			throw new \Exception('LDAP Operations error', $errorCode);
-		} else if ($errorCode === 19) {
-			ldap_get_option($this->curArgs[0], LDAP_OPT_ERROR_STRING, $extended_error);
-			throw new ConstraintViolationException(!empty($extended_error)?$extended_error:$errorMsg, $errorCode);
-		} else {
-			\OC::$server->getLogger()->debug('LDAP error {message} ({code}) after calling {func}', [
-				'app' => 'user_ldap',
-				'message' => $errorMsg,
-				'code' => $errorCode,
-				'func' => $this->curFunc,
-			]);
-		}
-	}
-
-	/**
-	 * Called after an ldap method is run to act on LDAP error if necessary
-	 * @throw \Exception
-	 */
-	private function postFunctionCall() {
-		if($this->isResource($this->curArgs[0])) {
-			$resource = $this->curArgs[0];
-		} else if(
-			   $this->curFunc === 'ldap_search'
-			&& is_array($this->curArgs[0])
-			&& $this->isResource($this->curArgs[0][0])
-		) {
-			// we use always the same LDAP connection resource, is enough to
-			// take the first one.
-			$resource = $this->curArgs[0][0];
-		} else {
-			return;
-		}
-
-		$this->processLDAPError($resource);
-
-		$this->curFunc = '';
-		$this->curArgs = [];
-	}
+    protected $curFunc = '';
+    protected $curArgs = [];
+
+    /**
+     * @param resource $link
+     * @param string $dn
+     * @param string $password
+     * @return bool|mixed
+     */
+    public function bind($link, $dn, $password) {
+        return $this->invokeLDAPMethod('bind', $link, $dn, $password);
+    }
+
+    /**
+     * @param string $host
+     * @param string $port
+     * @return mixed
+     */
+    public function connect($host, $port) {
+        if(strpos($host, '://') === false) {
+            $host = 'ldap://' . $host;
+        }
+        if(strpos($host, ':', strpos($host, '://') + 1) === false) {
+            //ldap_connect ignores port parameter when URLs are passed
+            $host .= ':' . $port;
+        }
+        return $this->invokeLDAPMethod('connect', $host);
+    }
+
+    /**
+     * @param resource $link
+     * @param resource $result
+     * @param string $cookie
+     * @return bool|LDAP
+     */
+    public function controlPagedResultResponse($link, $result, &$cookie) {
+        $this->preFunctionCall('ldap_control_paged_result_response',
+            [$link, $result, $cookie]);
+        $result = ldap_control_paged_result_response($link, $result, $cookie);
+        $this->postFunctionCall();
+
+        return $result;
+    }
+
+    /**
+     * @param LDAP $link
+     * @param int $pageSize
+     * @param bool $isCritical
+     * @param string $cookie
+     * @return mixed|true
+     */
+    public function controlPagedResult($link, $pageSize, $isCritical, $cookie) {
+        return $this->invokeLDAPMethod('control_paged_result', $link, $pageSize,
+                                        $isCritical, $cookie);
+    }
+
+    /**
+     * @param LDAP $link
+     * @param LDAP $result
+     * @return mixed
+     */
+    public function countEntries($link, $result) {
+        return $this->invokeLDAPMethod('count_entries', $link, $result);
+    }
+
+    /**
+     * @param LDAP $link
+     * @return integer
+     */
+    public function errno($link) {
+        return $this->invokeLDAPMethod('errno', $link);
+    }
+
+    /**
+     * @param LDAP $link
+     * @return string
+     */
+    public function error($link) {
+        return $this->invokeLDAPMethod('error', $link);
+    }
+
+    /**
+     * Splits DN into its component parts
+     * @param string $dn
+     * @param int @withAttrib
+     * @return array|false
+     * @link http://www.php.net/manual/en/function.ldap-explode-dn.php
+     */
+    public function explodeDN($dn, $withAttrib) {
+        return $this->invokeLDAPMethod('explode_dn', $dn, $withAttrib);
+    }
+
+    /**
+     * @param LDAP $link
+     * @param LDAP $result
+     * @return mixed
+     */
+    public function firstEntry($link, $result) {
+        return $this->invokeLDAPMethod('first_entry', $link, $result);
+    }
+
+    /**
+     * @param LDAP $link
+     * @param LDAP $result
+     * @return array|mixed
+     */
+    public function getAttributes($link, $result) {
+        return $this->invokeLDAPMethod('get_attributes', $link, $result);
+    }
+
+    /**
+     * @param LDAP $link
+     * @param LDAP $result
+     * @return mixed|string
+     */
+    public function getDN($link, $result) {
+        return $this->invokeLDAPMethod('get_dn', $link, $result);
+    }
+
+    /**
+     * @param LDAP $link
+     * @param LDAP $result
+     * @return array|mixed
+     */
+    public function getEntries($link, $result) {
+        return $this->invokeLDAPMethod('get_entries', $link, $result);
+    }
+
+    /**
+     * @param LDAP $link
+     * @param resource $result
+     * @return mixed
+     */
+    public function nextEntry($link, $result) {
+        return $this->invokeLDAPMethod('next_entry', $link, $result);
+    }
+
+    /**
+     * @param LDAP $link
+     * @param string $baseDN
+     * @param string $filter
+     * @param array $attr
+     * @return mixed
+     */
+    public function read($link, $baseDN, $filter, $attr) {
+        return $this->invokeLDAPMethod('read', $link, $baseDN, $filter, $attr);
+    }
+
+    /**
+     * @param LDAP $link
+     * @param string $baseDN
+     * @param string $filter
+     * @param array $attr
+     * @param int $attrsOnly
+     * @param int $limit
+     * @return mixed
+     * @throws \Exception
+     */
+    public function search($link, $baseDN, $filter, $attr, $attrsOnly = 0, $limit = 0) {
+        $oldHandler = set_error_handler(function($no, $message, $file, $line) use (&$oldHandler) {
+            if(strpos($message, 'Partial search results returned: Sizelimit exceeded') !== false) {
+                return true;
+            }
+            $oldHandler($no, $message, $file, $line);
+            return true;
+        });
+        try {
+            $result = $this->invokeLDAPMethod('search', $link, $baseDN, $filter, $attr, $attrsOnly, $limit);
+            restore_error_handler();
+            return $result;
+        } catch (\Exception $e) {
+            restore_error_handler();
+            throw $e;
+        }
+    }
+
+    /**
+     * @param LDAP $link
+     * @param string $userDN
+     * @param string $password
+     * @return bool
+     */
+    public function modReplace($link, $userDN, $password) {
+        return $this->invokeLDAPMethod('mod_replace', $link, $userDN, ['userPassword' => $password]);
+    }
+
+    /**
+     * @param LDAP $link
+     * @param string $userDN
+     * @param string $oldPassword
+     * @param string $password
+     * @return bool
+     */
+    public function exopPasswd($link, $userDN, $oldPassword, $password) {
+        return $this->invokeLDAPMethod('exop_passwd', $link, $userDN, $oldPassword, $password);
+    }
+
+    /**
+     * @param LDAP $link
+     * @param string $option
+     * @param int $value
+     * @return bool|mixed
+     */
+    public function setOption($link, $option, $value) {
+        return $this->invokeLDAPMethod('set_option', $link, $option, $value);
+    }
+
+    /**
+     * @param LDAP $link
+     * @return mixed|true
+     */
+    public function startTls($link) {
+        return $this->invokeLDAPMethod('start_tls', $link);
+    }
+
+    /**
+     * @param resource $link
+     * @return bool|mixed
+     */
+    public function unbind($link) {
+        return $this->invokeLDAPMethod('unbind', $link);
+    }
+
+    /**
+     * Checks whether the server supports LDAP
+     * @return boolean if it the case, false otherwise
+     * */
+    public function areLDAPFunctionsAvailable() {
+        return function_exists('ldap_connect');
+    }
+
+    /**
+     * Checks whether the submitted parameter is a resource
+     * @param Resource $resource the resource variable to check
+     * @return bool true if it is a resource, false otherwise
+     */
+    public function isResource($resource) {
+        return is_resource($resource);
+    }
+
+    /**
+     * Checks whether the return value from LDAP is wrong or not.
+     *
+     * When using ldap_search we provide an array, in case multiple bases are
+     * configured. Thus, we need to check the array elements.
+     *
+     * @param $result
+     * @return bool
+     */
+    protected function isResultFalse($result) {
+        if($result === false) {
+            return true;
+        }
+
+        if($this->curFunc === 'ldap_search' && is_array($result)) {
+            foreach ($result as $singleResult) {
+                if($singleResult === false) {
+                    return true;
+                }
+            }
+        }
+
+        return false;
+    }
+
+    /**
+     * @return mixed
+     */
+    protected function invokeLDAPMethod() {
+        $arguments = func_get_args();
+        $func = 'ldap_' . array_shift($arguments);
+        if(function_exists($func)) {
+            $this->preFunctionCall($func, $arguments);
+            $result = call_user_func_array($func, $arguments);
+            if ($this->isResultFalse($result)) {
+                $this->postFunctionCall();
+            }
+            return $result;
+        }
+        return null;
+    }
+
+    /**
+     * @param string $functionName
+     * @param array $args
+     */
+    private function preFunctionCall($functionName, $args) {
+        $this->curFunc = $functionName;
+        $this->curArgs = $args;
+    }
+
+    /**
+     * Analyzes the returned LDAP error and acts accordingly if not 0
+     *
+     * @param resource $resource the LDAP Connection resource
+     * @throws ConstraintViolationException
+     * @throws ServerNotAvailableException
+     * @throws \Exception
+     */
+    private function processLDAPError($resource) {
+        $errorCode = ldap_errno($resource);
+        if($errorCode === 0) {
+            return;
+        }
+        $errorMsg  = ldap_error($resource);
+
+        if($this->curFunc === 'ldap_get_entries'
+            && $errorCode === -4) {
+        } else if ($errorCode === 32) {
+            //for now
+        } else if ($errorCode === 10) {
+            //referrals, we switch them off, but then there is AD :)
+        } else if ($errorCode === -1) {
+            throw new ServerNotAvailableException('Lost connection to LDAP server.');
+        } else if ($errorCode === 52) {
+            throw new ServerNotAvailableException('LDAP server is shutting down.');
+        } else if ($errorCode === 48) {
+            throw new \Exception('LDAP authentication method rejected', $errorCode);
+        } else if ($errorCode === 1) {
+            throw new \Exception('LDAP Operations error', $errorCode);
+        } else if ($errorCode === 19) {
+            ldap_get_option($this->curArgs[0], LDAP_OPT_ERROR_STRING, $extended_error);
+            throw new ConstraintViolationException(!empty($extended_error)?$extended_error:$errorMsg, $errorCode);
+        } else {
+            \OC::$server->getLogger()->debug('LDAP error {message} ({code}) after calling {func}', [
+                'app' => 'user_ldap',
+                'message' => $errorMsg,
+                'code' => $errorCode,
+                'func' => $this->curFunc,
+            ]);
+        }
+    }
+
+    /**
+     * Called after an ldap method is run to act on LDAP error if necessary
+     * @throw \Exception
+     */
+    private function postFunctionCall() {
+        if($this->isResource($this->curArgs[0])) {
+            $resource = $this->curArgs[0];
+        } else if(
+                $this->curFunc === 'ldap_search'
+            && is_array($this->curArgs[0])
+            && $this->isResource($this->curArgs[0][0])
+        ) {
+            // we use always the same LDAP connection resource, is enough to
+            // take the first one.
+            $resource = $this->curArgs[0][0];
+        } else {
+            return;
+        }
+
+        $this->processLDAPError($resource);
+
+        $this->curFunc = '';
+        $this->curArgs = [];
+    }
 }

apps/user_ldap/lib/Connection.php

Indentation +616 added lines, -616 removed lines

@@ -68,621 +68,621 @@
  * @property string ldapGroupDisplayName
  */
 class Connection extends LDAPUtility {
-	private $ldapConnectionRes = null;
-	private $configPrefix;
-	private $configID;
-	private $configured = false;
-	//whether connection should be kept on __destruct
-	private $dontDestruct = false;
-
-	/**
-	 * @var bool runtime flag that indicates whether supported primary groups are available
-	 */
-	public $hasPrimaryGroups = true;
-
-	/**
-	 * @var bool runtime flag that indicates whether supported POSIX gidNumber are available
-	 */
-	public $hasGidNumber = true;
-
-	//cache handler
-	protected $cache;
-
-	/** @var Configuration settings handler **/
-	protected $configuration;
-
-	protected $doNotValidate = false;
-
-	protected $ignoreValidation = false;
-
-	protected $bindResult = [];
-
-	/**
-	 * Constructor
-	 * @param ILDAPWrapper $ldap
-	 * @param string $configPrefix a string with the prefix for the configkey column (appconfig table)
-	 * @param string|null $configID a string with the value for the appid column (appconfig table) or null for on-the-fly connections
-	 */
-	public function __construct(ILDAPWrapper $ldap, $configPrefix = '', $configID = 'user_ldap') {
-		parent::__construct($ldap);
-		$this->configPrefix = $configPrefix;
-		$this->configID = $configID;
-		$this->configuration = new Configuration($configPrefix,
-												 !is_null($configID));
-		$memcache = \OC::$server->getMemCacheFactory();
-		if($memcache->isAvailable()) {
-			$this->cache = $memcache->createDistributed();
-		}
-		$helper = new Helper(\OC::$server->getConfig());
-		$this->doNotValidate = !in_array($this->configPrefix,
-			$helper->getServerConfigurationPrefixes());
-	}
-
-	public function __destruct() {
-		if(!$this->dontDestruct && $this->ldap->isResource($this->ldapConnectionRes)) {
-			@$this->ldap->unbind($this->ldapConnectionRes);
-			$this->bindResult = [];
-		}
-	}
-
-	/**
-	 * defines behaviour when the instance is cloned
-	 */
-	public function __clone() {
-		$this->configuration = new Configuration($this->configPrefix,
-												 !is_null($this->configID));
-		if(count($this->bindResult) !== 0 && $this->bindResult['result'] === true) {
-			$this->bindResult = [];
-		}
-		$this->ldapConnectionRes = null;
-		$this->dontDestruct = true;
-	}
-
-	/**
-	 * @param string $name
-	 * @return bool|mixed
-	 */
-	public function __get($name) {
-		if(!$this->configured) {
-			$this->readConfiguration();
-		}
-
-		return $this->configuration->$name;
-	}
-
-	/**
-	 * @param string $name
-	 * @param mixed $value
-	 */
-	public function __set($name, $value) {
-		$this->doNotValidate = false;
-		$before = $this->configuration->$name;
-		$this->configuration->$name = $value;
-		$after = $this->configuration->$name;
-		if($before !== $after) {
-			if ($this->configID !== '' && $this->configID !== null) {
-				$this->configuration->saveConfiguration();
-			}
-			$this->validateConfiguration();
-		}
-	}
-
-	/**
-	 * @param string $rule
-	 * @return array
-	 * @throws \RuntimeException
-	 */
-	public function resolveRule($rule) {
-		return $this->configuration->resolveRule($rule);
-	}
-
-	/**
-	 * sets whether the result of the configuration validation shall
-	 * be ignored when establishing the connection. Used by the Wizard
-	 * in early configuration state.
-	 * @param bool $state
-	 */
-	public function setIgnoreValidation($state) {
-		$this->ignoreValidation = (bool)$state;
-	}
-
-	/**
-	 * initializes the LDAP backend
-	 * @param bool $force read the config settings no matter what
-	 */
-	public function init($force = false) {
-		$this->readConfiguration($force);
-		$this->establishConnection();
-	}
-
-	/**
-	 * Returns the LDAP handler
-	 */
-	public function getConnectionResource() {
-		if(!$this->ldapConnectionRes) {
-			$this->init();
-		} else if(!$this->ldap->isResource($this->ldapConnectionRes)) {
-			$this->ldapConnectionRes = null;
-			$this->establishConnection();
-		}
-		if(is_null($this->ldapConnectionRes)) {
-			\OCP\Util::writeLog('user_ldap', 'No LDAP Connection to server ' . $this->configuration->ldapHost, ILogger::ERROR);
-			throw new ServerNotAvailableException('Connection to LDAP server could not be established');
-		}
-		return $this->ldapConnectionRes;
-	}
-
-	/**
-	 * resets the connection resource
-	 */
-	public function resetConnectionResource() {
-		if(!is_null($this->ldapConnectionRes)) {
-			@$this->ldap->unbind($this->ldapConnectionRes);
-			$this->ldapConnectionRes = null;
-			$this->bindResult = [];
-		}
-	}
-
-	/**
-	 * @param string|null $key
-	 * @return string
-	 */
-	private function getCacheKey($key) {
-		$prefix = 'LDAP-'.$this->configID.'-'.$this->configPrefix.'-';
-		if(is_null($key)) {
-			return $prefix;
-		}
-		return $prefix.hash('sha256', $key);
-	}
-
-	/**
-	 * @param string $key
-	 * @return mixed|null
-	 */
-	public function getFromCache($key) {
-		if(!$this->configured) {
-			$this->readConfiguration();
-		}
-		if(is_null($this->cache) || !$this->configuration->ldapCacheTTL) {
-			return null;
-		}
-		$key = $this->getCacheKey($key);
-
-		return json_decode(base64_decode($this->cache->get($key)), true);
-	}
-
-	/**
-	 * @param string $key
-	 * @param mixed $value
-	 *
-	 * @return string
-	 */
-	public function writeToCache($key, $value) {
-		if(!$this->configured) {
-			$this->readConfiguration();
-		}
-		if(is_null($this->cache)
-			|| !$this->configuration->ldapCacheTTL
-			|| !$this->configuration->ldapConfigurationActive) {
-			return null;
-		}
-		$key   = $this->getCacheKey($key);
-		$value = base64_encode(json_encode($value));
-		$this->cache->set($key, $value, $this->configuration->ldapCacheTTL);
-	}
-
-	public function clearCache() {
-		if(!is_null($this->cache)) {
-			$this->cache->clear($this->getCacheKey(null));
-		}
-	}
-
-	/**
-	 * Caches the general LDAP configuration.
-	 * @param bool $force optional. true, if the re-read should be forced. defaults
-	 * to false.
-	 * @return null
-	 */
-	private function readConfiguration($force = false) {
-		if((!$this->configured || $force) && !is_null($this->configID)) {
-			$this->configuration->readConfiguration();
-			$this->configured = $this->validateConfiguration();
-		}
-	}
-
-	/**
-	 * set LDAP configuration with values delivered by an array, not read from configuration
-	 * @param array $config array that holds the config parameters in an associated array
-	 * @param array &$setParameters optional; array where the set fields will be given to
-	 * @return boolean true if config validates, false otherwise. Check with $setParameters for detailed success on single parameters
-	 */
-	public function setConfiguration($config, &$setParameters = null) {
-		if(is_null($setParameters)) {
-			$setParameters = [];
-		}
-		$this->doNotValidate = false;
-		$this->configuration->setConfiguration($config, $setParameters);
-		if(count($setParameters) > 0) {
-			$this->configured = $this->validateConfiguration();
-		}
-
-
-		return $this->configured;
-	}
-
-	/**
-	 * saves the current Configuration in the database and empties the
-	 * cache
-	 * @return null
-	 */
-	public function saveConfiguration() {
-		$this->configuration->saveConfiguration();
-		$this->clearCache();
-	}
-
-	/**
-	 * get the current LDAP configuration
-	 * @return array
-	 */
-	public function getConfiguration() {
-		$this->readConfiguration();
-		$config = $this->configuration->getConfiguration();
-		$cta = $this->configuration->getConfigTranslationArray();
-		$result = [];
-		foreach($cta as $dbkey => $configkey) {
-			switch($configkey) {
-				case 'homeFolderNamingRule':
-					if(strpos($config[$configkey], 'attr:') === 0) {
-						$result[$dbkey] = substr($config[$configkey], 5);
-					} else {
-						$result[$dbkey] = '';
-					}
-					break;
-				case 'ldapBase':
-				case 'ldapBaseUsers':
-				case 'ldapBaseGroups':
-				case 'ldapAttributesForUserSearch':
-				case 'ldapAttributesForGroupSearch':
-					if(is_array($config[$configkey])) {
-						$result[$dbkey] = implode("\n", $config[$configkey]);
-						break;
-					} //else follows default
-				default:
-					$result[$dbkey] = $config[$configkey];
-			}
-		}
-		return $result;
-	}
-
-	private function doSoftValidation() {
-		//if User or Group Base are not set, take over Base DN setting
-		foreach(['ldapBaseUsers', 'ldapBaseGroups'] as $keyBase) {
-			$val = $this->configuration->$keyBase;
-			if(empty($val)) {
-				$this->configuration->$keyBase = $this->configuration->ldapBase;
-			}
-		}
-
-		foreach(['ldapExpertUUIDUserAttr'  => 'ldapUuidUserAttribute',
-					  'ldapExpertUUIDGroupAttr' => 'ldapUuidGroupAttribute']
-				as $expertSetting => $effectiveSetting) {
-			$uuidOverride = $this->configuration->$expertSetting;
-			if(!empty($uuidOverride)) {
-				$this->configuration->$effectiveSetting = $uuidOverride;
-			} else {
-				$uuidAttributes = Access::UUID_ATTRIBUTES;
-				array_unshift($uuidAttributes, 'auto');
-				if(!in_array($this->configuration->$effectiveSetting,
-							$uuidAttributes)
-					&& (!is_null($this->configID))) {
-					$this->configuration->$effectiveSetting = 'auto';
-					$this->configuration->saveConfiguration();
-					\OCP\Util::writeLog('user_ldap',
-										'Illegal value for the '.
-										$effectiveSetting.', '.'reset to '.
-										'autodetect.', ILogger::INFO);
-				}
-
-			}
-		}
-
-		$backupPort = (int)$this->configuration->ldapBackupPort;
-		if ($backupPort <= 0) {
-			$this->configuration->backupPort = $this->configuration->ldapPort;
-		}
-
-		//make sure empty search attributes are saved as simple, empty array
-		$saKeys = ['ldapAttributesForUserSearch',
-						'ldapAttributesForGroupSearch'];
-		foreach($saKeys as $key) {
-			$val = $this->configuration->$key;
-			if(is_array($val) && count($val) === 1 && empty($val[0])) {
-				$this->configuration->$key = [];
-			}
-		}
-
-		if((stripos($this->configuration->ldapHost, 'ldaps://') === 0)
-			&& $this->configuration->ldapTLS) {
-			$this->configuration->ldapTLS = false;
-			\OCP\Util::writeLog(
-				'user_ldap',
-				'LDAPS (already using secure connection) and TLS do not work together. Switched off TLS.',
-				ILogger::INFO
-			);
-		}
-	}
-
-	/**
-	 * @return bool
-	 */
-	private function doCriticalValidation() {
-		$configurationOK = true;
-		$errorStr = 'Configuration Error (prefix '.
-			(string)$this->configPrefix .'): ';
-
-		//options that shall not be empty
-		$options = ['ldapHost', 'ldapPort', 'ldapUserDisplayName',
-						 'ldapGroupDisplayName', 'ldapLoginFilter'];
-		foreach($options as $key) {
-			$val = $this->configuration->$key;
-			if(empty($val)) {
-				switch($key) {
-					case 'ldapHost':
-						$subj = 'LDAP Host';
-						break;
-					case 'ldapPort':
-						$subj = 'LDAP Port';
-						break;
-					case 'ldapUserDisplayName':
-						$subj = 'LDAP User Display Name';
-						break;
-					case 'ldapGroupDisplayName':
-						$subj = 'LDAP Group Display Name';
-						break;
-					case 'ldapLoginFilter':
-						$subj = 'LDAP Login Filter';
-						break;
-					default:
-						$subj = $key;
-						break;
-				}
-				$configurationOK = false;
-				\OCP\Util::writeLog(
-					'user_ldap',
-					$errorStr.'No '.$subj.' given!',
-					ILogger::WARN
-				);
-			}
-		}
-
-		//combinations
-		$agent = $this->configuration->ldapAgentName;
-		$pwd = $this->configuration->ldapAgentPassword;
-		if (
-			($agent === ''  && $pwd !== '')
-			|| ($agent !== '' && $pwd === '')
-		) {
-			\OCP\Util::writeLog(
-				'user_ldap',
-				$errorStr.'either no password is given for the user ' .
-					'agent or a password is given, but not an LDAP agent.',
-				ILogger::WARN);
-			$configurationOK = false;
-		}
-
-		$base = $this->configuration->ldapBase;
-		$baseUsers = $this->configuration->ldapBaseUsers;
-		$baseGroups = $this->configuration->ldapBaseGroups;
-
-		if(empty($base) && empty($baseUsers) && empty($baseGroups)) {
-			\OCP\Util::writeLog(
-				'user_ldap',
-				$errorStr.'Not a single Base DN given.',
-				ILogger::WARN
-			);
-			$configurationOK = false;
-		}
-
-		if(mb_strpos($this->configuration->ldapLoginFilter, '%uid', 0, 'UTF-8')
-		   === false) {
-			\OCP\Util::writeLog(
-				'user_ldap',
-				$errorStr.'login filter does not contain %uid place holder.',
-				ILogger::WARN
-			);
-			$configurationOK = false;
-		}
-
-		return $configurationOK;
-	}
-
-	/**
-	 * Validates the user specified configuration
-	 * @return bool true if configuration seems OK, false otherwise
-	 */
-	private function validateConfiguration() {
-
-		if($this->doNotValidate) {
-			//don't do a validation if it is a new configuration with pure
-			//default values. Will be allowed on changes via __set or
-			//setConfiguration
-			return false;
-		}
-
-		// first step: "soft" checks: settings that are not really
-		// necessary, but advisable. If left empty, give an info message
-		$this->doSoftValidation();
-
-		//second step: critical checks. If left empty or filled wrong, mark as
-		//not configured and give a warning.
-		return $this->doCriticalValidation();
-	}
-
-
-	/**
-	 * Connects and Binds to LDAP
-	 *
-	 * @throws ServerNotAvailableException
-	 */
-	private function establishConnection() {
-		if(!$this->configuration->ldapConfigurationActive) {
-			return null;
-		}
-		static $phpLDAPinstalled = true;
-		if(!$phpLDAPinstalled) {
-			return false;
-		}
-		if(!$this->ignoreValidation && !$this->configured) {
-			\OCP\Util::writeLog(
-				'user_ldap',
-				'Configuration is invalid, cannot connect',
-				ILogger::WARN
-			);
-			return false;
-		}
-		if(!$this->ldapConnectionRes) {
-			if(!$this->ldap->areLDAPFunctionsAvailable()) {
-				$phpLDAPinstalled = false;
-				\OCP\Util::writeLog(
-					'user_ldap',
-					'function ldap_connect is not available. Make sure that the PHP ldap module is installed.',
-					ILogger::ERROR
-				);
-
-				return false;
-			}
-			if($this->configuration->turnOffCertCheck) {
-				if(putenv('LDAPTLS_REQCERT=never')) {
-					\OCP\Util::writeLog('user_ldap',
-						'Turned off SSL certificate validation successfully.',
-						ILogger::DEBUG);
-				} else {
-					\OCP\Util::writeLog(
-						'user_ldap',
-						'Could not turn off SSL certificate validation.',
-						ILogger::WARN
-					);
-				}
-			}
-
-			$isOverrideMainServer = ($this->configuration->ldapOverrideMainServer
-				|| $this->getFromCache('overrideMainServer'));
-			$isBackupHost = (trim($this->configuration->ldapBackupHost) !== "");
-			$bindStatus = false;
-			try {
-				if (!$isOverrideMainServer) {
-					$this->doConnect($this->configuration->ldapHost,
-						$this->configuration->ldapPort);
-					return $this->bind();
-				}
-			} catch (ServerNotAvailableException $e) {
-				if(!$isBackupHost) {
-					throw $e;
-				}
-			}
-
-			//if LDAP server is not reachable, try the Backup (Replica!) Server
-			if($isBackupHost || $isOverrideMainServer) {
-				$this->doConnect($this->configuration->ldapBackupHost,
-								 $this->configuration->ldapBackupPort);
-				$this->bindResult = [];
-				$bindStatus = $this->bind();
-				$error = $this->ldap->isResource($this->ldapConnectionRes) ?
-					$this->ldap->errno($this->ldapConnectionRes) : -1;
-				if($bindStatus && $error === 0 && !$this->getFromCache('overrideMainServer')) {
-					//when bind to backup server succeeded and failed to main server,
-					//skip contacting him until next cache refresh
-					$this->writeToCache('overrideMainServer', true);
-				}
-			}
-
-			return $bindStatus;
-		}
-		return null;
-	}
-
-	/**
-	 * @param string $host
-	 * @param string $port
-	 * @return bool
-	 * @throws \OC\ServerNotAvailableException
-	 */
-	private function doConnect($host, $port) {
-		if ($host === '') {
-			return false;
-		}
-
-		$this->ldapConnectionRes = $this->ldap->connect($host, $port);
-
-		if(!$this->ldap->setOption($this->ldapConnectionRes, LDAP_OPT_PROTOCOL_VERSION, 3)) {
-			throw new ServerNotAvailableException('Could not set required LDAP Protocol version.');
-		}
-
-		if(!$this->ldap->setOption($this->ldapConnectionRes, LDAP_OPT_REFERRALS, 0)) {
-			throw new ServerNotAvailableException('Could not disable LDAP referrals.');
-		}
-
-		if($this->configuration->ldapTLS) {
-			if(!$this->ldap->startTls($this->ldapConnectionRes)) {
-				throw new ServerNotAvailableException('Start TLS failed, when connecting to LDAP host ' . $host . '.');
-			}
-		}
-
-		return true;
-	}
-
-	/**
-	 * Binds to LDAP
-	 */
-	public function bind() {
-		if(!$this->configuration->ldapConfigurationActive) {
-			return false;
-		}
-		$cr = $this->ldapConnectionRes;
-		if(!$this->ldap->isResource($cr)) {
-			$cr = $this->getConnectionResource();
-		}
-
-		if(
-			count($this->bindResult) !== 0
-			&& $this->bindResult['dn'] === $this->configuration->ldapAgentName
-			&& \OC::$server->getHasher()->verify(
-				$this->configPrefix . $this->configuration->ldapAgentPassword,
-				$this->bindResult['hash']
-			)
-		) {
-			// don't attempt to bind again with the same data as before
-			// bind might have been invoked via getConnectionResource(),
-			// but we need results specifically for e.g. user login
-			return $this->bindResult['result'];
-		}
-
-		$ldapLogin = @$this->ldap->bind($cr,
-										$this->configuration->ldapAgentName,
-										$this->configuration->ldapAgentPassword);
-
-		$this->bindResult = [
-			'dn' => $this->configuration->ldapAgentName,
-			'hash' => \OC::$server->getHasher()->hash($this->configPrefix . $this->configuration->ldapAgentPassword),
-			'result' => $ldapLogin,
-		];
-
-		if(!$ldapLogin) {
-			$errno = $this->ldap->errno($cr);
-
-			\OCP\Util::writeLog('user_ldap',
-				'Bind failed: ' . $errno . ': ' . $this->ldap->error($cr),
-				ILogger::WARN);
-
-			// Set to failure mode, if LDAP error code is not LDAP_SUCCESS or LDAP_INVALID_CREDENTIALS
-			// or (needed for Apple Open Directory:) LDAP_INSUFFICIENT_ACCESS
-			if($errno !== 0 && $errno !== 49 && $errno !== 50) {
-				$this->ldapConnectionRes = null;
-			}
-
-			return false;
-		}
-		return true;
-	}
+    private $ldapConnectionRes = null;
+    private $configPrefix;
+    private $configID;
+    private $configured = false;
+    //whether connection should be kept on __destruct
+    private $dontDestruct = false;
+
+    /**
+     * @var bool runtime flag that indicates whether supported primary groups are available
+     */
+    public $hasPrimaryGroups = true;
+
+    /**
+     * @var bool runtime flag that indicates whether supported POSIX gidNumber are available
+     */
+    public $hasGidNumber = true;
+
+    //cache handler
+    protected $cache;
+
+    /** @var Configuration settings handler **/
+    protected $configuration;
+
+    protected $doNotValidate = false;
+
+    protected $ignoreValidation = false;
+
+    protected $bindResult = [];
+
+    /**
+     * Constructor
+     * @param ILDAPWrapper $ldap
+     * @param string $configPrefix a string with the prefix for the configkey column (appconfig table)
+     * @param string|null $configID a string with the value for the appid column (appconfig table) or null for on-the-fly connections
+     */
+    public function __construct(ILDAPWrapper $ldap, $configPrefix = '', $configID = 'user_ldap') {
+        parent::__construct($ldap);
+        $this->configPrefix = $configPrefix;
+        $this->configID = $configID;
+        $this->configuration = new Configuration($configPrefix,
+                                                    !is_null($configID));
+        $memcache = \OC::$server->getMemCacheFactory();
+        if($memcache->isAvailable()) {
+            $this->cache = $memcache->createDistributed();
+        }
+        $helper = new Helper(\OC::$server->getConfig());
+        $this->doNotValidate = !in_array($this->configPrefix,
+            $helper->getServerConfigurationPrefixes());
+    }
+
+    public function __destruct() {
+        if(!$this->dontDestruct && $this->ldap->isResource($this->ldapConnectionRes)) {
+            @$this->ldap->unbind($this->ldapConnectionRes);
+            $this->bindResult = [];
+        }
+    }
+
+    /**
+     * defines behaviour when the instance is cloned
+     */
+    public function __clone() {
+        $this->configuration = new Configuration($this->configPrefix,
+                                                    !is_null($this->configID));
+        if(count($this->bindResult) !== 0 && $this->bindResult['result'] === true) {
+            $this->bindResult = [];
+        }
+        $this->ldapConnectionRes = null;
+        $this->dontDestruct = true;
+    }
+
+    /**
+     * @param string $name
+     * @return bool|mixed
+     */
+    public function __get($name) {
+        if(!$this->configured) {
+            $this->readConfiguration();
+        }
+
+        return $this->configuration->$name;
+    }
+
+    /**
+     * @param string $name
+     * @param mixed $value
+     */
+    public function __set($name, $value) {
+        $this->doNotValidate = false;
+        $before = $this->configuration->$name;
+        $this->configuration->$name = $value;
+        $after = $this->configuration->$name;
+        if($before !== $after) {
+            if ($this->configID !== '' && $this->configID !== null) {
+                $this->configuration->saveConfiguration();
+            }
+            $this->validateConfiguration();
+        }
+    }
+
+    /**
+     * @param string $rule
+     * @return array
+     * @throws \RuntimeException
+     */
+    public function resolveRule($rule) {
+        return $this->configuration->resolveRule($rule);
+    }
+
+    /**
+     * sets whether the result of the configuration validation shall
+     * be ignored when establishing the connection. Used by the Wizard
+     * in early configuration state.
+     * @param bool $state
+     */
+    public function setIgnoreValidation($state) {
+        $this->ignoreValidation = (bool)$state;
+    }
+
+    /**
+     * initializes the LDAP backend
+     * @param bool $force read the config settings no matter what
+     */
+    public function init($force = false) {
+        $this->readConfiguration($force);
+        $this->establishConnection();
+    }
+
+    /**
+     * Returns the LDAP handler
+     */
+    public function getConnectionResource() {
+        if(!$this->ldapConnectionRes) {
+            $this->init();
+        } else if(!$this->ldap->isResource($this->ldapConnectionRes)) {
+            $this->ldapConnectionRes = null;
+            $this->establishConnection();
+        }
+        if(is_null($this->ldapConnectionRes)) {
+            \OCP\Util::writeLog('user_ldap', 'No LDAP Connection to server ' . $this->configuration->ldapHost, ILogger::ERROR);
+            throw new ServerNotAvailableException('Connection to LDAP server could not be established');
+        }
+        return $this->ldapConnectionRes;
+    }
+
+    /**
+     * resets the connection resource
+     */
+    public function resetConnectionResource() {
+        if(!is_null($this->ldapConnectionRes)) {
+            @$this->ldap->unbind($this->ldapConnectionRes);
+            $this->ldapConnectionRes = null;
+            $this->bindResult = [];
+        }
+    }
+
+    /**
+     * @param string|null $key
+     * @return string
+     */
+    private function getCacheKey($key) {
+        $prefix = 'LDAP-'.$this->configID.'-'.$this->configPrefix.'-';
+        if(is_null($key)) {
+            return $prefix;
+        }
+        return $prefix.hash('sha256', $key);
+    }
+
+    /**
+     * @param string $key
+     * @return mixed|null
+     */
+    public function getFromCache($key) {
+        if(!$this->configured) {
+            $this->readConfiguration();
+        }
+        if(is_null($this->cache) || !$this->configuration->ldapCacheTTL) {
+            return null;
+        }
+        $key = $this->getCacheKey($key);
+
+        return json_decode(base64_decode($this->cache->get($key)), true);
+    }
+
+    /**
+     * @param string $key
+     * @param mixed $value
+     *
+     * @return string
+     */
+    public function writeToCache($key, $value) {
+        if(!$this->configured) {
+            $this->readConfiguration();
+        }
+        if(is_null($this->cache)
+            || !$this->configuration->ldapCacheTTL
+            || !$this->configuration->ldapConfigurationActive) {
+            return null;
+        }
+        $key   = $this->getCacheKey($key);
+        $value = base64_encode(json_encode($value));
+        $this->cache->set($key, $value, $this->configuration->ldapCacheTTL);
+    }
+
+    public function clearCache() {
+        if(!is_null($this->cache)) {
+            $this->cache->clear($this->getCacheKey(null));
+        }
+    }
+
+    /**
+     * Caches the general LDAP configuration.
+     * @param bool $force optional. true, if the re-read should be forced. defaults
+     * to false.
+     * @return null
+     */
+    private function readConfiguration($force = false) {
+        if((!$this->configured || $force) && !is_null($this->configID)) {
+            $this->configuration->readConfiguration();
+            $this->configured = $this->validateConfiguration();
+        }
+    }
+
+    /**
+     * set LDAP configuration with values delivered by an array, not read from configuration
+     * @param array $config array that holds the config parameters in an associated array
+     * @param array &$setParameters optional; array where the set fields will be given to
+     * @return boolean true if config validates, false otherwise. Check with $setParameters for detailed success on single parameters
+     */
+    public function setConfiguration($config, &$setParameters = null) {
+        if(is_null($setParameters)) {
+            $setParameters = [];
+        }
+        $this->doNotValidate = false;
+        $this->configuration->setConfiguration($config, $setParameters);
+        if(count($setParameters) > 0) {
+            $this->configured = $this->validateConfiguration();
+        }
+
+
+        return $this->configured;
+    }
+
+    /**
+     * saves the current Configuration in the database and empties the
+     * cache
+     * @return null
+     */
+    public function saveConfiguration() {
+        $this->configuration->saveConfiguration();
+        $this->clearCache();
+    }
+
+    /**
+     * get the current LDAP configuration
+     * @return array
+     */
+    public function getConfiguration() {
+        $this->readConfiguration();
+        $config = $this->configuration->getConfiguration();
+        $cta = $this->configuration->getConfigTranslationArray();
+        $result = [];
+        foreach($cta as $dbkey => $configkey) {
+            switch($configkey) {
+                case 'homeFolderNamingRule':
+                    if(strpos($config[$configkey], 'attr:') === 0) {
+                        $result[$dbkey] = substr($config[$configkey], 5);
+                    } else {
+                        $result[$dbkey] = '';
+                    }
+                    break;
+                case 'ldapBase':
+                case 'ldapBaseUsers':
+                case 'ldapBaseGroups':
+                case 'ldapAttributesForUserSearch':
+                case 'ldapAttributesForGroupSearch':
+                    if(is_array($config[$configkey])) {
+                        $result[$dbkey] = implode("\n", $config[$configkey]);
+                        break;
+                    } //else follows default
+                default:
+                    $result[$dbkey] = $config[$configkey];
+            }
+        }
+        return $result;
+    }
+
+    private function doSoftValidation() {
+        //if User or Group Base are not set, take over Base DN setting
+        foreach(['ldapBaseUsers', 'ldapBaseGroups'] as $keyBase) {
+            $val = $this->configuration->$keyBase;
+            if(empty($val)) {
+                $this->configuration->$keyBase = $this->configuration->ldapBase;
+            }
+        }
+
+        foreach(['ldapExpertUUIDUserAttr'  => 'ldapUuidUserAttribute',
+                        'ldapExpertUUIDGroupAttr' => 'ldapUuidGroupAttribute']
+                as $expertSetting => $effectiveSetting) {
+            $uuidOverride = $this->configuration->$expertSetting;
+            if(!empty($uuidOverride)) {
+                $this->configuration->$effectiveSetting = $uuidOverride;
+            } else {
+                $uuidAttributes = Access::UUID_ATTRIBUTES;
+                array_unshift($uuidAttributes, 'auto');
+                if(!in_array($this->configuration->$effectiveSetting,
+                            $uuidAttributes)
+                    && (!is_null($this->configID))) {
+                    $this->configuration->$effectiveSetting = 'auto';
+                    $this->configuration->saveConfiguration();
+                    \OCP\Util::writeLog('user_ldap',
+                                        'Illegal value for the '.
+                                        $effectiveSetting.', '.'reset to '.
+                                        'autodetect.', ILogger::INFO);
+                }
+
+            }
+        }
+
+        $backupPort = (int)$this->configuration->ldapBackupPort;
+        if ($backupPort <= 0) {
+            $this->configuration->backupPort = $this->configuration->ldapPort;
+        }
+
+        //make sure empty search attributes are saved as simple, empty array
+        $saKeys = ['ldapAttributesForUserSearch',
+                        'ldapAttributesForGroupSearch'];
+        foreach($saKeys as $key) {
+            $val = $this->configuration->$key;
+            if(is_array($val) && count($val) === 1 && empty($val[0])) {
+                $this->configuration->$key = [];
+            }
+        }
+
+        if((stripos($this->configuration->ldapHost, 'ldaps://') === 0)
+            && $this->configuration->ldapTLS) {
+            $this->configuration->ldapTLS = false;
+            \OCP\Util::writeLog(
+                'user_ldap',
+                'LDAPS (already using secure connection) and TLS do not work together. Switched off TLS.',
+                ILogger::INFO
+            );
+        }
+    }
+
+    /**
+     * @return bool
+     */
+    private function doCriticalValidation() {
+        $configurationOK = true;
+        $errorStr = 'Configuration Error (prefix '.
+            (string)$this->configPrefix .'): ';
+
+        //options that shall not be empty
+        $options = ['ldapHost', 'ldapPort', 'ldapUserDisplayName',
+                            'ldapGroupDisplayName', 'ldapLoginFilter'];
+        foreach($options as $key) {
+            $val = $this->configuration->$key;
+            if(empty($val)) {
+                switch($key) {
+                    case 'ldapHost':
+                        $subj = 'LDAP Host';
+                        break;
+                    case 'ldapPort':
+                        $subj = 'LDAP Port';
+                        break;
+                    case 'ldapUserDisplayName':
+                        $subj = 'LDAP User Display Name';
+                        break;
+                    case 'ldapGroupDisplayName':
+                        $subj = 'LDAP Group Display Name';
+                        break;
+                    case 'ldapLoginFilter':
+                        $subj = 'LDAP Login Filter';
+                        break;
+                    default:
+                        $subj = $key;
+                        break;
+                }
+                $configurationOK = false;
+                \OCP\Util::writeLog(
+                    'user_ldap',
+                    $errorStr.'No '.$subj.' given!',
+                    ILogger::WARN
+                );
+            }
+        }
+
+        //combinations
+        $agent = $this->configuration->ldapAgentName;
+        $pwd = $this->configuration->ldapAgentPassword;
+        if (
+            ($agent === ''  && $pwd !== '')
+            || ($agent !== '' && $pwd === '')
+        ) {
+            \OCP\Util::writeLog(
+                'user_ldap',
+                $errorStr.'either no password is given for the user ' .
+                    'agent or a password is given, but not an LDAP agent.',
+                ILogger::WARN);
+            $configurationOK = false;
+        }
+
+        $base = $this->configuration->ldapBase;
+        $baseUsers = $this->configuration->ldapBaseUsers;
+        $baseGroups = $this->configuration->ldapBaseGroups;
+
+        if(empty($base) && empty($baseUsers) && empty($baseGroups)) {
+            \OCP\Util::writeLog(
+                'user_ldap',
+                $errorStr.'Not a single Base DN given.',
+                ILogger::WARN
+            );
+            $configurationOK = false;
+        }
+
+        if(mb_strpos($this->configuration->ldapLoginFilter, '%uid', 0, 'UTF-8')
+            === false) {
+            \OCP\Util::writeLog(
+                'user_ldap',
+                $errorStr.'login filter does not contain %uid place holder.',
+                ILogger::WARN
+            );
+            $configurationOK = false;
+        }
+
+        return $configurationOK;
+    }
+
+    /**
+     * Validates the user specified configuration
+     * @return bool true if configuration seems OK, false otherwise
+     */
+    private function validateConfiguration() {
+
+        if($this->doNotValidate) {
+            //don't do a validation if it is a new configuration with pure
+            //default values. Will be allowed on changes via __set or
+            //setConfiguration
+            return false;
+        }
+
+        // first step: "soft" checks: settings that are not really
+        // necessary, but advisable. If left empty, give an info message
+        $this->doSoftValidation();
+
+        //second step: critical checks. If left empty or filled wrong, mark as
+        //not configured and give a warning.
+        return $this->doCriticalValidation();
+    }
+
+
+    /**
+     * Connects and Binds to LDAP
+     *
+     * @throws ServerNotAvailableException
+     */
+    private function establishConnection() {
+        if(!$this->configuration->ldapConfigurationActive) {
+            return null;
+        }
+        static $phpLDAPinstalled = true;
+        if(!$phpLDAPinstalled) {
+            return false;
+        }
+        if(!$this->ignoreValidation && !$this->configured) {
+            \OCP\Util::writeLog(
+                'user_ldap',
+                'Configuration is invalid, cannot connect',
+                ILogger::WARN
+            );
+            return false;
+        }
+        if(!$this->ldapConnectionRes) {
+            if(!$this->ldap->areLDAPFunctionsAvailable()) {
+                $phpLDAPinstalled = false;
+                \OCP\Util::writeLog(
+                    'user_ldap',
+                    'function ldap_connect is not available. Make sure that the PHP ldap module is installed.',
+                    ILogger::ERROR
+                );
+
+                return false;
+            }
+            if($this->configuration->turnOffCertCheck) {
+                if(putenv('LDAPTLS_REQCERT=never')) {
+                    \OCP\Util::writeLog('user_ldap',
+                        'Turned off SSL certificate validation successfully.',
+                        ILogger::DEBUG);
+                } else {
+                    \OCP\Util::writeLog(
+                        'user_ldap',
+                        'Could not turn off SSL certificate validation.',
+                        ILogger::WARN
+                    );
+                }
+            }
+
+            $isOverrideMainServer = ($this->configuration->ldapOverrideMainServer
+                || $this->getFromCache('overrideMainServer'));
+            $isBackupHost = (trim($this->configuration->ldapBackupHost) !== "");
+            $bindStatus = false;
+            try {
+                if (!$isOverrideMainServer) {
+                    $this->doConnect($this->configuration->ldapHost,
+                        $this->configuration->ldapPort);
+                    return $this->bind();
+                }
+            } catch (ServerNotAvailableException $e) {
+                if(!$isBackupHost) {
+                    throw $e;
+                }
+            }
+
+            //if LDAP server is not reachable, try the Backup (Replica!) Server
+            if($isBackupHost || $isOverrideMainServer) {
+                $this->doConnect($this->configuration->ldapBackupHost,
+                                    $this->configuration->ldapBackupPort);
+                $this->bindResult = [];
+                $bindStatus = $this->bind();
+                $error = $this->ldap->isResource($this->ldapConnectionRes) ?
+                    $this->ldap->errno($this->ldapConnectionRes) : -1;
+                if($bindStatus && $error === 0 && !$this->getFromCache('overrideMainServer')) {
+                    //when bind to backup server succeeded and failed to main server,
+                    //skip contacting him until next cache refresh
+                    $this->writeToCache('overrideMainServer', true);
+                }
+            }
+
+            return $bindStatus;
+        }
+        return null;
+    }
+
+    /**
+     * @param string $host
+     * @param string $port
+     * @return bool
+     * @throws \OC\ServerNotAvailableException
+     */
+    private function doConnect($host, $port) {
+        if ($host === '') {
+            return false;
+        }
+
+        $this->ldapConnectionRes = $this->ldap->connect($host, $port);
+
+        if(!$this->ldap->setOption($this->ldapConnectionRes, LDAP_OPT_PROTOCOL_VERSION, 3)) {
+            throw new ServerNotAvailableException('Could not set required LDAP Protocol version.');
+        }
+
+        if(!$this->ldap->setOption($this->ldapConnectionRes, LDAP_OPT_REFERRALS, 0)) {
+            throw new ServerNotAvailableException('Could not disable LDAP referrals.');
+        }
+
+        if($this->configuration->ldapTLS) {
+            if(!$this->ldap->startTls($this->ldapConnectionRes)) {
+                throw new ServerNotAvailableException('Start TLS failed, when connecting to LDAP host ' . $host . '.');
+            }
+        }
+
+        return true;
+    }
+
+    /**
+     * Binds to LDAP
+     */
+    public function bind() {
+        if(!$this->configuration->ldapConfigurationActive) {
+            return false;
+        }
+        $cr = $this->ldapConnectionRes;
+        if(!$this->ldap->isResource($cr)) {
+            $cr = $this->getConnectionResource();
+        }
+
+        if(
+            count($this->bindResult) !== 0
+            && $this->bindResult['dn'] === $this->configuration->ldapAgentName
+            && \OC::$server->getHasher()->verify(
+                $this->configPrefix . $this->configuration->ldapAgentPassword,
+                $this->bindResult['hash']
+            )
+        ) {
+            // don't attempt to bind again with the same data as before
+            // bind might have been invoked via getConnectionResource(),
+            // but we need results specifically for e.g. user login
+            return $this->bindResult['result'];
+        }
+
+        $ldapLogin = @$this->ldap->bind($cr,
+                                        $this->configuration->ldapAgentName,
+                                        $this->configuration->ldapAgentPassword);
+
+        $this->bindResult = [
+            'dn' => $this->configuration->ldapAgentName,
+            'hash' => \OC::$server->getHasher()->hash($this->configPrefix . $this->configuration->ldapAgentPassword),
+            'result' => $ldapLogin,
+        ];
+
+        if(!$ldapLogin) {
+            $errno = $this->ldap->errno($cr);
+
+            \OCP\Util::writeLog('user_ldap',
+                'Bind failed: ' . $errno . ': ' . $this->ldap->error($cr),
+                ILogger::WARN);
+
+            // Set to failure mode, if LDAP error code is not LDAP_SUCCESS or LDAP_INVALID_CREDENTIALS
+            // or (needed for Apple Open Directory:) LDAP_INSUFFICIENT_ACCESS
+            if($errno !== 0 && $errno !== 49 && $errno !== 50) {
+                $this->ldapConnectionRes = null;
+            }
+
+            return false;
+        }
+        return true;
+    }
 
 }

Spacing +65 added lines, -65 removed lines

@@ -110,7 +110,7 @@ 
 		$this->configuration = new Configuration($configPrefix,
 												 !is_null($configID));
 		$memcache = \OC::$server->getMemCacheFactory();
-		if($memcache->isAvailable()) {
+		if ($memcache->isAvailable()) {
 			$this->cache = $memcache->createDistributed();
 		}
 		$helper = new Helper(\OC::$server->getConfig());
@@ -119,7 +119,7 @@ 
 	}
 
 	public function __destruct() {
-		if(!$this->dontDestruct && $this->ldap->isResource($this->ldapConnectionRes)) {
+		if (!$this->dontDestruct && $this->ldap->isResource($this->ldapConnectionRes)) {
 			@$this->ldap->unbind($this->ldapConnectionRes);
 			$this->bindResult = [];
 		}
@@ -131,7 +131,7 @@ 
 	public function __clone() {
 		$this->configuration = new Configuration($this->configPrefix,
 												 !is_null($this->configID));
-		if(count($this->bindResult) !== 0 && $this->bindResult['result'] === true) {
+		if (count($this->bindResult) !== 0 && $this->bindResult['result'] === true) {
 			$this->bindResult = [];
 		}
 		$this->ldapConnectionRes = null;
@@ -143,7 +143,7 @@ 
 	 * @return bool|mixed
 	 */
 	public function __get($name) {
-		if(!$this->configured) {
+		if (!$this->configured) {
 			$this->readConfiguration();
 		}
 
@@ -159,7 +159,7 @@ 
 		$before = $this->configuration->$name;
 		$this->configuration->$name = $value;
 		$after = $this->configuration->$name;
-		if($before !== $after) {
+		if ($before !== $after) {
 			if ($this->configID !== '' && $this->configID !== null) {
 				$this->configuration->saveConfiguration();
 			}
@@ -183,7 +183,7 @@ 
 	 * @param bool $state
 	 */
 	public function setIgnoreValidation($state) {
-		$this->ignoreValidation = (bool)$state;
+		$this->ignoreValidation = (bool) $state;
 	}
 
 	/**
@@ -199,14 +199,14 @@ 
 	 * Returns the LDAP handler
 	 */
 	public function getConnectionResource() {
-		if(!$this->ldapConnectionRes) {
+		if (!$this->ldapConnectionRes) {
 			$this->init();
-		} else if(!$this->ldap->isResource($this->ldapConnectionRes)) {
+		} else if (!$this->ldap->isResource($this->ldapConnectionRes)) {
 			$this->ldapConnectionRes = null;
 			$this->establishConnection();
 		}
-		if(is_null($this->ldapConnectionRes)) {
-			\OCP\Util::writeLog('user_ldap', 'No LDAP Connection to server ' . $this->configuration->ldapHost, ILogger::ERROR);
+		if (is_null($this->ldapConnectionRes)) {
+			\OCP\Util::writeLog('user_ldap', 'No LDAP Connection to server '.$this->configuration->ldapHost, ILogger::ERROR);
 			throw new ServerNotAvailableException('Connection to LDAP server could not be established');
 		}
 		return $this->ldapConnectionRes;
@@ -216,7 +216,7 @@ 
 	 * resets the connection resource
 	 */
 	public function resetConnectionResource() {
-		if(!is_null($this->ldapConnectionRes)) {
+		if (!is_null($this->ldapConnectionRes)) {
 			@$this->ldap->unbind($this->ldapConnectionRes);
 			$this->ldapConnectionRes = null;
 			$this->bindResult = [];
@@ -229,7 +229,7 @@ 
 	 */
 	private function getCacheKey($key) {
 		$prefix = 'LDAP-'.$this->configID.'-'.$this->configPrefix.'-';
-		if(is_null($key)) {
+		if (is_null($key)) {
 			return $prefix;
 		}
 		return $prefix.hash('sha256', $key);
@@ -240,10 +240,10 @@ 
 	 * @return mixed|null
 	 */
 	public function getFromCache($key) {
-		if(!$this->configured) {
+		if (!$this->configured) {
 			$this->readConfiguration();
 		}
-		if(is_null($this->cache) || !$this->configuration->ldapCacheTTL) {
+		if (is_null($this->cache) || !$this->configuration->ldapCacheTTL) {
 			return null;
 		}
 		$key = $this->getCacheKey($key);
@@ -258,10 +258,10 @@ 
 	 * @return string
 	 */
 	public function writeToCache($key, $value) {
-		if(!$this->configured) {
+		if (!$this->configured) {
 			$this->readConfiguration();
 		}
-		if(is_null($this->cache)
+		if (is_null($this->cache)
 			|| !$this->configuration->ldapCacheTTL
 			|| !$this->configuration->ldapConfigurationActive) {
 			return null;
@@ -272,7 +272,7 @@ 
 	}
 
 	public function clearCache() {
-		if(!is_null($this->cache)) {
+		if (!is_null($this->cache)) {
 			$this->cache->clear($this->getCacheKey(null));
 		}
 	}
@@ -284,7 +284,7 @@ 
 	 * @return null
 	 */
 	private function readConfiguration($force = false) {
-		if((!$this->configured || $force) && !is_null($this->configID)) {
+		if ((!$this->configured || $force) && !is_null($this->configID)) {
 			$this->configuration->readConfiguration();
 			$this->configured = $this->validateConfiguration();
 		}
@@ -297,12 +297,12 @@ 
 	 * @return boolean true if config validates, false otherwise. Check with $setParameters for detailed success on single parameters
 	 */
 	public function setConfiguration($config, &$setParameters = null) {
-		if(is_null($setParameters)) {
+		if (is_null($setParameters)) {
 			$setParameters = [];
 		}
 		$this->doNotValidate = false;
 		$this->configuration->setConfiguration($config, $setParameters);
-		if(count($setParameters) > 0) {
+		if (count($setParameters) > 0) {
 			$this->configured = $this->validateConfiguration();
 		}
 
@@ -329,10 +329,10 @@ 
 		$config = $this->configuration->getConfiguration();
 		$cta = $this->configuration->getConfigTranslationArray();
 		$result = [];
-		foreach($cta as $dbkey => $configkey) {
-			switch($configkey) {
+		foreach ($cta as $dbkey => $configkey) {
+			switch ($configkey) {
 				case 'homeFolderNamingRule':
-					if(strpos($config[$configkey], 'attr:') === 0) {
+					if (strpos($config[$configkey], 'attr:') === 0) {
 						$result[$dbkey] = substr($config[$configkey], 5);
 					} else {
 						$result[$dbkey] = '';
@@ -343,7 +343,7 @@ 
 				case 'ldapBaseGroups':
 				case 'ldapAttributesForUserSearch':
 				case 'ldapAttributesForGroupSearch':
-					if(is_array($config[$configkey])) {
+					if (is_array($config[$configkey])) {
 						$result[$dbkey] = implode("\n", $config[$configkey]);
 						break;
 					} //else follows default
@@ -356,23 +356,23 @@ 
 
 	private function doSoftValidation() {
 		//if User or Group Base are not set, take over Base DN setting
-		foreach(['ldapBaseUsers', 'ldapBaseGroups'] as $keyBase) {
+		foreach (['ldapBaseUsers', 'ldapBaseGroups'] as $keyBase) {
 			$val = $this->configuration->$keyBase;
-			if(empty($val)) {
+			if (empty($val)) {
 				$this->configuration->$keyBase = $this->configuration->ldapBase;
 			}
 		}
 
-		foreach(['ldapExpertUUIDUserAttr'  => 'ldapUuidUserAttribute',
+		foreach (['ldapExpertUUIDUserAttr'  => 'ldapUuidUserAttribute',
 					  'ldapExpertUUIDGroupAttr' => 'ldapUuidGroupAttribute']
 				as $expertSetting => $effectiveSetting) {
 			$uuidOverride = $this->configuration->$expertSetting;
-			if(!empty($uuidOverride)) {
+			if (!empty($uuidOverride)) {
 				$this->configuration->$effectiveSetting = $uuidOverride;
 			} else {
 				$uuidAttributes = Access::UUID_ATTRIBUTES;
 				array_unshift($uuidAttributes, 'auto');
-				if(!in_array($this->configuration->$effectiveSetting,
+				if (!in_array($this->configuration->$effectiveSetting,
 							$uuidAttributes)
 					&& (!is_null($this->configID))) {
 					$this->configuration->$effectiveSetting = 'auto';
@@ -386,7 +386,7 @@ 
 			}
 		}
 
-		$backupPort = (int)$this->configuration->ldapBackupPort;
+		$backupPort = (int) $this->configuration->ldapBackupPort;
 		if ($backupPort <= 0) {
 			$this->configuration->backupPort = $this->configuration->ldapPort;
 		}
@@ -394,14 +394,14 @@ 
 		//make sure empty search attributes are saved as simple, empty array
 		$saKeys = ['ldapAttributesForUserSearch',
 						'ldapAttributesForGroupSearch'];
-		foreach($saKeys as $key) {
+		foreach ($saKeys as $key) {
 			$val = $this->configuration->$key;
-			if(is_array($val) && count($val) === 1 && empty($val[0])) {
+			if (is_array($val) && count($val) === 1 && empty($val[0])) {
 				$this->configuration->$key = [];
 			}
 		}
 
-		if((stripos($this->configuration->ldapHost, 'ldaps://') === 0)
+		if ((stripos($this->configuration->ldapHost, 'ldaps://') === 0)
 			&& $this->configuration->ldapTLS) {
 			$this->configuration->ldapTLS = false;
 			\OCP\Util::writeLog(
@@ -418,15 +418,15 @@ 
 	private function doCriticalValidation() {
 		$configurationOK = true;
 		$errorStr = 'Configuration Error (prefix '.
-			(string)$this->configPrefix .'): ';
+			(string) $this->configPrefix.'): ';
 
 		//options that shall not be empty
 		$options = ['ldapHost', 'ldapPort', 'ldapUserDisplayName',
 						 'ldapGroupDisplayName', 'ldapLoginFilter'];
-		foreach($options as $key) {
+		foreach ($options as $key) {
 			$val = $this->configuration->$key;
-			if(empty($val)) {
-				switch($key) {
+			if (empty($val)) {
+				switch ($key) {
 					case 'ldapHost':
 						$subj = 'LDAP Host';
 						break;
@@ -459,12 +459,12 @@ 
 		$agent = $this->configuration->ldapAgentName;
 		$pwd = $this->configuration->ldapAgentPassword;
 		if (
-			($agent === ''  && $pwd !== '')
+			($agent === '' && $pwd !== '')
 			|| ($agent !== '' && $pwd === '')
 		) {
 			\OCP\Util::writeLog(
 				'user_ldap',
-				$errorStr.'either no password is given for the user ' .
+				$errorStr.'either no password is given for the user '.
 					'agent or a password is given, but not an LDAP agent.',
 				ILogger::WARN);
 			$configurationOK = false;
@@ -474,7 +474,7 @@ 
 		$baseUsers = $this->configuration->ldapBaseUsers;
 		$baseGroups = $this->configuration->ldapBaseGroups;
 
-		if(empty($base) && empty($baseUsers) && empty($baseGroups)) {
+		if (empty($base) && empty($baseUsers) && empty($baseGroups)) {
 			\OCP\Util::writeLog(
 				'user_ldap',
 				$errorStr.'Not a single Base DN given.',
@@ -483,7 +483,7 @@ 
 			$configurationOK = false;
 		}
 
-		if(mb_strpos($this->configuration->ldapLoginFilter, '%uid', 0, 'UTF-8')
+		if (mb_strpos($this->configuration->ldapLoginFilter, '%uid', 0, 'UTF-8')
 		   === false) {
 			\OCP\Util::writeLog(
 				'user_ldap',
@@ -502,7 +502,7 @@ 
 	 */
 	private function validateConfiguration() {
 
-		if($this->doNotValidate) {
+		if ($this->doNotValidate) {
 			//don't do a validation if it is a new configuration with pure
 			//default values. Will be allowed on changes via __set or
 			//setConfiguration
@@ -525,14 +525,14 @@ 
 	 * @throws ServerNotAvailableException
 	 */
 	private function establishConnection() {
-		if(!$this->configuration->ldapConfigurationActive) {
+		if (!$this->configuration->ldapConfigurationActive) {
 			return null;
 		}
 		static $phpLDAPinstalled = true;
-		if(!$phpLDAPinstalled) {
+		if (!$phpLDAPinstalled) {
 			return false;
 		}
-		if(!$this->ignoreValidation && !$this->configured) {
+		if (!$this->ignoreValidation && !$this->configured) {
 			\OCP\Util::writeLog(
 				'user_ldap',
 				'Configuration is invalid, cannot connect',
@@ -540,8 +540,8 @@ 
 			);
 			return false;
 		}
-		if(!$this->ldapConnectionRes) {
-			if(!$this->ldap->areLDAPFunctionsAvailable()) {
+		if (!$this->ldapConnectionRes) {
+			if (!$this->ldap->areLDAPFunctionsAvailable()) {
 				$phpLDAPinstalled = false;
 				\OCP\Util::writeLog(
 					'user_ldap',
@@ -551,8 +551,8 @@ 
 
 				return false;
 			}
-			if($this->configuration->turnOffCertCheck) {
-				if(putenv('LDAPTLS_REQCERT=never')) {
+			if ($this->configuration->turnOffCertCheck) {
+				if (putenv('LDAPTLS_REQCERT=never')) {
 					\OCP\Util::writeLog('user_ldap',
 						'Turned off SSL certificate validation successfully.',
 						ILogger::DEBUG);
@@ -576,20 +576,20 @@ 
 					return $this->bind();
 				}
 			} catch (ServerNotAvailableException $e) {
-				if(!$isBackupHost) {
+				if (!$isBackupHost) {
 					throw $e;
 				}
 			}
 
 			//if LDAP server is not reachable, try the Backup (Replica!) Server
-			if($isBackupHost || $isOverrideMainServer) {
+			if ($isBackupHost || $isOverrideMainServer) {
 				$this->doConnect($this->configuration->ldapBackupHost,
 								 $this->configuration->ldapBackupPort);
 				$this->bindResult = [];
 				$bindStatus = $this->bind();
 				$error = $this->ldap->isResource($this->ldapConnectionRes) ?
 					$this->ldap->errno($this->ldapConnectionRes) : -1;
-				if($bindStatus && $error === 0 && !$this->getFromCache('overrideMainServer')) {
+				if ($bindStatus && $error === 0 && !$this->getFromCache('overrideMainServer')) {
 					//when bind to backup server succeeded and failed to main server,
 					//skip contacting him until next cache refresh
 					$this->writeToCache('overrideMainServer', true);
@@ -614,17 +614,17 @@ 
 
 		$this->ldapConnectionRes = $this->ldap->connect($host, $port);
 
-		if(!$this->ldap->setOption($this->ldapConnectionRes, LDAP_OPT_PROTOCOL_VERSION, 3)) {
+		if (!$this->ldap->setOption($this->ldapConnectionRes, LDAP_OPT_PROTOCOL_VERSION, 3)) {
 			throw new ServerNotAvailableException('Could not set required LDAP Protocol version.');
 		}
 
-		if(!$this->ldap->setOption($this->ldapConnectionRes, LDAP_OPT_REFERRALS, 0)) {
+		if (!$this->ldap->setOption($this->ldapConnectionRes, LDAP_OPT_REFERRALS, 0)) {
 			throw new ServerNotAvailableException('Could not disable LDAP referrals.');
 		}
 
-		if($this->configuration->ldapTLS) {
-			if(!$this->ldap->startTls($this->ldapConnectionRes)) {
-				throw new ServerNotAvailableException('Start TLS failed, when connecting to LDAP host ' . $host . '.');
+		if ($this->configuration->ldapTLS) {
+			if (!$this->ldap->startTls($this->ldapConnectionRes)) {
+				throw new ServerNotAvailableException('Start TLS failed, when connecting to LDAP host '.$host.'.');
 			}
 		}
 
@@ -635,19 +635,19 @@ 
 	 * Binds to LDAP
 	 */
 	public function bind() {
-		if(!$this->configuration->ldapConfigurationActive) {
+		if (!$this->configuration->ldapConfigurationActive) {
 			return false;
 		}
 		$cr = $this->ldapConnectionRes;
-		if(!$this->ldap->isResource($cr)) {
+		if (!$this->ldap->isResource($cr)) {
 			$cr = $this->getConnectionResource();
 		}
 
-		if(
+		if (
 			count($this->bindResult) !== 0
 			&& $this->bindResult['dn'] === $this->configuration->ldapAgentName
 			&& \OC::$server->getHasher()->verify(
-				$this->configPrefix . $this->configuration->ldapAgentPassword,
+				$this->configPrefix.$this->configuration->ldapAgentPassword,
 				$this->bindResult['hash']
 			)
 		) {
@@ -663,20 +663,20 @@ 
 
 		$this->bindResult = [
 			'dn' => $this->configuration->ldapAgentName,
-			'hash' => \OC::$server->getHasher()->hash($this->configPrefix . $this->configuration->ldapAgentPassword),
+			'hash' => \OC::$server->getHasher()->hash($this->configPrefix.$this->configuration->ldapAgentPassword),
 			'result' => $ldapLogin,
 		];
 
-		if(!$ldapLogin) {
+		if (!$ldapLogin) {
 			$errno = $this->ldap->errno($cr);
 
 			\OCP\Util::writeLog('user_ldap',
-				'Bind failed: ' . $errno . ': ' . $this->ldap->error($cr),
+				'Bind failed: '.$errno.': '.$this->ldap->error($cr),
 				ILogger::WARN);
 
 			// Set to failure mode, if LDAP error code is not LDAP_SUCCESS or LDAP_INVALID_CREDENTIALS
 			// or (needed for Apple Open Directory:) LDAP_INSUFFICIENT_ACCESS
-			if($errno !== 0 && $errno !== 49 && $errno !== 50) {
+			if ($errno !== 0 && $errno !== 49 && $errno !== 50) {
 				$this->ldapConnectionRes = null;
 			}
 

apps/user_ldap/lib/Wizard.php

Indentation +1314 added lines, -1314 removed lines

@@ -42,1320 +42,1320 @@
 use OCP\ILogger;
 
 class Wizard extends LDAPUtility {
-	/** @var \OCP\IL10N */
-	static protected $l;
-	protected $access;
-	protected $cr;
-	protected $configuration;
-	protected $result;
-	protected $resultCache = [];
-
-	const LRESULT_PROCESSED_OK = 2;
-	const LRESULT_PROCESSED_INVALID = 3;
-	const LRESULT_PROCESSED_SKIP = 4;
-
-	const LFILTER_LOGIN      = 2;
-	const LFILTER_USER_LIST  = 3;
-	const LFILTER_GROUP_LIST = 4;
-
-	const LFILTER_MODE_ASSISTED = 2;
-	const LFILTER_MODE_RAW = 1;
-
-	const LDAP_NW_TIMEOUT = 4;
-
-	/**
-	 * Constructor
-	 * @param Configuration $configuration an instance of Configuration
-	 * @param ILDAPWrapper $ldap an instance of ILDAPWrapper
-	 * @param Access $access
-	 */
-	public function __construct(Configuration $configuration, ILDAPWrapper $ldap, Access $access) {
-		parent::__construct($ldap);
-		$this->configuration = $configuration;
-		if(is_null(Wizard::$l)) {
-			Wizard::$l = \OC::$server->getL10N('user_ldap');
-		}
-		$this->access = $access;
-		$this->result = new WizardResult();
-	}
-
-	public function  __destruct() {
-		if($this->result->hasChanges()) {
-			$this->configuration->saveConfiguration();
-		}
-	}
-
-	/**
-	 * counts entries in the LDAP directory
-	 *
-	 * @param string $filter the LDAP search filter
-	 * @param string $type a string being either 'users' or 'groups';
-	 * @return int
-	 * @throws \Exception
-	 */
-	public function countEntries(string $filter, string $type): int {
-		$reqs = ['ldapHost', 'ldapPort', 'ldapBase'];
-		if($type === 'users') {
-			$reqs[] = 'ldapUserFilter';
-		}
-		if(!$this->checkRequirements($reqs)) {
-			throw new \Exception('Requirements not met', 400);
-		}
-
-		$attr = ['dn']; // default
-		$limit = 1001;
-		if($type === 'groups') {
-			$result =  $this->access->countGroups($filter, $attr, $limit);
-		} else if($type === 'users') {
-			$result = $this->access->countUsers($filter, $attr, $limit);
-		} else if ($type === 'objects') {
-			$result = $this->access->countObjects($limit);
-		} else {
-			throw new \Exception('Internal error: Invalid object type', 500);
-		}
-
-		return (int)$result;
-	}
-
-	/**
-	 * formats the return value of a count operation to the string to be
-	 * inserted.
-	 *
-	 * @param int $count
-	 * @return string
-	 */
-	private function formatCountResult(int $count): string {
-		if($count > 1000) {
-			return '> 1000';
-		}
-		return (string)$count;
-	}
-
-	public function countGroups() {
-		$filter = $this->configuration->ldapGroupFilter;
-
-		if(empty($filter)) {
-			$output = self::$l->n('%s group found', '%s groups found', 0, [0]);
-			$this->result->addChange('ldap_group_count', $output);
-			return $this->result;
-		}
-
-		try {
-			$groupsTotal = $this->countEntries($filter, 'groups');
-		} catch (\Exception $e) {
-			//400 can be ignored, 500 is forwarded
-			if($e->getCode() === 500) {
-				throw $e;
-			}
-			return false;
-		}
-		$output = self::$l->n(
-			'%s group found',
-			'%s groups found',
-			$groupsTotal,
-			[$this->formatCountResult($groupsTotal)]
-		);
-		$this->result->addChange('ldap_group_count', $output);
-		return $this->result;
-	}
-
-	/**
-	 * @return WizardResult
-	 * @throws \Exception
-	 */
-	public function countUsers() {
-		$filter = $this->access->getFilterForUserCount();
-
-		$usersTotal = $this->countEntries($filter, 'users');
-		$output = self::$l->n(
-			'%s user found',
-			'%s users found',
-			$usersTotal,
-			[$this->formatCountResult($usersTotal)]
-		);
-		$this->result->addChange('ldap_user_count', $output);
-		return $this->result;
-	}
-
-	/**
-	 * counts any objects in the currently set base dn
-	 *
-	 * @return WizardResult
-	 * @throws \Exception
-	 */
-	public function countInBaseDN() {
-		// we don't need to provide a filter in this case
-		$total = $this->countEntries('', 'objects');
-		if($total === false) {
-			throw new \Exception('invalid results received');
-		}
-		$this->result->addChange('ldap_test_base', $total);
-		return $this->result;
-	}
-
-	/**
-	 * counts users with a specified attribute
-	 * @param string $attr
-	 * @param bool $existsCheck
-	 * @return int|bool
-	 */
-	public function countUsersWithAttribute($attr, $existsCheck = false) {
-		if(!$this->checkRequirements(['ldapHost',
-										   'ldapPort',
-										   'ldapBase',
-										   'ldapUserFilter',
-										   ])) {
-			return  false;
-		}
-
-		$filter = $this->access->combineFilterWithAnd([
-			$this->configuration->ldapUserFilter,
-			$attr . '=*'
-		]);
-
-		$limit = ($existsCheck === false) ? null : 1;
-
-		return $this->access->countUsers($filter, ['dn'], $limit);
-	}
-
-	/**
-	 * detects the display name attribute. If a setting is already present that
-	 * returns at least one hit, the detection will be canceled.
-	 * @return WizardResult|bool
-	 * @throws \Exception
-	 */
-	public function detectUserDisplayNameAttribute() {
-		if(!$this->checkRequirements(['ldapHost',
-										'ldapPort',
-										'ldapBase',
-										'ldapUserFilter',
-										])) {
-			return  false;
-		}
-
-		$attr = $this->configuration->ldapUserDisplayName;
-		if ($attr !== '' && $attr !== 'displayName') {
-			// most likely not the default value with upper case N,
-			// verify it still produces a result
-			$count = (int)$this->countUsersWithAttribute($attr, true);
-			if($count > 0) {
-				//no change, but we sent it back to make sure the user interface
-				//is still correct, even if the ajax call was cancelled meanwhile
-				$this->result->addChange('ldap_display_name', $attr);
-				return $this->result;
-			}
-		}
-
-		// first attribute that has at least one result wins
-		$displayNameAttrs = ['displayname', 'cn'];
-		foreach ($displayNameAttrs as $attr) {
-			$count = (int)$this->countUsersWithAttribute($attr, true);
-
-			if($count > 0) {
-				$this->applyFind('ldap_display_name', $attr);
-				return $this->result;
-			}
-		}
-
-		throw new \Exception(self::$l->t('Could not detect user display name attribute. Please specify it yourself in advanced LDAP settings.'));
-	}
-
-	/**
-	 * detects the most often used email attribute for users applying to the
-	 * user list filter. If a setting is already present that returns at least
-	 * one hit, the detection will be canceled.
-	 * @return WizardResult|bool
-	 */
-	public function detectEmailAttribute() {
-		if(!$this->checkRequirements(['ldapHost',
-										   'ldapPort',
-										   'ldapBase',
-										   'ldapUserFilter',
-										   ])) {
-			return  false;
-		}
-
-		$attr = $this->configuration->ldapEmailAttribute;
-		if ($attr !== '') {
-			$count = (int)$this->countUsersWithAttribute($attr, true);
-			if($count > 0) {
-				return false;
-			}
-			$writeLog = true;
-		} else {
-			$writeLog = false;
-		}
-
-		$emailAttributes = ['mail', 'mailPrimaryAddress'];
-		$winner = '';
-		$maxUsers = 0;
-		foreach($emailAttributes as $attr) {
-			$count = $this->countUsersWithAttribute($attr);
-			if($count > $maxUsers) {
-				$maxUsers = $count;
-				$winner = $attr;
-			}
-		}
-
-		if($winner !== '') {
-			$this->applyFind('ldap_email_attr', $winner);
-			if($writeLog) {
-				\OCP\Util::writeLog('user_ldap', 'The mail attribute has ' .
-					'automatically been reset, because the original value ' .
-					'did not return any results.', ILogger::INFO);
-			}
-		}
-
-		return $this->result;
-	}
-
-	/**
-	 * @return WizardResult
-	 * @throws \Exception
-	 */
-	public function determineAttributes() {
-		if(!$this->checkRequirements(['ldapHost',
-										   'ldapPort',
-										   'ldapBase',
-										   'ldapUserFilter',
-										   ])) {
-			return  false;
-		}
-
-		$attributes = $this->getUserAttributes();
-
-		natcasesort($attributes);
-		$attributes = array_values($attributes);
-
-		$this->result->addOptions('ldap_loginfilter_attributes', $attributes);
-
-		$selected = $this->configuration->ldapLoginFilterAttributes;
-		if(is_array($selected) && !empty($selected)) {
-			$this->result->addChange('ldap_loginfilter_attributes', $selected);
-		}
-
-		return $this->result;
-	}
-
-	/**
-	 * detects the available LDAP attributes
-	 * @return array|false The instance's WizardResult instance
-	 * @throws \Exception
-	 */
-	private function getUserAttributes() {
-		if(!$this->checkRequirements(['ldapHost',
-										   'ldapPort',
-										   'ldapBase',
-										   'ldapUserFilter',
-										   ])) {
-			return  false;
-		}
-		$cr = $this->getConnection();
-		if(!$cr) {
-			throw new \Exception('Could not connect to LDAP');
-		}
-
-		$base = $this->configuration->ldapBase[0];
-		$filter = $this->configuration->ldapUserFilter;
-		$rr = $this->ldap->search($cr, $base, $filter, [], 1, 1);
-		if(!$this->ldap->isResource($rr)) {
-			return false;
-		}
-		$er = $this->ldap->firstEntry($cr, $rr);
-		$attributes = $this->ldap->getAttributes($cr, $er);
-		$pureAttributes = [];
-		for($i = 0; $i < $attributes['count']; $i++) {
-			$pureAttributes[] = $attributes[$i];
-		}
-
-		return $pureAttributes;
-	}
-
-	/**
-	 * detects the available LDAP groups
-	 * @return WizardResult|false the instance's WizardResult instance
-	 */
-	public function determineGroupsForGroups() {
-		return $this->determineGroups('ldap_groupfilter_groups',
-									  'ldapGroupFilterGroups',
-									  false);
-	}
-
-	/**
-	 * detects the available LDAP groups
-	 * @return WizardResult|false the instance's WizardResult instance
-	 */
-	public function determineGroupsForUsers() {
-		return $this->determineGroups('ldap_userfilter_groups',
-									  'ldapUserFilterGroups');
-	}
-
-	/**
-	 * detects the available LDAP groups
-	 * @param string $dbKey
-	 * @param string $confKey
-	 * @param bool $testMemberOf
-	 * @return WizardResult|false the instance's WizardResult instance
-	 * @throws \Exception
-	 */
-	private function determineGroups($dbKey, $confKey, $testMemberOf = true) {
-		if(!$this->checkRequirements(['ldapHost',
-										   'ldapPort',
-										   'ldapBase',
-										   ])) {
-			return  false;
-		}
-		$cr = $this->getConnection();
-		if(!$cr) {
-			throw new \Exception('Could not connect to LDAP');
-		}
-
-		$this->fetchGroups($dbKey, $confKey);
-
-		if($testMemberOf) {
-			$this->configuration->hasMemberOfFilterSupport = $this->testMemberOf();
-			$this->result->markChange();
-			if(!$this->configuration->hasMemberOfFilterSupport) {
-				throw new \Exception('memberOf is not supported by the server');
-			}
-		}
-
-		return $this->result;
-	}
-
-	/**
-	 * fetches all groups from LDAP and adds them to the result object
-	 *
-	 * @param string $dbKey
-	 * @param string $confKey
-	 * @return array $groupEntries
-	 * @throws \Exception
-	 */
-	public function fetchGroups($dbKey, $confKey) {
-		$obclasses = ['posixGroup', 'group', 'zimbraDistributionList', 'groupOfNames', 'groupOfUniqueNames'];
-
-		$filterParts = [];
-		foreach($obclasses as $obclass) {
-			$filterParts[] = 'objectclass='.$obclass;
-		}
-		//we filter for everything
-		//- that looks like a group and
-		//- has the group display name set
-		$filter = $this->access->combineFilterWithOr($filterParts);
-		$filter = $this->access->combineFilterWithAnd([$filter, 'cn=*']);
-
-		$groupNames = [];
-		$groupEntries = [];
-		$limit = 400;
-		$offset = 0;
-		do {
-			// we need to request dn additionally here, otherwise memberOf
-			// detection will fail later
-			$result = $this->access->searchGroups($filter, ['cn', 'dn'], $limit, $offset);
-			foreach($result as $item) {
-				if(!isset($item['cn']) && !is_array($item['cn']) && !isset($item['cn'][0])) {
-					// just in case - no issue known
-					continue;
-				}
-				$groupNames[] = $item['cn'][0];
-				$groupEntries[] = $item;
-			}
-			$offset += $limit;
-		} while ($this->access->hasMoreResults());
-
-		if(count($groupNames) > 0) {
-			natsort($groupNames);
-			$this->result->addOptions($dbKey, array_values($groupNames));
-		} else {
-			throw new \Exception(self::$l->t('Could not find the desired feature'));
-		}
-
-		$setFeatures = $this->configuration->$confKey;
-		if(is_array($setFeatures) && !empty($setFeatures)) {
-			//something is already configured? pre-select it.
-			$this->result->addChange($dbKey, $setFeatures);
-		}
-		return $groupEntries;
-	}
-
-	public function determineGroupMemberAssoc() {
-		if(!$this->checkRequirements(['ldapHost',
-										   'ldapPort',
-										   'ldapGroupFilter',
-										   ])) {
-			return  false;
-		}
-		$attribute = $this->detectGroupMemberAssoc();
-		if($attribute === false) {
-			return false;
-		}
-		$this->configuration->setConfiguration(['ldapGroupMemberAssocAttr' => $attribute]);
-		$this->result->addChange('ldap_group_member_assoc_attribute', $attribute);
-
-		return $this->result;
-	}
-
-	/**
-	 * Detects the available object classes
-	 * @return WizardResult|false the instance's WizardResult instance
-	 * @throws \Exception
-	 */
-	public function determineGroupObjectClasses() {
-		if(!$this->checkRequirements(['ldapHost',
-										   'ldapPort',
-										   'ldapBase',
-										   ])) {
-			return  false;
-		}
-		$cr = $this->getConnection();
-		if(!$cr) {
-			throw new \Exception('Could not connect to LDAP');
-		}
-
-		$obclasses = ['groupOfNames', 'groupOfUniqueNames', 'group', 'posixGroup', '*'];
-		$this->determineFeature($obclasses,
-								'objectclass',
-								'ldap_groupfilter_objectclass',
-								'ldapGroupFilterObjectclass',
-								false);
-
-		return $this->result;
-	}
-
-	/**
-	 * detects the available object classes
-	 * @return WizardResult
-	 * @throws \Exception
-	 */
-	public function determineUserObjectClasses() {
-		if(!$this->checkRequirements(['ldapHost',
-										   'ldapPort',
-										   'ldapBase',
-										   ])) {
-			return  false;
-		}
-		$cr = $this->getConnection();
-		if(!$cr) {
-			throw new \Exception('Could not connect to LDAP');
-		}
-
-		$obclasses = ['inetOrgPerson', 'person', 'organizationalPerson',
-						   'user', 'posixAccount', '*'];
-		$filter = $this->configuration->ldapUserFilter;
-		//if filter is empty, it is probably the first time the wizard is called
-		//then, apply suggestions.
-		$this->determineFeature($obclasses,
-								'objectclass',
-								'ldap_userfilter_objectclass',
-								'ldapUserFilterObjectclass',
-								empty($filter));
-
-		return $this->result;
-	}
-
-	/**
-	 * @return WizardResult|false
-	 * @throws \Exception
-	 */
-	public function getGroupFilter() {
-		if(!$this->checkRequirements(['ldapHost',
-										   'ldapPort',
-										   'ldapBase',
-										   ])) {
-			return false;
-		}
-		//make sure the use display name is set
-		$displayName = $this->configuration->ldapGroupDisplayName;
-		if ($displayName === '') {
-			$d = $this->configuration->getDefaults();
-			$this->applyFind('ldap_group_display_name',
-							 $d['ldap_group_display_name']);
-		}
-		$filter = $this->composeLdapFilter(self::LFILTER_GROUP_LIST);
-
-		$this->applyFind('ldap_group_filter', $filter);
-		return $this->result;
-	}
-
-	/**
-	 * @return WizardResult|false
-	 * @throws \Exception
-	 */
-	public function getUserListFilter() {
-		if(!$this->checkRequirements(['ldapHost',
-										   'ldapPort',
-										   'ldapBase',
-										   ])) {
-			return false;
-		}
-		//make sure the use display name is set
-		$displayName = $this->configuration->ldapUserDisplayName;
-		if ($displayName === '') {
-			$d = $this->configuration->getDefaults();
-			$this->applyFind('ldap_display_name', $d['ldap_display_name']);
-		}
-		$filter = $this->composeLdapFilter(self::LFILTER_USER_LIST);
-		if(!$filter) {
-			throw new \Exception('Cannot create filter');
-		}
-
-		$this->applyFind('ldap_userlist_filter', $filter);
-		return $this->result;
-	}
-
-	/**
-	 * @return bool|WizardResult
-	 * @throws \Exception
-	 */
-	public function getUserLoginFilter() {
-		if(!$this->checkRequirements(['ldapHost',
-										   'ldapPort',
-										   'ldapBase',
-										   'ldapUserFilter',
-										   ])) {
-			return false;
-		}
-
-		$filter = $this->composeLdapFilter(self::LFILTER_LOGIN);
-		if(!$filter) {
-			throw new \Exception('Cannot create filter');
-		}
-
-		$this->applyFind('ldap_login_filter', $filter);
-		return $this->result;
-	}
-
-	/**
-	 * @return bool|WizardResult
-	 * @param string $loginName
-	 * @throws \Exception
-	 */
-	public function testLoginName($loginName) {
-		if(!$this->checkRequirements(['ldapHost',
-			'ldapPort',
-			'ldapBase',
-			'ldapLoginFilter',
-		])) {
-			return false;
-		}
-
-		$cr = $this->access->connection->getConnectionResource();
-		if(!$this->ldap->isResource($cr)) {
-			throw new \Exception('connection error');
-		}
-
-		if(mb_strpos($this->access->connection->ldapLoginFilter, '%uid', 0, 'UTF-8')
-			=== false) {
-			throw new \Exception('missing placeholder');
-		}
-
-		$users = $this->access->countUsersByLoginName($loginName);
-		if($this->ldap->errno($cr) !== 0) {
-			throw new \Exception($this->ldap->error($cr));
-		}
-		$filter = str_replace('%uid', $loginName, $this->access->connection->ldapLoginFilter);
-		$this->result->addChange('ldap_test_loginname', $users);
-		$this->result->addChange('ldap_test_effective_filter', $filter);
-		return $this->result;
-	}
-
-	/**
-	 * Tries to determine the port, requires given Host, User DN and Password
-	 * @return WizardResult|false WizardResult on success, false otherwise
-	 * @throws \Exception
-	 */
-	public function guessPortAndTLS() {
-		if(!$this->checkRequirements(['ldapHost',
-										   ])) {
-			return false;
-		}
-		$this->checkHost();
-		$portSettings = $this->getPortSettingsToTry();
-
-		if(!is_array($portSettings)) {
-			throw new \Exception(print_r($portSettings, true));
-		}
-
-		//proceed from the best configuration and return on first success
-		foreach($portSettings as $setting) {
-			$p = $setting['port'];
-			$t = $setting['tls'];
-			\OCP\Util::writeLog('user_ldap', 'Wiz: trying port '. $p . ', TLS '. $t, ILogger::DEBUG);
-			//connectAndBind may throw Exception, it needs to be catched by the
-			//callee of this method
-
-			try {
-				$settingsFound = $this->connectAndBind($p, $t);
-			} catch (\Exception $e) {
-				// any reply other than -1 (= cannot connect) is already okay,
-				// because then we found the server
-				// unavailable startTLS returns -11
-				if($e->getCode() > 0) {
-					$settingsFound = true;
-				} else {
-					throw $e;
-				}
-			}
-
-			if ($settingsFound === true) {
-				$config = [
-					'ldapPort' => $p,
-					'ldapTLS' => (int)$t
-				];
-				$this->configuration->setConfiguration($config);
-				\OCP\Util::writeLog('user_ldap', 'Wiz: detected Port ' . $p, ILogger::DEBUG);
-				$this->result->addChange('ldap_port', $p);
-				return $this->result;
-			}
-		}
-
-		//custom port, undetected (we do not brute force)
-		return false;
-	}
-
-	/**
-	 * tries to determine a base dn from User DN or LDAP Host
-	 * @return WizardResult|false WizardResult on success, false otherwise
-	 */
-	public function guessBaseDN() {
-		if(!$this->checkRequirements(['ldapHost',
-										   'ldapPort',
-										   ])) {
-			return false;
-		}
-
-		//check whether a DN is given in the agent name (99.9% of all cases)
-		$base = null;
-		$i = stripos($this->configuration->ldapAgentName, 'dc=');
-		if($i !== false) {
-			$base = substr($this->configuration->ldapAgentName, $i);
-			if($this->testBaseDN($base)) {
-				$this->applyFind('ldap_base', $base);
-				return $this->result;
-			}
-		}
-
-		//this did not help :(
-		//Let's see whether we can parse the Host URL and convert the domain to
-		//a base DN
-		$helper = new Helper(\OC::$server->getConfig());
-		$domain = $helper->getDomainFromURL($this->configuration->ldapHost);
-		if(!$domain) {
-			return false;
-		}
-
-		$dparts = explode('.', $domain);
-		while(count($dparts) > 0) {
-			$base2 = 'dc=' . implode(',dc=', $dparts);
-			if ($base !== $base2 && $this->testBaseDN($base2)) {
-				$this->applyFind('ldap_base', $base2);
-				return $this->result;
-			}
-			array_shift($dparts);
-		}
-
-		return false;
-	}
-
-	/**
-	 * sets the found value for the configuration key in the WizardResult
-	 * as well as in the Configuration instance
-	 * @param string $key the configuration key
-	 * @param string $value the (detected) value
-	 *
-	 */
-	private function applyFind($key, $value) {
-		$this->result->addChange($key, $value);
-		$this->configuration->setConfiguration([$key => $value]);
-	}
-
-	/**
-	 * Checks, whether a port was entered in the Host configuration
-	 * field. In this case the port will be stripped off, but also stored as
-	 * setting.
-	 */
-	private function checkHost() {
-		$host = $this->configuration->ldapHost;
-		$hostInfo = parse_url($host);
-
-		//removes Port from Host
-		if(is_array($hostInfo) && isset($hostInfo['port'])) {
-			$port = $hostInfo['port'];
-			$host = str_replace(':'.$port, '', $host);
-			$this->applyFind('ldap_host', $host);
-			$this->applyFind('ldap_port', $port);
-		}
-	}
-
-	/**
-	 * tries to detect the group member association attribute which is
-	 * one of 'uniqueMember', 'memberUid', 'member', 'gidNumber'
-	 * @return string|false, string with the attribute name, false on error
-	 * @throws \Exception
-	 */
-	private function detectGroupMemberAssoc() {
-		$possibleAttrs = ['uniqueMember', 'memberUid', 'member', 'gidNumber'];
-		$filter = $this->configuration->ldapGroupFilter;
-		if(empty($filter)) {
-			return false;
-		}
-		$cr = $this->getConnection();
-		if(!$cr) {
-			throw new \Exception('Could not connect to LDAP');
-		}
-		$base = $this->configuration->ldapBaseGroups[0] ?: $this->configuration->ldapBase[0];
-		$rr = $this->ldap->search($cr, $base, $filter, $possibleAttrs, 0, 1000);
-		if(!$this->ldap->isResource($rr)) {
-			return false;
-		}
-		$er = $this->ldap->firstEntry($cr, $rr);
-		while(is_resource($er)) {
-			$this->ldap->getDN($cr, $er);
-			$attrs = $this->ldap->getAttributes($cr, $er);
-			$result = [];
-			$possibleAttrsCount = count($possibleAttrs);
-			for($i = 0; $i < $possibleAttrsCount; $i++) {
-				if(isset($attrs[$possibleAttrs[$i]])) {
-					$result[$possibleAttrs[$i]] = $attrs[$possibleAttrs[$i]]['count'];
-				}
-			}
-			if(!empty($result)) {
-				natsort($result);
-				return key($result);
-			}
-
-			$er = $this->ldap->nextEntry($cr, $er);
-		}
-
-		return false;
-	}
-
-	/**
-	 * Checks whether for a given BaseDN results will be returned
-	 * @param string $base the BaseDN to test
-	 * @return bool true on success, false otherwise
-	 * @throws \Exception
-	 */
-	private function testBaseDN($base) {
-		$cr = $this->getConnection();
-		if(!$cr) {
-			throw new \Exception('Could not connect to LDAP');
-		}
-
-		//base is there, let's validate it. If we search for anything, we should
-		//get a result set > 0 on a proper base
-		$rr = $this->ldap->search($cr, $base, 'objectClass=*', ['dn'], 0, 1);
-		if(!$this->ldap->isResource($rr)) {
-			$errorNo  = $this->ldap->errno($cr);
-			$errorMsg = $this->ldap->error($cr);
-			\OCP\Util::writeLog('user_ldap', 'Wiz: Could not search base '.$base.
-							' Error '.$errorNo.': '.$errorMsg, ILogger::INFO);
-			return false;
-		}
-		$entries = $this->ldap->countEntries($cr, $rr);
-		return ($entries !== false) && ($entries > 0);
-	}
-
-	/**
-	 * Checks whether the server supports memberOf in LDAP Filter.
-	 * Note: at least in OpenLDAP, availability of memberOf is dependent on
-	 * a configured objectClass. I.e. not necessarily for all available groups
-	 * memberOf does work.
-	 *
-	 * @return bool true if it does, false otherwise
-	 * @throws \Exception
-	 */
-	private function testMemberOf() {
-		$cr = $this->getConnection();
-		if(!$cr) {
-			throw new \Exception('Could not connect to LDAP');
-		}
-		$result = $this->access->countUsers('memberOf=*', ['memberOf'], 1);
-		if(is_int($result) &&  $result > 0) {
-			return true;
-		}
-		return false;
-	}
-
-	/**
-	 * creates an LDAP Filter from given configuration
-	 * @param integer $filterType int, for which use case the filter shall be created
-	 * can be any of self::LFILTER_USER_LIST, self::LFILTER_LOGIN or
-	 * self::LFILTER_GROUP_LIST
-	 * @return string|false string with the filter on success, false otherwise
-	 * @throws \Exception
-	 */
-	private function composeLdapFilter($filterType) {
-		$filter = '';
-		$parts = 0;
-		switch ($filterType) {
-			case self::LFILTER_USER_LIST:
-				$objcs = $this->configuration->ldapUserFilterObjectclass;
-				//glue objectclasses
-				if(is_array($objcs) && count($objcs) > 0) {
-					$filter .= '(|';
-					foreach($objcs as $objc) {
-						$filter .= '(objectclass=' . $objc . ')';
-					}
-					$filter .= ')';
-					$parts++;
-				}
-				//glue group memberships
-				if($this->configuration->hasMemberOfFilterSupport) {
-					$cns = $this->configuration->ldapUserFilterGroups;
-					if(is_array($cns) && count($cns) > 0) {
-						$filter .= '(|';
-						$cr = $this->getConnection();
-						if(!$cr) {
-							throw new \Exception('Could not connect to LDAP');
-						}
-						$base = $this->configuration->ldapBase[0];
-						foreach($cns as $cn) {
-							$rr = $this->ldap->search($cr, $base, 'cn=' . $cn, ['dn', 'primaryGroupToken']);
-							if(!$this->ldap->isResource($rr)) {
-								continue;
-							}
-							$er = $this->ldap->firstEntry($cr, $rr);
-							$attrs = $this->ldap->getAttributes($cr, $er);
-							$dn = $this->ldap->getDN($cr, $er);
-							if ($dn === false || $dn === '') {
-								continue;
-							}
-							$filterPart = '(memberof=' . $dn . ')';
-							if(isset($attrs['primaryGroupToken'])) {
-								$pgt = $attrs['primaryGroupToken'][0];
-								$primaryFilterPart = '(primaryGroupID=' . $pgt .')';
-								$filterPart = '(|' . $filterPart . $primaryFilterPart . ')';
-							}
-							$filter .= $filterPart;
-						}
-						$filter .= ')';
-					}
-					$parts++;
-				}
-				//wrap parts in AND condition
-				if($parts > 1) {
-					$filter = '(&' . $filter . ')';
-				}
-				if ($filter === '') {
-					$filter = '(objectclass=*)';
-				}
-				break;
-
-			case self::LFILTER_GROUP_LIST:
-				$objcs = $this->configuration->ldapGroupFilterObjectclass;
-				//glue objectclasses
-				if(is_array($objcs) && count($objcs) > 0) {
-					$filter .= '(|';
-					foreach($objcs as $objc) {
-						$filter .= '(objectclass=' . $objc . ')';
-					}
-					$filter .= ')';
-					$parts++;
-				}
-				//glue group memberships
-				$cns = $this->configuration->ldapGroupFilterGroups;
-				if(is_array($cns) && count($cns) > 0) {
-					$filter .= '(|';
-					foreach($cns as $cn) {
-						$filter .= '(cn=' . $cn . ')';
-					}
-					$filter .= ')';
-				}
-				$parts++;
-				//wrap parts in AND condition
-				if($parts > 1) {
-					$filter = '(&' . $filter . ')';
-				}
-				break;
-
-			case self::LFILTER_LOGIN:
-				$ulf = $this->configuration->ldapUserFilter;
-				$loginpart = '=%uid';
-				$filterUsername = '';
-				$userAttributes = $this->getUserAttributes();
-				$userAttributes = array_change_key_case(array_flip($userAttributes));
-				$parts = 0;
-
-				if($this->configuration->ldapLoginFilterUsername === '1') {
-					$attr = '';
-					if(isset($userAttributes['uid'])) {
-						$attr = 'uid';
-					} else if(isset($userAttributes['samaccountname'])) {
-						$attr = 'samaccountname';
-					} else if(isset($userAttributes['cn'])) {
-						//fallback
-						$attr = 'cn';
-					}
-					if ($attr !== '') {
-						$filterUsername = '(' . $attr . $loginpart . ')';
-						$parts++;
-					}
-				}
-
-				$filterEmail = '';
-				if($this->configuration->ldapLoginFilterEmail === '1') {
-					$filterEmail = '(|(mailPrimaryAddress=%uid)(mail=%uid))';
-					$parts++;
-				}
-
-				$filterAttributes = '';
-				$attrsToFilter = $this->configuration->ldapLoginFilterAttributes;
-				if(is_array($attrsToFilter) && count($attrsToFilter) > 0) {
-					$filterAttributes = '(|';
-					foreach($attrsToFilter as $attribute) {
-						$filterAttributes .= '(' . $attribute . $loginpart . ')';
-					}
-					$filterAttributes .= ')';
-					$parts++;
-				}
-
-				$filterLogin = '';
-				if($parts > 1) {
-					$filterLogin = '(|';
-				}
-				$filterLogin .= $filterUsername;
-				$filterLogin .= $filterEmail;
-				$filterLogin .= $filterAttributes;
-				if($parts > 1) {
-					$filterLogin .= ')';
-				}
-
-				$filter = '(&'.$ulf.$filterLogin.')';
-				break;
-		}
-
-		\OCP\Util::writeLog('user_ldap', 'Wiz: Final filter '.$filter, ILogger::DEBUG);
-
-		return $filter;
-	}
-
-	/**
-	 * Connects and Binds to an LDAP Server
-	 *
-	 * @param int $port the port to connect with
-	 * @param bool $tls whether startTLS is to be used
-	 * @return bool
-	 * @throws \Exception
-	 */
-	private function connectAndBind($port, $tls) {
-		//connect, does not really trigger any server communication
-		$host = $this->configuration->ldapHost;
-		$hostInfo = parse_url($host);
-		if(!$hostInfo) {
-			throw new \Exception(self::$l->t('Invalid Host'));
-		}
-		\OCP\Util::writeLog('user_ldap', 'Wiz: Attempting to connect ', ILogger::DEBUG);
-		$cr = $this->ldap->connect($host, $port);
-		if(!is_resource($cr)) {
-			throw new \Exception(self::$l->t('Invalid Host'));
-		}
-
-		//set LDAP options
-		$this->ldap->setOption($cr, LDAP_OPT_PROTOCOL_VERSION, 3);
-		$this->ldap->setOption($cr, LDAP_OPT_REFERRALS, 0);
-		$this->ldap->setOption($cr, LDAP_OPT_NETWORK_TIMEOUT, self::LDAP_NW_TIMEOUT);
-
-		try {
-			if($tls) {
-				$isTlsWorking = @$this->ldap->startTls($cr);
-				if(!$isTlsWorking) {
-					return false;
-				}
-			}
-
-			\OCP\Util::writeLog('user_ldap', 'Wiz: Attemping to Bind ', ILogger::DEBUG);
-			//interesting part: do the bind!
-			$login = $this->ldap->bind($cr,
-				$this->configuration->ldapAgentName,
-				$this->configuration->ldapAgentPassword
-			);
-			$errNo = $this->ldap->errno($cr);
-			$error = ldap_error($cr);
-			$this->ldap->unbind($cr);
-		} catch(ServerNotAvailableException $e) {
-			return false;
-		}
-
-		if($login === true) {
-			$this->ldap->unbind($cr);
-			\OCP\Util::writeLog('user_ldap', 'Wiz: Bind successful to Port '. $port . ' TLS ' . (int)$tls, ILogger::DEBUG);
-			return true;
-		}
-
-		if($errNo === -1) {
-			//host, port or TLS wrong
-			return false;
-		}
-		throw new \Exception($error, $errNo);
-	}
-
-	/**
-	 * checks whether a valid combination of agent and password has been
-	 * provided (either two values or nothing for anonymous connect)
-	 * @return bool, true if everything is fine, false otherwise
-	 */
-	private function checkAgentRequirements() {
-		$agent = $this->configuration->ldapAgentName;
-		$pwd = $this->configuration->ldapAgentPassword;
-
-		return
-			($agent !== '' && $pwd !== '')
-			||  ($agent === '' && $pwd === '')
-		;
-	}
-
-	/**
-	 * @param array $reqs
-	 * @return bool
-	 */
-	private function checkRequirements($reqs) {
-		$this->checkAgentRequirements();
-		foreach($reqs as $option) {
-			$value = $this->configuration->$option;
-			if(empty($value)) {
-				return false;
-			}
-		}
-		return true;
-	}
-
-	/**
-	 * does a cumulativeSearch on LDAP to get different values of a
-	 * specified attribute
-	 * @param string[] $filters array, the filters that shall be used in the search
-	 * @param string $attr the attribute of which a list of values shall be returned
-	 * @param int $dnReadLimit the amount of how many DNs should be analyzed.
-	 * The lower, the faster
-	 * @param string $maxF string. if not null, this variable will have the filter that
-	 * yields most result entries
-	 * @return array|false an array with the values on success, false otherwise
-	 */
-	public function cumulativeSearchOnAttribute($filters, $attr, $dnReadLimit = 3, &$maxF = null) {
-		$dnRead = [];
-		$foundItems = [];
-		$maxEntries = 0;
-		if(!is_array($this->configuration->ldapBase)
-		   || !isset($this->configuration->ldapBase[0])) {
-			return false;
-		}
-		$base = $this->configuration->ldapBase[0];
-		$cr = $this->getConnection();
-		if(!$this->ldap->isResource($cr)) {
-			return false;
-		}
-		$lastFilter = null;
-		if(isset($filters[count($filters)-1])) {
-			$lastFilter = $filters[count($filters)-1];
-		}
-		foreach($filters as $filter) {
-			if($lastFilter === $filter && count($foundItems) > 0) {
-				//skip when the filter is a wildcard and results were found
-				continue;
-			}
-			// 20k limit for performance and reason
-			$rr = $this->ldap->search($cr, $base, $filter, [$attr], 0, 20000);
-			if(!$this->ldap->isResource($rr)) {
-				continue;
-			}
-			$entries = $this->ldap->countEntries($cr, $rr);
-			$getEntryFunc = 'firstEntry';
-			if(($entries !== false) && ($entries > 0)) {
-				if(!is_null($maxF) && $entries > $maxEntries) {
-					$maxEntries = $entries;
-					$maxF = $filter;
-				}
-				$dnReadCount = 0;
-				do {
-					$entry = $this->ldap->$getEntryFunc($cr, $rr);
-					$getEntryFunc = 'nextEntry';
-					if(!$this->ldap->isResource($entry)) {
-						continue 2;
-					}
-					$rr = $entry; //will be expected by nextEntry next round
-					$attributes = $this->ldap->getAttributes($cr, $entry);
-					$dn = $this->ldap->getDN($cr, $entry);
-					if($dn === false || in_array($dn, $dnRead)) {
-						continue;
-					}
-					$newItems = [];
-					$state = $this->getAttributeValuesFromEntry($attributes,
-																$attr,
-																$newItems);
-					$dnReadCount++;
-					$foundItems = array_merge($foundItems, $newItems);
-					$this->resultCache[$dn][$attr] = $newItems;
-					$dnRead[] = $dn;
-				} while(($state === self::LRESULT_PROCESSED_SKIP
-						|| $this->ldap->isResource($entry))
-						&& ($dnReadLimit === 0 || $dnReadCount < $dnReadLimit));
-			}
-		}
-
-		return array_unique($foundItems);
-	}
-
-	/**
-	 * determines if and which $attr are available on the LDAP server
-	 * @param string[] $objectclasses the objectclasses to use as search filter
-	 * @param string $attr the attribute to look for
-	 * @param string $dbkey the dbkey of the setting the feature is connected to
-	 * @param string $confkey the confkey counterpart for the $dbkey as used in the
-	 * Configuration class
-	 * @param bool $po whether the objectClass with most result entries
-	 * shall be pre-selected via the result
-	 * @return array|false list of found items.
-	 * @throws \Exception
-	 */
-	private function determineFeature($objectclasses, $attr, $dbkey, $confkey, $po = false) {
-		$cr = $this->getConnection();
-		if(!$cr) {
-			throw new \Exception('Could not connect to LDAP');
-		}
-		$p = 'objectclass=';
-		foreach($objectclasses as $key => $value) {
-			$objectclasses[$key] = $p.$value;
-		}
-		$maxEntryObjC = '';
-
-		//how deep to dig?
-		//When looking for objectclasses, testing few entries is sufficient,
-		$dig = 3;
-
-		$availableFeatures =
-			$this->cumulativeSearchOnAttribute($objectclasses, $attr,
-											   $dig, $maxEntryObjC);
-		if(is_array($availableFeatures)
-		   && count($availableFeatures) > 0) {
-			natcasesort($availableFeatures);
-			//natcasesort keeps indices, but we must get rid of them for proper
-			//sorting in the web UI. Therefore: array_values
-			$this->result->addOptions($dbkey, array_values($availableFeatures));
-		} else {
-			throw new \Exception(self::$l->t('Could not find the desired feature'));
-		}
-
-		$setFeatures = $this->configuration->$confkey;
-		if(is_array($setFeatures) && !empty($setFeatures)) {
-			//something is already configured? pre-select it.
-			$this->result->addChange($dbkey, $setFeatures);
-		} else if ($po && $maxEntryObjC !== '') {
-			//pre-select objectclass with most result entries
-			$maxEntryObjC = str_replace($p, '', $maxEntryObjC);
-			$this->applyFind($dbkey, $maxEntryObjC);
-			$this->result->addChange($dbkey, $maxEntryObjC);
-		}
-
-		return $availableFeatures;
-	}
-
-	/**
-	 * appends a list of values fr
-	 * @param resource $result the return value from ldap_get_attributes
-	 * @param string $attribute the attribute values to look for
-	 * @param array &$known new values will be appended here
-	 * @return int, state on of the class constants LRESULT_PROCESSED_OK,
-	 * LRESULT_PROCESSED_INVALID or LRESULT_PROCESSED_SKIP
-	 */
-	private function getAttributeValuesFromEntry($result, $attribute, &$known) {
-		if(!is_array($result)
-		   || !isset($result['count'])
-		   || !$result['count'] > 0) {
-			return self::LRESULT_PROCESSED_INVALID;
-		}
-
-		// strtolower on all keys for proper comparison
-		$result = \OCP\Util::mb_array_change_key_case($result);
-		$attribute = strtolower($attribute);
-		if(isset($result[$attribute])) {
-			foreach($result[$attribute] as $key => $val) {
-				if($key === 'count') {
-					continue;
-				}
-				if(!in_array($val, $known)) {
-					$known[] = $val;
-				}
-			}
-			return self::LRESULT_PROCESSED_OK;
-		} else {
-			return self::LRESULT_PROCESSED_SKIP;
-		}
-	}
-
-	/**
-	 * @return bool|mixed
-	 */
-	private function getConnection() {
-		if(!is_null($this->cr)) {
-			return $this->cr;
-		}
-
-		$cr = $this->ldap->connect(
-			$this->configuration->ldapHost,
-			$this->configuration->ldapPort
-		);
-
-		$this->ldap->setOption($cr, LDAP_OPT_PROTOCOL_VERSION, 3);
-		$this->ldap->setOption($cr, LDAP_OPT_REFERRALS, 0);
-		$this->ldap->setOption($cr, LDAP_OPT_NETWORK_TIMEOUT, self::LDAP_NW_TIMEOUT);
-		if($this->configuration->ldapTLS === 1) {
-			$this->ldap->startTls($cr);
-		}
-
-		$lo = @$this->ldap->bind($cr,
-								 $this->configuration->ldapAgentName,
-								 $this->configuration->ldapAgentPassword);
-		if($lo === true) {
-			$this->$cr = $cr;
-			return $cr;
-		}
-
-		return false;
-	}
-
-	/**
-	 * @return array
-	 */
-	private function getDefaultLdapPortSettings() {
-		static $settings = [
-								['port' => 7636, 'tls' => false],
-								['port' =>  636, 'tls' => false],
-								['port' => 7389, 'tls' => true],
-								['port' =>  389, 'tls' => true],
-								['port' => 7389, 'tls' => false],
-								['port' =>  389, 'tls' => false],
-						  ];
-		return $settings;
-	}
-
-	/**
-	 * @return array
-	 */
-	private function getPortSettingsToTry() {
-		//389 ← LDAP / Unencrypted or StartTLS
-		//636 ← LDAPS / SSL
-		//7xxx ← UCS. need to be checked first, because both ports may be open
-		$host = $this->configuration->ldapHost;
-		$port = (int)$this->configuration->ldapPort;
-		$portSettings = [];
-
-		//In case the port is already provided, we will check this first
-		if($port > 0) {
-			$hostInfo = parse_url($host);
-			if(!(is_array($hostInfo)
-				&& isset($hostInfo['scheme'])
-				&& stripos($hostInfo['scheme'], 'ldaps') !== false)) {
-				$portSettings[] = ['port' => $port, 'tls' => true];
-			}
-			$portSettings[] =['port' => $port, 'tls' => false];
-		}
-
-		//default ports
-		$portSettings = array_merge($portSettings,
-		                            $this->getDefaultLdapPortSettings());
-
-		return $portSettings;
-	}
+    /** @var \OCP\IL10N */
+    static protected $l;
+    protected $access;
+    protected $cr;
+    protected $configuration;
+    protected $result;
+    protected $resultCache = [];
+
+    const LRESULT_PROCESSED_OK = 2;
+    const LRESULT_PROCESSED_INVALID = 3;
+    const LRESULT_PROCESSED_SKIP = 4;
+
+    const LFILTER_LOGIN      = 2;
+    const LFILTER_USER_LIST  = 3;
+    const LFILTER_GROUP_LIST = 4;
+
+    const LFILTER_MODE_ASSISTED = 2;
+    const LFILTER_MODE_RAW = 1;
+
+    const LDAP_NW_TIMEOUT = 4;
+
+    /**
+     * Constructor
+     * @param Configuration $configuration an instance of Configuration
+     * @param ILDAPWrapper $ldap an instance of ILDAPWrapper
+     * @param Access $access
+     */
+    public function __construct(Configuration $configuration, ILDAPWrapper $ldap, Access $access) {
+        parent::__construct($ldap);
+        $this->configuration = $configuration;
+        if(is_null(Wizard::$l)) {
+            Wizard::$l = \OC::$server->getL10N('user_ldap');
+        }
+        $this->access = $access;
+        $this->result = new WizardResult();
+    }
+
+    public function  __destruct() {
+        if($this->result->hasChanges()) {
+            $this->configuration->saveConfiguration();
+        }
+    }
+
+    /**
+     * counts entries in the LDAP directory
+     *
+     * @param string $filter the LDAP search filter
+     * @param string $type a string being either 'users' or 'groups';
+     * @return int
+     * @throws \Exception
+     */
+    public function countEntries(string $filter, string $type): int {
+        $reqs = ['ldapHost', 'ldapPort', 'ldapBase'];
+        if($type === 'users') {
+            $reqs[] = 'ldapUserFilter';
+        }
+        if(!$this->checkRequirements($reqs)) {
+            throw new \Exception('Requirements not met', 400);
+        }
+
+        $attr = ['dn']; // default
+        $limit = 1001;
+        if($type === 'groups') {
+            $result =  $this->access->countGroups($filter, $attr, $limit);
+        } else if($type === 'users') {
+            $result = $this->access->countUsers($filter, $attr, $limit);
+        } else if ($type === 'objects') {
+            $result = $this->access->countObjects($limit);
+        } else {
+            throw new \Exception('Internal error: Invalid object type', 500);
+        }
+
+        return (int)$result;
+    }
+
+    /**
+     * formats the return value of a count operation to the string to be
+     * inserted.
+     *
+     * @param int $count
+     * @return string
+     */
+    private function formatCountResult(int $count): string {
+        if($count > 1000) {
+            return '> 1000';
+        }
+        return (string)$count;
+    }
+
+    public function countGroups() {
+        $filter = $this->configuration->ldapGroupFilter;
+
+        if(empty($filter)) {
+            $output = self::$l->n('%s group found', '%s groups found', 0, [0]);
+            $this->result->addChange('ldap_group_count', $output);
+            return $this->result;
+        }
+
+        try {
+            $groupsTotal = $this->countEntries($filter, 'groups');
+        } catch (\Exception $e) {
+            //400 can be ignored, 500 is forwarded
+            if($e->getCode() === 500) {
+                throw $e;
+            }
+            return false;
+        }
+        $output = self::$l->n(
+            '%s group found',
+            '%s groups found',
+            $groupsTotal,
+            [$this->formatCountResult($groupsTotal)]
+        );
+        $this->result->addChange('ldap_group_count', $output);
+        return $this->result;
+    }
+
+    /**
+     * @return WizardResult
+     * @throws \Exception
+     */
+    public function countUsers() {
+        $filter = $this->access->getFilterForUserCount();
+
+        $usersTotal = $this->countEntries($filter, 'users');
+        $output = self::$l->n(
+            '%s user found',
+            '%s users found',
+            $usersTotal,
+            [$this->formatCountResult($usersTotal)]
+        );
+        $this->result->addChange('ldap_user_count', $output);
+        return $this->result;
+    }
+
+    /**
+     * counts any objects in the currently set base dn
+     *
+     * @return WizardResult
+     * @throws \Exception
+     */
+    public function countInBaseDN() {
+        // we don't need to provide a filter in this case
+        $total = $this->countEntries('', 'objects');
+        if($total === false) {
+            throw new \Exception('invalid results received');
+        }
+        $this->result->addChange('ldap_test_base', $total);
+        return $this->result;
+    }
+
+    /**
+     * counts users with a specified attribute
+     * @param string $attr
+     * @param bool $existsCheck
+     * @return int|bool
+     */
+    public function countUsersWithAttribute($attr, $existsCheck = false) {
+        if(!$this->checkRequirements(['ldapHost',
+                                            'ldapPort',
+                                            'ldapBase',
+                                            'ldapUserFilter',
+                                            ])) {
+            return  false;
+        }
+
+        $filter = $this->access->combineFilterWithAnd([
+            $this->configuration->ldapUserFilter,
+            $attr . '=*'
+        ]);
+
+        $limit = ($existsCheck === false) ? null : 1;
+
+        return $this->access->countUsers($filter, ['dn'], $limit);
+    }
+
+    /**
+     * detects the display name attribute. If a setting is already present that
+     * returns at least one hit, the detection will be canceled.
+     * @return WizardResult|bool
+     * @throws \Exception
+     */
+    public function detectUserDisplayNameAttribute() {
+        if(!$this->checkRequirements(['ldapHost',
+                                        'ldapPort',
+                                        'ldapBase',
+                                        'ldapUserFilter',
+                                        ])) {
+            return  false;
+        }
+
+        $attr = $this->configuration->ldapUserDisplayName;
+        if ($attr !== '' && $attr !== 'displayName') {
+            // most likely not the default value with upper case N,
+            // verify it still produces a result
+            $count = (int)$this->countUsersWithAttribute($attr, true);
+            if($count > 0) {
+                //no change, but we sent it back to make sure the user interface
+                //is still correct, even if the ajax call was cancelled meanwhile
+                $this->result->addChange('ldap_display_name', $attr);
+                return $this->result;
+            }
+        }
+
+        // first attribute that has at least one result wins
+        $displayNameAttrs = ['displayname', 'cn'];
+        foreach ($displayNameAttrs as $attr) {
+            $count = (int)$this->countUsersWithAttribute($attr, true);
+
+            if($count > 0) {
+                $this->applyFind('ldap_display_name', $attr);
+                return $this->result;
+            }
+        }
+
+        throw new \Exception(self::$l->t('Could not detect user display name attribute. Please specify it yourself in advanced LDAP settings.'));
+    }
+
+    /**
+     * detects the most often used email attribute for users applying to the
+     * user list filter. If a setting is already present that returns at least
+     * one hit, the detection will be canceled.
+     * @return WizardResult|bool
+     */
+    public function detectEmailAttribute() {
+        if(!$this->checkRequirements(['ldapHost',
+                                            'ldapPort',
+                                            'ldapBase',
+                                            'ldapUserFilter',
+                                            ])) {
+            return  false;
+        }
+
+        $attr = $this->configuration->ldapEmailAttribute;
+        if ($attr !== '') {
+            $count = (int)$this->countUsersWithAttribute($attr, true);
+            if($count > 0) {
+                return false;
+            }
+            $writeLog = true;
+        } else {
+            $writeLog = false;
+        }
+
+        $emailAttributes = ['mail', 'mailPrimaryAddress'];
+        $winner = '';
+        $maxUsers = 0;
+        foreach($emailAttributes as $attr) {
+            $count = $this->countUsersWithAttribute($attr);
+            if($count > $maxUsers) {
+                $maxUsers = $count;
+                $winner = $attr;
+            }
+        }
+
+        if($winner !== '') {
+            $this->applyFind('ldap_email_attr', $winner);
+            if($writeLog) {
+                \OCP\Util::writeLog('user_ldap', 'The mail attribute has ' .
+                    'automatically been reset, because the original value ' .
+                    'did not return any results.', ILogger::INFO);
+            }
+        }
+
+        return $this->result;
+    }
+
+    /**
+     * @return WizardResult
+     * @throws \Exception
+     */
+    public function determineAttributes() {
+        if(!$this->checkRequirements(['ldapHost',
+                                            'ldapPort',
+                                            'ldapBase',
+                                            'ldapUserFilter',
+                                            ])) {
+            return  false;
+        }
+
+        $attributes = $this->getUserAttributes();
+
+        natcasesort($attributes);
+        $attributes = array_values($attributes);
+
+        $this->result->addOptions('ldap_loginfilter_attributes', $attributes);
+
+        $selected = $this->configuration->ldapLoginFilterAttributes;
+        if(is_array($selected) && !empty($selected)) {
+            $this->result->addChange('ldap_loginfilter_attributes', $selected);
+        }
+
+        return $this->result;
+    }
+
+    /**
+     * detects the available LDAP attributes
+     * @return array|false The instance's WizardResult instance
+     * @throws \Exception
+     */
+    private function getUserAttributes() {
+        if(!$this->checkRequirements(['ldapHost',
+                                            'ldapPort',
+                                            'ldapBase',
+                                            'ldapUserFilter',
+                                            ])) {
+            return  false;
+        }
+        $cr = $this->getConnection();
+        if(!$cr) {
+            throw new \Exception('Could not connect to LDAP');
+        }
+
+        $base = $this->configuration->ldapBase[0];
+        $filter = $this->configuration->ldapUserFilter;
+        $rr = $this->ldap->search($cr, $base, $filter, [], 1, 1);
+        if(!$this->ldap->isResource($rr)) {
+            return false;
+        }
+        $er = $this->ldap->firstEntry($cr, $rr);
+        $attributes = $this->ldap->getAttributes($cr, $er);
+        $pureAttributes = [];
+        for($i = 0; $i < $attributes['count']; $i++) {
+            $pureAttributes[] = $attributes[$i];
+        }
+
+        return $pureAttributes;
+    }
+
+    /**
+     * detects the available LDAP groups
+     * @return WizardResult|false the instance's WizardResult instance
+     */
+    public function determineGroupsForGroups() {
+        return $this->determineGroups('ldap_groupfilter_groups',
+                                        'ldapGroupFilterGroups',
+                                        false);
+    }
+
+    /**
+     * detects the available LDAP groups
+     * @return WizardResult|false the instance's WizardResult instance
+     */
+    public function determineGroupsForUsers() {
+        return $this->determineGroups('ldap_userfilter_groups',
+                                        'ldapUserFilterGroups');
+    }
+
+    /**
+     * detects the available LDAP groups
+     * @param string $dbKey
+     * @param string $confKey
+     * @param bool $testMemberOf
+     * @return WizardResult|false the instance's WizardResult instance
+     * @throws \Exception
+     */
+    private function determineGroups($dbKey, $confKey, $testMemberOf = true) {
+        if(!$this->checkRequirements(['ldapHost',
+                                            'ldapPort',
+                                            'ldapBase',
+                                            ])) {
+            return  false;
+        }
+        $cr = $this->getConnection();
+        if(!$cr) {
+            throw new \Exception('Could not connect to LDAP');
+        }
+
+        $this->fetchGroups($dbKey, $confKey);
+
+        if($testMemberOf) {
+            $this->configuration->hasMemberOfFilterSupport = $this->testMemberOf();
+            $this->result->markChange();
+            if(!$this->configuration->hasMemberOfFilterSupport) {
+                throw new \Exception('memberOf is not supported by the server');
+            }
+        }
+
+        return $this->result;
+    }
+
+    /**
+     * fetches all groups from LDAP and adds them to the result object
+     *
+     * @param string $dbKey
+     * @param string $confKey
+     * @return array $groupEntries
+     * @throws \Exception
+     */
+    public function fetchGroups($dbKey, $confKey) {
+        $obclasses = ['posixGroup', 'group', 'zimbraDistributionList', 'groupOfNames', 'groupOfUniqueNames'];
+
+        $filterParts = [];
+        foreach($obclasses as $obclass) {
+            $filterParts[] = 'objectclass='.$obclass;
+        }
+        //we filter for everything
+        //- that looks like a group and
+        //- has the group display name set
+        $filter = $this->access->combineFilterWithOr($filterParts);
+        $filter = $this->access->combineFilterWithAnd([$filter, 'cn=*']);
+
+        $groupNames = [];
+        $groupEntries = [];
+        $limit = 400;
+        $offset = 0;
+        do {
+            // we need to request dn additionally here, otherwise memberOf
+            // detection will fail later
+            $result = $this->access->searchGroups($filter, ['cn', 'dn'], $limit, $offset);
+            foreach($result as $item) {
+                if(!isset($item['cn']) && !is_array($item['cn']) && !isset($item['cn'][0])) {
+                    // just in case - no issue known
+                    continue;
+                }
+                $groupNames[] = $item['cn'][0];
+                $groupEntries[] = $item;
+            }
+            $offset += $limit;
+        } while ($this->access->hasMoreResults());
+
+        if(count($groupNames) > 0) {
+            natsort($groupNames);
+            $this->result->addOptions($dbKey, array_values($groupNames));
+        } else {
+            throw new \Exception(self::$l->t('Could not find the desired feature'));
+        }
+
+        $setFeatures = $this->configuration->$confKey;
+        if(is_array($setFeatures) && !empty($setFeatures)) {
+            //something is already configured? pre-select it.
+            $this->result->addChange($dbKey, $setFeatures);
+        }
+        return $groupEntries;
+    }
+
+    public function determineGroupMemberAssoc() {
+        if(!$this->checkRequirements(['ldapHost',
+                                            'ldapPort',
+                                            'ldapGroupFilter',
+                                            ])) {
+            return  false;
+        }
+        $attribute = $this->detectGroupMemberAssoc();
+        if($attribute === false) {
+            return false;
+        }
+        $this->configuration->setConfiguration(['ldapGroupMemberAssocAttr' => $attribute]);
+        $this->result->addChange('ldap_group_member_assoc_attribute', $attribute);
+
+        return $this->result;
+    }
+
+    /**
+     * Detects the available object classes
+     * @return WizardResult|false the instance's WizardResult instance
+     * @throws \Exception
+     */
+    public function determineGroupObjectClasses() {
+        if(!$this->checkRequirements(['ldapHost',
+                                            'ldapPort',
+                                            'ldapBase',
+                                            ])) {
+            return  false;
+        }
+        $cr = $this->getConnection();
+        if(!$cr) {
+            throw new \Exception('Could not connect to LDAP');
+        }
+
+        $obclasses = ['groupOfNames', 'groupOfUniqueNames', 'group', 'posixGroup', '*'];
+        $this->determineFeature($obclasses,
+                                'objectclass',
+                                'ldap_groupfilter_objectclass',
+                                'ldapGroupFilterObjectclass',
+                                false);
+
+        return $this->result;
+    }
+
+    /**
+     * detects the available object classes
+     * @return WizardResult
+     * @throws \Exception
+     */
+    public function determineUserObjectClasses() {
+        if(!$this->checkRequirements(['ldapHost',
+                                            'ldapPort',
+                                            'ldapBase',
+                                            ])) {
+            return  false;
+        }
+        $cr = $this->getConnection();
+        if(!$cr) {
+            throw new \Exception('Could not connect to LDAP');
+        }
+
+        $obclasses = ['inetOrgPerson', 'person', 'organizationalPerson',
+                            'user', 'posixAccount', '*'];
+        $filter = $this->configuration->ldapUserFilter;
+        //if filter is empty, it is probably the first time the wizard is called
+        //then, apply suggestions.
+        $this->determineFeature($obclasses,
+                                'objectclass',
+                                'ldap_userfilter_objectclass',
+                                'ldapUserFilterObjectclass',
+                                empty($filter));
+
+        return $this->result;
+    }
+
+    /**
+     * @return WizardResult|false
+     * @throws \Exception
+     */
+    public function getGroupFilter() {
+        if(!$this->checkRequirements(['ldapHost',
+                                            'ldapPort',
+                                            'ldapBase',
+                                            ])) {
+            return false;
+        }
+        //make sure the use display name is set
+        $displayName = $this->configuration->ldapGroupDisplayName;
+        if ($displayName === '') {
+            $d = $this->configuration->getDefaults();
+            $this->applyFind('ldap_group_display_name',
+                                $d['ldap_group_display_name']);
+        }
+        $filter = $this->composeLdapFilter(self::LFILTER_GROUP_LIST);
+
+        $this->applyFind('ldap_group_filter', $filter);
+        return $this->result;
+    }
+
+    /**
+     * @return WizardResult|false
+     * @throws \Exception
+     */
+    public function getUserListFilter() {
+        if(!$this->checkRequirements(['ldapHost',
+                                            'ldapPort',
+                                            'ldapBase',
+                                            ])) {
+            return false;
+        }
+        //make sure the use display name is set
+        $displayName = $this->configuration->ldapUserDisplayName;
+        if ($displayName === '') {
+            $d = $this->configuration->getDefaults();
+            $this->applyFind('ldap_display_name', $d['ldap_display_name']);
+        }
+        $filter = $this->composeLdapFilter(self::LFILTER_USER_LIST);
+        if(!$filter) {
+            throw new \Exception('Cannot create filter');
+        }
+
+        $this->applyFind('ldap_userlist_filter', $filter);
+        return $this->result;
+    }
+
+    /**
+     * @return bool|WizardResult
+     * @throws \Exception
+     */
+    public function getUserLoginFilter() {
+        if(!$this->checkRequirements(['ldapHost',
+                                            'ldapPort',
+                                            'ldapBase',
+                                            'ldapUserFilter',
+                                            ])) {
+            return false;
+        }
+
+        $filter = $this->composeLdapFilter(self::LFILTER_LOGIN);
+        if(!$filter) {
+            throw new \Exception('Cannot create filter');
+        }
+
+        $this->applyFind('ldap_login_filter', $filter);
+        return $this->result;
+    }
+
+    /**
+     * @return bool|WizardResult
+     * @param string $loginName
+     * @throws \Exception
+     */
+    public function testLoginName($loginName) {
+        if(!$this->checkRequirements(['ldapHost',
+            'ldapPort',
+            'ldapBase',
+            'ldapLoginFilter',
+        ])) {
+            return false;
+        }
+
+        $cr = $this->access->connection->getConnectionResource();
+        if(!$this->ldap->isResource($cr)) {
+            throw new \Exception('connection error');
+        }
+
+        if(mb_strpos($this->access->connection->ldapLoginFilter, '%uid', 0, 'UTF-8')
+            === false) {
+            throw new \Exception('missing placeholder');
+        }
+
+        $users = $this->access->countUsersByLoginName($loginName);
+        if($this->ldap->errno($cr) !== 0) {
+            throw new \Exception($this->ldap->error($cr));
+        }
+        $filter = str_replace('%uid', $loginName, $this->access->connection->ldapLoginFilter);
+        $this->result->addChange('ldap_test_loginname', $users);
+        $this->result->addChange('ldap_test_effective_filter', $filter);
+        return $this->result;
+    }
+
+    /**
+     * Tries to determine the port, requires given Host, User DN and Password
+     * @return WizardResult|false WizardResult on success, false otherwise
+     * @throws \Exception
+     */
+    public function guessPortAndTLS() {
+        if(!$this->checkRequirements(['ldapHost',
+                                            ])) {
+            return false;
+        }
+        $this->checkHost();
+        $portSettings = $this->getPortSettingsToTry();
+
+        if(!is_array($portSettings)) {
+            throw new \Exception(print_r($portSettings, true));
+        }
+
+        //proceed from the best configuration and return on first success
+        foreach($portSettings as $setting) {
+            $p = $setting['port'];
+            $t = $setting['tls'];
+            \OCP\Util::writeLog('user_ldap', 'Wiz: trying port '. $p . ', TLS '. $t, ILogger::DEBUG);
+            //connectAndBind may throw Exception, it needs to be catched by the
+            //callee of this method
+
+            try {
+                $settingsFound = $this->connectAndBind($p, $t);
+            } catch (\Exception $e) {
+                // any reply other than -1 (= cannot connect) is already okay,
+                // because then we found the server
+                // unavailable startTLS returns -11
+                if($e->getCode() > 0) {
+                    $settingsFound = true;
+                } else {
+                    throw $e;
+                }
+            }
+
+            if ($settingsFound === true) {
+                $config = [
+                    'ldapPort' => $p,
+                    'ldapTLS' => (int)$t
+                ];
+                $this->configuration->setConfiguration($config);
+                \OCP\Util::writeLog('user_ldap', 'Wiz: detected Port ' . $p, ILogger::DEBUG);
+                $this->result->addChange('ldap_port', $p);
+                return $this->result;
+            }
+        }
+
+        //custom port, undetected (we do not brute force)
+        return false;
+    }
+
+    /**
+     * tries to determine a base dn from User DN or LDAP Host
+     * @return WizardResult|false WizardResult on success, false otherwise
+     */
+    public function guessBaseDN() {
+        if(!$this->checkRequirements(['ldapHost',
+                                            'ldapPort',
+                                            ])) {
+            return false;
+        }
+
+        //check whether a DN is given in the agent name (99.9% of all cases)
+        $base = null;
+        $i = stripos($this->configuration->ldapAgentName, 'dc=');
+        if($i !== false) {
+            $base = substr($this->configuration->ldapAgentName, $i);
+            if($this->testBaseDN($base)) {
+                $this->applyFind('ldap_base', $base);
+                return $this->result;
+            }
+        }
+
+        //this did not help :(
+        //Let's see whether we can parse the Host URL and convert the domain to
+        //a base DN
+        $helper = new Helper(\OC::$server->getConfig());
+        $domain = $helper->getDomainFromURL($this->configuration->ldapHost);
+        if(!$domain) {
+            return false;
+        }
+
+        $dparts = explode('.', $domain);
+        while(count($dparts) > 0) {
+            $base2 = 'dc=' . implode(',dc=', $dparts);
+            if ($base !== $base2 && $this->testBaseDN($base2)) {
+                $this->applyFind('ldap_base', $base2);
+                return $this->result;
+            }
+            array_shift($dparts);
+        }
+
+        return false;
+    }
+
+    /**
+     * sets the found value for the configuration key in the WizardResult
+     * as well as in the Configuration instance
+     * @param string $key the configuration key
+     * @param string $value the (detected) value
+     *
+     */
+    private function applyFind($key, $value) {
+        $this->result->addChange($key, $value);
+        $this->configuration->setConfiguration([$key => $value]);
+    }
+
+    /**
+     * Checks, whether a port was entered in the Host configuration
+     * field. In this case the port will be stripped off, but also stored as
+     * setting.
+     */
+    private function checkHost() {
+        $host = $this->configuration->ldapHost;
+        $hostInfo = parse_url($host);
+
+        //removes Port from Host
+        if(is_array($hostInfo) && isset($hostInfo['port'])) {
+            $port = $hostInfo['port'];
+            $host = str_replace(':'.$port, '', $host);
+            $this->applyFind('ldap_host', $host);
+            $this->applyFind('ldap_port', $port);
+        }
+    }
+
+    /**
+     * tries to detect the group member association attribute which is
+     * one of 'uniqueMember', 'memberUid', 'member', 'gidNumber'
+     * @return string|false, string with the attribute name, false on error
+     * @throws \Exception
+     */
+    private function detectGroupMemberAssoc() {
+        $possibleAttrs = ['uniqueMember', 'memberUid', 'member', 'gidNumber'];
+        $filter = $this->configuration->ldapGroupFilter;
+        if(empty($filter)) {
+            return false;
+        }
+        $cr = $this->getConnection();
+        if(!$cr) {
+            throw new \Exception('Could not connect to LDAP');
+        }
+        $base = $this->configuration->ldapBaseGroups[0] ?: $this->configuration->ldapBase[0];
+        $rr = $this->ldap->search($cr, $base, $filter, $possibleAttrs, 0, 1000);
+        if(!$this->ldap->isResource($rr)) {
+            return false;
+        }
+        $er = $this->ldap->firstEntry($cr, $rr);
+        while(is_resource($er)) {
+            $this->ldap->getDN($cr, $er);
+            $attrs = $this->ldap->getAttributes($cr, $er);
+            $result = [];
+            $possibleAttrsCount = count($possibleAttrs);
+            for($i = 0; $i < $possibleAttrsCount; $i++) {
+                if(isset($attrs[$possibleAttrs[$i]])) {
+                    $result[$possibleAttrs[$i]] = $attrs[$possibleAttrs[$i]]['count'];
+                }
+            }
+            if(!empty($result)) {
+                natsort($result);
+                return key($result);
+            }
+
+            $er = $this->ldap->nextEntry($cr, $er);
+        }
+
+        return false;
+    }
+
+    /**
+     * Checks whether for a given BaseDN results will be returned
+     * @param string $base the BaseDN to test
+     * @return bool true on success, false otherwise
+     * @throws \Exception
+     */
+    private function testBaseDN($base) {
+        $cr = $this->getConnection();
+        if(!$cr) {
+            throw new \Exception('Could not connect to LDAP');
+        }
+
+        //base is there, let's validate it. If we search for anything, we should
+        //get a result set > 0 on a proper base
+        $rr = $this->ldap->search($cr, $base, 'objectClass=*', ['dn'], 0, 1);
+        if(!$this->ldap->isResource($rr)) {
+            $errorNo  = $this->ldap->errno($cr);
+            $errorMsg = $this->ldap->error($cr);
+            \OCP\Util::writeLog('user_ldap', 'Wiz: Could not search base '.$base.
+                            ' Error '.$errorNo.': '.$errorMsg, ILogger::INFO);
+            return false;
+        }
+        $entries = $this->ldap->countEntries($cr, $rr);
+        return ($entries !== false) && ($entries > 0);
+    }
+
+    /**
+     * Checks whether the server supports memberOf in LDAP Filter.
+     * Note: at least in OpenLDAP, availability of memberOf is dependent on
+     * a configured objectClass. I.e. not necessarily for all available groups
+     * memberOf does work.
+     *
+     * @return bool true if it does, false otherwise
+     * @throws \Exception
+     */
+    private function testMemberOf() {
+        $cr = $this->getConnection();
+        if(!$cr) {
+            throw new \Exception('Could not connect to LDAP');
+        }
+        $result = $this->access->countUsers('memberOf=*', ['memberOf'], 1);
+        if(is_int($result) &&  $result > 0) {
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * creates an LDAP Filter from given configuration
+     * @param integer $filterType int, for which use case the filter shall be created
+     * can be any of self::LFILTER_USER_LIST, self::LFILTER_LOGIN or
+     * self::LFILTER_GROUP_LIST
+     * @return string|false string with the filter on success, false otherwise
+     * @throws \Exception
+     */
+    private function composeLdapFilter($filterType) {
+        $filter = '';
+        $parts = 0;
+        switch ($filterType) {
+            case self::LFILTER_USER_LIST:
+                $objcs = $this->configuration->ldapUserFilterObjectclass;
+                //glue objectclasses
+                if(is_array($objcs) && count($objcs) > 0) {
+                    $filter .= '(|';
+                    foreach($objcs as $objc) {
+                        $filter .= '(objectclass=' . $objc . ')';
+                    }
+                    $filter .= ')';
+                    $parts++;
+                }
+                //glue group memberships
+                if($this->configuration->hasMemberOfFilterSupport) {
+                    $cns = $this->configuration->ldapUserFilterGroups;
+                    if(is_array($cns) && count($cns) > 0) {
+                        $filter .= '(|';
+                        $cr = $this->getConnection();
+                        if(!$cr) {
+                            throw new \Exception('Could not connect to LDAP');
+                        }
+                        $base = $this->configuration->ldapBase[0];
+                        foreach($cns as $cn) {
+                            $rr = $this->ldap->search($cr, $base, 'cn=' . $cn, ['dn', 'primaryGroupToken']);
+                            if(!$this->ldap->isResource($rr)) {
+                                continue;
+                            }
+                            $er = $this->ldap->firstEntry($cr, $rr);
+                            $attrs = $this->ldap->getAttributes($cr, $er);
+                            $dn = $this->ldap->getDN($cr, $er);
+                            if ($dn === false || $dn === '') {
+                                continue;
+                            }
+                            $filterPart = '(memberof=' . $dn . ')';
+                            if(isset($attrs['primaryGroupToken'])) {
+                                $pgt = $attrs['primaryGroupToken'][0];
+                                $primaryFilterPart = '(primaryGroupID=' . $pgt .')';
+                                $filterPart = '(|' . $filterPart . $primaryFilterPart . ')';
+                            }
+                            $filter .= $filterPart;
+                        }
+                        $filter .= ')';
+                    }
+                    $parts++;
+                }
+                //wrap parts in AND condition
+                if($parts > 1) {
+                    $filter = '(&' . $filter . ')';
+                }
+                if ($filter === '') {
+                    $filter = '(objectclass=*)';
+                }
+                break;
+
+            case self::LFILTER_GROUP_LIST:
+                $objcs = $this->configuration->ldapGroupFilterObjectclass;
+                //glue objectclasses
+                if(is_array($objcs) && count($objcs) > 0) {
+                    $filter .= '(|';
+                    foreach($objcs as $objc) {
+                        $filter .= '(objectclass=' . $objc . ')';
+                    }
+                    $filter .= ')';
+                    $parts++;
+                }
+                //glue group memberships
+                $cns = $this->configuration->ldapGroupFilterGroups;
+                if(is_array($cns) && count($cns) > 0) {
+                    $filter .= '(|';
+                    foreach($cns as $cn) {
+                        $filter .= '(cn=' . $cn . ')';
+                    }
+                    $filter .= ')';
+                }
+                $parts++;
+                //wrap parts in AND condition
+                if($parts > 1) {
+                    $filter = '(&' . $filter . ')';
+                }
+                break;
+
+            case self::LFILTER_LOGIN:
+                $ulf = $this->configuration->ldapUserFilter;
+                $loginpart = '=%uid';
+                $filterUsername = '';
+                $userAttributes = $this->getUserAttributes();
+                $userAttributes = array_change_key_case(array_flip($userAttributes));
+                $parts = 0;
+
+                if($this->configuration->ldapLoginFilterUsername === '1') {
+                    $attr = '';
+                    if(isset($userAttributes['uid'])) {
+                        $attr = 'uid';
+                    } else if(isset($userAttributes['samaccountname'])) {
+                        $attr = 'samaccountname';
+                    } else if(isset($userAttributes['cn'])) {
+                        //fallback
+                        $attr = 'cn';
+                    }
+                    if ($attr !== '') {
+                        $filterUsername = '(' . $attr . $loginpart . ')';
+                        $parts++;
+                    }
+                }
+
+                $filterEmail = '';
+                if($this->configuration->ldapLoginFilterEmail === '1') {
+                    $filterEmail = '(|(mailPrimaryAddress=%uid)(mail=%uid))';
+                    $parts++;
+                }
+
+                $filterAttributes = '';
+                $attrsToFilter = $this->configuration->ldapLoginFilterAttributes;
+                if(is_array($attrsToFilter) && count($attrsToFilter) > 0) {
+                    $filterAttributes = '(|';
+                    foreach($attrsToFilter as $attribute) {
+                        $filterAttributes .= '(' . $attribute . $loginpart . ')';
+                    }
+                    $filterAttributes .= ')';
+                    $parts++;
+                }
+
+                $filterLogin = '';
+                if($parts > 1) {
+                    $filterLogin = '(|';
+                }
+                $filterLogin .= $filterUsername;
+                $filterLogin .= $filterEmail;
+                $filterLogin .= $filterAttributes;
+                if($parts > 1) {
+                    $filterLogin .= ')';
+                }
+
+                $filter = '(&'.$ulf.$filterLogin.')';
+                break;
+        }
+
+        \OCP\Util::writeLog('user_ldap', 'Wiz: Final filter '.$filter, ILogger::DEBUG);
+
+        return $filter;
+    }
+
+    /**
+     * Connects and Binds to an LDAP Server
+     *
+     * @param int $port the port to connect with
+     * @param bool $tls whether startTLS is to be used
+     * @return bool
+     * @throws \Exception
+     */
+    private function connectAndBind($port, $tls) {
+        //connect, does not really trigger any server communication
+        $host = $this->configuration->ldapHost;
+        $hostInfo = parse_url($host);
+        if(!$hostInfo) {
+            throw new \Exception(self::$l->t('Invalid Host'));
+        }
+        \OCP\Util::writeLog('user_ldap', 'Wiz: Attempting to connect ', ILogger::DEBUG);
+        $cr = $this->ldap->connect($host, $port);
+        if(!is_resource($cr)) {
+            throw new \Exception(self::$l->t('Invalid Host'));
+        }
+
+        //set LDAP options
+        $this->ldap->setOption($cr, LDAP_OPT_PROTOCOL_VERSION, 3);
+        $this->ldap->setOption($cr, LDAP_OPT_REFERRALS, 0);
+        $this->ldap->setOption($cr, LDAP_OPT_NETWORK_TIMEOUT, self::LDAP_NW_TIMEOUT);
+
+        try {
+            if($tls) {
+                $isTlsWorking = @$this->ldap->startTls($cr);
+                if(!$isTlsWorking) {
+                    return false;
+                }
+            }
+
+            \OCP\Util::writeLog('user_ldap', 'Wiz: Attemping to Bind ', ILogger::DEBUG);
+            //interesting part: do the bind!
+            $login = $this->ldap->bind($cr,
+                $this->configuration->ldapAgentName,
+                $this->configuration->ldapAgentPassword
+            );
+            $errNo = $this->ldap->errno($cr);
+            $error = ldap_error($cr);
+            $this->ldap->unbind($cr);
+        } catch(ServerNotAvailableException $e) {
+            return false;
+        }
+
+        if($login === true) {
+            $this->ldap->unbind($cr);
+            \OCP\Util::writeLog('user_ldap', 'Wiz: Bind successful to Port '. $port . ' TLS ' . (int)$tls, ILogger::DEBUG);
+            return true;
+        }
+
+        if($errNo === -1) {
+            //host, port or TLS wrong
+            return false;
+        }
+        throw new \Exception($error, $errNo);
+    }
+
+    /**
+     * checks whether a valid combination of agent and password has been
+     * provided (either two values or nothing for anonymous connect)
+     * @return bool, true if everything is fine, false otherwise
+     */
+    private function checkAgentRequirements() {
+        $agent = $this->configuration->ldapAgentName;
+        $pwd = $this->configuration->ldapAgentPassword;
+
+        return
+            ($agent !== '' && $pwd !== '')
+            ||  ($agent === '' && $pwd === '')
+        ;
+    }
+
+    /**
+     * @param array $reqs
+     * @return bool
+     */
+    private function checkRequirements($reqs) {
+        $this->checkAgentRequirements();
+        foreach($reqs as $option) {
+            $value = $this->configuration->$option;
+            if(empty($value)) {
+                return false;
+            }
+        }
+        return true;
+    }
+
+    /**
+     * does a cumulativeSearch on LDAP to get different values of a
+     * specified attribute
+     * @param string[] $filters array, the filters that shall be used in the search
+     * @param string $attr the attribute of which a list of values shall be returned
+     * @param int $dnReadLimit the amount of how many DNs should be analyzed.
+     * The lower, the faster
+     * @param string $maxF string. if not null, this variable will have the filter that
+     * yields most result entries
+     * @return array|false an array with the values on success, false otherwise
+     */
+    public function cumulativeSearchOnAttribute($filters, $attr, $dnReadLimit = 3, &$maxF = null) {
+        $dnRead = [];
+        $foundItems = [];
+        $maxEntries = 0;
+        if(!is_array($this->configuration->ldapBase)
+           || !isset($this->configuration->ldapBase[0])) {
+            return false;
+        }
+        $base = $this->configuration->ldapBase[0];
+        $cr = $this->getConnection();
+        if(!$this->ldap->isResource($cr)) {
+            return false;
+        }
+        $lastFilter = null;
+        if(isset($filters[count($filters)-1])) {
+            $lastFilter = $filters[count($filters)-1];
+        }
+        foreach($filters as $filter) {
+            if($lastFilter === $filter && count($foundItems) > 0) {
+                //skip when the filter is a wildcard and results were found
+                continue;
+            }
+            // 20k limit for performance and reason
+            $rr = $this->ldap->search($cr, $base, $filter, [$attr], 0, 20000);
+            if(!$this->ldap->isResource($rr)) {
+                continue;
+            }
+            $entries = $this->ldap->countEntries($cr, $rr);
+            $getEntryFunc = 'firstEntry';
+            if(($entries !== false) && ($entries > 0)) {
+                if(!is_null($maxF) && $entries > $maxEntries) {
+                    $maxEntries = $entries;
+                    $maxF = $filter;
+                }
+                $dnReadCount = 0;
+                do {
+                    $entry = $this->ldap->$getEntryFunc($cr, $rr);
+                    $getEntryFunc = 'nextEntry';
+                    if(!$this->ldap->isResource($entry)) {
+                        continue 2;
+                    }
+                    $rr = $entry; //will be expected by nextEntry next round
+                    $attributes = $this->ldap->getAttributes($cr, $entry);
+                    $dn = $this->ldap->getDN($cr, $entry);
+                    if($dn === false || in_array($dn, $dnRead)) {
+                        continue;
+                    }
+                    $newItems = [];
+                    $state = $this->getAttributeValuesFromEntry($attributes,
+                                                                $attr,
+                                                                $newItems);
+                    $dnReadCount++;
+                    $foundItems = array_merge($foundItems, $newItems);
+                    $this->resultCache[$dn][$attr] = $newItems;
+                    $dnRead[] = $dn;
+                } while(($state === self::LRESULT_PROCESSED_SKIP
+                        || $this->ldap->isResource($entry))
+                        && ($dnReadLimit === 0 || $dnReadCount < $dnReadLimit));
+            }
+        }
+
+        return array_unique($foundItems);
+    }
+
+    /**
+     * determines if and which $attr are available on the LDAP server
+     * @param string[] $objectclasses the objectclasses to use as search filter
+     * @param string $attr the attribute to look for
+     * @param string $dbkey the dbkey of the setting the feature is connected to
+     * @param string $confkey the confkey counterpart for the $dbkey as used in the
+     * Configuration class
+     * @param bool $po whether the objectClass with most result entries
+     * shall be pre-selected via the result
+     * @return array|false list of found items.
+     * @throws \Exception
+     */
+    private function determineFeature($objectclasses, $attr, $dbkey, $confkey, $po = false) {
+        $cr = $this->getConnection();
+        if(!$cr) {
+            throw new \Exception('Could not connect to LDAP');
+        }
+        $p = 'objectclass=';
+        foreach($objectclasses as $key => $value) {
+            $objectclasses[$key] = $p.$value;
+        }
+        $maxEntryObjC = '';
+
+        //how deep to dig?
+        //When looking for objectclasses, testing few entries is sufficient,
+        $dig = 3;
+
+        $availableFeatures =
+            $this->cumulativeSearchOnAttribute($objectclasses, $attr,
+                                                $dig, $maxEntryObjC);
+        if(is_array($availableFeatures)
+           && count($availableFeatures) > 0) {
+            natcasesort($availableFeatures);
+            //natcasesort keeps indices, but we must get rid of them for proper
+            //sorting in the web UI. Therefore: array_values
+            $this->result->addOptions($dbkey, array_values($availableFeatures));
+        } else {
+            throw new \Exception(self::$l->t('Could not find the desired feature'));
+        }
+
+        $setFeatures = $this->configuration->$confkey;
+        if(is_array($setFeatures) && !empty($setFeatures)) {
+            //something is already configured? pre-select it.
+            $this->result->addChange($dbkey, $setFeatures);
+        } else if ($po && $maxEntryObjC !== '') {
+            //pre-select objectclass with most result entries
+            $maxEntryObjC = str_replace($p, '', $maxEntryObjC);
+            $this->applyFind($dbkey, $maxEntryObjC);
+            $this->result->addChange($dbkey, $maxEntryObjC);
+        }
+
+        return $availableFeatures;
+    }
+
+    /**
+     * appends a list of values fr
+     * @param resource $result the return value from ldap_get_attributes
+     * @param string $attribute the attribute values to look for
+     * @param array &$known new values will be appended here
+     * @return int, state on of the class constants LRESULT_PROCESSED_OK,
+     * LRESULT_PROCESSED_INVALID or LRESULT_PROCESSED_SKIP
+     */
+    private function getAttributeValuesFromEntry($result, $attribute, &$known) {
+        if(!is_array($result)
+           || !isset($result['count'])
+           || !$result['count'] > 0) {
+            return self::LRESULT_PROCESSED_INVALID;
+        }
+
+        // strtolower on all keys for proper comparison
+        $result = \OCP\Util::mb_array_change_key_case($result);
+        $attribute = strtolower($attribute);
+        if(isset($result[$attribute])) {
+            foreach($result[$attribute] as $key => $val) {
+                if($key === 'count') {
+                    continue;
+                }
+                if(!in_array($val, $known)) {
+                    $known[] = $val;
+                }
+            }
+            return self::LRESULT_PROCESSED_OK;
+        } else {
+            return self::LRESULT_PROCESSED_SKIP;
+        }
+    }
+
+    /**
+     * @return bool|mixed
+     */
+    private function getConnection() {
+        if(!is_null($this->cr)) {
+            return $this->cr;
+        }
+
+        $cr = $this->ldap->connect(
+            $this->configuration->ldapHost,
+            $this->configuration->ldapPort
+        );
+
+        $this->ldap->setOption($cr, LDAP_OPT_PROTOCOL_VERSION, 3);
+        $this->ldap->setOption($cr, LDAP_OPT_REFERRALS, 0);
+        $this->ldap->setOption($cr, LDAP_OPT_NETWORK_TIMEOUT, self::LDAP_NW_TIMEOUT);
+        if($this->configuration->ldapTLS === 1) {
+            $this->ldap->startTls($cr);
+        }
+
+        $lo = @$this->ldap->bind($cr,
+                                    $this->configuration->ldapAgentName,
+                                    $this->configuration->ldapAgentPassword);
+        if($lo === true) {
+            $this->$cr = $cr;
+            return $cr;
+        }
+
+        return false;
+    }
+
+    /**
+     * @return array
+     */
+    private function getDefaultLdapPortSettings() {
+        static $settings = [
+                                ['port' => 7636, 'tls' => false],
+                                ['port' =>  636, 'tls' => false],
+                                ['port' => 7389, 'tls' => true],
+                                ['port' =>  389, 'tls' => true],
+                                ['port' => 7389, 'tls' => false],
+                                ['port' =>  389, 'tls' => false],
+                            ];
+        return $settings;
+    }
+
+    /**
+     * @return array
+     */
+    private function getPortSettingsToTry() {
+        //389 ← LDAP / Unencrypted or StartTLS
+        //636 ← LDAPS / SSL
+        //7xxx ← UCS. need to be checked first, because both ports may be open
+        $host = $this->configuration->ldapHost;
+        $port = (int)$this->configuration->ldapPort;
+        $portSettings = [];
+
+        //In case the port is already provided, we will check this first
+        if($port > 0) {
+            $hostInfo = parse_url($host);
+            if(!(is_array($hostInfo)
+                && isset($hostInfo['scheme'])
+                && stripos($hostInfo['scheme'], 'ldaps') !== false)) {
+                $portSettings[] = ['port' => $port, 'tls' => true];
+            }
+            $portSettings[] =['port' => $port, 'tls' => false];
+        }
+
+        //default ports
+        $portSettings = array_merge($portSettings,
+                                    $this->getDefaultLdapPortSettings());
+
+        return $portSettings;
+    }
 
 
 }

Spacing +156 added lines, -156 removed lines

@@ -72,7 +72,7 @@ 
 	public function __construct(Configuration $configuration, ILDAPWrapper $ldap, Access $access) {
 		parent::__construct($ldap);
 		$this->configuration = $configuration;
-		if(is_null(Wizard::$l)) {
+		if (is_null(Wizard::$l)) {
 			Wizard::$l = \OC::$server->getL10N('user_ldap');
 		}
 		$this->access = $access;
@@ -80,7 +80,7 @@ 
 	}
 
 	public function  __destruct() {
-		if($this->result->hasChanges()) {
+		if ($this->result->hasChanges()) {
 			$this->configuration->saveConfiguration();
 		}
 	}
@@ -95,18 +95,18 @@ 
 	 */
 	public function countEntries(string $filter, string $type): int {
 		$reqs = ['ldapHost', 'ldapPort', 'ldapBase'];
-		if($type === 'users') {
+		if ($type === 'users') {
 			$reqs[] = 'ldapUserFilter';
 		}
-		if(!$this->checkRequirements($reqs)) {
+		if (!$this->checkRequirements($reqs)) {
 			throw new \Exception('Requirements not met', 400);
 		}
 
 		$attr = ['dn']; // default
 		$limit = 1001;
-		if($type === 'groups') {
-			$result =  $this->access->countGroups($filter, $attr, $limit);
-		} else if($type === 'users') {
+		if ($type === 'groups') {
+			$result = $this->access->countGroups($filter, $attr, $limit);
+		} else if ($type === 'users') {
 			$result = $this->access->countUsers($filter, $attr, $limit);
 		} else if ($type === 'objects') {
 			$result = $this->access->countObjects($limit);
@@ -114,7 +114,7 @@ 
 			throw new \Exception('Internal error: Invalid object type', 500);
 		}
 
-		return (int)$result;
+		return (int) $result;
 	}
 
 	/**
@@ -125,16 +125,16 @@ 
 	 * @return string
 	 */
 	private function formatCountResult(int $count): string {
-		if($count > 1000) {
+		if ($count > 1000) {
 			return '> 1000';
 		}
-		return (string)$count;
+		return (string) $count;
 	}
 
 	public function countGroups() {
 		$filter = $this->configuration->ldapGroupFilter;
 
-		if(empty($filter)) {
+		if (empty($filter)) {
 			$output = self::$l->n('%s group found', '%s groups found', 0, [0]);
 			$this->result->addChange('ldap_group_count', $output);
 			return $this->result;
@@ -144,7 +144,7 @@ 
 			$groupsTotal = $this->countEntries($filter, 'groups');
 		} catch (\Exception $e) {
 			//400 can be ignored, 500 is forwarded
-			if($e->getCode() === 500) {
+			if ($e->getCode() === 500) {
 				throw $e;
 			}
 			return false;
@@ -186,7 +186,7 @@ 
 	public function countInBaseDN() {
 		// we don't need to provide a filter in this case
 		$total = $this->countEntries('', 'objects');
-		if($total === false) {
+		if ($total === false) {
 			throw new \Exception('invalid results received');
 		}
 		$this->result->addChange('ldap_test_base', $total);
@@ -200,7 +200,7 @@ 
 	 * @return int|bool
 	 */
 	public function countUsersWithAttribute($attr, $existsCheck = false) {
-		if(!$this->checkRequirements(['ldapHost',
+		if (!$this->checkRequirements(['ldapHost',
 										   'ldapPort',
 										   'ldapBase',
 										   'ldapUserFilter',
@@ -210,7 +210,7 @@ 
 
 		$filter = $this->access->combineFilterWithAnd([
 			$this->configuration->ldapUserFilter,
-			$attr . '=*'
+			$attr.'=*'
 		]);
 
 		$limit = ($existsCheck === false) ? null : 1;
@@ -225,7 +225,7 @@ 
 	 * @throws \Exception
 	 */
 	public function detectUserDisplayNameAttribute() {
-		if(!$this->checkRequirements(['ldapHost',
+		if (!$this->checkRequirements(['ldapHost',
 										'ldapPort',
 										'ldapBase',
 										'ldapUserFilter',
@@ -237,8 +237,8 @@ 
 		if ($attr !== '' && $attr !== 'displayName') {
 			// most likely not the default value with upper case N,
 			// verify it still produces a result
-			$count = (int)$this->countUsersWithAttribute($attr, true);
-			if($count > 0) {
+			$count = (int) $this->countUsersWithAttribute($attr, true);
+			if ($count > 0) {
 				//no change, but we sent it back to make sure the user interface
 				//is still correct, even if the ajax call was cancelled meanwhile
 				$this->result->addChange('ldap_display_name', $attr);
@@ -249,9 +249,9 @@ 
 		// first attribute that has at least one result wins
 		$displayNameAttrs = ['displayname', 'cn'];
 		foreach ($displayNameAttrs as $attr) {
-			$count = (int)$this->countUsersWithAttribute($attr, true);
+			$count = (int) $this->countUsersWithAttribute($attr, true);
 
-			if($count > 0) {
+			if ($count > 0) {
 				$this->applyFind('ldap_display_name', $attr);
 				return $this->result;
 			}
@@ -267,7 +267,7 @@ 
 	 * @return WizardResult|bool
 	 */
 	public function detectEmailAttribute() {
-		if(!$this->checkRequirements(['ldapHost',
+		if (!$this->checkRequirements(['ldapHost',
 										   'ldapPort',
 										   'ldapBase',
 										   'ldapUserFilter',
@@ -277,8 +277,8 @@ 
 
 		$attr = $this->configuration->ldapEmailAttribute;
 		if ($attr !== '') {
-			$count = (int)$this->countUsersWithAttribute($attr, true);
-			if($count > 0) {
+			$count = (int) $this->countUsersWithAttribute($attr, true);
+			if ($count > 0) {
 				return false;
 			}
 			$writeLog = true;
@@ -289,19 +289,19 @@ 
 		$emailAttributes = ['mail', 'mailPrimaryAddress'];
 		$winner = '';
 		$maxUsers = 0;
-		foreach($emailAttributes as $attr) {
+		foreach ($emailAttributes as $attr) {
 			$count = $this->countUsersWithAttribute($attr);
-			if($count > $maxUsers) {
+			if ($count > $maxUsers) {
 				$maxUsers = $count;
 				$winner = $attr;
 			}
 		}
 
-		if($winner !== '') {
+		if ($winner !== '') {
 			$this->applyFind('ldap_email_attr', $winner);
-			if($writeLog) {
-				\OCP\Util::writeLog('user_ldap', 'The mail attribute has ' .
-					'automatically been reset, because the original value ' .
+			if ($writeLog) {
+				\OCP\Util::writeLog('user_ldap', 'The mail attribute has '.
+					'automatically been reset, because the original value '.
 					'did not return any results.', ILogger::INFO);
 			}
 		}
@@ -314,7 +314,7 @@ 
 	 * @throws \Exception
 	 */
 	public function determineAttributes() {
-		if(!$this->checkRequirements(['ldapHost',
+		if (!$this->checkRequirements(['ldapHost',
 										   'ldapPort',
 										   'ldapBase',
 										   'ldapUserFilter',
@@ -330,7 +330,7 @@ 
 		$this->result->addOptions('ldap_loginfilter_attributes', $attributes);
 
 		$selected = $this->configuration->ldapLoginFilterAttributes;
-		if(is_array($selected) && !empty($selected)) {
+		if (is_array($selected) && !empty($selected)) {
 			$this->result->addChange('ldap_loginfilter_attributes', $selected);
 		}
 
@@ -343,7 +343,7 @@ 
 	 * @throws \Exception
 	 */
 	private function getUserAttributes() {
-		if(!$this->checkRequirements(['ldapHost',
+		if (!$this->checkRequirements(['ldapHost',
 										   'ldapPort',
 										   'ldapBase',
 										   'ldapUserFilter',
@@ -351,20 +351,20 @@ 
 			return  false;
 		}
 		$cr = $this->getConnection();
-		if(!$cr) {
+		if (!$cr) {
 			throw new \Exception('Could not connect to LDAP');
 		}
 
 		$base = $this->configuration->ldapBase[0];
 		$filter = $this->configuration->ldapUserFilter;
 		$rr = $this->ldap->search($cr, $base, $filter, [], 1, 1);
-		if(!$this->ldap->isResource($rr)) {
+		if (!$this->ldap->isResource($rr)) {
 			return false;
 		}
 		$er = $this->ldap->firstEntry($cr, $rr);
 		$attributes = $this->ldap->getAttributes($cr, $er);
 		$pureAttributes = [];
-		for($i = 0; $i < $attributes['count']; $i++) {
+		for ($i = 0; $i < $attributes['count']; $i++) {
 			$pureAttributes[] = $attributes[$i];
 		}
 
@@ -399,23 +399,23 @@ 
 	 * @throws \Exception
 	 */
 	private function determineGroups($dbKey, $confKey, $testMemberOf = true) {
-		if(!$this->checkRequirements(['ldapHost',
+		if (!$this->checkRequirements(['ldapHost',
 										   'ldapPort',
 										   'ldapBase',
 										   ])) {
 			return  false;
 		}
 		$cr = $this->getConnection();
-		if(!$cr) {
+		if (!$cr) {
 			throw new \Exception('Could not connect to LDAP');
 		}
 
 		$this->fetchGroups($dbKey, $confKey);
 
-		if($testMemberOf) {
+		if ($testMemberOf) {
 			$this->configuration->hasMemberOfFilterSupport = $this->testMemberOf();
 			$this->result->markChange();
-			if(!$this->configuration->hasMemberOfFilterSupport) {
+			if (!$this->configuration->hasMemberOfFilterSupport) {
 				throw new \Exception('memberOf is not supported by the server');
 			}
 		}
@@ -435,7 +435,7 @@ 
 		$obclasses = ['posixGroup', 'group', 'zimbraDistributionList', 'groupOfNames', 'groupOfUniqueNames'];
 
 		$filterParts = [];
-		foreach($obclasses as $obclass) {
+		foreach ($obclasses as $obclass) {
 			$filterParts[] = 'objectclass='.$obclass;
 		}
 		//we filter for everything
@@ -452,8 +452,8 @@ 
 			// we need to request dn additionally here, otherwise memberOf
 			// detection will fail later
 			$result = $this->access->searchGroups($filter, ['cn', 'dn'], $limit, $offset);
-			foreach($result as $item) {
-				if(!isset($item['cn']) && !is_array($item['cn']) && !isset($item['cn'][0])) {
+			foreach ($result as $item) {
+				if (!isset($item['cn']) && !is_array($item['cn']) && !isset($item['cn'][0])) {
 					// just in case - no issue known
 					continue;
 				}
@@ -463,7 +463,7 @@ 
 			$offset += $limit;
 		} while ($this->access->hasMoreResults());
 
-		if(count($groupNames) > 0) {
+		if (count($groupNames) > 0) {
 			natsort($groupNames);
 			$this->result->addOptions($dbKey, array_values($groupNames));
 		} else {
@@ -471,7 +471,7 @@ 
 		}
 
 		$setFeatures = $this->configuration->$confKey;
-		if(is_array($setFeatures) && !empty($setFeatures)) {
+		if (is_array($setFeatures) && !empty($setFeatures)) {
 			//something is already configured? pre-select it.
 			$this->result->addChange($dbKey, $setFeatures);
 		}
@@ -479,14 +479,14 @@ 
 	}
 
 	public function determineGroupMemberAssoc() {
-		if(!$this->checkRequirements(['ldapHost',
+		if (!$this->checkRequirements(['ldapHost',
 										   'ldapPort',
 										   'ldapGroupFilter',
 										   ])) {
 			return  false;
 		}
 		$attribute = $this->detectGroupMemberAssoc();
-		if($attribute === false) {
+		if ($attribute === false) {
 			return false;
 		}
 		$this->configuration->setConfiguration(['ldapGroupMemberAssocAttr' => $attribute]);
@@ -501,14 +501,14 @@ 
 	 * @throws \Exception
 	 */
 	public function determineGroupObjectClasses() {
-		if(!$this->checkRequirements(['ldapHost',
+		if (!$this->checkRequirements(['ldapHost',
 										   'ldapPort',
 										   'ldapBase',
 										   ])) {
 			return  false;
 		}
 		$cr = $this->getConnection();
-		if(!$cr) {
+		if (!$cr) {
 			throw new \Exception('Could not connect to LDAP');
 		}
 
@@ -528,14 +528,14 @@ 
 	 * @throws \Exception
 	 */
 	public function determineUserObjectClasses() {
-		if(!$this->checkRequirements(['ldapHost',
+		if (!$this->checkRequirements(['ldapHost',
 										   'ldapPort',
 										   'ldapBase',
 										   ])) {
 			return  false;
 		}
 		$cr = $this->getConnection();
-		if(!$cr) {
+		if (!$cr) {
 			throw new \Exception('Could not connect to LDAP');
 		}
 
@@ -558,7 +558,7 @@ 
 	 * @throws \Exception
 	 */
 	public function getGroupFilter() {
-		if(!$this->checkRequirements(['ldapHost',
+		if (!$this->checkRequirements(['ldapHost',
 										   'ldapPort',
 										   'ldapBase',
 										   ])) {
@@ -582,7 +582,7 @@ 
 	 * @throws \Exception
 	 */
 	public function getUserListFilter() {
-		if(!$this->checkRequirements(['ldapHost',
+		if (!$this->checkRequirements(['ldapHost',
 										   'ldapPort',
 										   'ldapBase',
 										   ])) {
@@ -595,7 +595,7 @@ 
 			$this->applyFind('ldap_display_name', $d['ldap_display_name']);
 		}
 		$filter = $this->composeLdapFilter(self::LFILTER_USER_LIST);
-		if(!$filter) {
+		if (!$filter) {
 			throw new \Exception('Cannot create filter');
 		}
 
@@ -608,7 +608,7 @@ 
 	 * @throws \Exception
 	 */
 	public function getUserLoginFilter() {
-		if(!$this->checkRequirements(['ldapHost',
+		if (!$this->checkRequirements(['ldapHost',
 										   'ldapPort',
 										   'ldapBase',
 										   'ldapUserFilter',
@@ -617,7 +617,7 @@ 
 		}
 
 		$filter = $this->composeLdapFilter(self::LFILTER_LOGIN);
-		if(!$filter) {
+		if (!$filter) {
 			throw new \Exception('Cannot create filter');
 		}
 
@@ -631,7 +631,7 @@ 
 	 * @throws \Exception
 	 */
 	public function testLoginName($loginName) {
-		if(!$this->checkRequirements(['ldapHost',
+		if (!$this->checkRequirements(['ldapHost',
 			'ldapPort',
 			'ldapBase',
 			'ldapLoginFilter',
@@ -640,17 +640,17 @@ 
 		}
 
 		$cr = $this->access->connection->getConnectionResource();
-		if(!$this->ldap->isResource($cr)) {
+		if (!$this->ldap->isResource($cr)) {
 			throw new \Exception('connection error');
 		}
 
-		if(mb_strpos($this->access->connection->ldapLoginFilter, '%uid', 0, 'UTF-8')
+		if (mb_strpos($this->access->connection->ldapLoginFilter, '%uid', 0, 'UTF-8')
 			=== false) {
 			throw new \Exception('missing placeholder');
 		}
 
 		$users = $this->access->countUsersByLoginName($loginName);
-		if($this->ldap->errno($cr) !== 0) {
+		if ($this->ldap->errno($cr) !== 0) {
 			throw new \Exception($this->ldap->error($cr));
 		}
 		$filter = str_replace('%uid', $loginName, $this->access->connection->ldapLoginFilter);
@@ -665,22 +665,22 @@ 
 	 * @throws \Exception
 	 */
 	public function guessPortAndTLS() {
-		if(!$this->checkRequirements(['ldapHost',
+		if (!$this->checkRequirements(['ldapHost',
 										   ])) {
 			return false;
 		}
 		$this->checkHost();
 		$portSettings = $this->getPortSettingsToTry();
 
-		if(!is_array($portSettings)) {
+		if (!is_array($portSettings)) {
 			throw new \Exception(print_r($portSettings, true));
 		}
 
 		//proceed from the best configuration and return on first success
-		foreach($portSettings as $setting) {
+		foreach ($portSettings as $setting) {
 			$p = $setting['port'];
 			$t = $setting['tls'];
-			\OCP\Util::writeLog('user_ldap', 'Wiz: trying port '. $p . ', TLS '. $t, ILogger::DEBUG);
+			\OCP\Util::writeLog('user_ldap', 'Wiz: trying port '.$p.', TLS '.$t, ILogger::DEBUG);
 			//connectAndBind may throw Exception, it needs to be catched by the
 			//callee of this method
 
@@ -690,7 +690,7 @@ 
 				// any reply other than -1 (= cannot connect) is already okay,
 				// because then we found the server
 				// unavailable startTLS returns -11
-				if($e->getCode() > 0) {
+				if ($e->getCode() > 0) {
 					$settingsFound = true;
 				} else {
 					throw $e;
@@ -700,10 +700,10 @@ 
 			if ($settingsFound === true) {
 				$config = [
 					'ldapPort' => $p,
-					'ldapTLS' => (int)$t
+					'ldapTLS' => (int) $t
 				];
 				$this->configuration->setConfiguration($config);
-				\OCP\Util::writeLog('user_ldap', 'Wiz: detected Port ' . $p, ILogger::DEBUG);
+				\OCP\Util::writeLog('user_ldap', 'Wiz: detected Port '.$p, ILogger::DEBUG);
 				$this->result->addChange('ldap_port', $p);
 				return $this->result;
 			}
@@ -718,7 +718,7 @@ 
 	 * @return WizardResult|false WizardResult on success, false otherwise
 	 */
 	public function guessBaseDN() {
-		if(!$this->checkRequirements(['ldapHost',
+		if (!$this->checkRequirements(['ldapHost',
 										   'ldapPort',
 										   ])) {
 			return false;
@@ -727,9 +727,9 @@ 
 		//check whether a DN is given in the agent name (99.9% of all cases)
 		$base = null;
 		$i = stripos($this->configuration->ldapAgentName, 'dc=');
-		if($i !== false) {
+		if ($i !== false) {
 			$base = substr($this->configuration->ldapAgentName, $i);
-			if($this->testBaseDN($base)) {
+			if ($this->testBaseDN($base)) {
 				$this->applyFind('ldap_base', $base);
 				return $this->result;
 			}
@@ -740,13 +740,13 @@ 
 		//a base DN
 		$helper = new Helper(\OC::$server->getConfig());
 		$domain = $helper->getDomainFromURL($this->configuration->ldapHost);
-		if(!$domain) {
+		if (!$domain) {
 			return false;
 		}
 
 		$dparts = explode('.', $domain);
-		while(count($dparts) > 0) {
-			$base2 = 'dc=' . implode(',dc=', $dparts);
+		while (count($dparts) > 0) {
+			$base2 = 'dc='.implode(',dc=', $dparts);
 			if ($base !== $base2 && $this->testBaseDN($base2)) {
 				$this->applyFind('ldap_base', $base2);
 				return $this->result;
@@ -779,7 +779,7 @@ 
 		$hostInfo = parse_url($host);
 
 		//removes Port from Host
-		if(is_array($hostInfo) && isset($hostInfo['port'])) {
+		if (is_array($hostInfo) && isset($hostInfo['port'])) {
 			$port = $hostInfo['port'];
 			$host = str_replace(':'.$port, '', $host);
 			$this->applyFind('ldap_host', $host);
@@ -796,30 +796,30 @@ 
 	private function detectGroupMemberAssoc() {
 		$possibleAttrs = ['uniqueMember', 'memberUid', 'member', 'gidNumber'];
 		$filter = $this->configuration->ldapGroupFilter;
-		if(empty($filter)) {
+		if (empty($filter)) {
 			return false;
 		}
 		$cr = $this->getConnection();
-		if(!$cr) {
+		if (!$cr) {
 			throw new \Exception('Could not connect to LDAP');
 		}
 		$base = $this->configuration->ldapBaseGroups[0] ?: $this->configuration->ldapBase[0];
 		$rr = $this->ldap->search($cr, $base, $filter, $possibleAttrs, 0, 1000);
-		if(!$this->ldap->isResource($rr)) {
+		if (!$this->ldap->isResource($rr)) {
 			return false;
 		}
 		$er = $this->ldap->firstEntry($cr, $rr);
-		while(is_resource($er)) {
+		while (is_resource($er)) {
 			$this->ldap->getDN($cr, $er);
 			$attrs = $this->ldap->getAttributes($cr, $er);
 			$result = [];
 			$possibleAttrsCount = count($possibleAttrs);
-			for($i = 0; $i < $possibleAttrsCount; $i++) {
-				if(isset($attrs[$possibleAttrs[$i]])) {
+			for ($i = 0; $i < $possibleAttrsCount; $i++) {
+				if (isset($attrs[$possibleAttrs[$i]])) {
 					$result[$possibleAttrs[$i]] = $attrs[$possibleAttrs[$i]]['count'];
 				}
 			}
-			if(!empty($result)) {
+			if (!empty($result)) {
 				natsort($result);
 				return key($result);
 			}
@@ -838,14 +838,14 @@ 
 	 */
 	private function testBaseDN($base) {
 		$cr = $this->getConnection();
-		if(!$cr) {
+		if (!$cr) {
 			throw new \Exception('Could not connect to LDAP');
 		}
 
 		//base is there, let's validate it. If we search for anything, we should
 		//get a result set > 0 on a proper base
 		$rr = $this->ldap->search($cr, $base, 'objectClass=*', ['dn'], 0, 1);
-		if(!$this->ldap->isResource($rr)) {
+		if (!$this->ldap->isResource($rr)) {
 			$errorNo  = $this->ldap->errno($cr);
 			$errorMsg = $this->ldap->error($cr);
 			\OCP\Util::writeLog('user_ldap', 'Wiz: Could not search base '.$base.
@@ -867,11 +867,11 @@ 
 	 */
 	private function testMemberOf() {
 		$cr = $this->getConnection();
-		if(!$cr) {
+		if (!$cr) {
 			throw new \Exception('Could not connect to LDAP');
 		}
 		$result = $this->access->countUsers('memberOf=*', ['memberOf'], 1);
-		if(is_int($result) &&  $result > 0) {
+		if (is_int($result) && $result > 0) {
 			return true;
 		}
 		return false;
@@ -892,27 +892,27 @@ 
 			case self::LFILTER_USER_LIST:
 				$objcs = $this->configuration->ldapUserFilterObjectclass;
 				//glue objectclasses
-				if(is_array($objcs) && count($objcs) > 0) {
+				if (is_array($objcs) && count($objcs) > 0) {
 					$filter .= '(|';
-					foreach($objcs as $objc) {
-						$filter .= '(objectclass=' . $objc . ')';
+					foreach ($objcs as $objc) {
+						$filter .= '(objectclass='.$objc.')';
 					}
 					$filter .= ')';
 					$parts++;
 				}
 				//glue group memberships
-				if($this->configuration->hasMemberOfFilterSupport) {
+				if ($this->configuration->hasMemberOfFilterSupport) {
 					$cns = $this->configuration->ldapUserFilterGroups;
-					if(is_array($cns) && count($cns) > 0) {
+					if (is_array($cns) && count($cns) > 0) {
 						$filter .= '(|';
 						$cr = $this->getConnection();
-						if(!$cr) {
+						if (!$cr) {
 							throw new \Exception('Could not connect to LDAP');
 						}
 						$base = $this->configuration->ldapBase[0];
-						foreach($cns as $cn) {
-							$rr = $this->ldap->search($cr, $base, 'cn=' . $cn, ['dn', 'primaryGroupToken']);
-							if(!$this->ldap->isResource($rr)) {
+						foreach ($cns as $cn) {
+							$rr = $this->ldap->search($cr, $base, 'cn='.$cn, ['dn', 'primaryGroupToken']);
+							if (!$this->ldap->isResource($rr)) {
 								continue;
 							}
 							$er = $this->ldap->firstEntry($cr, $rr);
@@ -921,11 +921,11 @@ 
 							if ($dn === false || $dn === '') {
 								continue;
 							}
-							$filterPart = '(memberof=' . $dn . ')';
-							if(isset($attrs['primaryGroupToken'])) {
+							$filterPart = '(memberof='.$dn.')';
+							if (isset($attrs['primaryGroupToken'])) {
 								$pgt = $attrs['primaryGroupToken'][0];
-								$primaryFilterPart = '(primaryGroupID=' . $pgt .')';
-								$filterPart = '(|' . $filterPart . $primaryFilterPart . ')';
+								$primaryFilterPart = '(primaryGroupID='.$pgt.')';
+								$filterPart = '(|'.$filterPart.$primaryFilterPart.')';
 							}
 							$filter .= $filterPart;
 						}
@@ -934,8 +934,8 @@ 
 					$parts++;
 				}
 				//wrap parts in AND condition
-				if($parts > 1) {
-					$filter = '(&' . $filter . ')';
+				if ($parts > 1) {
+					$filter = '(&'.$filter.')';
 				}
 				if ($filter === '') {
 					$filter = '(objectclass=*)';
@@ -945,27 +945,27 @@ 
 			case self::LFILTER_GROUP_LIST:
 				$objcs = $this->configuration->ldapGroupFilterObjectclass;
 				//glue objectclasses
-				if(is_array($objcs) && count($objcs) > 0) {
+				if (is_array($objcs) && count($objcs) > 0) {
 					$filter .= '(|';
-					foreach($objcs as $objc) {
-						$filter .= '(objectclass=' . $objc . ')';
+					foreach ($objcs as $objc) {
+						$filter .= '(objectclass='.$objc.')';
 					}
 					$filter .= ')';
 					$parts++;
 				}
 				//glue group memberships
 				$cns = $this->configuration->ldapGroupFilterGroups;
-				if(is_array($cns) && count($cns) > 0) {
+				if (is_array($cns) && count($cns) > 0) {
 					$filter .= '(|';
-					foreach($cns as $cn) {
-						$filter .= '(cn=' . $cn . ')';
+					foreach ($cns as $cn) {
+						$filter .= '(cn='.$cn.')';
 					}
 					$filter .= ')';
 				}
 				$parts++;
 				//wrap parts in AND condition
-				if($parts > 1) {
-					$filter = '(&' . $filter . ')';
+				if ($parts > 1) {
+					$filter = '(&'.$filter.')';
 				}
 				break;
 
@@ -977,47 +977,47 @@ 
 				$userAttributes = array_change_key_case(array_flip($userAttributes));
 				$parts = 0;
 
-				if($this->configuration->ldapLoginFilterUsername === '1') {
+				if ($this->configuration->ldapLoginFilterUsername === '1') {
 					$attr = '';
-					if(isset($userAttributes['uid'])) {
+					if (isset($userAttributes['uid'])) {
 						$attr = 'uid';
-					} else if(isset($userAttributes['samaccountname'])) {
+					} else if (isset($userAttributes['samaccountname'])) {
 						$attr = 'samaccountname';
-					} else if(isset($userAttributes['cn'])) {
+					} else if (isset($userAttributes['cn'])) {
 						//fallback
 						$attr = 'cn';
 					}
 					if ($attr !== '') {
-						$filterUsername = '(' . $attr . $loginpart . ')';
+						$filterUsername = '('.$attr.$loginpart.')';
 						$parts++;
 					}
 				}
 
 				$filterEmail = '';
-				if($this->configuration->ldapLoginFilterEmail === '1') {
+				if ($this->configuration->ldapLoginFilterEmail === '1') {
 					$filterEmail = '(|(mailPrimaryAddress=%uid)(mail=%uid))';
 					$parts++;
 				}
 
 				$filterAttributes = '';
 				$attrsToFilter = $this->configuration->ldapLoginFilterAttributes;
-				if(is_array($attrsToFilter) && count($attrsToFilter) > 0) {
+				if (is_array($attrsToFilter) && count($attrsToFilter) > 0) {
 					$filterAttributes = '(|';
-					foreach($attrsToFilter as $attribute) {
-						$filterAttributes .= '(' . $attribute . $loginpart . ')';
+					foreach ($attrsToFilter as $attribute) {
+						$filterAttributes .= '('.$attribute.$loginpart.')';
 					}
 					$filterAttributes .= ')';
 					$parts++;
 				}
 
 				$filterLogin = '';
-				if($parts > 1) {
+				if ($parts > 1) {
 					$filterLogin = '(|';
 				}
 				$filterLogin .= $filterUsername;
 				$filterLogin .= $filterEmail;
 				$filterLogin .= $filterAttributes;
-				if($parts > 1) {
+				if ($parts > 1) {
 					$filterLogin .= ')';
 				}
 
@@ -1042,12 +1042,12 @@ 
 		//connect, does not really trigger any server communication
 		$host = $this->configuration->ldapHost;
 		$hostInfo = parse_url($host);
-		if(!$hostInfo) {
+		if (!$hostInfo) {
 			throw new \Exception(self::$l->t('Invalid Host'));
 		}
 		\OCP\Util::writeLog('user_ldap', 'Wiz: Attempting to connect ', ILogger::DEBUG);
 		$cr = $this->ldap->connect($host, $port);
-		if(!is_resource($cr)) {
+		if (!is_resource($cr)) {
 			throw new \Exception(self::$l->t('Invalid Host'));
 		}
 
@@ -1057,9 +1057,9 @@ 
 		$this->ldap->setOption($cr, LDAP_OPT_NETWORK_TIMEOUT, self::LDAP_NW_TIMEOUT);
 
 		try {
-			if($tls) {
+			if ($tls) {
 				$isTlsWorking = @$this->ldap->startTls($cr);
-				if(!$isTlsWorking) {
+				if (!$isTlsWorking) {
 					return false;
 				}
 			}
@@ -1073,17 +1073,17 @@ 
 			$errNo = $this->ldap->errno($cr);
 			$error = ldap_error($cr);
 			$this->ldap->unbind($cr);
-		} catch(ServerNotAvailableException $e) {
+		} catch (ServerNotAvailableException $e) {
 			return false;
 		}
 
-		if($login === true) {
+		if ($login === true) {
 			$this->ldap->unbind($cr);
-			\OCP\Util::writeLog('user_ldap', 'Wiz: Bind successful to Port '. $port . ' TLS ' . (int)$tls, ILogger::DEBUG);
+			\OCP\Util::writeLog('user_ldap', 'Wiz: Bind successful to Port '.$port.' TLS '.(int) $tls, ILogger::DEBUG);
 			return true;
 		}
 
-		if($errNo === -1) {
+		if ($errNo === -1) {
 			//host, port or TLS wrong
 			return false;
 		}
@@ -1111,9 +1111,9 @@ 
 	 */
 	private function checkRequirements($reqs) {
 		$this->checkAgentRequirements();
-		foreach($reqs as $option) {
+		foreach ($reqs as $option) {
 			$value = $this->configuration->$option;
-			if(empty($value)) {
+			if (empty($value)) {
 				return false;
 			}
 		}
@@ -1135,33 +1135,33 @@ 
 		$dnRead = [];
 		$foundItems = [];
 		$maxEntries = 0;
-		if(!is_array($this->configuration->ldapBase)
+		if (!is_array($this->configuration->ldapBase)
 		   || !isset($this->configuration->ldapBase[0])) {
 			return false;
 		}
 		$base = $this->configuration->ldapBase[0];
 		$cr = $this->getConnection();
-		if(!$this->ldap->isResource($cr)) {
+		if (!$this->ldap->isResource($cr)) {
 			return false;
 		}
 		$lastFilter = null;
-		if(isset($filters[count($filters)-1])) {
-			$lastFilter = $filters[count($filters)-1];
+		if (isset($filters[count($filters) - 1])) {
+			$lastFilter = $filters[count($filters) - 1];
 		}
-		foreach($filters as $filter) {
-			if($lastFilter === $filter && count($foundItems) > 0) {
+		foreach ($filters as $filter) {
+			if ($lastFilter === $filter && count($foundItems) > 0) {
 				//skip when the filter is a wildcard and results were found
 				continue;
 			}
 			// 20k limit for performance and reason
 			$rr = $this->ldap->search($cr, $base, $filter, [$attr], 0, 20000);
-			if(!$this->ldap->isResource($rr)) {
+			if (!$this->ldap->isResource($rr)) {
 				continue;
 			}
 			$entries = $this->ldap->countEntries($cr, $rr);
 			$getEntryFunc = 'firstEntry';
-			if(($entries !== false) && ($entries > 0)) {
-				if(!is_null($maxF) && $entries > $maxEntries) {
+			if (($entries !== false) && ($entries > 0)) {
+				if (!is_null($maxF) && $entries > $maxEntries) {
 					$maxEntries = $entries;
 					$maxF = $filter;
 				}
@@ -1169,13 +1169,13 @@ 
 				do {
 					$entry = $this->ldap->$getEntryFunc($cr, $rr);
 					$getEntryFunc = 'nextEntry';
-					if(!$this->ldap->isResource($entry)) {
+					if (!$this->ldap->isResource($entry)) {
 						continue 2;
 					}
 					$rr = $entry; //will be expected by nextEntry next round
 					$attributes = $this->ldap->getAttributes($cr, $entry);
 					$dn = $this->ldap->getDN($cr, $entry);
-					if($dn === false || in_array($dn, $dnRead)) {
+					if ($dn === false || in_array($dn, $dnRead)) {
 						continue;
 					}
 					$newItems = [];
@@ -1186,7 +1186,7 @@ 
 					$foundItems = array_merge($foundItems, $newItems);
 					$this->resultCache[$dn][$attr] = $newItems;
 					$dnRead[] = $dn;
-				} while(($state === self::LRESULT_PROCESSED_SKIP
+				} while (($state === self::LRESULT_PROCESSED_SKIP
 						|| $this->ldap->isResource($entry))
 						&& ($dnReadLimit === 0 || $dnReadCount < $dnReadLimit));
 			}
@@ -1209,11 +1209,11 @@ 
 	 */
 	private function determineFeature($objectclasses, $attr, $dbkey, $confkey, $po = false) {
 		$cr = $this->getConnection();
-		if(!$cr) {
+		if (!$cr) {
 			throw new \Exception('Could not connect to LDAP');
 		}
 		$p = 'objectclass=';
-		foreach($objectclasses as $key => $value) {
+		foreach ($objectclasses as $key => $value) {
 			$objectclasses[$key] = $p.$value;
 		}
 		$maxEntryObjC = '';
@@ -1225,7 +1225,7 @@ 
 		$availableFeatures =
 			$this->cumulativeSearchOnAttribute($objectclasses, $attr,
 											   $dig, $maxEntryObjC);
-		if(is_array($availableFeatures)
+		if (is_array($availableFeatures)
 		   && count($availableFeatures) > 0) {
 			natcasesort($availableFeatures);
 			//natcasesort keeps indices, but we must get rid of them for proper
@@ -1236,7 +1236,7 @@ 
 		}
 
 		$setFeatures = $this->configuration->$confkey;
-		if(is_array($setFeatures) && !empty($setFeatures)) {
+		if (is_array($setFeatures) && !empty($setFeatures)) {
 			//something is already configured? pre-select it.
 			$this->result->addChange($dbkey, $setFeatures);
 		} else if ($po && $maxEntryObjC !== '') {
@@ -1258,7 +1258,7 @@ 
 	 * LRESULT_PROCESSED_INVALID or LRESULT_PROCESSED_SKIP
 	 */
 	private function getAttributeValuesFromEntry($result, $attribute, &$known) {
-		if(!is_array($result)
+		if (!is_array($result)
 		   || !isset($result['count'])
 		   || !$result['count'] > 0) {
 			return self::LRESULT_PROCESSED_INVALID;
@@ -1267,12 +1267,12 @@ 
 		// strtolower on all keys for proper comparison
 		$result = \OCP\Util::mb_array_change_key_case($result);
 		$attribute = strtolower($attribute);
-		if(isset($result[$attribute])) {
-			foreach($result[$attribute] as $key => $val) {
-				if($key === 'count') {
+		if (isset($result[$attribute])) {
+			foreach ($result[$attribute] as $key => $val) {
+				if ($key === 'count') {
 					continue;
 				}
-				if(!in_array($val, $known)) {
+				if (!in_array($val, $known)) {
 					$known[] = $val;
 				}
 			}
@@ -1286,7 +1286,7 @@ 
 	 * @return bool|mixed
 	 */
 	private function getConnection() {
-		if(!is_null($this->cr)) {
+		if (!is_null($this->cr)) {
 			return $this->cr;
 		}
 
@@ -1298,14 +1298,14 @@ 
 		$this->ldap->setOption($cr, LDAP_OPT_PROTOCOL_VERSION, 3);
 		$this->ldap->setOption($cr, LDAP_OPT_REFERRALS, 0);
 		$this->ldap->setOption($cr, LDAP_OPT_NETWORK_TIMEOUT, self::LDAP_NW_TIMEOUT);
-		if($this->configuration->ldapTLS === 1) {
+		if ($this->configuration->ldapTLS === 1) {
 			$this->ldap->startTls($cr);
 		}
 
 		$lo = @$this->ldap->bind($cr,
 								 $this->configuration->ldapAgentName,
 								 $this->configuration->ldapAgentPassword);
-		if($lo === true) {
+		if ($lo === true) {
 			$this->$cr = $cr;
 			return $cr;
 		}
@@ -1336,18 +1336,18 @@ 
 		//636 ← LDAPS / SSL
 		//7xxx ← UCS. need to be checked first, because both ports may be open
 		$host = $this->configuration->ldapHost;
-		$port = (int)$this->configuration->ldapPort;
+		$port = (int) $this->configuration->ldapPort;
 		$portSettings = [];
 
 		//In case the port is already provided, we will check this first
-		if($port > 0) {
+		if ($port > 0) {
 			$hostInfo = parse_url($host);
-			if(!(is_array($hostInfo)
+			if (!(is_array($hostInfo)
 				&& isset($hostInfo['scheme'])
 				&& stripos($hostInfo['scheme'], 'ldaps') !== false)) {
 				$portSettings[] = ['port' => $port, 'tls' => true];
 			}
-			$portSettings[] =['port' => $port, 'tls' => false];
+			$portSettings[] = ['port' => $port, 'tls' => false];
 		}
 
 		//default ports

apps/user_ldap/lib/GroupPluginManager.php

Indentation +139 added lines, -139 removed lines

@@ -27,143 +27,143 @@
 
 class GroupPluginManager {
 
-	private $respondToActions = 0;
-
-	private $which = [
-		GroupInterface::CREATE_GROUP => null,
-		GroupInterface::DELETE_GROUP => null,
-		GroupInterface::ADD_TO_GROUP => null,
-		GroupInterface::REMOVE_FROM_GROUP => null,
-		GroupInterface::COUNT_USERS => null,
-		GroupInterface::GROUP_DETAILS => null
-	];
-
-	/**
-	 * @return int All implemented actions
-	 */
-	public function getImplementedActions() {
-		return $this->respondToActions;
-	}
-
-	/**
-	 * Registers a group plugin that may implement some actions, overriding User_LDAP's group actions.
-	 * @param ILDAPGroupPlugin $plugin
-	 */
-	public function register(ILDAPGroupPlugin $plugin) {
-		$respondToActions = $plugin->respondToActions();
-		$this->respondToActions |= $respondToActions;
-
-		foreach($this->which as $action => $v) {
-			if ((bool)($respondToActions & $action)) {
-				$this->which[$action] = $plugin;
-				\OC::$server->getLogger()->debug("Registered action ".$action." to plugin ".get_class($plugin), ['app' => 'user_ldap']);
-			}
-		}
-	}
-
-	/**
-	 * Signal if there is a registered plugin that implements some given actions
-	 * @param int $actions Actions defined in \OCP\GroupInterface, like GroupInterface::REMOVE_FROM_GROUP
-	 * @return bool
-	 */
-	public function implementsActions($actions) {
-		return ($actions & $this->respondToActions) == $actions;
-	}
-
-	/**
-	 * Create a group
-	 * @param string $gid Group Id
-	 * @return string | null The group DN if group creation was successful.
-	 * @throws \Exception
-	 */
-	public function createGroup($gid) {
-		$plugin = $this->which[GroupInterface::CREATE_GROUP];
-
-		if ($plugin) {
-			return $plugin->createGroup($gid);
-		}
-		throw new \Exception('No plugin implements createGroup in this LDAP Backend.');
-	}
-
-	/**
-	 * Delete a group
-	 * @param string $gid Group Id of the group to delete
-	 * @return bool
-	 * @throws \Exception
-	 */
-	public function deleteGroup($gid) {
-		$plugin = $this->which[GroupInterface::DELETE_GROUP];
-
-		if ($plugin) {
-			return $plugin->deleteGroup($gid);
-		}
-		throw new \Exception('No plugin implements deleteGroup in this LDAP Backend.');
-	}
-
-	/**
-	 * Add a user to a group
-	 * @param string $uid ID of the user to add to group
-	 * @param string $gid ID of the group in which add the user
-	 * @return bool
-	 * @throws \Exception
-	 *
-	 * Adds a user to a group.
-	 */
-	public function addToGroup($uid, $gid) {
-		$plugin = $this->which[GroupInterface::ADD_TO_GROUP];
-
-		if ($plugin) {
-			return $plugin->addToGroup($uid, $gid);
-		}
-		throw new \Exception('No plugin implements addToGroup in this LDAP Backend.');
-	}
-
-	/**
-	 * Removes a user from a group
-	 * @param string $uid ID of the user to remove from group
-	 * @param string $gid ID of the group from which remove the user
-	 * @return bool
-	 * @throws \Exception
-	 *
-	 * removes the user from a group.
-	 */
-	public function removeFromGroup($uid, $gid) {
-		$plugin = $this->which[GroupInterface::REMOVE_FROM_GROUP];
-
-		if ($plugin) {
-			return $plugin->removeFromGroup($uid, $gid);
-		}
-		throw new \Exception('No plugin implements removeFromGroup in this LDAP Backend.');
-	}
-
-	/**
-	 * get the number of all users matching the search string in a group
-	 * @param string $gid ID of the group
-	 * @param string $search query string
-	 * @return int|false
-	 * @throws \Exception
-	 */
-	public function countUsersInGroup($gid, $search = '') {
-		$plugin = $this->which[GroupInterface::COUNT_USERS];
-
-		if ($plugin) {
-			return $plugin->countUsersInGroup($gid,$search);
-		}
-		throw new \Exception('No plugin implements countUsersInGroup in this LDAP Backend.');
-	}
-
-	/**
-	 * get an array with group details
-	 * @param string $gid
-	 * @return array|false
-	 * @throws \Exception
-	 */
-	public function getGroupDetails($gid) {
-		$plugin = $this->which[GroupInterface::GROUP_DETAILS];
-
-		if ($plugin) {
-			return $plugin->getGroupDetails($gid);
-		}
-		throw new \Exception('No plugin implements getGroupDetails in this LDAP Backend.');
-	}
+    private $respondToActions = 0;
+
+    private $which = [
+        GroupInterface::CREATE_GROUP => null,
+        GroupInterface::DELETE_GROUP => null,
+        GroupInterface::ADD_TO_GROUP => null,
+        GroupInterface::REMOVE_FROM_GROUP => null,
+        GroupInterface::COUNT_USERS => null,
+        GroupInterface::GROUP_DETAILS => null
+    ];
+
+    /**
+     * @return int All implemented actions
+     */
+    public function getImplementedActions() {
+        return $this->respondToActions;
+    }
+
+    /**
+     * Registers a group plugin that may implement some actions, overriding User_LDAP's group actions.
+     * @param ILDAPGroupPlugin $plugin
+     */
+    public function register(ILDAPGroupPlugin $plugin) {
+        $respondToActions = $plugin->respondToActions();
+        $this->respondToActions |= $respondToActions;
+
+        foreach($this->which as $action => $v) {
+            if ((bool)($respondToActions & $action)) {
+                $this->which[$action] = $plugin;
+                \OC::$server->getLogger()->debug("Registered action ".$action." to plugin ".get_class($plugin), ['app' => 'user_ldap']);
+            }
+        }
+    }
+
+    /**
+     * Signal if there is a registered plugin that implements some given actions
+     * @param int $actions Actions defined in \OCP\GroupInterface, like GroupInterface::REMOVE_FROM_GROUP
+     * @return bool
+     */
+    public function implementsActions($actions) {
+        return ($actions & $this->respondToActions) == $actions;
+    }
+
+    /**
+     * Create a group
+     * @param string $gid Group Id
+     * @return string | null The group DN if group creation was successful.
+     * @throws \Exception
+     */
+    public function createGroup($gid) {
+        $plugin = $this->which[GroupInterface::CREATE_GROUP];
+
+        if ($plugin) {
+            return $plugin->createGroup($gid);
+        }
+        throw new \Exception('No plugin implements createGroup in this LDAP Backend.');
+    }
+
+    /**
+     * Delete a group
+     * @param string $gid Group Id of the group to delete
+     * @return bool
+     * @throws \Exception
+     */
+    public function deleteGroup($gid) {
+        $plugin = $this->which[GroupInterface::DELETE_GROUP];
+
+        if ($plugin) {
+            return $plugin->deleteGroup($gid);
+        }
+        throw new \Exception('No plugin implements deleteGroup in this LDAP Backend.');
+    }
+
+    /**
+     * Add a user to a group
+     * @param string $uid ID of the user to add to group
+     * @param string $gid ID of the group in which add the user
+     * @return bool
+     * @throws \Exception
+     *
+     * Adds a user to a group.
+     */
+    public function addToGroup($uid, $gid) {
+        $plugin = $this->which[GroupInterface::ADD_TO_GROUP];
+
+        if ($plugin) {
+            return $plugin->addToGroup($uid, $gid);
+        }
+        throw new \Exception('No plugin implements addToGroup in this LDAP Backend.');
+    }
+
+    /**
+     * Removes a user from a group
+     * @param string $uid ID of the user to remove from group
+     * @param string $gid ID of the group from which remove the user
+     * @return bool
+     * @throws \Exception
+     *
+     * removes the user from a group.
+     */
+    public function removeFromGroup($uid, $gid) {
+        $plugin = $this->which[GroupInterface::REMOVE_FROM_GROUP];
+
+        if ($plugin) {
+            return $plugin->removeFromGroup($uid, $gid);
+        }
+        throw new \Exception('No plugin implements removeFromGroup in this LDAP Backend.');
+    }
+
+    /**
+     * get the number of all users matching the search string in a group
+     * @param string $gid ID of the group
+     * @param string $search query string
+     * @return int|false
+     * @throws \Exception
+     */
+    public function countUsersInGroup($gid, $search = '') {
+        $plugin = $this->which[GroupInterface::COUNT_USERS];
+
+        if ($plugin) {
+            return $plugin->countUsersInGroup($gid,$search);
+        }
+        throw new \Exception('No plugin implements countUsersInGroup in this LDAP Backend.');
+    }
+
+    /**
+     * get an array with group details
+     * @param string $gid
+     * @return array|false
+     * @throws \Exception
+     */
+    public function getGroupDetails($gid) {
+        $plugin = $this->which[GroupInterface::GROUP_DETAILS];
+
+        if ($plugin) {
+            return $plugin->getGroupDetails($gid);
+        }
+        throw new \Exception('No plugin implements getGroupDetails in this LDAP Backend.');
+    }
 }

apps/user_ldap/lib/Access.php

Indentation +2028 added lines, -2028 removed lines

@@ -63,1779 +63,1779 @@ 
  * @package OCA\User_LDAP
  */
 class Access extends LDAPUtility {
-	const UUID_ATTRIBUTES = ['entryuuid', 'nsuniqueid', 'objectguid', 'guid', 'ipauniqueid'];
-
-	/** @var \OCA\User_LDAP\Connection */
-	public $connection;
-	/** @var Manager */
-	public $userManager;
-	//never ever check this var directly, always use getPagedSearchResultState
-	protected $pagedSearchedSuccessful;
-
-	/**
-	 * @var string[] $cookies an array of returned Paged Result cookies
-	 */
-	protected $cookies = [];
-
-	/**
-	 * @var string $lastCookie the last cookie returned from a Paged Results
-	 * operation, defaults to an empty string
-	 */
-	protected $lastCookie = '';
-
-	/**
-	 * @var AbstractMapping $userMapper
-	 */
-	protected $userMapper;
-
-	/**
-	* @var AbstractMapping $userMapper
-	*/
-	protected $groupMapper;
-
-	/**
-	 * @var \OCA\User_LDAP\Helper
-	 */
-	private $helper;
-	/** @var IConfig */
-	private $config;
-	/** @var IUserManager */
-	private $ncUserManager;
-
-	public function __construct(
-		Connection $connection,
-		ILDAPWrapper $ldap,
-		Manager $userManager,
-		Helper $helper,
-		IConfig $config,
-		IUserManager $ncUserManager
-	) {
-		parent::__construct($ldap);
-		$this->connection = $connection;
-		$this->userManager = $userManager;
-		$this->userManager->setLdapAccess($this);
-		$this->helper = $helper;
-		$this->config = $config;
-		$this->ncUserManager = $ncUserManager;
-	}
-
-	/**
-	 * sets the User Mapper
-	 * @param AbstractMapping $mapper
-	 */
-	public function setUserMapper(AbstractMapping $mapper) {
-		$this->userMapper = $mapper;
-	}
-
-	/**
-	 * returns the User Mapper
-	 * @throws \Exception
-	 * @return AbstractMapping
-	 */
-	public function getUserMapper() {
-		if(is_null($this->userMapper)) {
-			throw new \Exception('UserMapper was not assigned to this Access instance.');
-		}
-		return $this->userMapper;
-	}
-
-	/**
-	 * sets the Group Mapper
-	 * @param AbstractMapping $mapper
-	 */
-	public function setGroupMapper(AbstractMapping $mapper) {
-		$this->groupMapper = $mapper;
-	}
-
-	/**
-	 * returns the Group Mapper
-	 * @throws \Exception
-	 * @return AbstractMapping
-	 */
-	public function getGroupMapper() {
-		if(is_null($this->groupMapper)) {
-			throw new \Exception('GroupMapper was not assigned to this Access instance.');
-		}
-		return $this->groupMapper;
-	}
-
-	/**
-	 * @return bool
-	 */
-	private function checkConnection() {
-		return ($this->connection instanceof Connection);
-	}
-
-	/**
-	 * returns the Connection instance
-	 * @return \OCA\User_LDAP\Connection
-	 */
-	public function getConnection() {
-		return $this->connection;
-	}
-
-	/**
-	 * reads a given attribute for an LDAP record identified by a DN
-	 *
-	 * @param string $dn the record in question
-	 * @param string $attr the attribute that shall be retrieved
-	 *        if empty, just check the record's existence
-	 * @param string $filter
-	 * @return array|false an array of values on success or an empty
-	 *          array if $attr is empty, false otherwise
-	 * @throws ServerNotAvailableException
-	 */
-	public function readAttribute($dn, $attr, $filter = 'objectClass=*') {
-		if(!$this->checkConnection()) {
-			\OCP\Util::writeLog('user_ldap',
-				'No LDAP Connector assigned, access impossible for readAttribute.',
-				ILogger::WARN);
-			return false;
-		}
-		$cr = $this->connection->getConnectionResource();
-		if(!$this->ldap->isResource($cr)) {
-			//LDAP not available
-			\OCP\Util::writeLog('user_ldap', 'LDAP resource not available.', ILogger::DEBUG);
-			return false;
-		}
-		//Cancel possibly running Paged Results operation, otherwise we run in
-		//LDAP protocol errors
-		$this->abandonPagedSearch();
-		// openLDAP requires that we init a new Paged Search. Not needed by AD,
-		// but does not hurt either.
-		$pagingSize = (int)$this->connection->ldapPagingSize;
-		// 0 won't result in replies, small numbers may leave out groups
-		// (cf. #12306), 500 is default for paging and should work everywhere.
-		$maxResults = $pagingSize > 20 ? $pagingSize : 500;
-		$attr = mb_strtolower($attr, 'UTF-8');
-		// the actual read attribute later may contain parameters on a ranged
-		// request, e.g. member;range=99-199. Depends on server reply.
-		$attrToRead = $attr;
-
-		$values = [];
-		$isRangeRequest = false;
-		do {
-			$result = $this->executeRead($cr, $dn, $attrToRead, $filter, $maxResults);
-			if(is_bool($result)) {
-				// when an exists request was run and it was successful, an empty
-				// array must be returned
-				return $result ? [] : false;
-			}
-
-			if (!$isRangeRequest) {
-				$values = $this->extractAttributeValuesFromResult($result, $attr);
-				if (!empty($values)) {
-					return $values;
-				}
-			}
-
-			$isRangeRequest = false;
-			$result = $this->extractRangeData($result, $attr);
-			if (!empty($result)) {
-				$normalizedResult = $this->extractAttributeValuesFromResult(
-					[ $attr => $result['values'] ],
-					$attr
-				);
-				$values = array_merge($values, $normalizedResult);
-
-				if($result['rangeHigh'] === '*') {
-					// when server replies with * as high range value, there are
-					// no more results left
-					return $values;
-				} else {
-					$low  = $result['rangeHigh'] + 1;
-					$attrToRead = $result['attributeName'] . ';range=' . $low . '-*';
-					$isRangeRequest = true;
-				}
-			}
-		} while($isRangeRequest);
-
-		\OCP\Util::writeLog('user_ldap', 'Requested attribute '.$attr.' not found for '.$dn, ILogger::DEBUG);
-		return false;
-	}
-
-	/**
-	 * Runs an read operation against LDAP
-	 *
-	 * @param resource $cr the LDAP connection
-	 * @param string $dn
-	 * @param string $attribute
-	 * @param string $filter
-	 * @param int $maxResults
-	 * @return array|bool false if there was any error, true if an exists check
-	 *                    was performed and the requested DN found, array with the
-	 *                    returned data on a successful usual operation
-	 * @throws ServerNotAvailableException
-	 */
-	public function executeRead($cr, $dn, $attribute, $filter, $maxResults) {
-		$this->initPagedSearch($filter, [$dn], [$attribute], $maxResults, 0);
-		$dn = $this->helper->DNasBaseParameter($dn);
-		$rr = @$this->invokeLDAPMethod('read', $cr, $dn, $filter, [$attribute]);
-		if (!$this->ldap->isResource($rr)) {
-			if ($attribute !== '') {
-				//do not throw this message on userExists check, irritates
-				\OCP\Util::writeLog('user_ldap', 'readAttribute failed for DN ' . $dn, ILogger::DEBUG);
-			}
-			//in case an error occurs , e.g. object does not exist
-			return false;
-		}
-		if ($attribute === '' && ($filter === 'objectclass=*' || $this->invokeLDAPMethod('countEntries', $cr, $rr) === 1)) {
-			\OCP\Util::writeLog('user_ldap', 'readAttribute: ' . $dn . ' found', ILogger::DEBUG);
-			return true;
-		}
-		$er = $this->invokeLDAPMethod('firstEntry', $cr, $rr);
-		if (!$this->ldap->isResource($er)) {
-			//did not match the filter, return false
-			return false;
-		}
-		//LDAP attributes are not case sensitive
-		$result = \OCP\Util::mb_array_change_key_case(
-			$this->invokeLDAPMethod('getAttributes', $cr, $er), MB_CASE_LOWER, 'UTF-8');
-
-		return $result;
-	}
-
-	/**
-	 * Normalizes a result grom getAttributes(), i.e. handles DNs and binary
-	 * data if present.
-	 *
-	 * @param array $result from ILDAPWrapper::getAttributes()
-	 * @param string $attribute the attribute name that was read
-	 * @return string[]
-	 */
-	public function extractAttributeValuesFromResult($result, $attribute) {
-		$values = [];
-		if(isset($result[$attribute]) && $result[$attribute]['count'] > 0) {
-			$lowercaseAttribute = strtolower($attribute);
-			for($i=0;$i<$result[$attribute]['count'];$i++) {
-				if($this->resemblesDN($attribute)) {
-					$values[] = $this->helper->sanitizeDN($result[$attribute][$i]);
-				} elseif($lowercaseAttribute === 'objectguid' || $lowercaseAttribute === 'guid') {
-					$values[] = $this->convertObjectGUID2Str($result[$attribute][$i]);
-				} else {
-					$values[] = $result[$attribute][$i];
-				}
-			}
-		}
-		return $values;
-	}
-
-	/**
-	 * Attempts to find ranged data in a getAttribute results and extracts the
-	 * returned values as well as information on the range and full attribute
-	 * name for further processing.
-	 *
-	 * @param array $result from ILDAPWrapper::getAttributes()
-	 * @param string $attribute the attribute name that was read. Without ";range=…"
-	 * @return array If a range was detected with keys 'values', 'attributeName',
-	 *               'attributeFull' and 'rangeHigh', otherwise empty.
-	 */
-	public function extractRangeData($result, $attribute) {
-		$keys = array_keys($result);
-		foreach($keys as $key) {
-			if($key !== $attribute && strpos($key, $attribute) === 0) {
-				$queryData = explode(';', $key);
-				if(strpos($queryData[1], 'range=') === 0) {
-					$high = substr($queryData[1], 1 + strpos($queryData[1], '-'));
-					$data = [
-						'values' => $result[$key],
-						'attributeName' => $queryData[0],
-						'attributeFull' => $key,
-						'rangeHigh' => $high,
-					];
-					return $data;
-				}
-			}
-		}
-		return [];
-	}
-
-	/**
-	 * Set password for an LDAP user identified by a DN
-	 *
-	 * @param string $userDN the user in question
-	 * @param string $password the new password
-	 * @return bool
-	 * @throws HintException
-	 * @throws \Exception
-	 */
-	public function setPassword($userDN, $password) {
-		if((int)$this->connection->turnOnPasswordChange !== 1) {
-			throw new \Exception('LDAP password changes are disabled.');
-		}
-		$cr = $this->connection->getConnectionResource();
-		if(!$this->ldap->isResource($cr)) {
-			//LDAP not available
-			\OCP\Util::writeLog('user_ldap', 'LDAP resource not available.', ILogger::DEBUG);
-			return false;
-		}
-		try {
-			// try PASSWD extended operation first
-			return @$this->invokeLDAPMethod('exopPasswd', $cr, $userDN, '', $password) ||
-						@$this->invokeLDAPMethod('modReplace', $cr, $userDN, $password);
-		} catch(ConstraintViolationException $e) {
-			throw new HintException('Password change rejected.', \OC::$server->getL10N('user_ldap')->t('Password change rejected. Hint: ').$e->getMessage(), $e->getCode());
-		}
-	}
-
-	/**
-	 * checks whether the given attributes value is probably a DN
-	 * @param string $attr the attribute in question
-	 * @return boolean if so true, otherwise false
-	 */
-	private function resemblesDN($attr) {
-		$resemblingAttributes = [
-			'dn',
-			'uniquemember',
-			'member',
-			// memberOf is an "operational" attribute, without a definition in any RFC
-			'memberof'
-		];
-		return in_array($attr, $resemblingAttributes);
-	}
-
-	/**
-	 * checks whether the given string is probably a DN
-	 * @param string $string
-	 * @return boolean
-	 */
-	public function stringResemblesDN($string) {
-		$r = $this->ldap->explodeDN($string, 0);
-		// if exploding a DN succeeds and does not end up in
-		// an empty array except for $r[count] being 0.
-		return (is_array($r) && count($r) > 1);
-	}
-
-	/**
-	 * returns a DN-string that is cleaned from not domain parts, e.g.
-	 * cn=foo,cn=bar,dc=foobar,dc=server,dc=org
-	 * becomes dc=foobar,dc=server,dc=org
-	 * @param string $dn
-	 * @return string
-	 */
-	public function getDomainDNFromDN($dn) {
-		$allParts = $this->ldap->explodeDN($dn, 0);
-		if($allParts === false) {
-			//not a valid DN
-			return '';
-		}
-		$domainParts = [];
-		$dcFound = false;
-		foreach($allParts as $part) {
-			if(!$dcFound && strpos($part, 'dc=') === 0) {
-				$dcFound = true;
-			}
-			if($dcFound) {
-				$domainParts[] = $part;
-			}
-		}
-		return implode(',', $domainParts);
-	}
-
-	/**
-	 * returns the LDAP DN for the given internal Nextcloud name of the group
-	 * @param string $name the Nextcloud name in question
-	 * @return string|false LDAP DN on success, otherwise false
-	 */
-	public function groupname2dn($name) {
-		return $this->groupMapper->getDNByName($name);
-	}
-
-	/**
-	 * returns the LDAP DN for the given internal Nextcloud name of the user
-	 * @param string $name the Nextcloud name in question
-	 * @return string|false with the LDAP DN on success, otherwise false
-	 */
-	public function username2dn($name) {
-		$fdn = $this->userMapper->getDNByName($name);
-
-		//Check whether the DN belongs to the Base, to avoid issues on multi-
-		//server setups
-		if(is_string($fdn) && $this->isDNPartOfBase($fdn, $this->connection->ldapBaseUsers)) {
-			return $fdn;
-		}
-
-		return false;
-	}
-
-	/**
-	 * returns the internal Nextcloud name for the given LDAP DN of the group, false on DN outside of search DN or failure
-	 *
-	 * @param string $fdn the dn of the group object
-	 * @param string $ldapName optional, the display name of the object
-	 * @return string|false with the name to use in Nextcloud, false on DN outside of search DN
-	 * @throws \Exception
-	 */
-	public function dn2groupname($fdn, $ldapName = null) {
-		//To avoid bypassing the base DN settings under certain circumstances
-		//with the group support, check whether the provided DN matches one of
-		//the given Bases
-		if(!$this->isDNPartOfBase($fdn, $this->connection->ldapBaseGroups)) {
-			return false;
-		}
-
-		return $this->dn2ocname($fdn, $ldapName, false);
-	}
-
-	/**
-	 * accepts an array of group DNs and tests whether they match the user
-	 * filter by doing read operations against the group entries. Returns an
-	 * array of DNs that match the filter.
-	 *
-	 * @param string[] $groupDNs
-	 * @return string[]
-	 * @throws ServerNotAvailableException
-	 */
-	public function groupsMatchFilter($groupDNs) {
-		$validGroupDNs = [];
-		foreach($groupDNs as $dn) {
-			$cacheKey = 'groupsMatchFilter-'.$dn;
-			$groupMatchFilter = $this->connection->getFromCache($cacheKey);
-			if(!is_null($groupMatchFilter)) {
-				if($groupMatchFilter) {
-					$validGroupDNs[] = $dn;
-				}
-				continue;
-			}
-
-			// Check the base DN first. If this is not met already, we don't
-			// need to ask the server at all.
-			if(!$this->isDNPartOfBase($dn, $this->connection->ldapBaseGroups)) {
-				$this->connection->writeToCache($cacheKey, false);
-				continue;
-			}
-
-			$result = $this->readAttribute($dn, '', $this->connection->ldapGroupFilter);
-			if(is_array($result)) {
-				$this->connection->writeToCache($cacheKey, true);
-				$validGroupDNs[] = $dn;
-			} else {
-				$this->connection->writeToCache($cacheKey, false);
-			}
-
-		}
-		return $validGroupDNs;
-	}
-
-	/**
-	 * returns the internal Nextcloud name for the given LDAP DN of the user, false on DN outside of search DN or failure
-	 *
-	 * @param string $dn the dn of the user object
-	 * @param string $ldapName optional, the display name of the object
-	 * @return string|false with with the name to use in Nextcloud
-	 * @throws \Exception
-	 */
-	public function dn2username($fdn, $ldapName = null) {
-		//To avoid bypassing the base DN settings under certain circumstances
-		//with the group support, check whether the provided DN matches one of
-		//the given Bases
-		if(!$this->isDNPartOfBase($fdn, $this->connection->ldapBaseUsers)) {
-			return false;
-		}
-
-		return $this->dn2ocname($fdn, $ldapName, true);
-	}
-
-	/**
-	 * returns an internal Nextcloud name for the given LDAP DN, false on DN outside of search DN
-	 *
-	 * @param string $fdn the dn of the user object
-	 * @param string|null $ldapName optional, the display name of the object
-	 * @param bool $isUser optional, whether it is a user object (otherwise group assumed)
-	 * @param bool|null $newlyMapped
-	 * @param array|null $record
-	 * @return false|string with with the name to use in Nextcloud
-	 * @throws \Exception
-	 */
-	public function dn2ocname($fdn, $ldapName = null, $isUser = true, &$newlyMapped = null, array $record = null) {
-		$newlyMapped = false;
-		if($isUser) {
-			$mapper = $this->getUserMapper();
-			$nameAttribute = $this->connection->ldapUserDisplayName;
-			$filter = $this->connection->ldapUserFilter;
-		} else {
-			$mapper = $this->getGroupMapper();
-			$nameAttribute = $this->connection->ldapGroupDisplayName;
-			$filter = $this->connection->ldapGroupFilter;
-		}
-
-		//let's try to retrieve the Nextcloud name from the mappings table
-		$ncName = $mapper->getNameByDN($fdn);
-		if(is_string($ncName)) {
-			return $ncName;
-		}
-
-		//second try: get the UUID and check if it is known. Then, update the DN and return the name.
-		$uuid = $this->getUUID($fdn, $isUser, $record);
-		if(is_string($uuid)) {
-			$ncName = $mapper->getNameByUUID($uuid);
-			if(is_string($ncName)) {
-				$mapper->setDNbyUUID($fdn, $uuid);
-				return $ncName;
-			}
-		} else {
-			//If the UUID can't be detected something is foul.
-			\OCP\Util::writeLog('user_ldap', 'Cannot determine UUID for '.$fdn.'. Skipping.', ILogger::INFO);
-			return false;
-		}
-
-		if(is_null($ldapName)) {
-			$ldapName = $this->readAttribute($fdn, $nameAttribute, $filter);
-			if(!isset($ldapName[0]) && empty($ldapName[0])) {
-				\OCP\Util::writeLog('user_ldap', 'No or empty name for '.$fdn.' with filter '.$filter.'.', ILogger::INFO);
-				return false;
-			}
-			$ldapName = $ldapName[0];
-		}
-
-		if($isUser) {
-			$usernameAttribute = (string)$this->connection->ldapExpertUsernameAttr;
-			if ($usernameAttribute !== '') {
-				$username = $this->readAttribute($fdn, $usernameAttribute);
-				$username = $username[0];
-			} else {
-				$username = $uuid;
-			}
-			try {
-				$intName = $this->sanitizeUsername($username);
-			} catch (\InvalidArgumentException $e) {
-				\OC::$server->getLogger()->logException($e, [
-					'app' => 'user_ldap',
-					'level' => ILogger::WARN,
-				]);
-				// we don't attempt to set a username here. We can go for
-				// for an alternative 4 digit random number as we would append
-				// otherwise, however it's likely not enough space in bigger
-				// setups, and most importantly: this is not intended.
-				return false;
-			}
-		} else {
-			$intName = $ldapName;
-		}
-
-		//a new user/group! Add it only if it doesn't conflict with other backend's users or existing groups
-		//disabling Cache is required to avoid that the new user is cached as not-existing in fooExists check
-		//NOTE: mind, disabling cache affects only this instance! Using it
-		// outside of core user management will still cache the user as non-existing.
-		$originalTTL = $this->connection->ldapCacheTTL;
-		$this->connection->setConfiguration(['ldapCacheTTL' => 0]);
-		if( $intName !== ''
-			&& (($isUser && !$this->ncUserManager->userExists($intName))
-				|| (!$isUser && !\OC::$server->getGroupManager()->groupExists($intName))
-			)
-		) {
-			$this->connection->setConfiguration(['ldapCacheTTL' => $originalTTL]);
-			$newlyMapped = $this->mapAndAnnounceIfApplicable($mapper, $fdn, $intName, $uuid, $isUser);
-			if($newlyMapped) {
-				return $intName;
-			}
-		}
-
-		$this->connection->setConfiguration(['ldapCacheTTL' => $originalTTL]);
-		$altName = $this->createAltInternalOwnCloudName($intName, $isUser);
-		if (is_string($altName)) {
-			if($this->mapAndAnnounceIfApplicable($mapper, $fdn, $altName, $uuid, $isUser)) {
-				$newlyMapped = true;
-				return $altName;
-			}
-		}
-
-		//if everything else did not help..
-		\OCP\Util::writeLog('user_ldap', 'Could not create unique name for '.$fdn.'.', ILogger::INFO);
-		return false;
-	}
-
-	public function mapAndAnnounceIfApplicable(
-		AbstractMapping $mapper,
-		string $fdn,
-		string $name,
-		string $uuid,
-		bool $isUser
-	) :bool {
-		if($mapper->map($fdn, $name, $uuid)) {
-			if ($this->ncUserManager instanceof PublicEmitter && $isUser) {
-				$this->cacheUserExists($name);
-				$this->ncUserManager->emit('\OC\User', 'assignedUserId', [$name]);
-			} elseif (!$isUser) {
-				$this->cacheGroupExists($name);
-			}
-			return true;
-		}
-		return false;
-	}
-
-	/**
-	 * gives back the user names as they are used ownClod internally
-	 *
-	 * @param array $ldapUsers as returned by fetchList()
-	 * @return array an array with the user names to use in Nextcloud
-	 *
-	 * gives back the user names as they are used ownClod internally
-	 * @throws \Exception
-	 */
-	public function nextcloudUserNames($ldapUsers) {
-		return $this->ldap2NextcloudNames($ldapUsers, true);
-	}
-
-	/**
-	 * gives back the group names as they are used ownClod internally
-	 *
-	 * @param array $ldapGroups as returned by fetchList()
-	 * @return array an array with the group names to use in Nextcloud
-	 *
-	 * gives back the group names as they are used ownClod internally
-	 * @throws \Exception
-	 */
-	public function nextcloudGroupNames($ldapGroups) {
-		return $this->ldap2NextcloudNames($ldapGroups, false);
-	}
-
-	/**
-	 * @param array $ldapObjects as returned by fetchList()
-	 * @param bool $isUsers
-	 * @return array
-	 * @throws \Exception
-	 */
-	private function ldap2NextcloudNames($ldapObjects, $isUsers) {
-		if($isUsers) {
-			$nameAttribute = $this->connection->ldapUserDisplayName;
-			$sndAttribute  = $this->connection->ldapUserDisplayName2;
-		} else {
-			$nameAttribute = $this->connection->ldapGroupDisplayName;
-		}
-		$nextcloudNames = [];
-
-		foreach($ldapObjects as $ldapObject) {
-			$nameByLDAP = null;
-			if(    isset($ldapObject[$nameAttribute])
-				&& is_array($ldapObject[$nameAttribute])
-				&& isset($ldapObject[$nameAttribute][0])
-			) {
-				// might be set, but not necessarily. if so, we use it.
-				$nameByLDAP = $ldapObject[$nameAttribute][0];
-			}
-
-			$ncName = $this->dn2ocname($ldapObject['dn'][0], $nameByLDAP, $isUsers);
-			if($ncName) {
-				$nextcloudNames[] = $ncName;
-				if($isUsers) {
-					$this->updateUserState($ncName);
-					//cache the user names so it does not need to be retrieved
-					//again later (e.g. sharing dialogue).
-					if(is_null($nameByLDAP)) {
-						continue;
-					}
-					$sndName = isset($ldapObject[$sndAttribute][0])
-						? $ldapObject[$sndAttribute][0] : '';
-					$this->cacheUserDisplayName($ncName, $nameByLDAP, $sndName);
-				} else if($nameByLDAP !== null) {
-					$this->cacheGroupDisplayName($ncName, $nameByLDAP);
-				}
-			}
-		}
-		return $nextcloudNames;
-	}
-
-	/**
-	 * removes the deleted-flag of a user if it was set
-	 *
-	 * @param string $ncname
-	 * @throws \Exception
-	 */
-	public function updateUserState($ncname) {
-		$user = $this->userManager->get($ncname);
-		if($user instanceof OfflineUser) {
-			$user->unmark();
-		}
-	}
-
-	/**
-	 * caches the user display name
-	 * @param string $ocName the internal Nextcloud username
-	 * @param string|false $home the home directory path
-	 */
-	public function cacheUserHome($ocName, $home) {
-		$cacheKey = 'getHome'.$ocName;
-		$this->connection->writeToCache($cacheKey, $home);
-	}
-
-	/**
-	 * caches a user as existing
-	 * @param string $ocName the internal Nextcloud username
-	 */
-	public function cacheUserExists($ocName) {
-		$this->connection->writeToCache('userExists'.$ocName, true);
-	}
-
-	/**
-	 * caches a group as existing
-	 */
-	public function cacheGroupExists(string $gid): void {
-		$this->connection->writeToCache('groupExists'.$gid, true);
-	}
-
-	/**
-	 * caches the user display name
-	 *
-	 * @param string $ocName the internal Nextcloud username
-	 * @param string $displayName the display name
-	 * @param string $displayName2 the second display name
-	 * @throws \Exception
-	 */
-	public function cacheUserDisplayName($ocName, $displayName, $displayName2 = '') {
-		$user = $this->userManager->get($ocName);
-		if($user === null) {
-			return;
-		}
-		$displayName = $user->composeAndStoreDisplayName($displayName, $displayName2);
-		$cacheKeyTrunk = 'getDisplayName';
-		$this->connection->writeToCache($cacheKeyTrunk.$ocName, $displayName);
-	}
-
-	public function cacheGroupDisplayName(string $ncName, string $displayName): void {
-		$cacheKey = 'group_getDisplayName' . $ncName;
-		$this->connection->writeToCache($cacheKey, $displayName);
-	}
-
-	/**
-	 * creates a unique name for internal Nextcloud use for users. Don't call it directly.
-	 * @param string $name the display name of the object
-	 * @return string|false with with the name to use in Nextcloud or false if unsuccessful
-	 *
-	 * Instead of using this method directly, call
-	 * createAltInternalOwnCloudName($name, true)
-	 */
-	private function _createAltInternalOwnCloudNameForUsers($name) {
-		$attempts = 0;
-		//while loop is just a precaution. If a name is not generated within
-		//20 attempts, something else is very wrong. Avoids infinite loop.
-		while($attempts < 20){
-			$altName = $name . '_' . rand(1000,9999);
-			if(!$this->ncUserManager->userExists($altName)) {
-				return $altName;
-			}
-			$attempts++;
-		}
-		return false;
-	}
-
-	/**
-	 * creates a unique name for internal Nextcloud use for groups. Don't call it directly.
-	 * @param string $name the display name of the object
-	 * @return string|false with with the name to use in Nextcloud or false if unsuccessful.
-	 *
-	 * Instead of using this method directly, call
-	 * createAltInternalOwnCloudName($name, false)
-	 *
-	 * Group names are also used as display names, so we do a sequential
-	 * numbering, e.g. Developers_42 when there are 41 other groups called
-	 * "Developers"
-	 */
-	private function _createAltInternalOwnCloudNameForGroups($name) {
-		$usedNames = $this->groupMapper->getNamesBySearch($name, "", '_%');
-		if(!$usedNames || count($usedNames) === 0) {
-			$lastNo = 1; //will become name_2
-		} else {
-			natsort($usedNames);
-			$lastName = array_pop($usedNames);
-			$lastNo = (int)substr($lastName, strrpos($lastName, '_') + 1);
-		}
-		$altName = $name.'_'. (string)($lastNo+1);
-		unset($usedNames);
-
-		$attempts = 1;
-		while($attempts < 21){
-			// Check to be really sure it is unique
-			// while loop is just a precaution. If a name is not generated within
-			// 20 attempts, something else is very wrong. Avoids infinite loop.
-			if(!\OC::$server->getGroupManager()->groupExists($altName)) {
-				return $altName;
-			}
-			$altName = $name . '_' . ($lastNo + $attempts);
-			$attempts++;
-		}
-		return false;
-	}
-
-	/**
-	 * creates a unique name for internal Nextcloud use.
-	 * @param string $name the display name of the object
-	 * @param boolean $isUser whether name should be created for a user (true) or a group (false)
-	 * @return string|false with with the name to use in Nextcloud or false if unsuccessful
-	 */
-	private function createAltInternalOwnCloudName($name, $isUser) {
-		$originalTTL = $this->connection->ldapCacheTTL;
-		$this->connection->setConfiguration(['ldapCacheTTL' => 0]);
-		if($isUser) {
-			$altName = $this->_createAltInternalOwnCloudNameForUsers($name);
-		} else {
-			$altName = $this->_createAltInternalOwnCloudNameForGroups($name);
-		}
-		$this->connection->setConfiguration(['ldapCacheTTL' => $originalTTL]);
-
-		return $altName;
-	}
-
-	/**
-	 * fetches a list of users according to a provided loginName and utilizing
-	 * the login filter.
-	 *
-	 * @param string $loginName
-	 * @param array $attributes optional, list of attributes to read
-	 * @return array
-	 */
-	public function fetchUsersByLoginName($loginName, $attributes = ['dn']) {
-		$loginName = $this->escapeFilterPart($loginName);
-		$filter = str_replace('%uid', $loginName, $this->connection->ldapLoginFilter);
-		return $this->fetchListOfUsers($filter, $attributes);
-	}
-
-	/**
-	 * counts the number of users according to a provided loginName and
-	 * utilizing the login filter.
-	 *
-	 * @param string $loginName
-	 * @return int
-	 */
-	public function countUsersByLoginName($loginName) {
-		$loginName = $this->escapeFilterPart($loginName);
-		$filter = str_replace('%uid', $loginName, $this->connection->ldapLoginFilter);
-		return $this->countUsers($filter);
-	}
-
-	/**
-	 * @param string $filter
-	 * @param string|string[] $attr
-	 * @param int $limit
-	 * @param int $offset
-	 * @param bool $forceApplyAttributes
-	 * @return array
-	 * @throws \Exception
-	 */
-	public function fetchListOfUsers($filter, $attr, $limit = null, $offset = null, $forceApplyAttributes = false) {
-		$ldapRecords = $this->searchUsers($filter, $attr, $limit, $offset);
-		$recordsToUpdate = $ldapRecords;
-		if(!$forceApplyAttributes) {
-			$isBackgroundJobModeAjax = $this->config
-					->getAppValue('core', 'backgroundjobs_mode', 'ajax') === 'ajax';
-			$recordsToUpdate = array_filter($ldapRecords, function($record) use ($isBackgroundJobModeAjax) {
-				$newlyMapped = false;
-				$uid = $this->dn2ocname($record['dn'][0], null, true, $newlyMapped, $record);
-				if(is_string($uid)) {
-					$this->cacheUserExists($uid);
-				}
-				return ($uid !== false) && ($newlyMapped || $isBackgroundJobModeAjax);
-			});
-		}
-		$this->batchApplyUserAttributes($recordsToUpdate);
-		return $this->fetchList($ldapRecords, $this->manyAttributes($attr));
-	}
-
-	/**
-	 * provided with an array of LDAP user records the method will fetch the
-	 * user object and requests it to process the freshly fetched attributes and
-	 * and their values
-	 *
-	 * @param array $ldapRecords
-	 * @throws \Exception
-	 */
-	public function batchApplyUserAttributes(array $ldapRecords){
-		$displayNameAttribute = strtolower($this->connection->ldapUserDisplayName);
-		foreach($ldapRecords as $userRecord) {
-			if(!isset($userRecord[$displayNameAttribute])) {
-				// displayName is obligatory
-				continue;
-			}
-			$ocName  = $this->dn2ocname($userRecord['dn'][0], null, true);
-			if($ocName === false) {
-				continue;
-			}
-			$this->updateUserState($ocName);
-			$user = $this->userManager->get($ocName);
-			if ($user !== null) {
-				$user->processAttributes($userRecord);
-			} else {
-				\OC::$server->getLogger()->debug(
-					"The ldap user manager returned null for $ocName",
-					['app'=>'user_ldap']
-				);
-			}
-		}
-	}
-
-	/**
-	 * @param string $filter
-	 * @param string|string[] $attr
-	 * @param int $limit
-	 * @param int $offset
-	 * @return array
-	 */
-	public function fetchListOfGroups($filter, $attr, $limit = null, $offset = null) {
-		$groupRecords = $this->searchGroups($filter, $attr, $limit, $offset);
-		array_walk($groupRecords, function($record) {
-			$newlyMapped = false;
-			$gid = $this->dn2ocname($record['dn'][0], null, false, $newlyMapped, $record);
-			if(!$newlyMapped && is_string($gid)) {
-				$this->cacheGroupExists($gid);
-			}
-		});
-		return $this->fetchList($groupRecords, $this->manyAttributes($attr));
-	}
-
-	/**
-	 * @param array $list
-	 * @param bool $manyAttributes
-	 * @return array
-	 */
-	private function fetchList($list, $manyAttributes) {
-		if(is_array($list)) {
-			if($manyAttributes) {
-				return $list;
-			} else {
-				$list = array_reduce($list, function($carry, $item) {
-					$attribute = array_keys($item)[0];
-					$carry[] = $item[$attribute][0];
-					return $carry;
-				}, []);
-				return array_unique($list, SORT_LOCALE_STRING);
-			}
-		}
-
-		//error cause actually, maybe throw an exception in future.
-		return [];
-	}
-
-	/**
-	 * executes an LDAP search, optimized for Users
-	 *
-	 * @param string $filter the LDAP filter for the search
-	 * @param string|string[] $attr optional, when a certain attribute shall be filtered out
-	 * @param integer $limit
-	 * @param integer $offset
-	 * @return array with the search result
-	 *
-	 * Executes an LDAP search
-	 * @throws ServerNotAvailableException
-	 */
-	public function searchUsers($filter, $attr = null, $limit = null, $offset = null) {
-		$result = [];
-		foreach($this->connection->ldapBaseUsers as $base) {
-			$result = array_merge($result, $this->search($filter, [$base], $attr, $limit, $offset));
-		}
-		return $result;
-	}
-
-	/**
-	 * @param string $filter
-	 * @param string|string[] $attr
-	 * @param int $limit
-	 * @param int $offset
-	 * @return false|int
-	 * @throws ServerNotAvailableException
-	 */
-	public function countUsers($filter, $attr = ['dn'], $limit = null, $offset = null) {
-		$result = false;
-		foreach($this->connection->ldapBaseUsers as $base) {
-			$count = $this->count($filter, [$base], $attr, $limit, $offset);
-			$result = is_int($count) ? (int)$result + $count : $result;
-		}
-		return $result;
-	}
-
-	/**
-	 * executes an LDAP search, optimized for Groups
-	 *
-	 * @param string $filter the LDAP filter for the search
-	 * @param string|string[] $attr optional, when a certain attribute shall be filtered out
-	 * @param integer $limit
-	 * @param integer $offset
-	 * @return array with the search result
-	 *
-	 * Executes an LDAP search
-	 * @throws ServerNotAvailableException
-	 */
-	public function searchGroups($filter, $attr = null, $limit = null, $offset = null) {
-		$result = [];
-		foreach($this->connection->ldapBaseGroups as $base) {
-			$result = array_merge($result, $this->search($filter, [$base], $attr, $limit, $offset));
-		}
-		return $result;
-	}
-
-	/**
-	 * returns the number of available groups
-	 *
-	 * @param string $filter the LDAP search filter
-	 * @param string[] $attr optional
-	 * @param int|null $limit
-	 * @param int|null $offset
-	 * @return int|bool
-	 * @throws ServerNotAvailableException
-	 */
-	public function countGroups($filter, $attr = ['dn'], $limit = null, $offset = null) {
-		$result = false;
-		foreach($this->connection->ldapBaseGroups as $base) {
-			$count = $this->count($filter, [$base], $attr, $limit, $offset);
-			$result = is_int($count) ? (int)$result + $count : $result;
-		}
-		return $result;
-	}
-
-	/**
-	 * returns the number of available objects on the base DN
-	 *
-	 * @param int|null $limit
-	 * @param int|null $offset
-	 * @return int|bool
-	 * @throws ServerNotAvailableException
-	 */
-	public function countObjects($limit = null, $offset = null) {
-		$result = false;
-		foreach($this->connection->ldapBase as $base) {
-			$count = $this->count('objectclass=*', [$base], ['dn'], $limit, $offset);
-			$result = is_int($count) ? (int)$result + $count : $result;
-		}
-		return $result;
-	}
-
-	/**
-	 * Returns the LDAP handler
-	 * @throws \OC\ServerNotAvailableException
-	 */
-
-	/**
-	 * @return mixed
-	 * @throws \OC\ServerNotAvailableException
-	 */
-	private function invokeLDAPMethod() {
-		$arguments = func_get_args();
-		$command = array_shift($arguments);
-		$cr = array_shift($arguments);
-		if (!method_exists($this->ldap, $command)) {
-			return null;
-		}
-		array_unshift($arguments, $cr);
-		// php no longer supports call-time pass-by-reference
-		// thus cannot support controlPagedResultResponse as the third argument
-		// is a reference
-		$doMethod = function () use ($command, &$arguments) {
-			if ($command == 'controlPagedResultResponse') {
-				throw new \InvalidArgumentException('Invoker does not support controlPagedResultResponse, call LDAP Wrapper directly instead.');
-			} else {
-				return call_user_func_array([$this->ldap, $command], $arguments);
-			}
-		};
-		try {
-			$ret = $doMethod();
-		} catch (ServerNotAvailableException $e) {
-			/* Server connection lost, attempt to reestablish it
+    const UUID_ATTRIBUTES = ['entryuuid', 'nsuniqueid', 'objectguid', 'guid', 'ipauniqueid'];
+
+    /** @var \OCA\User_LDAP\Connection */
+    public $connection;
+    /** @var Manager */
+    public $userManager;
+    //never ever check this var directly, always use getPagedSearchResultState
+    protected $pagedSearchedSuccessful;
+
+    /**
+     * @var string[] $cookies an array of returned Paged Result cookies
+     */
+    protected $cookies = [];
+
+    /**
+     * @var string $lastCookie the last cookie returned from a Paged Results
+     * operation, defaults to an empty string
+     */
+    protected $lastCookie = '';
+
+    /**
+     * @var AbstractMapping $userMapper
+     */
+    protected $userMapper;
+
+    /**
+     * @var AbstractMapping $userMapper
+     */
+    protected $groupMapper;
+
+    /**
+     * @var \OCA\User_LDAP\Helper
+     */
+    private $helper;
+    /** @var IConfig */
+    private $config;
+    /** @var IUserManager */
+    private $ncUserManager;
+
+    public function __construct(
+        Connection $connection,
+        ILDAPWrapper $ldap,
+        Manager $userManager,
+        Helper $helper,
+        IConfig $config,
+        IUserManager $ncUserManager
+    ) {
+        parent::__construct($ldap);
+        $this->connection = $connection;
+        $this->userManager = $userManager;
+        $this->userManager->setLdapAccess($this);
+        $this->helper = $helper;
+        $this->config = $config;
+        $this->ncUserManager = $ncUserManager;
+    }
+
+    /**
+     * sets the User Mapper
+     * @param AbstractMapping $mapper
+     */
+    public function setUserMapper(AbstractMapping $mapper) {
+        $this->userMapper = $mapper;
+    }
+
+    /**
+     * returns the User Mapper
+     * @throws \Exception
+     * @return AbstractMapping
+     */
+    public function getUserMapper() {
+        if(is_null($this->userMapper)) {
+            throw new \Exception('UserMapper was not assigned to this Access instance.');
+        }
+        return $this->userMapper;
+    }
+
+    /**
+     * sets the Group Mapper
+     * @param AbstractMapping $mapper
+     */
+    public function setGroupMapper(AbstractMapping $mapper) {
+        $this->groupMapper = $mapper;
+    }
+
+    /**
+     * returns the Group Mapper
+     * @throws \Exception
+     * @return AbstractMapping
+     */
+    public function getGroupMapper() {
+        if(is_null($this->groupMapper)) {
+            throw new \Exception('GroupMapper was not assigned to this Access instance.');
+        }
+        return $this->groupMapper;
+    }
+
+    /**
+     * @return bool
+     */
+    private function checkConnection() {
+        return ($this->connection instanceof Connection);
+    }
+
+    /**
+     * returns the Connection instance
+     * @return \OCA\User_LDAP\Connection
+     */
+    public function getConnection() {
+        return $this->connection;
+    }
+
+    /**
+     * reads a given attribute for an LDAP record identified by a DN
+     *
+     * @param string $dn the record in question
+     * @param string $attr the attribute that shall be retrieved
+     *        if empty, just check the record's existence
+     * @param string $filter
+     * @return array|false an array of values on success or an empty
+     *          array if $attr is empty, false otherwise
+     * @throws ServerNotAvailableException
+     */
+    public function readAttribute($dn, $attr, $filter = 'objectClass=*') {
+        if(!$this->checkConnection()) {
+            \OCP\Util::writeLog('user_ldap',
+                'No LDAP Connector assigned, access impossible for readAttribute.',
+                ILogger::WARN);
+            return false;
+        }
+        $cr = $this->connection->getConnectionResource();
+        if(!$this->ldap->isResource($cr)) {
+            //LDAP not available
+            \OCP\Util::writeLog('user_ldap', 'LDAP resource not available.', ILogger::DEBUG);
+            return false;
+        }
+        //Cancel possibly running Paged Results operation, otherwise we run in
+        //LDAP protocol errors
+        $this->abandonPagedSearch();
+        // openLDAP requires that we init a new Paged Search. Not needed by AD,
+        // but does not hurt either.
+        $pagingSize = (int)$this->connection->ldapPagingSize;
+        // 0 won't result in replies, small numbers may leave out groups
+        // (cf. #12306), 500 is default for paging and should work everywhere.
+        $maxResults = $pagingSize > 20 ? $pagingSize : 500;
+        $attr = mb_strtolower($attr, 'UTF-8');
+        // the actual read attribute later may contain parameters on a ranged
+        // request, e.g. member;range=99-199. Depends on server reply.
+        $attrToRead = $attr;
+
+        $values = [];
+        $isRangeRequest = false;
+        do {
+            $result = $this->executeRead($cr, $dn, $attrToRead, $filter, $maxResults);
+            if(is_bool($result)) {
+                // when an exists request was run and it was successful, an empty
+                // array must be returned
+                return $result ? [] : false;
+            }
+
+            if (!$isRangeRequest) {
+                $values = $this->extractAttributeValuesFromResult($result, $attr);
+                if (!empty($values)) {
+                    return $values;
+                }
+            }
+
+            $isRangeRequest = false;
+            $result = $this->extractRangeData($result, $attr);
+            if (!empty($result)) {
+                $normalizedResult = $this->extractAttributeValuesFromResult(
+                    [ $attr => $result['values'] ],
+                    $attr
+                );
+                $values = array_merge($values, $normalizedResult);
+
+                if($result['rangeHigh'] === '*') {
+                    // when server replies with * as high range value, there are
+                    // no more results left
+                    return $values;
+                } else {
+                    $low  = $result['rangeHigh'] + 1;
+                    $attrToRead = $result['attributeName'] . ';range=' . $low . '-*';
+                    $isRangeRequest = true;
+                }
+            }
+        } while($isRangeRequest);
+
+        \OCP\Util::writeLog('user_ldap', 'Requested attribute '.$attr.' not found for '.$dn, ILogger::DEBUG);
+        return false;
+    }
+
+    /**
+     * Runs an read operation against LDAP
+     *
+     * @param resource $cr the LDAP connection
+     * @param string $dn
+     * @param string $attribute
+     * @param string $filter
+     * @param int $maxResults
+     * @return array|bool false if there was any error, true if an exists check
+     *                    was performed and the requested DN found, array with the
+     *                    returned data on a successful usual operation
+     * @throws ServerNotAvailableException
+     */
+    public function executeRead($cr, $dn, $attribute, $filter, $maxResults) {
+        $this->initPagedSearch($filter, [$dn], [$attribute], $maxResults, 0);
+        $dn = $this->helper->DNasBaseParameter($dn);
+        $rr = @$this->invokeLDAPMethod('read', $cr, $dn, $filter, [$attribute]);
+        if (!$this->ldap->isResource($rr)) {
+            if ($attribute !== '') {
+                //do not throw this message on userExists check, irritates
+                \OCP\Util::writeLog('user_ldap', 'readAttribute failed for DN ' . $dn, ILogger::DEBUG);
+            }
+            //in case an error occurs , e.g. object does not exist
+            return false;
+        }
+        if ($attribute === '' && ($filter === 'objectclass=*' || $this->invokeLDAPMethod('countEntries', $cr, $rr) === 1)) {
+            \OCP\Util::writeLog('user_ldap', 'readAttribute: ' . $dn . ' found', ILogger::DEBUG);
+            return true;
+        }
+        $er = $this->invokeLDAPMethod('firstEntry', $cr, $rr);
+        if (!$this->ldap->isResource($er)) {
+            //did not match the filter, return false
+            return false;
+        }
+        //LDAP attributes are not case sensitive
+        $result = \OCP\Util::mb_array_change_key_case(
+            $this->invokeLDAPMethod('getAttributes', $cr, $er), MB_CASE_LOWER, 'UTF-8');
+
+        return $result;
+    }
+
+    /**
+     * Normalizes a result grom getAttributes(), i.e. handles DNs and binary
+     * data if present.
+     *
+     * @param array $result from ILDAPWrapper::getAttributes()
+     * @param string $attribute the attribute name that was read
+     * @return string[]
+     */
+    public function extractAttributeValuesFromResult($result, $attribute) {
+        $values = [];
+        if(isset($result[$attribute]) && $result[$attribute]['count'] > 0) {
+            $lowercaseAttribute = strtolower($attribute);
+            for($i=0;$i<$result[$attribute]['count'];$i++) {
+                if($this->resemblesDN($attribute)) {
+                    $values[] = $this->helper->sanitizeDN($result[$attribute][$i]);
+                } elseif($lowercaseAttribute === 'objectguid' || $lowercaseAttribute === 'guid') {
+                    $values[] = $this->convertObjectGUID2Str($result[$attribute][$i]);
+                } else {
+                    $values[] = $result[$attribute][$i];
+                }
+            }
+        }
+        return $values;
+    }
+
+    /**
+     * Attempts to find ranged data in a getAttribute results and extracts the
+     * returned values as well as information on the range and full attribute
+     * name for further processing.
+     *
+     * @param array $result from ILDAPWrapper::getAttributes()
+     * @param string $attribute the attribute name that was read. Without ";range=…"
+     * @return array If a range was detected with keys 'values', 'attributeName',
+     *               'attributeFull' and 'rangeHigh', otherwise empty.
+     */
+    public function extractRangeData($result, $attribute) {
+        $keys = array_keys($result);
+        foreach($keys as $key) {
+            if($key !== $attribute && strpos($key, $attribute) === 0) {
+                $queryData = explode(';', $key);
+                if(strpos($queryData[1], 'range=') === 0) {
+                    $high = substr($queryData[1], 1 + strpos($queryData[1], '-'));
+                    $data = [
+                        'values' => $result[$key],
+                        'attributeName' => $queryData[0],
+                        'attributeFull' => $key,
+                        'rangeHigh' => $high,
+                    ];
+                    return $data;
+                }
+            }
+        }
+        return [];
+    }
+
+    /**
+     * Set password for an LDAP user identified by a DN
+     *
+     * @param string $userDN the user in question
+     * @param string $password the new password
+     * @return bool
+     * @throws HintException
+     * @throws \Exception
+     */
+    public function setPassword($userDN, $password) {
+        if((int)$this->connection->turnOnPasswordChange !== 1) {
+            throw new \Exception('LDAP password changes are disabled.');
+        }
+        $cr = $this->connection->getConnectionResource();
+        if(!$this->ldap->isResource($cr)) {
+            //LDAP not available
+            \OCP\Util::writeLog('user_ldap', 'LDAP resource not available.', ILogger::DEBUG);
+            return false;
+        }
+        try {
+            // try PASSWD extended operation first
+            return @$this->invokeLDAPMethod('exopPasswd', $cr, $userDN, '', $password) ||
+                        @$this->invokeLDAPMethod('modReplace', $cr, $userDN, $password);
+        } catch(ConstraintViolationException $e) {
+            throw new HintException('Password change rejected.', \OC::$server->getL10N('user_ldap')->t('Password change rejected. Hint: ').$e->getMessage(), $e->getCode());
+        }
+    }
+
+    /**
+     * checks whether the given attributes value is probably a DN
+     * @param string $attr the attribute in question
+     * @return boolean if so true, otherwise false
+     */
+    private function resemblesDN($attr) {
+        $resemblingAttributes = [
+            'dn',
+            'uniquemember',
+            'member',
+            // memberOf is an "operational" attribute, without a definition in any RFC
+            'memberof'
+        ];
+        return in_array($attr, $resemblingAttributes);
+    }
+
+    /**
+     * checks whether the given string is probably a DN
+     * @param string $string
+     * @return boolean
+     */
+    public function stringResemblesDN($string) {
+        $r = $this->ldap->explodeDN($string, 0);
+        // if exploding a DN succeeds and does not end up in
+        // an empty array except for $r[count] being 0.
+        return (is_array($r) && count($r) > 1);
+    }
+
+    /**
+     * returns a DN-string that is cleaned from not domain parts, e.g.
+     * cn=foo,cn=bar,dc=foobar,dc=server,dc=org
+     * becomes dc=foobar,dc=server,dc=org
+     * @param string $dn
+     * @return string
+     */
+    public function getDomainDNFromDN($dn) {
+        $allParts = $this->ldap->explodeDN($dn, 0);
+        if($allParts === false) {
+            //not a valid DN
+            return '';
+        }
+        $domainParts = [];
+        $dcFound = false;
+        foreach($allParts as $part) {
+            if(!$dcFound && strpos($part, 'dc=') === 0) {
+                $dcFound = true;
+            }
+            if($dcFound) {
+                $domainParts[] = $part;
+            }
+        }
+        return implode(',', $domainParts);
+    }
+
+    /**
+     * returns the LDAP DN for the given internal Nextcloud name of the group
+     * @param string $name the Nextcloud name in question
+     * @return string|false LDAP DN on success, otherwise false
+     */
+    public function groupname2dn($name) {
+        return $this->groupMapper->getDNByName($name);
+    }
+
+    /**
+     * returns the LDAP DN for the given internal Nextcloud name of the user
+     * @param string $name the Nextcloud name in question
+     * @return string|false with the LDAP DN on success, otherwise false
+     */
+    public function username2dn($name) {
+        $fdn = $this->userMapper->getDNByName($name);
+
+        //Check whether the DN belongs to the Base, to avoid issues on multi-
+        //server setups
+        if(is_string($fdn) && $this->isDNPartOfBase($fdn, $this->connection->ldapBaseUsers)) {
+            return $fdn;
+        }
+
+        return false;
+    }
+
+    /**
+     * returns the internal Nextcloud name for the given LDAP DN of the group, false on DN outside of search DN or failure
+     *
+     * @param string $fdn the dn of the group object
+     * @param string $ldapName optional, the display name of the object
+     * @return string|false with the name to use in Nextcloud, false on DN outside of search DN
+     * @throws \Exception
+     */
+    public function dn2groupname($fdn, $ldapName = null) {
+        //To avoid bypassing the base DN settings under certain circumstances
+        //with the group support, check whether the provided DN matches one of
+        //the given Bases
+        if(!$this->isDNPartOfBase($fdn, $this->connection->ldapBaseGroups)) {
+            return false;
+        }
+
+        return $this->dn2ocname($fdn, $ldapName, false);
+    }
+
+    /**
+     * accepts an array of group DNs and tests whether they match the user
+     * filter by doing read operations against the group entries. Returns an
+     * array of DNs that match the filter.
+     *
+     * @param string[] $groupDNs
+     * @return string[]
+     * @throws ServerNotAvailableException
+     */
+    public function groupsMatchFilter($groupDNs) {
+        $validGroupDNs = [];
+        foreach($groupDNs as $dn) {
+            $cacheKey = 'groupsMatchFilter-'.$dn;
+            $groupMatchFilter = $this->connection->getFromCache($cacheKey);
+            if(!is_null($groupMatchFilter)) {
+                if($groupMatchFilter) {
+                    $validGroupDNs[] = $dn;
+                }
+                continue;
+            }
+
+            // Check the base DN first. If this is not met already, we don't
+            // need to ask the server at all.
+            if(!$this->isDNPartOfBase($dn, $this->connection->ldapBaseGroups)) {
+                $this->connection->writeToCache($cacheKey, false);
+                continue;
+            }
+
+            $result = $this->readAttribute($dn, '', $this->connection->ldapGroupFilter);
+            if(is_array($result)) {
+                $this->connection->writeToCache($cacheKey, true);
+                $validGroupDNs[] = $dn;
+            } else {
+                $this->connection->writeToCache($cacheKey, false);
+            }
+
+        }
+        return $validGroupDNs;
+    }
+
+    /**
+     * returns the internal Nextcloud name for the given LDAP DN of the user, false on DN outside of search DN or failure
+     *
+     * @param string $dn the dn of the user object
+     * @param string $ldapName optional, the display name of the object
+     * @return string|false with with the name to use in Nextcloud
+     * @throws \Exception
+     */
+    public function dn2username($fdn, $ldapName = null) {
+        //To avoid bypassing the base DN settings under certain circumstances
+        //with the group support, check whether the provided DN matches one of
+        //the given Bases
+        if(!$this->isDNPartOfBase($fdn, $this->connection->ldapBaseUsers)) {
+            return false;
+        }
+
+        return $this->dn2ocname($fdn, $ldapName, true);
+    }
+
+    /**
+     * returns an internal Nextcloud name for the given LDAP DN, false on DN outside of search DN
+     *
+     * @param string $fdn the dn of the user object
+     * @param string|null $ldapName optional, the display name of the object
+     * @param bool $isUser optional, whether it is a user object (otherwise group assumed)
+     * @param bool|null $newlyMapped
+     * @param array|null $record
+     * @return false|string with with the name to use in Nextcloud
+     * @throws \Exception
+     */
+    public function dn2ocname($fdn, $ldapName = null, $isUser = true, &$newlyMapped = null, array $record = null) {
+        $newlyMapped = false;
+        if($isUser) {
+            $mapper = $this->getUserMapper();
+            $nameAttribute = $this->connection->ldapUserDisplayName;
+            $filter = $this->connection->ldapUserFilter;
+        } else {
+            $mapper = $this->getGroupMapper();
+            $nameAttribute = $this->connection->ldapGroupDisplayName;
+            $filter = $this->connection->ldapGroupFilter;
+        }
+
+        //let's try to retrieve the Nextcloud name from the mappings table
+        $ncName = $mapper->getNameByDN($fdn);
+        if(is_string($ncName)) {
+            return $ncName;
+        }
+
+        //second try: get the UUID and check if it is known. Then, update the DN and return the name.
+        $uuid = $this->getUUID($fdn, $isUser, $record);
+        if(is_string($uuid)) {
+            $ncName = $mapper->getNameByUUID($uuid);
+            if(is_string($ncName)) {
+                $mapper->setDNbyUUID($fdn, $uuid);
+                return $ncName;
+            }
+        } else {
+            //If the UUID can't be detected something is foul.
+            \OCP\Util::writeLog('user_ldap', 'Cannot determine UUID for '.$fdn.'. Skipping.', ILogger::INFO);
+            return false;
+        }
+
+        if(is_null($ldapName)) {
+            $ldapName = $this->readAttribute($fdn, $nameAttribute, $filter);
+            if(!isset($ldapName[0]) && empty($ldapName[0])) {
+                \OCP\Util::writeLog('user_ldap', 'No or empty name for '.$fdn.' with filter '.$filter.'.', ILogger::INFO);
+                return false;
+            }
+            $ldapName = $ldapName[0];
+        }
+
+        if($isUser) {
+            $usernameAttribute = (string)$this->connection->ldapExpertUsernameAttr;
+            if ($usernameAttribute !== '') {
+                $username = $this->readAttribute($fdn, $usernameAttribute);
+                $username = $username[0];
+            } else {
+                $username = $uuid;
+            }
+            try {
+                $intName = $this->sanitizeUsername($username);
+            } catch (\InvalidArgumentException $e) {
+                \OC::$server->getLogger()->logException($e, [
+                    'app' => 'user_ldap',
+                    'level' => ILogger::WARN,
+                ]);
+                // we don't attempt to set a username here. We can go for
+                // for an alternative 4 digit random number as we would append
+                // otherwise, however it's likely not enough space in bigger
+                // setups, and most importantly: this is not intended.
+                return false;
+            }
+        } else {
+            $intName = $ldapName;
+        }
+
+        //a new user/group! Add it only if it doesn't conflict with other backend's users or existing groups
+        //disabling Cache is required to avoid that the new user is cached as not-existing in fooExists check
+        //NOTE: mind, disabling cache affects only this instance! Using it
+        // outside of core user management will still cache the user as non-existing.
+        $originalTTL = $this->connection->ldapCacheTTL;
+        $this->connection->setConfiguration(['ldapCacheTTL' => 0]);
+        if( $intName !== ''
+            && (($isUser && !$this->ncUserManager->userExists($intName))
+                || (!$isUser && !\OC::$server->getGroupManager()->groupExists($intName))
+            )
+        ) {
+            $this->connection->setConfiguration(['ldapCacheTTL' => $originalTTL]);
+            $newlyMapped = $this->mapAndAnnounceIfApplicable($mapper, $fdn, $intName, $uuid, $isUser);
+            if($newlyMapped) {
+                return $intName;
+            }
+        }
+
+        $this->connection->setConfiguration(['ldapCacheTTL' => $originalTTL]);
+        $altName = $this->createAltInternalOwnCloudName($intName, $isUser);
+        if (is_string($altName)) {
+            if($this->mapAndAnnounceIfApplicable($mapper, $fdn, $altName, $uuid, $isUser)) {
+                $newlyMapped = true;
+                return $altName;
+            }
+        }
+
+        //if everything else did not help..
+        \OCP\Util::writeLog('user_ldap', 'Could not create unique name for '.$fdn.'.', ILogger::INFO);
+        return false;
+    }
+
+    public function mapAndAnnounceIfApplicable(
+        AbstractMapping $mapper,
+        string $fdn,
+        string $name,
+        string $uuid,
+        bool $isUser
+    ) :bool {
+        if($mapper->map($fdn, $name, $uuid)) {
+            if ($this->ncUserManager instanceof PublicEmitter && $isUser) {
+                $this->cacheUserExists($name);
+                $this->ncUserManager->emit('\OC\User', 'assignedUserId', [$name]);
+            } elseif (!$isUser) {
+                $this->cacheGroupExists($name);
+            }
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * gives back the user names as they are used ownClod internally
+     *
+     * @param array $ldapUsers as returned by fetchList()
+     * @return array an array with the user names to use in Nextcloud
+     *
+     * gives back the user names as they are used ownClod internally
+     * @throws \Exception
+     */
+    public function nextcloudUserNames($ldapUsers) {
+        return $this->ldap2NextcloudNames($ldapUsers, true);
+    }
+
+    /**
+     * gives back the group names as they are used ownClod internally
+     *
+     * @param array $ldapGroups as returned by fetchList()
+     * @return array an array with the group names to use in Nextcloud
+     *
+     * gives back the group names as they are used ownClod internally
+     * @throws \Exception
+     */
+    public function nextcloudGroupNames($ldapGroups) {
+        return $this->ldap2NextcloudNames($ldapGroups, false);
+    }
+
+    /**
+     * @param array $ldapObjects as returned by fetchList()
+     * @param bool $isUsers
+     * @return array
+     * @throws \Exception
+     */
+    private function ldap2NextcloudNames($ldapObjects, $isUsers) {
+        if($isUsers) {
+            $nameAttribute = $this->connection->ldapUserDisplayName;
+            $sndAttribute  = $this->connection->ldapUserDisplayName2;
+        } else {
+            $nameAttribute = $this->connection->ldapGroupDisplayName;
+        }
+        $nextcloudNames = [];
+
+        foreach($ldapObjects as $ldapObject) {
+            $nameByLDAP = null;
+            if(    isset($ldapObject[$nameAttribute])
+                && is_array($ldapObject[$nameAttribute])
+                && isset($ldapObject[$nameAttribute][0])
+            ) {
+                // might be set, but not necessarily. if so, we use it.
+                $nameByLDAP = $ldapObject[$nameAttribute][0];
+            }
+
+            $ncName = $this->dn2ocname($ldapObject['dn'][0], $nameByLDAP, $isUsers);
+            if($ncName) {
+                $nextcloudNames[] = $ncName;
+                if($isUsers) {
+                    $this->updateUserState($ncName);
+                    //cache the user names so it does not need to be retrieved
+                    //again later (e.g. sharing dialogue).
+                    if(is_null($nameByLDAP)) {
+                        continue;
+                    }
+                    $sndName = isset($ldapObject[$sndAttribute][0])
+                        ? $ldapObject[$sndAttribute][0] : '';
+                    $this->cacheUserDisplayName($ncName, $nameByLDAP, $sndName);
+                } else if($nameByLDAP !== null) {
+                    $this->cacheGroupDisplayName($ncName, $nameByLDAP);
+                }
+            }
+        }
+        return $nextcloudNames;
+    }
+
+    /**
+     * removes the deleted-flag of a user if it was set
+     *
+     * @param string $ncname
+     * @throws \Exception
+     */
+    public function updateUserState($ncname) {
+        $user = $this->userManager->get($ncname);
+        if($user instanceof OfflineUser) {
+            $user->unmark();
+        }
+    }
+
+    /**
+     * caches the user display name
+     * @param string $ocName the internal Nextcloud username
+     * @param string|false $home the home directory path
+     */
+    public function cacheUserHome($ocName, $home) {
+        $cacheKey = 'getHome'.$ocName;
+        $this->connection->writeToCache($cacheKey, $home);
+    }
+
+    /**
+     * caches a user as existing
+     * @param string $ocName the internal Nextcloud username
+     */
+    public function cacheUserExists($ocName) {
+        $this->connection->writeToCache('userExists'.$ocName, true);
+    }
+
+    /**
+     * caches a group as existing
+     */
+    public function cacheGroupExists(string $gid): void {
+        $this->connection->writeToCache('groupExists'.$gid, true);
+    }
+
+    /**
+     * caches the user display name
+     *
+     * @param string $ocName the internal Nextcloud username
+     * @param string $displayName the display name
+     * @param string $displayName2 the second display name
+     * @throws \Exception
+     */
+    public function cacheUserDisplayName($ocName, $displayName, $displayName2 = '') {
+        $user = $this->userManager->get($ocName);
+        if($user === null) {
+            return;
+        }
+        $displayName = $user->composeAndStoreDisplayName($displayName, $displayName2);
+        $cacheKeyTrunk = 'getDisplayName';
+        $this->connection->writeToCache($cacheKeyTrunk.$ocName, $displayName);
+    }
+
+    public function cacheGroupDisplayName(string $ncName, string $displayName): void {
+        $cacheKey = 'group_getDisplayName' . $ncName;
+        $this->connection->writeToCache($cacheKey, $displayName);
+    }
+
+    /**
+     * creates a unique name for internal Nextcloud use for users. Don't call it directly.
+     * @param string $name the display name of the object
+     * @return string|false with with the name to use in Nextcloud or false if unsuccessful
+     *
+     * Instead of using this method directly, call
+     * createAltInternalOwnCloudName($name, true)
+     */
+    private function _createAltInternalOwnCloudNameForUsers($name) {
+        $attempts = 0;
+        //while loop is just a precaution. If a name is not generated within
+        //20 attempts, something else is very wrong. Avoids infinite loop.
+        while($attempts < 20){
+            $altName = $name . '_' . rand(1000,9999);
+            if(!$this->ncUserManager->userExists($altName)) {
+                return $altName;
+            }
+            $attempts++;
+        }
+        return false;
+    }
+
+    /**
+     * creates a unique name for internal Nextcloud use for groups. Don't call it directly.
+     * @param string $name the display name of the object
+     * @return string|false with with the name to use in Nextcloud or false if unsuccessful.
+     *
+     * Instead of using this method directly, call
+     * createAltInternalOwnCloudName($name, false)
+     *
+     * Group names are also used as display names, so we do a sequential
+     * numbering, e.g. Developers_42 when there are 41 other groups called
+     * "Developers"
+     */
+    private function _createAltInternalOwnCloudNameForGroups($name) {
+        $usedNames = $this->groupMapper->getNamesBySearch($name, "", '_%');
+        if(!$usedNames || count($usedNames) === 0) {
+            $lastNo = 1; //will become name_2
+        } else {
+            natsort($usedNames);
+            $lastName = array_pop($usedNames);
+            $lastNo = (int)substr($lastName, strrpos($lastName, '_') + 1);
+        }
+        $altName = $name.'_'. (string)($lastNo+1);
+        unset($usedNames);
+
+        $attempts = 1;
+        while($attempts < 21){
+            // Check to be really sure it is unique
+            // while loop is just a precaution. If a name is not generated within
+            // 20 attempts, something else is very wrong. Avoids infinite loop.
+            if(!\OC::$server->getGroupManager()->groupExists($altName)) {
+                return $altName;
+            }
+            $altName = $name . '_' . ($lastNo + $attempts);
+            $attempts++;
+        }
+        return false;
+    }
+
+    /**
+     * creates a unique name for internal Nextcloud use.
+     * @param string $name the display name of the object
+     * @param boolean $isUser whether name should be created for a user (true) or a group (false)
+     * @return string|false with with the name to use in Nextcloud or false if unsuccessful
+     */
+    private function createAltInternalOwnCloudName($name, $isUser) {
+        $originalTTL = $this->connection->ldapCacheTTL;
+        $this->connection->setConfiguration(['ldapCacheTTL' => 0]);
+        if($isUser) {
+            $altName = $this->_createAltInternalOwnCloudNameForUsers($name);
+        } else {
+            $altName = $this->_createAltInternalOwnCloudNameForGroups($name);
+        }
+        $this->connection->setConfiguration(['ldapCacheTTL' => $originalTTL]);
+
+        return $altName;
+    }
+
+    /**
+     * fetches a list of users according to a provided loginName and utilizing
+     * the login filter.
+     *
+     * @param string $loginName
+     * @param array $attributes optional, list of attributes to read
+     * @return array
+     */
+    public function fetchUsersByLoginName($loginName, $attributes = ['dn']) {
+        $loginName = $this->escapeFilterPart($loginName);
+        $filter = str_replace('%uid', $loginName, $this->connection->ldapLoginFilter);
+        return $this->fetchListOfUsers($filter, $attributes);
+    }
+
+    /**
+     * counts the number of users according to a provided loginName and
+     * utilizing the login filter.
+     *
+     * @param string $loginName
+     * @return int
+     */
+    public function countUsersByLoginName($loginName) {
+        $loginName = $this->escapeFilterPart($loginName);
+        $filter = str_replace('%uid', $loginName, $this->connection->ldapLoginFilter);
+        return $this->countUsers($filter);
+    }
+
+    /**
+     * @param string $filter
+     * @param string|string[] $attr
+     * @param int $limit
+     * @param int $offset
+     * @param bool $forceApplyAttributes
+     * @return array
+     * @throws \Exception
+     */
+    public function fetchListOfUsers($filter, $attr, $limit = null, $offset = null, $forceApplyAttributes = false) {
+        $ldapRecords = $this->searchUsers($filter, $attr, $limit, $offset);
+        $recordsToUpdate = $ldapRecords;
+        if(!$forceApplyAttributes) {
+            $isBackgroundJobModeAjax = $this->config
+                    ->getAppValue('core', 'backgroundjobs_mode', 'ajax') === 'ajax';
+            $recordsToUpdate = array_filter($ldapRecords, function($record) use ($isBackgroundJobModeAjax) {
+                $newlyMapped = false;
+                $uid = $this->dn2ocname($record['dn'][0], null, true, $newlyMapped, $record);
+                if(is_string($uid)) {
+                    $this->cacheUserExists($uid);
+                }
+                return ($uid !== false) && ($newlyMapped || $isBackgroundJobModeAjax);
+            });
+        }
+        $this->batchApplyUserAttributes($recordsToUpdate);
+        return $this->fetchList($ldapRecords, $this->manyAttributes($attr));
+    }
+
+    /**
+     * provided with an array of LDAP user records the method will fetch the
+     * user object and requests it to process the freshly fetched attributes and
+     * and their values
+     *
+     * @param array $ldapRecords
+     * @throws \Exception
+     */
+    public function batchApplyUserAttributes(array $ldapRecords){
+        $displayNameAttribute = strtolower($this->connection->ldapUserDisplayName);
+        foreach($ldapRecords as $userRecord) {
+            if(!isset($userRecord[$displayNameAttribute])) {
+                // displayName is obligatory
+                continue;
+            }
+            $ocName  = $this->dn2ocname($userRecord['dn'][0], null, true);
+            if($ocName === false) {
+                continue;
+            }
+            $this->updateUserState($ocName);
+            $user = $this->userManager->get($ocName);
+            if ($user !== null) {
+                $user->processAttributes($userRecord);
+            } else {
+                \OC::$server->getLogger()->debug(
+                    "The ldap user manager returned null for $ocName",
+                    ['app'=>'user_ldap']
+                );
+            }
+        }
+    }
+
+    /**
+     * @param string $filter
+     * @param string|string[] $attr
+     * @param int $limit
+     * @param int $offset
+     * @return array
+     */
+    public function fetchListOfGroups($filter, $attr, $limit = null, $offset = null) {
+        $groupRecords = $this->searchGroups($filter, $attr, $limit, $offset);
+        array_walk($groupRecords, function($record) {
+            $newlyMapped = false;
+            $gid = $this->dn2ocname($record['dn'][0], null, false, $newlyMapped, $record);
+            if(!$newlyMapped && is_string($gid)) {
+                $this->cacheGroupExists($gid);
+            }
+        });
+        return $this->fetchList($groupRecords, $this->manyAttributes($attr));
+    }
+
+    /**
+     * @param array $list
+     * @param bool $manyAttributes
+     * @return array
+     */
+    private function fetchList($list, $manyAttributes) {
+        if(is_array($list)) {
+            if($manyAttributes) {
+                return $list;
+            } else {
+                $list = array_reduce($list, function($carry, $item) {
+                    $attribute = array_keys($item)[0];
+                    $carry[] = $item[$attribute][0];
+                    return $carry;
+                }, []);
+                return array_unique($list, SORT_LOCALE_STRING);
+            }
+        }
+
+        //error cause actually, maybe throw an exception in future.
+        return [];
+    }
+
+    /**
+     * executes an LDAP search, optimized for Users
+     *
+     * @param string $filter the LDAP filter for the search
+     * @param string|string[] $attr optional, when a certain attribute shall be filtered out
+     * @param integer $limit
+     * @param integer $offset
+     * @return array with the search result
+     *
+     * Executes an LDAP search
+     * @throws ServerNotAvailableException
+     */
+    public function searchUsers($filter, $attr = null, $limit = null, $offset = null) {
+        $result = [];
+        foreach($this->connection->ldapBaseUsers as $base) {
+            $result = array_merge($result, $this->search($filter, [$base], $attr, $limit, $offset));
+        }
+        return $result;
+    }
+
+    /**
+     * @param string $filter
+     * @param string|string[] $attr
+     * @param int $limit
+     * @param int $offset
+     * @return false|int
+     * @throws ServerNotAvailableException
+     */
+    public function countUsers($filter, $attr = ['dn'], $limit = null, $offset = null) {
+        $result = false;
+        foreach($this->connection->ldapBaseUsers as $base) {
+            $count = $this->count($filter, [$base], $attr, $limit, $offset);
+            $result = is_int($count) ? (int)$result + $count : $result;
+        }
+        return $result;
+    }
+
+    /**
+     * executes an LDAP search, optimized for Groups
+     *
+     * @param string $filter the LDAP filter for the search
+     * @param string|string[] $attr optional, when a certain attribute shall be filtered out
+     * @param integer $limit
+     * @param integer $offset
+     * @return array with the search result
+     *
+     * Executes an LDAP search
+     * @throws ServerNotAvailableException
+     */
+    public function searchGroups($filter, $attr = null, $limit = null, $offset = null) {
+        $result = [];
+        foreach($this->connection->ldapBaseGroups as $base) {
+            $result = array_merge($result, $this->search($filter, [$base], $attr, $limit, $offset));
+        }
+        return $result;
+    }
+
+    /**
+     * returns the number of available groups
+     *
+     * @param string $filter the LDAP search filter
+     * @param string[] $attr optional
+     * @param int|null $limit
+     * @param int|null $offset
+     * @return int|bool
+     * @throws ServerNotAvailableException
+     */
+    public function countGroups($filter, $attr = ['dn'], $limit = null, $offset = null) {
+        $result = false;
+        foreach($this->connection->ldapBaseGroups as $base) {
+            $count = $this->count($filter, [$base], $attr, $limit, $offset);
+            $result = is_int($count) ? (int)$result + $count : $result;
+        }
+        return $result;
+    }
+
+    /**
+     * returns the number of available objects on the base DN
+     *
+     * @param int|null $limit
+     * @param int|null $offset
+     * @return int|bool
+     * @throws ServerNotAvailableException
+     */
+    public function countObjects($limit = null, $offset = null) {
+        $result = false;
+        foreach($this->connection->ldapBase as $base) {
+            $count = $this->count('objectclass=*', [$base], ['dn'], $limit, $offset);
+            $result = is_int($count) ? (int)$result + $count : $result;
+        }
+        return $result;
+    }
+
+    /**
+     * Returns the LDAP handler
+     * @throws \OC\ServerNotAvailableException
+     */
+
+    /**
+     * @return mixed
+     * @throws \OC\ServerNotAvailableException
+     */
+    private function invokeLDAPMethod() {
+        $arguments = func_get_args();
+        $command = array_shift($arguments);
+        $cr = array_shift($arguments);
+        if (!method_exists($this->ldap, $command)) {
+            return null;
+        }
+        array_unshift($arguments, $cr);
+        // php no longer supports call-time pass-by-reference
+        // thus cannot support controlPagedResultResponse as the third argument
+        // is a reference
+        $doMethod = function () use ($command, &$arguments) {
+            if ($command == 'controlPagedResultResponse') {
+                throw new \InvalidArgumentException('Invoker does not support controlPagedResultResponse, call LDAP Wrapper directly instead.');
+            } else {
+                return call_user_func_array([$this->ldap, $command], $arguments);
+            }
+        };
+        try {
+            $ret = $doMethod();
+        } catch (ServerNotAvailableException $e) {
+            /* Server connection lost, attempt to reestablish it
 			 * Maybe implement exponential backoff?
 			 * This was enough to get solr indexer working which has large delays between LDAP fetches.
 			 */
-			\OCP\Util::writeLog('user_ldap', "Connection lost on $command, attempting to reestablish.", ILogger::DEBUG);
-			$this->connection->resetConnectionResource();
-			$cr = $this->connection->getConnectionResource();
-
-			if(!$this->ldap->isResource($cr)) {
-				// Seems like we didn't find any resource.
-				\OCP\Util::writeLog('user_ldap', "Could not $command, because resource is missing.", ILogger::DEBUG);
-				throw $e;
-			}
-
-			$arguments[0] = array_pad([], count($arguments[0]), $cr);
-			$ret = $doMethod();
-		}
-		return $ret;
-	}
-
-	/**
-	 * retrieved. Results will according to the order in the array.
-	 *
-	 * @param $filter
-	 * @param $base
-	 * @param string[]|string|null $attr
-	 * @param int $limit optional, maximum results to be counted
-	 * @param int $offset optional, a starting point
-	 * @return array|false array with the search result as first value and pagedSearchOK as
-	 * second | false if not successful
-	 * @throws ServerNotAvailableException
-	 */
-	private function executeSearch($filter, $base, &$attr = null, $limit = null, $offset = null) {
-		if(!is_null($attr) && !is_array($attr)) {
-			$attr = [mb_strtolower($attr, 'UTF-8')];
-		}
-
-		// See if we have a resource, in case not cancel with message
-		$cr = $this->connection->getConnectionResource();
-		if(!$this->ldap->isResource($cr)) {
-			// Seems like we didn't find any resource.
-			// Return an empty array just like before.
-			\OCP\Util::writeLog('user_ldap', 'Could not search, because resource is missing.', ILogger::DEBUG);
-			return false;
-		}
-
-		//check whether paged search should be attempted
-		$pagedSearchOK = $this->initPagedSearch($filter, $base, $attr, (int)$limit, $offset);
-
-		$linkResources = array_pad([], count($base), $cr);
-		$sr = $this->invokeLDAPMethod('search', $linkResources, $base, $filter, $attr);
-		// cannot use $cr anymore, might have changed in the previous call!
-		$error = $this->ldap->errno($this->connection->getConnectionResource());
-		if(!is_array($sr) || $error !== 0) {
-			\OCP\Util::writeLog('user_ldap', 'Attempt for Paging?  '.print_r($pagedSearchOK, true), ILogger::ERROR);
-			return false;
-		}
-
-		return [$sr, $pagedSearchOK];
-	}
-
-	/**
-	 * processes an LDAP paged search operation
-	 *
-	 * @param array $sr the array containing the LDAP search resources
-	 * @param string $filter the LDAP filter for the search
-	 * @param array $base an array containing the LDAP subtree(s) that shall be searched
-	 * @param int $iFoundItems number of results in the single search operation
-	 * @param int $limit maximum results to be counted
-	 * @param int $offset a starting point
-	 * @param bool $pagedSearchOK whether a paged search has been executed
-	 * @param bool $skipHandling required for paged search when cookies to
-	 * prior results need to be gained
-	 * @return bool cookie validity, true if we have more pages, false otherwise.
-	 * @throws ServerNotAvailableException
-	 */
-	private function processPagedSearchStatus($sr, $filter, $base, $iFoundItems, $limit, $offset, $pagedSearchOK, $skipHandling) {
-		$cookie = null;
-		if($pagedSearchOK) {
-			$cr = $this->connection->getConnectionResource();
-			foreach($sr as $key => $res) {
-				if($this->ldap->controlPagedResultResponse($cr, $res, $cookie)) {
-					$this->setPagedResultCookie($base[$key], $filter, $limit, $offset, $cookie);
-				}
-			}
-
-			//browsing through prior pages to get the cookie for the new one
-			if($skipHandling) {
-				return false;
-			}
-			// if count is bigger, then the server does not support
-			// paged search. Instead, he did a normal search. We set a
-			// flag here, so the callee knows how to deal with it.
-			if($iFoundItems <= $limit) {
-				$this->pagedSearchedSuccessful = true;
-			}
-		} else {
-			if(!is_null($limit) && (int)$this->connection->ldapPagingSize !== 0) {
-				\OC::$server->getLogger()->debug(
-					'Paged search was not available',
-					[ 'app' => 'user_ldap' ]
-				);
-			}
-		}
-		/* ++ Fixing RHDS searches with pages with zero results ++
+            \OCP\Util::writeLog('user_ldap', "Connection lost on $command, attempting to reestablish.", ILogger::DEBUG);
+            $this->connection->resetConnectionResource();
+            $cr = $this->connection->getConnectionResource();
+
+            if(!$this->ldap->isResource($cr)) {
+                // Seems like we didn't find any resource.
+                \OCP\Util::writeLog('user_ldap', "Could not $command, because resource is missing.", ILogger::DEBUG);
+                throw $e;
+            }
+
+            $arguments[0] = array_pad([], count($arguments[0]), $cr);
+            $ret = $doMethod();
+        }
+        return $ret;
+    }
+
+    /**
+     * retrieved. Results will according to the order in the array.
+     *
+     * @param $filter
+     * @param $base
+     * @param string[]|string|null $attr
+     * @param int $limit optional, maximum results to be counted
+     * @param int $offset optional, a starting point
+     * @return array|false array with the search result as first value and pagedSearchOK as
+     * second | false if not successful
+     * @throws ServerNotAvailableException
+     */
+    private function executeSearch($filter, $base, &$attr = null, $limit = null, $offset = null) {
+        if(!is_null($attr) && !is_array($attr)) {
+            $attr = [mb_strtolower($attr, 'UTF-8')];
+        }
+
+        // See if we have a resource, in case not cancel with message
+        $cr = $this->connection->getConnectionResource();
+        if(!$this->ldap->isResource($cr)) {
+            // Seems like we didn't find any resource.
+            // Return an empty array just like before.
+            \OCP\Util::writeLog('user_ldap', 'Could not search, because resource is missing.', ILogger::DEBUG);
+            return false;
+        }
+
+        //check whether paged search should be attempted
+        $pagedSearchOK = $this->initPagedSearch($filter, $base, $attr, (int)$limit, $offset);
+
+        $linkResources = array_pad([], count($base), $cr);
+        $sr = $this->invokeLDAPMethod('search', $linkResources, $base, $filter, $attr);
+        // cannot use $cr anymore, might have changed in the previous call!
+        $error = $this->ldap->errno($this->connection->getConnectionResource());
+        if(!is_array($sr) || $error !== 0) {
+            \OCP\Util::writeLog('user_ldap', 'Attempt for Paging?  '.print_r($pagedSearchOK, true), ILogger::ERROR);
+            return false;
+        }
+
+        return [$sr, $pagedSearchOK];
+    }
+
+    /**
+     * processes an LDAP paged search operation
+     *
+     * @param array $sr the array containing the LDAP search resources
+     * @param string $filter the LDAP filter for the search
+     * @param array $base an array containing the LDAP subtree(s) that shall be searched
+     * @param int $iFoundItems number of results in the single search operation
+     * @param int $limit maximum results to be counted
+     * @param int $offset a starting point
+     * @param bool $pagedSearchOK whether a paged search has been executed
+     * @param bool $skipHandling required for paged search when cookies to
+     * prior results need to be gained
+     * @return bool cookie validity, true if we have more pages, false otherwise.
+     * @throws ServerNotAvailableException
+     */
+    private function processPagedSearchStatus($sr, $filter, $base, $iFoundItems, $limit, $offset, $pagedSearchOK, $skipHandling) {
+        $cookie = null;
+        if($pagedSearchOK) {
+            $cr = $this->connection->getConnectionResource();
+            foreach($sr as $key => $res) {
+                if($this->ldap->controlPagedResultResponse($cr, $res, $cookie)) {
+                    $this->setPagedResultCookie($base[$key], $filter, $limit, $offset, $cookie);
+                }
+            }
+
+            //browsing through prior pages to get the cookie for the new one
+            if($skipHandling) {
+                return false;
+            }
+            // if count is bigger, then the server does not support
+            // paged search. Instead, he did a normal search. We set a
+            // flag here, so the callee knows how to deal with it.
+            if($iFoundItems <= $limit) {
+                $this->pagedSearchedSuccessful = true;
+            }
+        } else {
+            if(!is_null($limit) && (int)$this->connection->ldapPagingSize !== 0) {
+                \OC::$server->getLogger()->debug(
+                    'Paged search was not available',
+                    [ 'app' => 'user_ldap' ]
+                );
+            }
+        }
+        /* ++ Fixing RHDS searches with pages with zero results ++
 		 * Return cookie status. If we don't have more pages, with RHDS
 		 * cookie is null, with openldap cookie is an empty string and
 		 * to 386ds '0' is a valid cookie. Even if $iFoundItems == 0
 		 */
-		return !empty($cookie) || $cookie === '0';
-	}
-
-	/**
-	 * executes an LDAP search, but counts the results only
-	 *
-	 * @param string $filter the LDAP filter for the search
-	 * @param array $base an array containing the LDAP subtree(s) that shall be searched
-	 * @param string|string[] $attr optional, array, one or more attributes that shall be
-	 * retrieved. Results will according to the order in the array.
-	 * @param int $limit optional, maximum results to be counted
-	 * @param int $offset optional, a starting point
-	 * @param bool $skipHandling indicates whether the pages search operation is
-	 * completed
-	 * @return int|false Integer or false if the search could not be initialized
-	 * @throws ServerNotAvailableException
-	 */
-	private function count($filter, $base, $attr = null, $limit = null, $offset = null, $skipHandling = false) {
-		\OCP\Util::writeLog('user_ldap', 'Count filter:  '.print_r($filter, true), ILogger::DEBUG);
-
-		$limitPerPage = (int)$this->connection->ldapPagingSize;
-		if(!is_null($limit) && $limit < $limitPerPage && $limit > 0) {
-			$limitPerPage = $limit;
-		}
-
-		$counter = 0;
-		$count = null;
-		$this->connection->getConnectionResource();
-
-		do {
-			$search = $this->executeSearch($filter, $base, $attr, $limitPerPage, $offset);
-			if($search === false) {
-				return $counter > 0 ? $counter : false;
-			}
-			list($sr, $pagedSearchOK) = $search;
-
-			/* ++ Fixing RHDS searches with pages with zero results ++
+        return !empty($cookie) || $cookie === '0';
+    }
+
+    /**
+     * executes an LDAP search, but counts the results only
+     *
+     * @param string $filter the LDAP filter for the search
+     * @param array $base an array containing the LDAP subtree(s) that shall be searched
+     * @param string|string[] $attr optional, array, one or more attributes that shall be
+     * retrieved. Results will according to the order in the array.
+     * @param int $limit optional, maximum results to be counted
+     * @param int $offset optional, a starting point
+     * @param bool $skipHandling indicates whether the pages search operation is
+     * completed
+     * @return int|false Integer or false if the search could not be initialized
+     * @throws ServerNotAvailableException
+     */
+    private function count($filter, $base, $attr = null, $limit = null, $offset = null, $skipHandling = false) {
+        \OCP\Util::writeLog('user_ldap', 'Count filter:  '.print_r($filter, true), ILogger::DEBUG);
+
+        $limitPerPage = (int)$this->connection->ldapPagingSize;
+        if(!is_null($limit) && $limit < $limitPerPage && $limit > 0) {
+            $limitPerPage = $limit;
+        }
+
+        $counter = 0;
+        $count = null;
+        $this->connection->getConnectionResource();
+
+        do {
+            $search = $this->executeSearch($filter, $base, $attr, $limitPerPage, $offset);
+            if($search === false) {
+                return $counter > 0 ? $counter : false;
+            }
+            list($sr, $pagedSearchOK) = $search;
+
+            /* ++ Fixing RHDS searches with pages with zero results ++
 			 * countEntriesInSearchResults() method signature changed
 			 * by removing $limit and &$hasHitLimit parameters
 			 */
-			$count = $this->countEntriesInSearchResults($sr);
-			$counter += $count;
+            $count = $this->countEntriesInSearchResults($sr);
+            $counter += $count;
 
-			$hasMorePages = $this->processPagedSearchStatus($sr, $filter, $base, $count, $limitPerPage,
-										$offset, $pagedSearchOK, $skipHandling);
-			$offset += $limitPerPage;
-			/* ++ Fixing RHDS searches with pages with zero results ++
+            $hasMorePages = $this->processPagedSearchStatus($sr, $filter, $base, $count, $limitPerPage,
+                                        $offset, $pagedSearchOK, $skipHandling);
+            $offset += $limitPerPage;
+            /* ++ Fixing RHDS searches with pages with zero results ++
 			 * Continue now depends on $hasMorePages value
 			 */
-			$continue = $pagedSearchOK && $hasMorePages;
-		} while($continue && (is_null($limit) || $limit <= 0 || $limit > $counter));
-
-		return $counter;
-	}
-
-	/**
-	 * @param array $searchResults
-	 * @return int
-	 * @throws ServerNotAvailableException
-	 */
-	private function countEntriesInSearchResults($searchResults) {
-		$counter = 0;
-
-		foreach($searchResults as $res) {
-			$count = (int)$this->invokeLDAPMethod('countEntries', $this->connection->getConnectionResource(), $res);
-			$counter += $count;
-		}
-
-		return $counter;
-	}
-
-	/**
-	 * Executes an LDAP search
-	 *
-	 * @param string $filter the LDAP filter for the search
-	 * @param array $base an array containing the LDAP subtree(s) that shall be searched
-	 * @param string|string[] $attr optional, array, one or more attributes that shall be
-	 * @param int $limit
-	 * @param int $offset
-	 * @param bool $skipHandling
-	 * @return array with the search result
-	 * @throws ServerNotAvailableException
-	 */
-	public function search($filter, $base, $attr = null, $limit = null, $offset = null, $skipHandling = false) {
-		$limitPerPage = (int)$this->connection->ldapPagingSize;
-		if(!is_null($limit) && $limit < $limitPerPage && $limit > 0) {
-			$limitPerPage = $limit;
-		}
-
-		/* ++ Fixing RHDS searches with pages with zero results ++
+            $continue = $pagedSearchOK && $hasMorePages;
+        } while($continue && (is_null($limit) || $limit <= 0 || $limit > $counter));
+
+        return $counter;
+    }
+
+    /**
+     * @param array $searchResults
+     * @return int
+     * @throws ServerNotAvailableException
+     */
+    private function countEntriesInSearchResults($searchResults) {
+        $counter = 0;
+
+        foreach($searchResults as $res) {
+            $count = (int)$this->invokeLDAPMethod('countEntries', $this->connection->getConnectionResource(), $res);
+            $counter += $count;
+        }
+
+        return $counter;
+    }
+
+    /**
+     * Executes an LDAP search
+     *
+     * @param string $filter the LDAP filter for the search
+     * @param array $base an array containing the LDAP subtree(s) that shall be searched
+     * @param string|string[] $attr optional, array, one or more attributes that shall be
+     * @param int $limit
+     * @param int $offset
+     * @param bool $skipHandling
+     * @return array with the search result
+     * @throws ServerNotAvailableException
+     */
+    public function search($filter, $base, $attr = null, $limit = null, $offset = null, $skipHandling = false) {
+        $limitPerPage = (int)$this->connection->ldapPagingSize;
+        if(!is_null($limit) && $limit < $limitPerPage && $limit > 0) {
+            $limitPerPage = $limit;
+        }
+
+        /* ++ Fixing RHDS searches with pages with zero results ++
 		 * As we can have pages with zero results and/or pages with less
 		 * than $limit results but with a still valid server 'cookie',
 		 * loops through until we get $continue equals true and
 		 * $findings['count'] < $limit
 		 */
-		$findings = [];
-		$savedoffset = $offset;
-		do {
-			$search = $this->executeSearch($filter, $base, $attr, $limitPerPage, $offset);
-			if($search === false) {
-				return [];
-			}
-			list($sr, $pagedSearchOK) = $search;
-			$cr = $this->connection->getConnectionResource();
-
-			if($skipHandling) {
-				//i.e. result do not need to be fetched, we just need the cookie
-				//thus pass 1 or any other value as $iFoundItems because it is not
-				//used
-				$this->processPagedSearchStatus($sr, $filter, $base, 1, $limitPerPage,
-								$offset, $pagedSearchOK,
-								$skipHandling);
-				return [];
-			}
-
-			$iFoundItems = 0;
-			foreach($sr as $res) {
-				$findings = array_merge($findings, $this->invokeLDAPMethod('getEntries', $cr, $res));
-				$iFoundItems = max($iFoundItems, $findings['count']);
-				unset($findings['count']);
-			}
-
-			$continue = $this->processPagedSearchStatus($sr, $filter, $base, $iFoundItems,
-				$limitPerPage, $offset, $pagedSearchOK,
-										$skipHandling);
-			$offset += $limitPerPage;
-		} while ($continue && $pagedSearchOK && ($limit === null || count($findings) < $limit));
-		// reseting offset
-		$offset = $savedoffset;
-
-		// if we're here, probably no connection resource is returned.
-		// to make Nextcloud behave nicely, we simply give back an empty array.
-		if(is_null($findings)) {
-			return [];
-		}
-
-		if(!is_null($attr)) {
-			$selection = [];
-			$i = 0;
-			foreach($findings as $item) {
-				if(!is_array($item)) {
-					continue;
-				}
-				$item = \OCP\Util::mb_array_change_key_case($item, MB_CASE_LOWER, 'UTF-8');
-				foreach($attr as $key) {
-					if(isset($item[$key])) {
-						if(is_array($item[$key]) && isset($item[$key]['count'])) {
-							unset($item[$key]['count']);
-						}
-						if($key !== 'dn') {
-							if($this->resemblesDN($key)) {
-								$selection[$i][$key] = $this->helper->sanitizeDN($item[$key]);
-							} else if($key === 'objectguid' || $key === 'guid') {
-								$selection[$i][$key] = [$this->convertObjectGUID2Str($item[$key][0])];
-							} else {
-								$selection[$i][$key] = $item[$key];
-							}
-						} else {
-							$selection[$i][$key] = [$this->helper->sanitizeDN($item[$key])];
-						}
-					}
-
-				}
-				$i++;
-			}
-			$findings = $selection;
-		}
-		//we slice the findings, when
-		//a) paged search unsuccessful, though attempted
-		//b) no paged search, but limit set
-		if((!$this->getPagedSearchResultState()
-			&& $pagedSearchOK)
-			|| (
-				!$pagedSearchOK
-				&& !is_null($limit)
-			)
-		) {
-			$findings = array_slice($findings, (int)$offset, $limit);
-		}
-		return $findings;
-	}
-
-	/**
-	 * @param string $name
-	 * @return string
-	 * @throws \InvalidArgumentException
-	 */
-	public function sanitizeUsername($name) {
-		$name = trim($name);
-
-		if($this->connection->ldapIgnoreNamingRules) {
-			return $name;
-		}
-
-		// Transliteration to ASCII
-		$transliterated = @iconv('UTF-8', 'ASCII//TRANSLIT', $name);
-		if($transliterated !== false) {
-			// depending on system config iconv can work or not
-			$name = $transliterated;
-		}
-
-		// Replacements
-		$name = str_replace(' ', '_', $name);
-
-		// Every remaining disallowed characters will be removed
-		$name = preg_replace('/[^a-zA-Z0-9_.@-]/u', '', $name);
-
-		if($name === '') {
-			throw new \InvalidArgumentException('provided name template for username does not contain any allowed characters');
-		}
-
-		return $name;
-	}
-
-	/**
-	* escapes (user provided) parts for LDAP filter
-	* @param string $input, the provided value
-	* @param bool $allowAsterisk whether in * at the beginning should be preserved
-	* @return string the escaped string
-	*/
-	public function escapeFilterPart($input, $allowAsterisk = false) {
-		$asterisk = '';
-		if($allowAsterisk && strlen($input) > 0 && $input[0] === '*') {
-			$asterisk = '*';
-			$input = mb_substr($input, 1, null, 'UTF-8');
-		}
-		$search  = ['*', '\\', '(', ')'];
-		$replace = ['\\*', '\\\\', '\\(', '\\)'];
-		return $asterisk . str_replace($search, $replace, $input);
-	}
-
-	/**
-	 * combines the input filters with AND
-	 * @param string[] $filters the filters to connect
-	 * @return string the combined filter
-	 */
-	public function combineFilterWithAnd($filters) {
-		return $this->combineFilter($filters, '&');
-	}
-
-	/**
-	 * combines the input filters with OR
-	 * @param string[] $filters the filters to connect
-	 * @return string the combined filter
-	 * Combines Filter arguments with OR
-	 */
-	public function combineFilterWithOr($filters) {
-		return $this->combineFilter($filters, '|');
-	}
-
-	/**
-	 * combines the input filters with given operator
-	 * @param string[] $filters the filters to connect
-	 * @param string $operator either & or |
-	 * @return string the combined filter
-	 */
-	private function combineFilter($filters, $operator) {
-		$combinedFilter = '('.$operator;
-		foreach($filters as $filter) {
-			if ($filter !== '' && $filter[0] !== '(') {
-				$filter = '('.$filter.')';
-			}
-			$combinedFilter.=$filter;
-		}
-		$combinedFilter.=')';
-		return $combinedFilter;
-	}
-
-	/**
-	 * creates a filter part for to perform search for users
-	 * @param string $search the search term
-	 * @return string the final filter part to use in LDAP searches
-	 */
-	public function getFilterPartForUserSearch($search) {
-		return $this->getFilterPartForSearch($search,
-			$this->connection->ldapAttributesForUserSearch,
-			$this->connection->ldapUserDisplayName);
-	}
-
-	/**
-	 * creates a filter part for to perform search for groups
-	 * @param string $search the search term
-	 * @return string the final filter part to use in LDAP searches
-	 */
-	public function getFilterPartForGroupSearch($search) {
-		return $this->getFilterPartForSearch($search,
-			$this->connection->ldapAttributesForGroupSearch,
-			$this->connection->ldapGroupDisplayName);
-	}
-
-	/**
-	 * creates a filter part for searches by splitting up the given search
-	 * string into single words
-	 * @param string $search the search term
-	 * @param string[] $searchAttributes needs to have at least two attributes,
-	 * otherwise it does not make sense :)
-	 * @return string the final filter part to use in LDAP searches
-	 * @throws \Exception
-	 */
-	private function getAdvancedFilterPartForSearch($search, $searchAttributes) {
-		if(!is_array($searchAttributes) || count($searchAttributes) < 2) {
-			throw new \Exception('searchAttributes must be an array with at least two string');
-		}
-		$searchWords = explode(' ', trim($search));
-		$wordFilters = [];
-		foreach($searchWords as $word) {
-			$word = $this->prepareSearchTerm($word);
-			//every word needs to appear at least once
-			$wordMatchOneAttrFilters = [];
-			foreach($searchAttributes as $attr) {
-				$wordMatchOneAttrFilters[] = $attr . '=' . $word;
-			}
-			$wordFilters[] = $this->combineFilterWithOr($wordMatchOneAttrFilters);
-		}
-		return $this->combineFilterWithAnd($wordFilters);
-	}
-
-	/**
-	 * creates a filter part for searches
-	 * @param string $search the search term
-	 * @param string[]|null $searchAttributes
-	 * @param string $fallbackAttribute a fallback attribute in case the user
-	 * did not define search attributes. Typically the display name attribute.
-	 * @return string the final filter part to use in LDAP searches
-	 */
-	private function getFilterPartForSearch($search, $searchAttributes, $fallbackAttribute) {
-		$filter = [];
-		$haveMultiSearchAttributes = (is_array($searchAttributes) && count($searchAttributes) > 0);
-		if($haveMultiSearchAttributes && strpos(trim($search), ' ') !== false) {
-			try {
-				return $this->getAdvancedFilterPartForSearch($search, $searchAttributes);
-			} catch(\Exception $e) {
-				\OCP\Util::writeLog(
-					'user_ldap',
-					'Creating advanced filter for search failed, falling back to simple method.',
-					ILogger::INFO
-				);
-			}
-		}
-
-		$search = $this->prepareSearchTerm($search);
-		if(!is_array($searchAttributes) || count($searchAttributes) === 0) {
-			if ($fallbackAttribute === '') {
-				return '';
-			}
-			$filter[] = $fallbackAttribute . '=' . $search;
-		} else {
-			foreach($searchAttributes as $attribute) {
-				$filter[] = $attribute . '=' . $search;
-			}
-		}
-		if(count($filter) === 1) {
-			return '('.$filter[0].')';
-		}
-		return $this->combineFilterWithOr($filter);
-	}
-
-	/**
-	 * returns the search term depending on whether we are allowed
-	 * list users found by ldap with the current input appended by
-	 * a *
-	 * @return string
-	 */
-	private function prepareSearchTerm($term) {
-		$config = \OC::$server->getConfig();
-
-		$allowEnum = $config->getAppValue('core', 'shareapi_allow_share_dialog_user_enumeration', 'yes');
-
-		$result = $term;
-		if ($term === '') {
-			$result = '*';
-		} else if ($allowEnum !== 'no') {
-			$result = $term . '*';
-		}
-		return $result;
-	}
-
-	/**
-	 * returns the filter used for counting users
-	 * @return string
-	 */
-	public function getFilterForUserCount() {
-		$filter = $this->combineFilterWithAnd([
-			$this->connection->ldapUserFilter,
-			$this->connection->ldapUserDisplayName . '=*'
-		]);
-
-		return $filter;
-	}
-
-	/**
-	 * @param string $name
-	 * @param string $password
-	 * @return bool
-	 */
-	public function areCredentialsValid($name, $password) {
-		$name = $this->helper->DNasBaseParameter($name);
-		$testConnection = clone $this->connection;
-		$credentials = [
-			'ldapAgentName' => $name,
-			'ldapAgentPassword' => $password
-		];
-		if(!$testConnection->setConfiguration($credentials)) {
-			return false;
-		}
-		return $testConnection->bind();
-	}
-
-	/**
-	 * reverse lookup of a DN given a known UUID
-	 *
-	 * @param string $uuid
-	 * @return string
-	 * @throws \Exception
-	 */
-	public function getUserDnByUuid($uuid) {
-		$uuidOverride = $this->connection->ldapExpertUUIDUserAttr;
-		$filter       = $this->connection->ldapUserFilter;
-		$base         = $this->connection->ldapBaseUsers;
-
-		if ($this->connection->ldapUuidUserAttribute === 'auto' && $uuidOverride === '') {
-			// Sacrebleu! The UUID attribute is unknown :( We need first an
-			// existing DN to be able to reliably detect it.
-			$result = $this->search($filter, $base, ['dn'], 1);
-			if(!isset($result[0]) || !isset($result[0]['dn'])) {
-				throw new \Exception('Cannot determine UUID attribute');
-			}
-			$dn = $result[0]['dn'][0];
-			if(!$this->detectUuidAttribute($dn, true)) {
-				throw new \Exception('Cannot determine UUID attribute');
-			}
-		} else {
-			// The UUID attribute is either known or an override is given.
-			// By calling this method we ensure that $this->connection->$uuidAttr
-			// is definitely set
-			if(!$this->detectUuidAttribute('', true)) {
-				throw new \Exception('Cannot determine UUID attribute');
-			}
-		}
-
-		$uuidAttr = $this->connection->ldapUuidUserAttribute;
-		if($uuidAttr === 'guid' || $uuidAttr === 'objectguid') {
-			$uuid = $this->formatGuid2ForFilterUser($uuid);
-		}
-
-		$filter = $uuidAttr . '=' . $uuid;
-		$result = $this->searchUsers($filter, ['dn'], 2);
-		if(is_array($result) && isset($result[0]) && isset($result[0]['dn']) && count($result) === 1) {
-			// we put the count into account to make sure that this is
-			// really unique
-			return $result[0]['dn'][0];
-		}
-
-		throw new \Exception('Cannot determine UUID attribute');
-	}
-
-	/**
-	 * auto-detects the directory's UUID attribute
-	 *
-	 * @param string $dn a known DN used to check against
-	 * @param bool $isUser
-	 * @param bool $force the detection should be run, even if it is not set to auto
-	 * @param array|null $ldapRecord
-	 * @return bool true on success, false otherwise
-	 * @throws ServerNotAvailableException
-	 */
-	private function detectUuidAttribute($dn, $isUser = true, $force = false, array $ldapRecord = null) {
-		if($isUser) {
-			$uuidAttr     = 'ldapUuidUserAttribute';
-			$uuidOverride = $this->connection->ldapExpertUUIDUserAttr;
-		} else {
-			$uuidAttr     = 'ldapUuidGroupAttribute';
-			$uuidOverride = $this->connection->ldapExpertUUIDGroupAttr;
-		}
-
-		if(!$force) {
-			if($this->connection->$uuidAttr !== 'auto') {
-				return true;
-			} else if (is_string($uuidOverride) && trim($uuidOverride) !== '') {
-				$this->connection->$uuidAttr = $uuidOverride;
-				return true;
-			}
-
-			$attribute = $this->connection->getFromCache($uuidAttr);
-			if(!$attribute === null) {
-				$this->connection->$uuidAttr = $attribute;
-				return true;
-			}
-		}
-
-		foreach(self::UUID_ATTRIBUTES as $attribute) {
-			if($ldapRecord !== null) {
-				// we have the info from LDAP already, we don't need to talk to the server again
-				if(isset($ldapRecord[$attribute])) {
-					$this->connection->$uuidAttr = $attribute;
-					return true;
-				}
-			}
-
-			$value = $this->readAttribute($dn, $attribute);
-			if(is_array($value) && isset($value[0]) && !empty($value[0])) {
-				\OC::$server->getLogger()->debug(
-					'Setting {attribute} as {subject}',
-					[
-						'app' => 'user_ldap',
-						'attribute' => $attribute,
-						'subject' => $uuidAttr
-					]
-				);
-				$this->connection->$uuidAttr = $attribute;
-				$this->connection->writeToCache($uuidAttr, $attribute);
-				return true;
-			}
-		}
-		\OC::$server->getLogger()->debug('Could not autodetect the UUID attribute', ['app' => 'user_ldap']);
-
-		return false;
-	}
-
-	/**
-	 * @param string $dn
-	 * @param bool $isUser
-	 * @param null $ldapRecord
-	 * @return bool|string
-	 * @throws ServerNotAvailableException
-	 */
-	public function getUUID($dn, $isUser = true, $ldapRecord = null) {
-		if($isUser) {
-			$uuidAttr     = 'ldapUuidUserAttribute';
-			$uuidOverride = $this->connection->ldapExpertUUIDUserAttr;
-		} else {
-			$uuidAttr     = 'ldapUuidGroupAttribute';
-			$uuidOverride = $this->connection->ldapExpertUUIDGroupAttr;
-		}
-
-		$uuid = false;
-		if($this->detectUuidAttribute($dn, $isUser, false, $ldapRecord)) {
-			$attr = $this->connection->$uuidAttr;
-			$uuid = isset($ldapRecord[$attr]) ? $ldapRecord[$attr] : $this->readAttribute($dn, $attr);
-			if( !is_array($uuid)
-				&& $uuidOverride !== ''
-				&& $this->detectUuidAttribute($dn, $isUser, true, $ldapRecord))
-			{
-				$uuid = isset($ldapRecord[$this->connection->$uuidAttr])
-					? $ldapRecord[$this->connection->$uuidAttr]
-					: $this->readAttribute($dn, $this->connection->$uuidAttr);
-			}
-			if(is_array($uuid) && isset($uuid[0]) && !empty($uuid[0])) {
-				$uuid = $uuid[0];
-			}
-		}
-
-		return $uuid;
-	}
-
-	/**
-	 * converts a binary ObjectGUID into a string representation
-	 * @param string $oguid the ObjectGUID in it's binary form as retrieved from AD
-	 * @return string
-	 * @link http://www.php.net/manual/en/function.ldap-get-values-len.php#73198
-	 */
-	private function convertObjectGUID2Str($oguid) {
-		$hex_guid = bin2hex($oguid);
-		$hex_guid_to_guid_str = '';
-		for($k = 1; $k <= 4; ++$k) {
-			$hex_guid_to_guid_str .= substr($hex_guid, 8 - 2 * $k, 2);
-		}
-		$hex_guid_to_guid_str .= '-';
-		for($k = 1; $k <= 2; ++$k) {
-			$hex_guid_to_guid_str .= substr($hex_guid, 12 - 2 * $k, 2);
-		}
-		$hex_guid_to_guid_str .= '-';
-		for($k = 1; $k <= 2; ++$k) {
-			$hex_guid_to_guid_str .= substr($hex_guid, 16 - 2 * $k, 2);
-		}
-		$hex_guid_to_guid_str .= '-' . substr($hex_guid, 16, 4);
-		$hex_guid_to_guid_str .= '-' . substr($hex_guid, 20);
-
-		return strtoupper($hex_guid_to_guid_str);
-	}
-
-	/**
-	 * the first three blocks of the string-converted GUID happen to be in
-	 * reverse order. In order to use it in a filter, this needs to be
-	 * corrected. Furthermore the dashes need to be replaced and \\ preprended
-	 * to every two hax figures.
-	 *
-	 * If an invalid string is passed, it will be returned without change.
-	 *
-	 * @param string $guid
-	 * @return string
-	 */
-	public function formatGuid2ForFilterUser($guid) {
-		if(!is_string($guid)) {
-			throw new \InvalidArgumentException('String expected');
-		}
-		$blocks = explode('-', $guid);
-		if(count($blocks) !== 5) {
-			/*
+        $findings = [];
+        $savedoffset = $offset;
+        do {
+            $search = $this->executeSearch($filter, $base, $attr, $limitPerPage, $offset);
+            if($search === false) {
+                return [];
+            }
+            list($sr, $pagedSearchOK) = $search;
+            $cr = $this->connection->getConnectionResource();
+
+            if($skipHandling) {
+                //i.e. result do not need to be fetched, we just need the cookie
+                //thus pass 1 or any other value as $iFoundItems because it is not
+                //used
+                $this->processPagedSearchStatus($sr, $filter, $base, 1, $limitPerPage,
+                                $offset, $pagedSearchOK,
+                                $skipHandling);
+                return [];
+            }
+
+            $iFoundItems = 0;
+            foreach($sr as $res) {
+                $findings = array_merge($findings, $this->invokeLDAPMethod('getEntries', $cr, $res));
+                $iFoundItems = max($iFoundItems, $findings['count']);
+                unset($findings['count']);
+            }
+
+            $continue = $this->processPagedSearchStatus($sr, $filter, $base, $iFoundItems,
+                $limitPerPage, $offset, $pagedSearchOK,
+                                        $skipHandling);
+            $offset += $limitPerPage;
+        } while ($continue && $pagedSearchOK && ($limit === null || count($findings) < $limit));
+        // reseting offset
+        $offset = $savedoffset;
+
+        // if we're here, probably no connection resource is returned.
+        // to make Nextcloud behave nicely, we simply give back an empty array.
+        if(is_null($findings)) {
+            return [];
+        }
+
+        if(!is_null($attr)) {
+            $selection = [];
+            $i = 0;
+            foreach($findings as $item) {
+                if(!is_array($item)) {
+                    continue;
+                }
+                $item = \OCP\Util::mb_array_change_key_case($item, MB_CASE_LOWER, 'UTF-8');
+                foreach($attr as $key) {
+                    if(isset($item[$key])) {
+                        if(is_array($item[$key]) && isset($item[$key]['count'])) {
+                            unset($item[$key]['count']);
+                        }
+                        if($key !== 'dn') {
+                            if($this->resemblesDN($key)) {
+                                $selection[$i][$key] = $this->helper->sanitizeDN($item[$key]);
+                            } else if($key === 'objectguid' || $key === 'guid') {
+                                $selection[$i][$key] = [$this->convertObjectGUID2Str($item[$key][0])];
+                            } else {
+                                $selection[$i][$key] = $item[$key];
+                            }
+                        } else {
+                            $selection[$i][$key] = [$this->helper->sanitizeDN($item[$key])];
+                        }
+                    }
+
+                }
+                $i++;
+            }
+            $findings = $selection;
+        }
+        //we slice the findings, when
+        //a) paged search unsuccessful, though attempted
+        //b) no paged search, but limit set
+        if((!$this->getPagedSearchResultState()
+            && $pagedSearchOK)
+            || (
+                !$pagedSearchOK
+                && !is_null($limit)
+            )
+        ) {
+            $findings = array_slice($findings, (int)$offset, $limit);
+        }
+        return $findings;
+    }
+
+    /**
+     * @param string $name
+     * @return string
+     * @throws \InvalidArgumentException
+     */
+    public function sanitizeUsername($name) {
+        $name = trim($name);
+
+        if($this->connection->ldapIgnoreNamingRules) {
+            return $name;
+        }
+
+        // Transliteration to ASCII
+        $transliterated = @iconv('UTF-8', 'ASCII//TRANSLIT', $name);
+        if($transliterated !== false) {
+            // depending on system config iconv can work or not
+            $name = $transliterated;
+        }
+
+        // Replacements
+        $name = str_replace(' ', '_', $name);
+
+        // Every remaining disallowed characters will be removed
+        $name = preg_replace('/[^a-zA-Z0-9_.@-]/u', '', $name);
+
+        if($name === '') {
+            throw new \InvalidArgumentException('provided name template for username does not contain any allowed characters');
+        }
+
+        return $name;
+    }
+
+    /**
+     * escapes (user provided) parts for LDAP filter
+     * @param string $input, the provided value
+     * @param bool $allowAsterisk whether in * at the beginning should be preserved
+     * @return string the escaped string
+     */
+    public function escapeFilterPart($input, $allowAsterisk = false) {
+        $asterisk = '';
+        if($allowAsterisk && strlen($input) > 0 && $input[0] === '*') {
+            $asterisk = '*';
+            $input = mb_substr($input, 1, null, 'UTF-8');
+        }
+        $search  = ['*', '\\', '(', ')'];
+        $replace = ['\\*', '\\\\', '\\(', '\\)'];
+        return $asterisk . str_replace($search, $replace, $input);
+    }
+
+    /**
+     * combines the input filters with AND
+     * @param string[] $filters the filters to connect
+     * @return string the combined filter
+     */
+    public function combineFilterWithAnd($filters) {
+        return $this->combineFilter($filters, '&');
+    }
+
+    /**
+     * combines the input filters with OR
+     * @param string[] $filters the filters to connect
+     * @return string the combined filter
+     * Combines Filter arguments with OR
+     */
+    public function combineFilterWithOr($filters) {
+        return $this->combineFilter($filters, '|');
+    }
+
+    /**
+     * combines the input filters with given operator
+     * @param string[] $filters the filters to connect
+     * @param string $operator either & or |
+     * @return string the combined filter
+     */
+    private function combineFilter($filters, $operator) {
+        $combinedFilter = '('.$operator;
+        foreach($filters as $filter) {
+            if ($filter !== '' && $filter[0] !== '(') {
+                $filter = '('.$filter.')';
+            }
+            $combinedFilter.=$filter;
+        }
+        $combinedFilter.=')';
+        return $combinedFilter;
+    }
+
+    /**
+     * creates a filter part for to perform search for users
+     * @param string $search the search term
+     * @return string the final filter part to use in LDAP searches
+     */
+    public function getFilterPartForUserSearch($search) {
+        return $this->getFilterPartForSearch($search,
+            $this->connection->ldapAttributesForUserSearch,
+            $this->connection->ldapUserDisplayName);
+    }
+
+    /**
+     * creates a filter part for to perform search for groups
+     * @param string $search the search term
+     * @return string the final filter part to use in LDAP searches
+     */
+    public function getFilterPartForGroupSearch($search) {
+        return $this->getFilterPartForSearch($search,
+            $this->connection->ldapAttributesForGroupSearch,
+            $this->connection->ldapGroupDisplayName);
+    }
+
+    /**
+     * creates a filter part for searches by splitting up the given search
+     * string into single words
+     * @param string $search the search term
+     * @param string[] $searchAttributes needs to have at least two attributes,
+     * otherwise it does not make sense :)
+     * @return string the final filter part to use in LDAP searches
+     * @throws \Exception
+     */
+    private function getAdvancedFilterPartForSearch($search, $searchAttributes) {
+        if(!is_array($searchAttributes) || count($searchAttributes) < 2) {
+            throw new \Exception('searchAttributes must be an array with at least two string');
+        }
+        $searchWords = explode(' ', trim($search));
+        $wordFilters = [];
+        foreach($searchWords as $word) {
+            $word = $this->prepareSearchTerm($word);
+            //every word needs to appear at least once
+            $wordMatchOneAttrFilters = [];
+            foreach($searchAttributes as $attr) {
+                $wordMatchOneAttrFilters[] = $attr . '=' . $word;
+            }
+            $wordFilters[] = $this->combineFilterWithOr($wordMatchOneAttrFilters);
+        }
+        return $this->combineFilterWithAnd($wordFilters);
+    }
+
+    /**
+     * creates a filter part for searches
+     * @param string $search the search term
+     * @param string[]|null $searchAttributes
+     * @param string $fallbackAttribute a fallback attribute in case the user
+     * did not define search attributes. Typically the display name attribute.
+     * @return string the final filter part to use in LDAP searches
+     */
+    private function getFilterPartForSearch($search, $searchAttributes, $fallbackAttribute) {
+        $filter = [];
+        $haveMultiSearchAttributes = (is_array($searchAttributes) && count($searchAttributes) > 0);
+        if($haveMultiSearchAttributes && strpos(trim($search), ' ') !== false) {
+            try {
+                return $this->getAdvancedFilterPartForSearch($search, $searchAttributes);
+            } catch(\Exception $e) {
+                \OCP\Util::writeLog(
+                    'user_ldap',
+                    'Creating advanced filter for search failed, falling back to simple method.',
+                    ILogger::INFO
+                );
+            }
+        }
+
+        $search = $this->prepareSearchTerm($search);
+        if(!is_array($searchAttributes) || count($searchAttributes) === 0) {
+            if ($fallbackAttribute === '') {
+                return '';
+            }
+            $filter[] = $fallbackAttribute . '=' . $search;
+        } else {
+            foreach($searchAttributes as $attribute) {
+                $filter[] = $attribute . '=' . $search;
+            }
+        }
+        if(count($filter) === 1) {
+            return '('.$filter[0].')';
+        }
+        return $this->combineFilterWithOr($filter);
+    }
+
+    /**
+     * returns the search term depending on whether we are allowed
+     * list users found by ldap with the current input appended by
+     * a *
+     * @return string
+     */
+    private function prepareSearchTerm($term) {
+        $config = \OC::$server->getConfig();
+
+        $allowEnum = $config->getAppValue('core', 'shareapi_allow_share_dialog_user_enumeration', 'yes');
+
+        $result = $term;
+        if ($term === '') {
+            $result = '*';
+        } else if ($allowEnum !== 'no') {
+            $result = $term . '*';
+        }
+        return $result;
+    }
+
+    /**
+     * returns the filter used for counting users
+     * @return string
+     */
+    public function getFilterForUserCount() {
+        $filter = $this->combineFilterWithAnd([
+            $this->connection->ldapUserFilter,
+            $this->connection->ldapUserDisplayName . '=*'
+        ]);
+
+        return $filter;
+    }
+
+    /**
+     * @param string $name
+     * @param string $password
+     * @return bool
+     */
+    public function areCredentialsValid($name, $password) {
+        $name = $this->helper->DNasBaseParameter($name);
+        $testConnection = clone $this->connection;
+        $credentials = [
+            'ldapAgentName' => $name,
+            'ldapAgentPassword' => $password
+        ];
+        if(!$testConnection->setConfiguration($credentials)) {
+            return false;
+        }
+        return $testConnection->bind();
+    }
+
+    /**
+     * reverse lookup of a DN given a known UUID
+     *
+     * @param string $uuid
+     * @return string
+     * @throws \Exception
+     */
+    public function getUserDnByUuid($uuid) {
+        $uuidOverride = $this->connection->ldapExpertUUIDUserAttr;
+        $filter       = $this->connection->ldapUserFilter;
+        $base         = $this->connection->ldapBaseUsers;
+
+        if ($this->connection->ldapUuidUserAttribute === 'auto' && $uuidOverride === '') {
+            // Sacrebleu! The UUID attribute is unknown :( We need first an
+            // existing DN to be able to reliably detect it.
+            $result = $this->search($filter, $base, ['dn'], 1);
+            if(!isset($result[0]) || !isset($result[0]['dn'])) {
+                throw new \Exception('Cannot determine UUID attribute');
+            }
+            $dn = $result[0]['dn'][0];
+            if(!$this->detectUuidAttribute($dn, true)) {
+                throw new \Exception('Cannot determine UUID attribute');
+            }
+        } else {
+            // The UUID attribute is either known or an override is given.
+            // By calling this method we ensure that $this->connection->$uuidAttr
+            // is definitely set
+            if(!$this->detectUuidAttribute('', true)) {
+                throw new \Exception('Cannot determine UUID attribute');
+            }
+        }
+
+        $uuidAttr = $this->connection->ldapUuidUserAttribute;
+        if($uuidAttr === 'guid' || $uuidAttr === 'objectguid') {
+            $uuid = $this->formatGuid2ForFilterUser($uuid);
+        }
+
+        $filter = $uuidAttr . '=' . $uuid;
+        $result = $this->searchUsers($filter, ['dn'], 2);
+        if(is_array($result) && isset($result[0]) && isset($result[0]['dn']) && count($result) === 1) {
+            // we put the count into account to make sure that this is
+            // really unique
+            return $result[0]['dn'][0];
+        }
+
+        throw new \Exception('Cannot determine UUID attribute');
+    }
+
+    /**
+     * auto-detects the directory's UUID attribute
+     *
+     * @param string $dn a known DN used to check against
+     * @param bool $isUser
+     * @param bool $force the detection should be run, even if it is not set to auto
+     * @param array|null $ldapRecord
+     * @return bool true on success, false otherwise
+     * @throws ServerNotAvailableException
+     */
+    private function detectUuidAttribute($dn, $isUser = true, $force = false, array $ldapRecord = null) {
+        if($isUser) {
+            $uuidAttr     = 'ldapUuidUserAttribute';
+            $uuidOverride = $this->connection->ldapExpertUUIDUserAttr;
+        } else {
+            $uuidAttr     = 'ldapUuidGroupAttribute';
+            $uuidOverride = $this->connection->ldapExpertUUIDGroupAttr;
+        }
+
+        if(!$force) {
+            if($this->connection->$uuidAttr !== 'auto') {
+                return true;
+            } else if (is_string($uuidOverride) && trim($uuidOverride) !== '') {
+                $this->connection->$uuidAttr = $uuidOverride;
+                return true;
+            }
+
+            $attribute = $this->connection->getFromCache($uuidAttr);
+            if(!$attribute === null) {
+                $this->connection->$uuidAttr = $attribute;
+                return true;
+            }
+        }
+
+        foreach(self::UUID_ATTRIBUTES as $attribute) {
+            if($ldapRecord !== null) {
+                // we have the info from LDAP already, we don't need to talk to the server again
+                if(isset($ldapRecord[$attribute])) {
+                    $this->connection->$uuidAttr = $attribute;
+                    return true;
+                }
+            }
+
+            $value = $this->readAttribute($dn, $attribute);
+            if(is_array($value) && isset($value[0]) && !empty($value[0])) {
+                \OC::$server->getLogger()->debug(
+                    'Setting {attribute} as {subject}',
+                    [
+                        'app' => 'user_ldap',
+                        'attribute' => $attribute,
+                        'subject' => $uuidAttr
+                    ]
+                );
+                $this->connection->$uuidAttr = $attribute;
+                $this->connection->writeToCache($uuidAttr, $attribute);
+                return true;
+            }
+        }
+        \OC::$server->getLogger()->debug('Could not autodetect the UUID attribute', ['app' => 'user_ldap']);
+
+        return false;
+    }
+
+    /**
+     * @param string $dn
+     * @param bool $isUser
+     * @param null $ldapRecord
+     * @return bool|string
+     * @throws ServerNotAvailableException
+     */
+    public function getUUID($dn, $isUser = true, $ldapRecord = null) {
+        if($isUser) {
+            $uuidAttr     = 'ldapUuidUserAttribute';
+            $uuidOverride = $this->connection->ldapExpertUUIDUserAttr;
+        } else {
+            $uuidAttr     = 'ldapUuidGroupAttribute';
+            $uuidOverride = $this->connection->ldapExpertUUIDGroupAttr;
+        }
+
+        $uuid = false;
+        if($this->detectUuidAttribute($dn, $isUser, false, $ldapRecord)) {
+            $attr = $this->connection->$uuidAttr;
+            $uuid = isset($ldapRecord[$attr]) ? $ldapRecord[$attr] : $this->readAttribute($dn, $attr);
+            if( !is_array($uuid)
+                && $uuidOverride !== ''
+                && $this->detectUuidAttribute($dn, $isUser, true, $ldapRecord))
+            {
+                $uuid = isset($ldapRecord[$this->connection->$uuidAttr])
+                    ? $ldapRecord[$this->connection->$uuidAttr]
+                    : $this->readAttribute($dn, $this->connection->$uuidAttr);
+            }
+            if(is_array($uuid) && isset($uuid[0]) && !empty($uuid[0])) {
+                $uuid = $uuid[0];
+            }
+        }
+
+        return $uuid;
+    }
+
+    /**
+     * converts a binary ObjectGUID into a string representation
+     * @param string $oguid the ObjectGUID in it's binary form as retrieved from AD
+     * @return string
+     * @link http://www.php.net/manual/en/function.ldap-get-values-len.php#73198
+     */
+    private function convertObjectGUID2Str($oguid) {
+        $hex_guid = bin2hex($oguid);
+        $hex_guid_to_guid_str = '';
+        for($k = 1; $k <= 4; ++$k) {
+            $hex_guid_to_guid_str .= substr($hex_guid, 8 - 2 * $k, 2);
+        }
+        $hex_guid_to_guid_str .= '-';
+        for($k = 1; $k <= 2; ++$k) {
+            $hex_guid_to_guid_str .= substr($hex_guid, 12 - 2 * $k, 2);
+        }
+        $hex_guid_to_guid_str .= '-';
+        for($k = 1; $k <= 2; ++$k) {
+            $hex_guid_to_guid_str .= substr($hex_guid, 16 - 2 * $k, 2);
+        }
+        $hex_guid_to_guid_str .= '-' . substr($hex_guid, 16, 4);
+        $hex_guid_to_guid_str .= '-' . substr($hex_guid, 20);
+
+        return strtoupper($hex_guid_to_guid_str);
+    }
+
+    /**
+     * the first three blocks of the string-converted GUID happen to be in
+     * reverse order. In order to use it in a filter, this needs to be
+     * corrected. Furthermore the dashes need to be replaced and \\ preprended
+     * to every two hax figures.
+     *
+     * If an invalid string is passed, it will be returned without change.
+     *
+     * @param string $guid
+     * @return string
+     */
+    public function formatGuid2ForFilterUser($guid) {
+        if(!is_string($guid)) {
+            throw new \InvalidArgumentException('String expected');
+        }
+        $blocks = explode('-', $guid);
+        if(count($blocks) !== 5) {
+            /*
 			 * Why not throw an Exception instead? This method is a utility
 			 * called only when trying to figure out whether a "missing" known
 			 * LDAP user was or was not renamed on the LDAP server. And this
@@ -1846,283 +1846,283 @@ 
 			 * an exception here would kill the experience for a valid, acting
 			 * user. Instead we write a log message.
 			 */
-			\OC::$server->getLogger()->info(
-				'Passed string does not resemble a valid GUID. Known UUID ' .
-				'({uuid}) probably does not match UUID configuration.',
-				[ 'app' => 'user_ldap', 'uuid' => $guid ]
-			);
-			return $guid;
-		}
-		for($i=0; $i < 3; $i++) {
-			$pairs = str_split($blocks[$i], 2);
-			$pairs = array_reverse($pairs);
-			$blocks[$i] = implode('', $pairs);
-		}
-		for($i=0; $i < 5; $i++) {
-			$pairs = str_split($blocks[$i], 2);
-			$blocks[$i] = '\\' . implode('\\', $pairs);
-		}
-		return implode('', $blocks);
-	}
-
-	/**
-	 * gets a SID of the domain of the given dn
-	 *
-	 * @param string $dn
-	 * @return string|bool
-	 * @throws ServerNotAvailableException
-	 */
-	public function getSID($dn) {
-		$domainDN = $this->getDomainDNFromDN($dn);
-		$cacheKey = 'getSID-'.$domainDN;
-		$sid = $this->connection->getFromCache($cacheKey);
-		if(!is_null($sid)) {
-			return $sid;
-		}
-
-		$objectSid = $this->readAttribute($domainDN, 'objectsid');
-		if(!is_array($objectSid) || empty($objectSid)) {
-			$this->connection->writeToCache($cacheKey, false);
-			return false;
-		}
-		$domainObjectSid = $this->convertSID2Str($objectSid[0]);
-		$this->connection->writeToCache($cacheKey, $domainObjectSid);
-
-		return $domainObjectSid;
-	}
-
-	/**
-	 * converts a binary SID into a string representation
-	 * @param string $sid
-	 * @return string
-	 */
-	public function convertSID2Str($sid) {
-		// The format of a SID binary string is as follows:
-		// 1 byte for the revision level
-		// 1 byte for the number n of variable sub-ids
-		// 6 bytes for identifier authority value
-		// n*4 bytes for n sub-ids
-		//
-		// Example: 010400000000000515000000a681e50e4d6c6c2bca32055f
-		//  Legend: RRNNAAAAAAAAAAAA11111111222222223333333344444444
-		$revision = ord($sid[0]);
-		$numberSubID = ord($sid[1]);
-
-		$subIdStart = 8; // 1 + 1 + 6
-		$subIdLength = 4;
-		if (strlen($sid) !== $subIdStart + $subIdLength * $numberSubID) {
-			// Incorrect number of bytes present.
-			return '';
-		}
-
-		// 6 bytes = 48 bits can be represented using floats without loss of
-		// precision (see https://gist.github.com/bantu/886ac680b0aef5812f71)
-		$iav = number_format(hexdec(bin2hex(substr($sid, 2, 6))), 0, '', '');
-
-		$subIDs = [];
-		for ($i = 0; $i < $numberSubID; $i++) {
-			$subID = unpack('V', substr($sid, $subIdStart + $subIdLength * $i, $subIdLength));
-			$subIDs[] = sprintf('%u', $subID[1]);
-		}
-
-		// Result for example above: S-1-5-21-249921958-728525901-1594176202
-		return sprintf('S-%d-%s-%s', $revision, $iav, implode('-', $subIDs));
-	}
-
-	/**
-	 * checks if the given DN is part of the given base DN(s)
-	 * @param string $dn the DN
-	 * @param string[] $bases array containing the allowed base DN or DNs
-	 * @return bool
-	 */
-	public function isDNPartOfBase($dn, $bases) {
-		$belongsToBase = false;
-		$bases = $this->helper->sanitizeDN($bases);
-
-		foreach($bases as $base) {
-			$belongsToBase = true;
-			if(mb_strripos($dn, $base, 0, 'UTF-8') !== (mb_strlen($dn, 'UTF-8')-mb_strlen($base, 'UTF-8'))) {
-				$belongsToBase = false;
-			}
-			if($belongsToBase) {
-				break;
-			}
-		}
-		return $belongsToBase;
-	}
-
-	/**
-	 * resets a running Paged Search operation
-	 *
-	 * @throws ServerNotAvailableException
-	 */
-	private function abandonPagedSearch() {
-		$cr = $this->connection->getConnectionResource();
-		$this->invokeLDAPMethod('controlPagedResult', $cr, 0, false, $this->lastCookie);
-		$this->getPagedSearchResultState();
-		$this->lastCookie = '';
-		$this->cookies = [];
-	}
-
-	/**
-	 * get a cookie for the next LDAP paged search
-	 * @param string $base a string with the base DN for the search
-	 * @param string $filter the search filter to identify the correct search
-	 * @param int $limit the limit (or 'pageSize'), to identify the correct search well
-	 * @param int $offset the offset for the new search to identify the correct search really good
-	 * @return string containing the key or empty if none is cached
-	 */
-	private function getPagedResultCookie($base, $filter, $limit, $offset) {
-		if($offset === 0) {
-			return '';
-		}
-		$offset -= $limit;
-		//we work with cache here
-		$cacheKey = 'lc' . crc32($base) . '-' . crc32($filter) . '-' . (int)$limit . '-' . (int)$offset;
-		$cookie = '';
-		if(isset($this->cookies[$cacheKey])) {
-			$cookie = $this->cookies[$cacheKey];
-			if(is_null($cookie)) {
-				$cookie = '';
-			}
-		}
-		return $cookie;
-	}
-
-	/**
-	 * checks whether an LDAP paged search operation has more pages that can be
-	 * retrieved, typically when offset and limit are provided.
-	 *
-	 * Be very careful to use it: the last cookie value, which is inspected, can
-	 * be reset by other operations. Best, call it immediately after a search(),
-	 * searchUsers() or searchGroups() call. count-methods are probably safe as
-	 * well. Don't rely on it with any fetchList-method.
-	 * @return bool
-	 */
-	public function hasMoreResults() {
-		if(empty($this->lastCookie) && $this->lastCookie !== '0') {
-			// as in RFC 2696, when all results are returned, the cookie will
-			// be empty.
-			return false;
-		}
-
-		return true;
-	}
-
-	/**
-	 * set a cookie for LDAP paged search run
-	 * @param string $base a string with the base DN for the search
-	 * @param string $filter the search filter to identify the correct search
-	 * @param int $limit the limit (or 'pageSize'), to identify the correct search well
-	 * @param int $offset the offset for the run search to identify the correct search really good
-	 * @param string $cookie string containing the cookie returned by ldap_control_paged_result_response
-	 * @return void
-	 */
-	private function setPagedResultCookie($base, $filter, $limit, $offset, $cookie) {
-		// allow '0' for 389ds
-		if(!empty($cookie) || $cookie === '0') {
-			$cacheKey = 'lc' . crc32($base) . '-' . crc32($filter) . '-' . (int)$limit . '-' . (int)$offset;
-			$this->cookies[$cacheKey] = $cookie;
-			$this->lastCookie = $cookie;
-		}
-	}
-
-	/**
-	 * Check whether the most recent paged search was successful. It flushed the state var. Use it always after a possible paged search.
-	 * @return boolean|null true on success, null or false otherwise
-	 */
-	public function getPagedSearchResultState() {
-		$result = $this->pagedSearchedSuccessful;
-		$this->pagedSearchedSuccessful = null;
-		return $result;
-	}
-
-	/**
-	 * Prepares a paged search, if possible
-	 *
-	 * @param string $filter the LDAP filter for the search
-	 * @param string[] $bases an array containing the LDAP subtree(s) that shall be searched
-	 * @param string[] $attr optional, when a certain attribute shall be filtered outside
-	 * @param int $limit
-	 * @param int $offset
-	 * @return bool|true
-	 * @throws ServerNotAvailableException
-	 */
-	private function initPagedSearch($filter, $bases, $attr, $limit, $offset) {
-		$pagedSearchOK = false;
-		if ($limit !== 0) {
-			$offset = (int)$offset; //can be null
-			\OCP\Util::writeLog('user_ldap',
-				'initializing paged search for  Filter '.$filter.' base '.print_r($bases, true)
-				.' attr '.print_r($attr, true). ' limit ' .$limit.' offset '.$offset,
-				ILogger::DEBUG);
-			//get the cookie from the search for the previous search, required by LDAP
-			foreach($bases as $base) {
-
-				$cookie = $this->getPagedResultCookie($base, $filter, $limit, $offset);
-				if(empty($cookie) && $cookie !== "0" && ($offset > 0)) {
-					// no cookie known from a potential previous search. We need
-					// to start from 0 to come to the desired page. cookie value
-					// of '0' is valid, because 389ds
-					$reOffset = ($offset - $limit) < 0 ? 0 : $offset - $limit;
-					$this->search($filter, [$base], $attr, $limit, $reOffset, true);
-					$cookie = $this->getPagedResultCookie($base, $filter, $limit, $offset);
-					//still no cookie? obviously, the server does not like us. Let's skip paging efforts.
-					// '0' is valid, because 389ds
-					//TODO: remember this, probably does not change in the next request...
-					if(empty($cookie) && $cookie !== '0') {
-						$cookie = null;
-					}
-				}
-				if(!is_null($cookie)) {
-					//since offset = 0, this is a new search. We abandon other searches that might be ongoing.
-					$this->abandonPagedSearch();
-					$pagedSearchOK = $this->invokeLDAPMethod('controlPagedResult',
-						$this->connection->getConnectionResource(), $limit,
-						false, $cookie);
-					if(!$pagedSearchOK) {
-						return false;
-					}
-					\OCP\Util::writeLog('user_ldap', 'Ready for a paged search', ILogger::DEBUG);
-				} else {
-					$e = new \Exception('No paged search possible, Limit '.$limit.' Offset '.$offset);
-					\OC::$server->getLogger()->logException($e, ['level' => ILogger::DEBUG]);
-				}
-
-			}
-		/* ++ Fixing RHDS searches with pages with zero results ++
+            \OC::$server->getLogger()->info(
+                'Passed string does not resemble a valid GUID. Known UUID ' .
+                '({uuid}) probably does not match UUID configuration.',
+                [ 'app' => 'user_ldap', 'uuid' => $guid ]
+            );
+            return $guid;
+        }
+        for($i=0; $i < 3; $i++) {
+            $pairs = str_split($blocks[$i], 2);
+            $pairs = array_reverse($pairs);
+            $blocks[$i] = implode('', $pairs);
+        }
+        for($i=0; $i < 5; $i++) {
+            $pairs = str_split($blocks[$i], 2);
+            $blocks[$i] = '\\' . implode('\\', $pairs);
+        }
+        return implode('', $blocks);
+    }
+
+    /**
+     * gets a SID of the domain of the given dn
+     *
+     * @param string $dn
+     * @return string|bool
+     * @throws ServerNotAvailableException
+     */
+    public function getSID($dn) {
+        $domainDN = $this->getDomainDNFromDN($dn);
+        $cacheKey = 'getSID-'.$domainDN;
+        $sid = $this->connection->getFromCache($cacheKey);
+        if(!is_null($sid)) {
+            return $sid;
+        }
+
+        $objectSid = $this->readAttribute($domainDN, 'objectsid');
+        if(!is_array($objectSid) || empty($objectSid)) {
+            $this->connection->writeToCache($cacheKey, false);
+            return false;
+        }
+        $domainObjectSid = $this->convertSID2Str($objectSid[0]);
+        $this->connection->writeToCache($cacheKey, $domainObjectSid);
+
+        return $domainObjectSid;
+    }
+
+    /**
+     * converts a binary SID into a string representation
+     * @param string $sid
+     * @return string
+     */
+    public function convertSID2Str($sid) {
+        // The format of a SID binary string is as follows:
+        // 1 byte for the revision level
+        // 1 byte for the number n of variable sub-ids
+        // 6 bytes for identifier authority value
+        // n*4 bytes for n sub-ids
+        //
+        // Example: 010400000000000515000000a681e50e4d6c6c2bca32055f
+        //  Legend: RRNNAAAAAAAAAAAA11111111222222223333333344444444
+        $revision = ord($sid[0]);
+        $numberSubID = ord($sid[1]);
+
+        $subIdStart = 8; // 1 + 1 + 6
+        $subIdLength = 4;
+        if (strlen($sid) !== $subIdStart + $subIdLength * $numberSubID) {
+            // Incorrect number of bytes present.
+            return '';
+        }
+
+        // 6 bytes = 48 bits can be represented using floats without loss of
+        // precision (see https://gist.github.com/bantu/886ac680b0aef5812f71)
+        $iav = number_format(hexdec(bin2hex(substr($sid, 2, 6))), 0, '', '');
+
+        $subIDs = [];
+        for ($i = 0; $i < $numberSubID; $i++) {
+            $subID = unpack('V', substr($sid, $subIdStart + $subIdLength * $i, $subIdLength));
+            $subIDs[] = sprintf('%u', $subID[1]);
+        }
+
+        // Result for example above: S-1-5-21-249921958-728525901-1594176202
+        return sprintf('S-%d-%s-%s', $revision, $iav, implode('-', $subIDs));
+    }
+
+    /**
+     * checks if the given DN is part of the given base DN(s)
+     * @param string $dn the DN
+     * @param string[] $bases array containing the allowed base DN or DNs
+     * @return bool
+     */
+    public function isDNPartOfBase($dn, $bases) {
+        $belongsToBase = false;
+        $bases = $this->helper->sanitizeDN($bases);
+
+        foreach($bases as $base) {
+            $belongsToBase = true;
+            if(mb_strripos($dn, $base, 0, 'UTF-8') !== (mb_strlen($dn, 'UTF-8')-mb_strlen($base, 'UTF-8'))) {
+                $belongsToBase = false;
+            }
+            if($belongsToBase) {
+                break;
+            }
+        }
+        return $belongsToBase;
+    }
+
+    /**
+     * resets a running Paged Search operation
+     *
+     * @throws ServerNotAvailableException
+     */
+    private function abandonPagedSearch() {
+        $cr = $this->connection->getConnectionResource();
+        $this->invokeLDAPMethod('controlPagedResult', $cr, 0, false, $this->lastCookie);
+        $this->getPagedSearchResultState();
+        $this->lastCookie = '';
+        $this->cookies = [];
+    }
+
+    /**
+     * get a cookie for the next LDAP paged search
+     * @param string $base a string with the base DN for the search
+     * @param string $filter the search filter to identify the correct search
+     * @param int $limit the limit (or 'pageSize'), to identify the correct search well
+     * @param int $offset the offset for the new search to identify the correct search really good
+     * @return string containing the key or empty if none is cached
+     */
+    private function getPagedResultCookie($base, $filter, $limit, $offset) {
+        if($offset === 0) {
+            return '';
+        }
+        $offset -= $limit;
+        //we work with cache here
+        $cacheKey = 'lc' . crc32($base) . '-' . crc32($filter) . '-' . (int)$limit . '-' . (int)$offset;
+        $cookie = '';
+        if(isset($this->cookies[$cacheKey])) {
+            $cookie = $this->cookies[$cacheKey];
+            if(is_null($cookie)) {
+                $cookie = '';
+            }
+        }
+        return $cookie;
+    }
+
+    /**
+     * checks whether an LDAP paged search operation has more pages that can be
+     * retrieved, typically when offset and limit are provided.
+     *
+     * Be very careful to use it: the last cookie value, which is inspected, can
+     * be reset by other operations. Best, call it immediately after a search(),
+     * searchUsers() or searchGroups() call. count-methods are probably safe as
+     * well. Don't rely on it with any fetchList-method.
+     * @return bool
+     */
+    public function hasMoreResults() {
+        if(empty($this->lastCookie) && $this->lastCookie !== '0') {
+            // as in RFC 2696, when all results are returned, the cookie will
+            // be empty.
+            return false;
+        }
+
+        return true;
+    }
+
+    /**
+     * set a cookie for LDAP paged search run
+     * @param string $base a string with the base DN for the search
+     * @param string $filter the search filter to identify the correct search
+     * @param int $limit the limit (or 'pageSize'), to identify the correct search well
+     * @param int $offset the offset for the run search to identify the correct search really good
+     * @param string $cookie string containing the cookie returned by ldap_control_paged_result_response
+     * @return void
+     */
+    private function setPagedResultCookie($base, $filter, $limit, $offset, $cookie) {
+        // allow '0' for 389ds
+        if(!empty($cookie) || $cookie === '0') {
+            $cacheKey = 'lc' . crc32($base) . '-' . crc32($filter) . '-' . (int)$limit . '-' . (int)$offset;
+            $this->cookies[$cacheKey] = $cookie;
+            $this->lastCookie = $cookie;
+        }
+    }
+
+    /**
+     * Check whether the most recent paged search was successful. It flushed the state var. Use it always after a possible paged search.
+     * @return boolean|null true on success, null or false otherwise
+     */
+    public function getPagedSearchResultState() {
+        $result = $this->pagedSearchedSuccessful;
+        $this->pagedSearchedSuccessful = null;
+        return $result;
+    }
+
+    /**
+     * Prepares a paged search, if possible
+     *
+     * @param string $filter the LDAP filter for the search
+     * @param string[] $bases an array containing the LDAP subtree(s) that shall be searched
+     * @param string[] $attr optional, when a certain attribute shall be filtered outside
+     * @param int $limit
+     * @param int $offset
+     * @return bool|true
+     * @throws ServerNotAvailableException
+     */
+    private function initPagedSearch($filter, $bases, $attr, $limit, $offset) {
+        $pagedSearchOK = false;
+        if ($limit !== 0) {
+            $offset = (int)$offset; //can be null
+            \OCP\Util::writeLog('user_ldap',
+                'initializing paged search for  Filter '.$filter.' base '.print_r($bases, true)
+                .' attr '.print_r($attr, true). ' limit ' .$limit.' offset '.$offset,
+                ILogger::DEBUG);
+            //get the cookie from the search for the previous search, required by LDAP
+            foreach($bases as $base) {
+
+                $cookie = $this->getPagedResultCookie($base, $filter, $limit, $offset);
+                if(empty($cookie) && $cookie !== "0" && ($offset > 0)) {
+                    // no cookie known from a potential previous search. We need
+                    // to start from 0 to come to the desired page. cookie value
+                    // of '0' is valid, because 389ds
+                    $reOffset = ($offset - $limit) < 0 ? 0 : $offset - $limit;
+                    $this->search($filter, [$base], $attr, $limit, $reOffset, true);
+                    $cookie = $this->getPagedResultCookie($base, $filter, $limit, $offset);
+                    //still no cookie? obviously, the server does not like us. Let's skip paging efforts.
+                    // '0' is valid, because 389ds
+                    //TODO: remember this, probably does not change in the next request...
+                    if(empty($cookie) && $cookie !== '0') {
+                        $cookie = null;
+                    }
+                }
+                if(!is_null($cookie)) {
+                    //since offset = 0, this is a new search. We abandon other searches that might be ongoing.
+                    $this->abandonPagedSearch();
+                    $pagedSearchOK = $this->invokeLDAPMethod('controlPagedResult',
+                        $this->connection->getConnectionResource(), $limit,
+                        false, $cookie);
+                    if(!$pagedSearchOK) {
+                        return false;
+                    }
+                    \OCP\Util::writeLog('user_ldap', 'Ready for a paged search', ILogger::DEBUG);
+                } else {
+                    $e = new \Exception('No paged search possible, Limit '.$limit.' Offset '.$offset);
+                    \OC::$server->getLogger()->logException($e, ['level' => ILogger::DEBUG]);
+                }
+
+            }
+        /* ++ Fixing RHDS searches with pages with zero results ++
 		 * We coudn't get paged searches working with our RHDS for login ($limit = 0),
 		 * due to pages with zero results.
 		 * So we added "&& !empty($this->lastCookie)" to this test to ignore pagination
 		 * if we don't have a previous paged search.
 		 */
-		} else if ($limit === 0 && !empty($this->lastCookie)) {
-			// a search without limit was requested. However, if we do use
-			// Paged Search once, we always must do it. This requires us to
-			// initialize it with the configured page size.
-			$this->abandonPagedSearch();
-			// in case someone set it to 0 … use 500, otherwise no results will
-			// be returned.
-			$pageSize = (int)$this->connection->ldapPagingSize > 0 ? (int)$this->connection->ldapPagingSize : 500;
-			$pagedSearchOK = $this->invokeLDAPMethod('controlPagedResult',
-				$this->connection->getConnectionResource(),
-				$pageSize, false, '');
-		}
-
-		return $pagedSearchOK;
-	}
-
-	/**
-	 * Is more than one $attr used for search?
-	 *
-	 * @param string|string[]|null $attr
-	 * @return bool
-	 */
-	private function manyAttributes($attr): bool {
-		if (\is_array($attr)) {
-			return \count($attr) > 1;
-		}
-		return false;
-	}
+        } else if ($limit === 0 && !empty($this->lastCookie)) {
+            // a search without limit was requested. However, if we do use
+            // Paged Search once, we always must do it. This requires us to
+            // initialize it with the configured page size.
+            $this->abandonPagedSearch();
+            // in case someone set it to 0 … use 500, otherwise no results will
+            // be returned.
+            $pageSize = (int)$this->connection->ldapPagingSize > 0 ? (int)$this->connection->ldapPagingSize : 500;
+            $pagedSearchOK = $this->invokeLDAPMethod('controlPagedResult',
+                $this->connection->getConnectionResource(),
+                $pageSize, false, '');
+        }
+
+        return $pagedSearchOK;
+    }
+
+    /**
+     * Is more than one $attr used for search?
+     *
+     * @param string|string[]|null $attr
+     * @return bool
+     */
+    private function manyAttributes($attr): bool {
+        if (\is_array($attr)) {
+            return \count($attr) > 1;
+        }
+        return false;
+    }
 
 }

Spacing +193 added lines, -193 removed lines

@@ -133,7 +133,7 @@ 
 	 * @return AbstractMapping
 	 */
 	public function getUserMapper() {
-		if(is_null($this->userMapper)) {
+		if (is_null($this->userMapper)) {
 			throw new \Exception('UserMapper was not assigned to this Access instance.');
 		}
 		return $this->userMapper;
@@ -153,7 +153,7 @@ 
 	 * @return AbstractMapping
 	 */
 	public function getGroupMapper() {
-		if(is_null($this->groupMapper)) {
+		if (is_null($this->groupMapper)) {
 			throw new \Exception('GroupMapper was not assigned to this Access instance.');
 		}
 		return $this->groupMapper;
@@ -186,14 +186,14 @@ 
 	 * @throws ServerNotAvailableException
 	 */
 	public function readAttribute($dn, $attr, $filter = 'objectClass=*') {
-		if(!$this->checkConnection()) {
+		if (!$this->checkConnection()) {
 			\OCP\Util::writeLog('user_ldap',
 				'No LDAP Connector assigned, access impossible for readAttribute.',
 				ILogger::WARN);
 			return false;
 		}
 		$cr = $this->connection->getConnectionResource();
-		if(!$this->ldap->isResource($cr)) {
+		if (!$this->ldap->isResource($cr)) {
 			//LDAP not available
 			\OCP\Util::writeLog('user_ldap', 'LDAP resource not available.', ILogger::DEBUG);
 			return false;
@@ -203,7 +203,7 @@ 
 		$this->abandonPagedSearch();
 		// openLDAP requires that we init a new Paged Search. Not needed by AD,
 		// but does not hurt either.
-		$pagingSize = (int)$this->connection->ldapPagingSize;
+		$pagingSize = (int) $this->connection->ldapPagingSize;
 		// 0 won't result in replies, small numbers may leave out groups
 		// (cf. #12306), 500 is default for paging and should work everywhere.
 		$maxResults = $pagingSize > 20 ? $pagingSize : 500;
@@ -216,7 +216,7 @@ 
 		$isRangeRequest = false;
 		do {
 			$result = $this->executeRead($cr, $dn, $attrToRead, $filter, $maxResults);
-			if(is_bool($result)) {
+			if (is_bool($result)) {
 				// when an exists request was run and it was successful, an empty
 				// array must be returned
 				return $result ? [] : false;
@@ -233,22 +233,22 @@ 
 			$result = $this->extractRangeData($result, $attr);
 			if (!empty($result)) {
 				$normalizedResult = $this->extractAttributeValuesFromResult(
-					[ $attr => $result['values'] ],
+					[$attr => $result['values']],
 					$attr
 				);
 				$values = array_merge($values, $normalizedResult);
 
-				if($result['rangeHigh'] === '*') {
+				if ($result['rangeHigh'] === '*') {
 					// when server replies with * as high range value, there are
 					// no more results left
 					return $values;
 				} else {
-					$low  = $result['rangeHigh'] + 1;
-					$attrToRead = $result['attributeName'] . ';range=' . $low . '-*';
+					$low = $result['rangeHigh'] + 1;
+					$attrToRead = $result['attributeName'].';range='.$low.'-*';
 					$isRangeRequest = true;
 				}
 			}
-		} while($isRangeRequest);
+		} while ($isRangeRequest);
 
 		\OCP\Util::writeLog('user_ldap', 'Requested attribute '.$attr.' not found for '.$dn, ILogger::DEBUG);
 		return false;
@@ -274,13 +274,13 @@ 
 		if (!$this->ldap->isResource($rr)) {
 			if ($attribute !== '') {
 				//do not throw this message on userExists check, irritates
-				\OCP\Util::writeLog('user_ldap', 'readAttribute failed for DN ' . $dn, ILogger::DEBUG);
+				\OCP\Util::writeLog('user_ldap', 'readAttribute failed for DN '.$dn, ILogger::DEBUG);
 			}
 			//in case an error occurs , e.g. object does not exist
 			return false;
 		}
 		if ($attribute === '' && ($filter === 'objectclass=*' || $this->invokeLDAPMethod('countEntries', $cr, $rr) === 1)) {
-			\OCP\Util::writeLog('user_ldap', 'readAttribute: ' . $dn . ' found', ILogger::DEBUG);
+			\OCP\Util::writeLog('user_ldap', 'readAttribute: '.$dn.' found', ILogger::DEBUG);
 			return true;
 		}
 		$er = $this->invokeLDAPMethod('firstEntry', $cr, $rr);
@@ -305,12 +305,12 @@ 
 	 */
 	public function extractAttributeValuesFromResult($result, $attribute) {
 		$values = [];
-		if(isset($result[$attribute]) && $result[$attribute]['count'] > 0) {
+		if (isset($result[$attribute]) && $result[$attribute]['count'] > 0) {
 			$lowercaseAttribute = strtolower($attribute);
-			for($i=0;$i<$result[$attribute]['count'];$i++) {
-				if($this->resemblesDN($attribute)) {
+			for ($i = 0; $i < $result[$attribute]['count']; $i++) {
+				if ($this->resemblesDN($attribute)) {
 					$values[] = $this->helper->sanitizeDN($result[$attribute][$i]);
-				} elseif($lowercaseAttribute === 'objectguid' || $lowercaseAttribute === 'guid') {
+				} elseif ($lowercaseAttribute === 'objectguid' || $lowercaseAttribute === 'guid') {
 					$values[] = $this->convertObjectGUID2Str($result[$attribute][$i]);
 				} else {
 					$values[] = $result[$attribute][$i];
@@ -332,10 +332,10 @@ 
 	 */
 	public function extractRangeData($result, $attribute) {
 		$keys = array_keys($result);
-		foreach($keys as $key) {
-			if($key !== $attribute && strpos($key, $attribute) === 0) {
+		foreach ($keys as $key) {
+			if ($key !== $attribute && strpos($key, $attribute) === 0) {
 				$queryData = explode(';', $key);
-				if(strpos($queryData[1], 'range=') === 0) {
+				if (strpos($queryData[1], 'range=') === 0) {
 					$high = substr($queryData[1], 1 + strpos($queryData[1], '-'));
 					$data = [
 						'values' => $result[$key],
@@ -360,11 +360,11 @@ 
 	 * @throws \Exception
 	 */
 	public function setPassword($userDN, $password) {
-		if((int)$this->connection->turnOnPasswordChange !== 1) {
+		if ((int) $this->connection->turnOnPasswordChange !== 1) {
 			throw new \Exception('LDAP password changes are disabled.');
 		}
 		$cr = $this->connection->getConnectionResource();
-		if(!$this->ldap->isResource($cr)) {
+		if (!$this->ldap->isResource($cr)) {
 			//LDAP not available
 			\OCP\Util::writeLog('user_ldap', 'LDAP resource not available.', ILogger::DEBUG);
 			return false;
@@ -373,7 +373,7 @@ 
 			// try PASSWD extended operation first
 			return @$this->invokeLDAPMethod('exopPasswd', $cr, $userDN, '', $password) ||
 						@$this->invokeLDAPMethod('modReplace', $cr, $userDN, $password);
-		} catch(ConstraintViolationException $e) {
+		} catch (ConstraintViolationException $e) {
 			throw new HintException('Password change rejected.', \OC::$server->getL10N('user_ldap')->t('Password change rejected. Hint: ').$e->getMessage(), $e->getCode());
 		}
 	}
@@ -415,17 +415,17 @@ 
 	 */
 	public function getDomainDNFromDN($dn) {
 		$allParts = $this->ldap->explodeDN($dn, 0);
-		if($allParts === false) {
+		if ($allParts === false) {
 			//not a valid DN
 			return '';
 		}
 		$domainParts = [];
 		$dcFound = false;
-		foreach($allParts as $part) {
-			if(!$dcFound && strpos($part, 'dc=') === 0) {
+		foreach ($allParts as $part) {
+			if (!$dcFound && strpos($part, 'dc=') === 0) {
 				$dcFound = true;
 			}
-			if($dcFound) {
+			if ($dcFound) {
 				$domainParts[] = $part;
 			}
 		}
@@ -451,7 +451,7 @@ 
 
 		//Check whether the DN belongs to the Base, to avoid issues on multi-
 		//server setups
-		if(is_string($fdn) && $this->isDNPartOfBase($fdn, $this->connection->ldapBaseUsers)) {
+		if (is_string($fdn) && $this->isDNPartOfBase($fdn, $this->connection->ldapBaseUsers)) {
 			return $fdn;
 		}
 
@@ -470,7 +470,7 @@ 
 		//To avoid bypassing the base DN settings under certain circumstances
 		//with the group support, check whether the provided DN matches one of
 		//the given Bases
-		if(!$this->isDNPartOfBase($fdn, $this->connection->ldapBaseGroups)) {
+		if (!$this->isDNPartOfBase($fdn, $this->connection->ldapBaseGroups)) {
 			return false;
 		}
 
@@ -488,11 +488,11 @@ 
 	 */
 	public function groupsMatchFilter($groupDNs) {
 		$validGroupDNs = [];
-		foreach($groupDNs as $dn) {
+		foreach ($groupDNs as $dn) {
 			$cacheKey = 'groupsMatchFilter-'.$dn;
 			$groupMatchFilter = $this->connection->getFromCache($cacheKey);
-			if(!is_null($groupMatchFilter)) {
-				if($groupMatchFilter) {
+			if (!is_null($groupMatchFilter)) {
+				if ($groupMatchFilter) {
 					$validGroupDNs[] = $dn;
 				}
 				continue;
@@ -500,13 +500,13 @@ 
 
 			// Check the base DN first. If this is not met already, we don't
 			// need to ask the server at all.
-			if(!$this->isDNPartOfBase($dn, $this->connection->ldapBaseGroups)) {
+			if (!$this->isDNPartOfBase($dn, $this->connection->ldapBaseGroups)) {
 				$this->connection->writeToCache($cacheKey, false);
 				continue;
 			}
 
 			$result = $this->readAttribute($dn, '', $this->connection->ldapGroupFilter);
-			if(is_array($result)) {
+			if (is_array($result)) {
 				$this->connection->writeToCache($cacheKey, true);
 				$validGroupDNs[] = $dn;
 			} else {
@@ -529,7 +529,7 @@ 
 		//To avoid bypassing the base DN settings under certain circumstances
 		//with the group support, check whether the provided DN matches one of
 		//the given Bases
-		if(!$this->isDNPartOfBase($fdn, $this->connection->ldapBaseUsers)) {
+		if (!$this->isDNPartOfBase($fdn, $this->connection->ldapBaseUsers)) {
 			return false;
 		}
 
@@ -549,7 +549,7 @@ 
 	 */
 	public function dn2ocname($fdn, $ldapName = null, $isUser = true, &$newlyMapped = null, array $record = null) {
 		$newlyMapped = false;
-		if($isUser) {
+		if ($isUser) {
 			$mapper = $this->getUserMapper();
 			$nameAttribute = $this->connection->ldapUserDisplayName;
 			$filter = $this->connection->ldapUserFilter;
@@ -561,15 +561,15 @@ 
 
 		//let's try to retrieve the Nextcloud name from the mappings table
 		$ncName = $mapper->getNameByDN($fdn);
-		if(is_string($ncName)) {
+		if (is_string($ncName)) {
 			return $ncName;
 		}
 
 		//second try: get the UUID and check if it is known. Then, update the DN and return the name.
 		$uuid = $this->getUUID($fdn, $isUser, $record);
-		if(is_string($uuid)) {
+		if (is_string($uuid)) {
 			$ncName = $mapper->getNameByUUID($uuid);
-			if(is_string($ncName)) {
+			if (is_string($ncName)) {
 				$mapper->setDNbyUUID($fdn, $uuid);
 				return $ncName;
 			}
@@ -579,17 +579,17 @@ 
 			return false;
 		}
 
-		if(is_null($ldapName)) {
+		if (is_null($ldapName)) {
 			$ldapName = $this->readAttribute($fdn, $nameAttribute, $filter);
-			if(!isset($ldapName[0]) && empty($ldapName[0])) {
+			if (!isset($ldapName[0]) && empty($ldapName[0])) {
 				\OCP\Util::writeLog('user_ldap', 'No or empty name for '.$fdn.' with filter '.$filter.'.', ILogger::INFO);
 				return false;
 			}
 			$ldapName = $ldapName[0];
 		}
 
-		if($isUser) {
-			$usernameAttribute = (string)$this->connection->ldapExpertUsernameAttr;
+		if ($isUser) {
+			$usernameAttribute = (string) $this->connection->ldapExpertUsernameAttr;
 			if ($usernameAttribute !== '') {
 				$username = $this->readAttribute($fdn, $usernameAttribute);
 				$username = $username[0];
@@ -619,14 +619,14 @@ 
 		// outside of core user management will still cache the user as non-existing.
 		$originalTTL = $this->connection->ldapCacheTTL;
 		$this->connection->setConfiguration(['ldapCacheTTL' => 0]);
-		if( $intName !== ''
+		if ($intName !== ''
 			&& (($isUser && !$this->ncUserManager->userExists($intName))
 				|| (!$isUser && !\OC::$server->getGroupManager()->groupExists($intName))
 			)
 		) {
 			$this->connection->setConfiguration(['ldapCacheTTL' => $originalTTL]);
 			$newlyMapped = $this->mapAndAnnounceIfApplicable($mapper, $fdn, $intName, $uuid, $isUser);
-			if($newlyMapped) {
+			if ($newlyMapped) {
 				return $intName;
 			}
 		}
@@ -634,7 +634,7 @@ 
 		$this->connection->setConfiguration(['ldapCacheTTL' => $originalTTL]);
 		$altName = $this->createAltInternalOwnCloudName($intName, $isUser);
 		if (is_string($altName)) {
-			if($this->mapAndAnnounceIfApplicable($mapper, $fdn, $altName, $uuid, $isUser)) {
+			if ($this->mapAndAnnounceIfApplicable($mapper, $fdn, $altName, $uuid, $isUser)) {
 				$newlyMapped = true;
 				return $altName;
 			}
@@ -652,7 +652,7 @@ 
 		string $uuid,
 		bool $isUser
 	) :bool {
-		if($mapper->map($fdn, $name, $uuid)) {
+		if ($mapper->map($fdn, $name, $uuid)) {
 			if ($this->ncUserManager instanceof PublicEmitter && $isUser) {
 				$this->cacheUserExists($name);
 				$this->ncUserManager->emit('\OC\User', 'assignedUserId', [$name]);
@@ -697,7 +697,7 @@ 
 	 * @throws \Exception
 	 */
 	private function ldap2NextcloudNames($ldapObjects, $isUsers) {
-		if($isUsers) {
+		if ($isUsers) {
 			$nameAttribute = $this->connection->ldapUserDisplayName;
 			$sndAttribute  = $this->connection->ldapUserDisplayName2;
 		} else {
@@ -705,9 +705,9 @@ 
 		}
 		$nextcloudNames = [];
 
-		foreach($ldapObjects as $ldapObject) {
+		foreach ($ldapObjects as $ldapObject) {
 			$nameByLDAP = null;
-			if(    isset($ldapObject[$nameAttribute])
+			if (isset($ldapObject[$nameAttribute])
 				&& is_array($ldapObject[$nameAttribute])
 				&& isset($ldapObject[$nameAttribute][0])
 			) {
@@ -716,19 +716,19 @@ 
 			}
 
 			$ncName = $this->dn2ocname($ldapObject['dn'][0], $nameByLDAP, $isUsers);
-			if($ncName) {
+			if ($ncName) {
 				$nextcloudNames[] = $ncName;
-				if($isUsers) {
+				if ($isUsers) {
 					$this->updateUserState($ncName);
 					//cache the user names so it does not need to be retrieved
 					//again later (e.g. sharing dialogue).
-					if(is_null($nameByLDAP)) {
+					if (is_null($nameByLDAP)) {
 						continue;
 					}
 					$sndName = isset($ldapObject[$sndAttribute][0])
 						? $ldapObject[$sndAttribute][0] : '';
 					$this->cacheUserDisplayName($ncName, $nameByLDAP, $sndName);
-				} else if($nameByLDAP !== null) {
+				} else if ($nameByLDAP !== null) {
 					$this->cacheGroupDisplayName($ncName, $nameByLDAP);
 				}
 			}
@@ -744,7 +744,7 @@ 
 	 */
 	public function updateUserState($ncname) {
 		$user = $this->userManager->get($ncname);
-		if($user instanceof OfflineUser) {
+		if ($user instanceof OfflineUser) {
 			$user->unmark();
 		}
 	}
@@ -784,7 +784,7 @@ 
 	 */
 	public function cacheUserDisplayName($ocName, $displayName, $displayName2 = '') {
 		$user = $this->userManager->get($ocName);
-		if($user === null) {
+		if ($user === null) {
 			return;
 		}
 		$displayName = $user->composeAndStoreDisplayName($displayName, $displayName2);
@@ -793,7 +793,7 @@ 
 	}
 
 	public function cacheGroupDisplayName(string $ncName, string $displayName): void {
-		$cacheKey = 'group_getDisplayName' . $ncName;
+		$cacheKey = 'group_getDisplayName'.$ncName;
 		$this->connection->writeToCache($cacheKey, $displayName);
 	}
 
@@ -809,9 +809,9 @@ 
 		$attempts = 0;
 		//while loop is just a precaution. If a name is not generated within
 		//20 attempts, something else is very wrong. Avoids infinite loop.
-		while($attempts < 20){
-			$altName = $name . '_' . rand(1000,9999);
-			if(!$this->ncUserManager->userExists($altName)) {
+		while ($attempts < 20) {
+			$altName = $name.'_'.rand(1000, 9999);
+			if (!$this->ncUserManager->userExists($altName)) {
 				return $altName;
 			}
 			$attempts++;
@@ -833,25 +833,25 @@ 
 	 */
 	private function _createAltInternalOwnCloudNameForGroups($name) {
 		$usedNames = $this->groupMapper->getNamesBySearch($name, "", '_%');
-		if(!$usedNames || count($usedNames) === 0) {
+		if (!$usedNames || count($usedNames) === 0) {
 			$lastNo = 1; //will become name_2
 		} else {
 			natsort($usedNames);
 			$lastName = array_pop($usedNames);
-			$lastNo = (int)substr($lastName, strrpos($lastName, '_') + 1);
+			$lastNo = (int) substr($lastName, strrpos($lastName, '_') + 1);
 		}
-		$altName = $name.'_'. (string)($lastNo+1);
+		$altName = $name.'_'.(string) ($lastNo + 1);
 		unset($usedNames);
 
 		$attempts = 1;
-		while($attempts < 21){
+		while ($attempts < 21) {
 			// Check to be really sure it is unique
 			// while loop is just a precaution. If a name is not generated within
 			// 20 attempts, something else is very wrong. Avoids infinite loop.
-			if(!\OC::$server->getGroupManager()->groupExists($altName)) {
+			if (!\OC::$server->getGroupManager()->groupExists($altName)) {
 				return $altName;
 			}
-			$altName = $name . '_' . ($lastNo + $attempts);
+			$altName = $name.'_'.($lastNo + $attempts);
 			$attempts++;
 		}
 		return false;
@@ -866,7 +866,7 @@ 
 	private function createAltInternalOwnCloudName($name, $isUser) {
 		$originalTTL = $this->connection->ldapCacheTTL;
 		$this->connection->setConfiguration(['ldapCacheTTL' => 0]);
-		if($isUser) {
+		if ($isUser) {
 			$altName = $this->_createAltInternalOwnCloudNameForUsers($name);
 		} else {
 			$altName = $this->_createAltInternalOwnCloudNameForGroups($name);
@@ -915,13 +915,13 @@ 
 	public function fetchListOfUsers($filter, $attr, $limit = null, $offset = null, $forceApplyAttributes = false) {
 		$ldapRecords = $this->searchUsers($filter, $attr, $limit, $offset);
 		$recordsToUpdate = $ldapRecords;
-		if(!$forceApplyAttributes) {
+		if (!$forceApplyAttributes) {
 			$isBackgroundJobModeAjax = $this->config
 					->getAppValue('core', 'backgroundjobs_mode', 'ajax') === 'ajax';
 			$recordsToUpdate = array_filter($ldapRecords, function($record) use ($isBackgroundJobModeAjax) {
 				$newlyMapped = false;
 				$uid = $this->dn2ocname($record['dn'][0], null, true, $newlyMapped, $record);
-				if(is_string($uid)) {
+				if (is_string($uid)) {
 					$this->cacheUserExists($uid);
 				}
 				return ($uid !== false) && ($newlyMapped || $isBackgroundJobModeAjax);
@@ -939,15 +939,15 @@ 
 	 * @param array $ldapRecords
 	 * @throws \Exception
 	 */
-	public function batchApplyUserAttributes(array $ldapRecords){
+	public function batchApplyUserAttributes(array $ldapRecords) {
 		$displayNameAttribute = strtolower($this->connection->ldapUserDisplayName);
-		foreach($ldapRecords as $userRecord) {
-			if(!isset($userRecord[$displayNameAttribute])) {
+		foreach ($ldapRecords as $userRecord) {
+			if (!isset($userRecord[$displayNameAttribute])) {
 				// displayName is obligatory
 				continue;
 			}
-			$ocName  = $this->dn2ocname($userRecord['dn'][0], null, true);
-			if($ocName === false) {
+			$ocName = $this->dn2ocname($userRecord['dn'][0], null, true);
+			if ($ocName === false) {
 				continue;
 			}
 			$this->updateUserState($ocName);
@@ -975,7 +975,7 @@ 
 		array_walk($groupRecords, function($record) {
 			$newlyMapped = false;
 			$gid = $this->dn2ocname($record['dn'][0], null, false, $newlyMapped, $record);
-			if(!$newlyMapped && is_string($gid)) {
+			if (!$newlyMapped && is_string($gid)) {
 				$this->cacheGroupExists($gid);
 			}
 		});
@@ -988,8 +988,8 @@ 
 	 * @return array
 	 */
 	private function fetchList($list, $manyAttributes) {
-		if(is_array($list)) {
-			if($manyAttributes) {
+		if (is_array($list)) {
+			if ($manyAttributes) {
 				return $list;
 			} else {
 				$list = array_reduce($list, function($carry, $item) {
@@ -1019,7 +1019,7 @@ 
 	 */
 	public function searchUsers($filter, $attr = null, $limit = null, $offset = null) {
 		$result = [];
-		foreach($this->connection->ldapBaseUsers as $base) {
+		foreach ($this->connection->ldapBaseUsers as $base) {
 			$result = array_merge($result, $this->search($filter, [$base], $attr, $limit, $offset));
 		}
 		return $result;
@@ -1035,9 +1035,9 @@ 
 	 */
 	public function countUsers($filter, $attr = ['dn'], $limit = null, $offset = null) {
 		$result = false;
-		foreach($this->connection->ldapBaseUsers as $base) {
+		foreach ($this->connection->ldapBaseUsers as $base) {
 			$count = $this->count($filter, [$base], $attr, $limit, $offset);
-			$result = is_int($count) ? (int)$result + $count : $result;
+			$result = is_int($count) ? (int) $result + $count : $result;
 		}
 		return $result;
 	}
@@ -1056,7 +1056,7 @@ 
 	 */
 	public function searchGroups($filter, $attr = null, $limit = null, $offset = null) {
 		$result = [];
-		foreach($this->connection->ldapBaseGroups as $base) {
+		foreach ($this->connection->ldapBaseGroups as $base) {
 			$result = array_merge($result, $this->search($filter, [$base], $attr, $limit, $offset));
 		}
 		return $result;
@@ -1074,9 +1074,9 @@ 
 	 */
 	public function countGroups($filter, $attr = ['dn'], $limit = null, $offset = null) {
 		$result = false;
-		foreach($this->connection->ldapBaseGroups as $base) {
+		foreach ($this->connection->ldapBaseGroups as $base) {
 			$count = $this->count($filter, [$base], $attr, $limit, $offset);
-			$result = is_int($count) ? (int)$result + $count : $result;
+			$result = is_int($count) ? (int) $result + $count : $result;
 		}
 		return $result;
 	}
@@ -1091,9 +1091,9 @@ 
 	 */
 	public function countObjects($limit = null, $offset = null) {
 		$result = false;
-		foreach($this->connection->ldapBase as $base) {
+		foreach ($this->connection->ldapBase as $base) {
 			$count = $this->count('objectclass=*', [$base], ['dn'], $limit, $offset);
-			$result = is_int($count) ? (int)$result + $count : $result;
+			$result = is_int($count) ? (int) $result + $count : $result;
 		}
 		return $result;
 	}
@@ -1118,7 +1118,7 @@ 
 		// php no longer supports call-time pass-by-reference
 		// thus cannot support controlPagedResultResponse as the third argument
 		// is a reference
-		$doMethod = function () use ($command, &$arguments) {
+		$doMethod = function() use ($command, &$arguments) {
 			if ($command == 'controlPagedResultResponse') {
 				throw new \InvalidArgumentException('Invoker does not support controlPagedResultResponse, call LDAP Wrapper directly instead.');
 			} else {
@@ -1136,7 +1136,7 @@ 
 			$this->connection->resetConnectionResource();
 			$cr = $this->connection->getConnectionResource();
 
-			if(!$this->ldap->isResource($cr)) {
+			if (!$this->ldap->isResource($cr)) {
 				// Seems like we didn't find any resource.
 				\OCP\Util::writeLog('user_ldap', "Could not $command, because resource is missing.", ILogger::DEBUG);
 				throw $e;
@@ -1161,13 +1161,13 @@ 
 	 * @throws ServerNotAvailableException
 	 */
 	private function executeSearch($filter, $base, &$attr = null, $limit = null, $offset = null) {
-		if(!is_null($attr) && !is_array($attr)) {
+		if (!is_null($attr) && !is_array($attr)) {
 			$attr = [mb_strtolower($attr, 'UTF-8')];
 		}
 
 		// See if we have a resource, in case not cancel with message
 		$cr = $this->connection->getConnectionResource();
-		if(!$this->ldap->isResource($cr)) {
+		if (!$this->ldap->isResource($cr)) {
 			// Seems like we didn't find any resource.
 			// Return an empty array just like before.
 			\OCP\Util::writeLog('user_ldap', 'Could not search, because resource is missing.', ILogger::DEBUG);
@@ -1175,13 +1175,13 @@ 
 		}
 
 		//check whether paged search should be attempted
-		$pagedSearchOK = $this->initPagedSearch($filter, $base, $attr, (int)$limit, $offset);
+		$pagedSearchOK = $this->initPagedSearch($filter, $base, $attr, (int) $limit, $offset);
 
 		$linkResources = array_pad([], count($base), $cr);
 		$sr = $this->invokeLDAPMethod('search', $linkResources, $base, $filter, $attr);
 		// cannot use $cr anymore, might have changed in the previous call!
 		$error = $this->ldap->errno($this->connection->getConnectionResource());
-		if(!is_array($sr) || $error !== 0) {
+		if (!is_array($sr) || $error !== 0) {
 			\OCP\Util::writeLog('user_ldap', 'Attempt for Paging?  '.print_r($pagedSearchOK, true), ILogger::ERROR);
 			return false;
 		}
@@ -1206,29 +1206,29 @@ 
 	 */
 	private function processPagedSearchStatus($sr, $filter, $base, $iFoundItems, $limit, $offset, $pagedSearchOK, $skipHandling) {
 		$cookie = null;
-		if($pagedSearchOK) {
+		if ($pagedSearchOK) {
 			$cr = $this->connection->getConnectionResource();
-			foreach($sr as $key => $res) {
-				if($this->ldap->controlPagedResultResponse($cr, $res, $cookie)) {
+			foreach ($sr as $key => $res) {
+				if ($this->ldap->controlPagedResultResponse($cr, $res, $cookie)) {
 					$this->setPagedResultCookie($base[$key], $filter, $limit, $offset, $cookie);
 				}
 			}
 
 			//browsing through prior pages to get the cookie for the new one
-			if($skipHandling) {
+			if ($skipHandling) {
 				return false;
 			}
 			// if count is bigger, then the server does not support
 			// paged search. Instead, he did a normal search. We set a
 			// flag here, so the callee knows how to deal with it.
-			if($iFoundItems <= $limit) {
+			if ($iFoundItems <= $limit) {
 				$this->pagedSearchedSuccessful = true;
 			}
 		} else {
-			if(!is_null($limit) && (int)$this->connection->ldapPagingSize !== 0) {
+			if (!is_null($limit) && (int) $this->connection->ldapPagingSize !== 0) {
 				\OC::$server->getLogger()->debug(
 					'Paged search was not available',
-					[ 'app' => 'user_ldap' ]
+					['app' => 'user_ldap']
 				);
 			}
 		}
@@ -1257,8 +1257,8 @@ 
 	private function count($filter, $base, $attr = null, $limit = null, $offset = null, $skipHandling = false) {
 		\OCP\Util::writeLog('user_ldap', 'Count filter:  '.print_r($filter, true), ILogger::DEBUG);
 
-		$limitPerPage = (int)$this->connection->ldapPagingSize;
-		if(!is_null($limit) && $limit < $limitPerPage && $limit > 0) {
+		$limitPerPage = (int) $this->connection->ldapPagingSize;
+		if (!is_null($limit) && $limit < $limitPerPage && $limit > 0) {
 			$limitPerPage = $limit;
 		}
 
@@ -1268,7 +1268,7 @@ 
 
 		do {
 			$search = $this->executeSearch($filter, $base, $attr, $limitPerPage, $offset);
-			if($search === false) {
+			if ($search === false) {
 				return $counter > 0 ? $counter : false;
 			}
 			list($sr, $pagedSearchOK) = $search;
@@ -1287,7 +1287,7 @@ 
 			 * Continue now depends on $hasMorePages value
 			 */
 			$continue = $pagedSearchOK && $hasMorePages;
-		} while($continue && (is_null($limit) || $limit <= 0 || $limit > $counter));
+		} while ($continue && (is_null($limit) || $limit <= 0 || $limit > $counter));
 
 		return $counter;
 	}
@@ -1300,8 +1300,8 @@ 
 	private function countEntriesInSearchResults($searchResults) {
 		$counter = 0;
 
-		foreach($searchResults as $res) {
-			$count = (int)$this->invokeLDAPMethod('countEntries', $this->connection->getConnectionResource(), $res);
+		foreach ($searchResults as $res) {
+			$count = (int) $this->invokeLDAPMethod('countEntries', $this->connection->getConnectionResource(), $res);
 			$counter += $count;
 		}
 
@@ -1321,8 +1321,8 @@ 
 	 * @throws ServerNotAvailableException
 	 */
 	public function search($filter, $base, $attr = null, $limit = null, $offset = null, $skipHandling = false) {
-		$limitPerPage = (int)$this->connection->ldapPagingSize;
-		if(!is_null($limit) && $limit < $limitPerPage && $limit > 0) {
+		$limitPerPage = (int) $this->connection->ldapPagingSize;
+		if (!is_null($limit) && $limit < $limitPerPage && $limit > 0) {
 			$limitPerPage = $limit;
 		}
 
@@ -1336,13 +1336,13 @@ 
 		$savedoffset = $offset;
 		do {
 			$search = $this->executeSearch($filter, $base, $attr, $limitPerPage, $offset);
-			if($search === false) {
+			if ($search === false) {
 				return [];
 			}
 			list($sr, $pagedSearchOK) = $search;
 			$cr = $this->connection->getConnectionResource();
 
-			if($skipHandling) {
+			if ($skipHandling) {
 				//i.e. result do not need to be fetched, we just need the cookie
 				//thus pass 1 or any other value as $iFoundItems because it is not
 				//used
@@ -1353,7 +1353,7 @@ 
 			}
 
 			$iFoundItems = 0;
-			foreach($sr as $res) {
+			foreach ($sr as $res) {
 				$findings = array_merge($findings, $this->invokeLDAPMethod('getEntries', $cr, $res));
 				$iFoundItems = max($iFoundItems, $findings['count']);
 				unset($findings['count']);
@@ -1369,27 +1369,27 @@ 
 
 		// if we're here, probably no connection resource is returned.
 		// to make Nextcloud behave nicely, we simply give back an empty array.
-		if(is_null($findings)) {
+		if (is_null($findings)) {
 			return [];
 		}
 
-		if(!is_null($attr)) {
+		if (!is_null($attr)) {
 			$selection = [];
 			$i = 0;
-			foreach($findings as $item) {
-				if(!is_array($item)) {
+			foreach ($findings as $item) {
+				if (!is_array($item)) {
 					continue;
 				}
 				$item = \OCP\Util::mb_array_change_key_case($item, MB_CASE_LOWER, 'UTF-8');
-				foreach($attr as $key) {
-					if(isset($item[$key])) {
-						if(is_array($item[$key]) && isset($item[$key]['count'])) {
+				foreach ($attr as $key) {
+					if (isset($item[$key])) {
+						if (is_array($item[$key]) && isset($item[$key]['count'])) {
 							unset($item[$key]['count']);
 						}
-						if($key !== 'dn') {
-							if($this->resemblesDN($key)) {
+						if ($key !== 'dn') {
+							if ($this->resemblesDN($key)) {
 								$selection[$i][$key] = $this->helper->sanitizeDN($item[$key]);
-							} else if($key === 'objectguid' || $key === 'guid') {
+							} else if ($key === 'objectguid' || $key === 'guid') {
 								$selection[$i][$key] = [$this->convertObjectGUID2Str($item[$key][0])];
 							} else {
 								$selection[$i][$key] = $item[$key];
@@ -1407,14 +1407,14 @@ 
 		//we slice the findings, when
 		//a) paged search unsuccessful, though attempted
 		//b) no paged search, but limit set
-		if((!$this->getPagedSearchResultState()
+		if ((!$this->getPagedSearchResultState()
 			&& $pagedSearchOK)
 			|| (
 				!$pagedSearchOK
 				&& !is_null($limit)
 			)
 		) {
-			$findings = array_slice($findings, (int)$offset, $limit);
+			$findings = array_slice($findings, (int) $offset, $limit);
 		}
 		return $findings;
 	}
@@ -1427,13 +1427,13 @@ 
 	public function sanitizeUsername($name) {
 		$name = trim($name);
 
-		if($this->connection->ldapIgnoreNamingRules) {
+		if ($this->connection->ldapIgnoreNamingRules) {
 			return $name;
 		}
 
 		// Transliteration to ASCII
 		$transliterated = @iconv('UTF-8', 'ASCII//TRANSLIT', $name);
-		if($transliterated !== false) {
+		if ($transliterated !== false) {
 			// depending on system config iconv can work or not
 			$name = $transliterated;
 		}
@@ -1444,7 +1444,7 @@ 
 		// Every remaining disallowed characters will be removed
 		$name = preg_replace('/[^a-zA-Z0-9_.@-]/u', '', $name);
 
-		if($name === '') {
+		if ($name === '') {
 			throw new \InvalidArgumentException('provided name template for username does not contain any allowed characters');
 		}
 
@@ -1459,13 +1459,13 @@ 
 	*/
 	public function escapeFilterPart($input, $allowAsterisk = false) {
 		$asterisk = '';
-		if($allowAsterisk && strlen($input) > 0 && $input[0] === '*') {
+		if ($allowAsterisk && strlen($input) > 0 && $input[0] === '*') {
 			$asterisk = '*';
 			$input = mb_substr($input, 1, null, 'UTF-8');
 		}
 		$search  = ['*', '\\', '(', ')'];
 		$replace = ['\\*', '\\\\', '\\(', '\\)'];
-		return $asterisk . str_replace($search, $replace, $input);
+		return $asterisk.str_replace($search, $replace, $input);
 	}
 
 	/**
@@ -1495,13 +1495,13 @@ 
 	 */
 	private function combineFilter($filters, $operator) {
 		$combinedFilter = '('.$operator;
-		foreach($filters as $filter) {
+		foreach ($filters as $filter) {
 			if ($filter !== '' && $filter[0] !== '(') {
 				$filter = '('.$filter.')';
 			}
-			$combinedFilter.=$filter;
+			$combinedFilter .= $filter;
 		}
-		$combinedFilter.=')';
+		$combinedFilter .= ')';
 		return $combinedFilter;
 	}
 
@@ -1537,17 +1537,17 @@ 
 	 * @throws \Exception
 	 */
 	private function getAdvancedFilterPartForSearch($search, $searchAttributes) {
-		if(!is_array($searchAttributes) || count($searchAttributes) < 2) {
+		if (!is_array($searchAttributes) || count($searchAttributes) < 2) {
 			throw new \Exception('searchAttributes must be an array with at least two string');
 		}
 		$searchWords = explode(' ', trim($search));
 		$wordFilters = [];
-		foreach($searchWords as $word) {
+		foreach ($searchWords as $word) {
 			$word = $this->prepareSearchTerm($word);
 			//every word needs to appear at least once
 			$wordMatchOneAttrFilters = [];
-			foreach($searchAttributes as $attr) {
-				$wordMatchOneAttrFilters[] = $attr . '=' . $word;
+			foreach ($searchAttributes as $attr) {
+				$wordMatchOneAttrFilters[] = $attr.'='.$word;
 			}
 			$wordFilters[] = $this->combineFilterWithOr($wordMatchOneAttrFilters);
 		}
@@ -1565,10 +1565,10 @@ 
 	private function getFilterPartForSearch($search, $searchAttributes, $fallbackAttribute) {
 		$filter = [];
 		$haveMultiSearchAttributes = (is_array($searchAttributes) && count($searchAttributes) > 0);
-		if($haveMultiSearchAttributes && strpos(trim($search), ' ') !== false) {
+		if ($haveMultiSearchAttributes && strpos(trim($search), ' ') !== false) {
 			try {
 				return $this->getAdvancedFilterPartForSearch($search, $searchAttributes);
-			} catch(\Exception $e) {
+			} catch (\Exception $e) {
 				\OCP\Util::writeLog(
 					'user_ldap',
 					'Creating advanced filter for search failed, falling back to simple method.',
@@ -1578,17 +1578,17 @@ 
 		}
 
 		$search = $this->prepareSearchTerm($search);
-		if(!is_array($searchAttributes) || count($searchAttributes) === 0) {
+		if (!is_array($searchAttributes) || count($searchAttributes) === 0) {
 			if ($fallbackAttribute === '') {
 				return '';
 			}
-			$filter[] = $fallbackAttribute . '=' . $search;
+			$filter[] = $fallbackAttribute.'='.$search;
 		} else {
-			foreach($searchAttributes as $attribute) {
-				$filter[] = $attribute . '=' . $search;
+			foreach ($searchAttributes as $attribute) {
+				$filter[] = $attribute.'='.$search;
 			}
 		}
-		if(count($filter) === 1) {
+		if (count($filter) === 1) {
 			return '('.$filter[0].')';
 		}
 		return $this->combineFilterWithOr($filter);
@@ -1609,7 +1609,7 @@ 
 		if ($term === '') {
 			$result = '*';
 		} else if ($allowEnum !== 'no') {
-			$result = $term . '*';
+			$result = $term.'*';
 		}
 		return $result;
 	}
@@ -1621,7 +1621,7 @@ 
 	public function getFilterForUserCount() {
 		$filter = $this->combineFilterWithAnd([
 			$this->connection->ldapUserFilter,
-			$this->connection->ldapUserDisplayName . '=*'
+			$this->connection->ldapUserDisplayName.'=*'
 		]);
 
 		return $filter;
@@ -1639,7 +1639,7 @@ 
 			'ldapAgentName' => $name,
 			'ldapAgentPassword' => $password
 		];
-		if(!$testConnection->setConfiguration($credentials)) {
+		if (!$testConnection->setConfiguration($credentials)) {
 			return false;
 		}
 		return $testConnection->bind();
@@ -1661,30 +1661,30 @@ 
 			// Sacrebleu! The UUID attribute is unknown :( We need first an
 			// existing DN to be able to reliably detect it.
 			$result = $this->search($filter, $base, ['dn'], 1);
-			if(!isset($result[0]) || !isset($result[0]['dn'])) {
+			if (!isset($result[0]) || !isset($result[0]['dn'])) {
 				throw new \Exception('Cannot determine UUID attribute');
 			}
 			$dn = $result[0]['dn'][0];
-			if(!$this->detectUuidAttribute($dn, true)) {
+			if (!$this->detectUuidAttribute($dn, true)) {
 				throw new \Exception('Cannot determine UUID attribute');
 			}
 		} else {
 			// The UUID attribute is either known or an override is given.
 			// By calling this method we ensure that $this->connection->$uuidAttr
 			// is definitely set
-			if(!$this->detectUuidAttribute('', true)) {
+			if (!$this->detectUuidAttribute('', true)) {
 				throw new \Exception('Cannot determine UUID attribute');
 			}
 		}
 
 		$uuidAttr = $this->connection->ldapUuidUserAttribute;
-		if($uuidAttr === 'guid' || $uuidAttr === 'objectguid') {
+		if ($uuidAttr === 'guid' || $uuidAttr === 'objectguid') {
 			$uuid = $this->formatGuid2ForFilterUser($uuid);
 		}
 
-		$filter = $uuidAttr . '=' . $uuid;
+		$filter = $uuidAttr.'='.$uuid;
 		$result = $this->searchUsers($filter, ['dn'], 2);
-		if(is_array($result) && isset($result[0]) && isset($result[0]['dn']) && count($result) === 1) {
+		if (is_array($result) && isset($result[0]) && isset($result[0]['dn']) && count($result) === 1) {
 			// we put the count into account to make sure that this is
 			// really unique
 			return $result[0]['dn'][0];
@@ -1704,7 +1704,7 @@ 
 	 * @throws ServerNotAvailableException
 	 */
 	private function detectUuidAttribute($dn, $isUser = true, $force = false, array $ldapRecord = null) {
-		if($isUser) {
+		if ($isUser) {
 			$uuidAttr     = 'ldapUuidUserAttribute';
 			$uuidOverride = $this->connection->ldapExpertUUIDUserAttr;
 		} else {
@@ -1712,8 +1712,8 @@ 
 			$uuidOverride = $this->connection->ldapExpertUUIDGroupAttr;
 		}
 
-		if(!$force) {
-			if($this->connection->$uuidAttr !== 'auto') {
+		if (!$force) {
+			if ($this->connection->$uuidAttr !== 'auto') {
 				return true;
 			} else if (is_string($uuidOverride) && trim($uuidOverride) !== '') {
 				$this->connection->$uuidAttr = $uuidOverride;
@@ -1721,23 +1721,23 @@ 
 			}
 
 			$attribute = $this->connection->getFromCache($uuidAttr);
-			if(!$attribute === null) {
+			if (!$attribute === null) {
 				$this->connection->$uuidAttr = $attribute;
 				return true;
 			}
 		}
 
-		foreach(self::UUID_ATTRIBUTES as $attribute) {
-			if($ldapRecord !== null) {
+		foreach (self::UUID_ATTRIBUTES as $attribute) {
+			if ($ldapRecord !== null) {
 				// we have the info from LDAP already, we don't need to talk to the server again
-				if(isset($ldapRecord[$attribute])) {
+				if (isset($ldapRecord[$attribute])) {
 					$this->connection->$uuidAttr = $attribute;
 					return true;
 				}
 			}
 
 			$value = $this->readAttribute($dn, $attribute);
-			if(is_array($value) && isset($value[0]) && !empty($value[0])) {
+			if (is_array($value) && isset($value[0]) && !empty($value[0])) {
 				\OC::$server->getLogger()->debug(
 					'Setting {attribute} as {subject}',
 					[
@@ -1764,7 +1764,7 @@ 
 	 * @throws ServerNotAvailableException
 	 */
 	public function getUUID($dn, $isUser = true, $ldapRecord = null) {
-		if($isUser) {
+		if ($isUser) {
 			$uuidAttr     = 'ldapUuidUserAttribute';
 			$uuidOverride = $this->connection->ldapExpertUUIDUserAttr;
 		} else {
@@ -1773,10 +1773,10 @@ 
 		}
 
 		$uuid = false;
-		if($this->detectUuidAttribute($dn, $isUser, false, $ldapRecord)) {
+		if ($this->detectUuidAttribute($dn, $isUser, false, $ldapRecord)) {
 			$attr = $this->connection->$uuidAttr;
 			$uuid = isset($ldapRecord[$attr]) ? $ldapRecord[$attr] : $this->readAttribute($dn, $attr);
-			if( !is_array($uuid)
+			if (!is_array($uuid)
 				&& $uuidOverride !== ''
 				&& $this->detectUuidAttribute($dn, $isUser, true, $ldapRecord))
 			{
@@ -1784,7 +1784,7 @@ 
 					? $ldapRecord[$this->connection->$uuidAttr]
 					: $this->readAttribute($dn, $this->connection->$uuidAttr);
 			}
-			if(is_array($uuid) && isset($uuid[0]) && !empty($uuid[0])) {
+			if (is_array($uuid) && isset($uuid[0]) && !empty($uuid[0])) {
 				$uuid = $uuid[0];
 			}
 		}
@@ -1801,19 +1801,19 @@ 
 	private function convertObjectGUID2Str($oguid) {
 		$hex_guid = bin2hex($oguid);
 		$hex_guid_to_guid_str = '';
-		for($k = 1; $k <= 4; ++$k) {
+		for ($k = 1; $k <= 4; ++$k) {
 			$hex_guid_to_guid_str .= substr($hex_guid, 8 - 2 * $k, 2);
 		}
 		$hex_guid_to_guid_str .= '-';
-		for($k = 1; $k <= 2; ++$k) {
+		for ($k = 1; $k <= 2; ++$k) {
 			$hex_guid_to_guid_str .= substr($hex_guid, 12 - 2 * $k, 2);
 		}
 		$hex_guid_to_guid_str .= '-';
-		for($k = 1; $k <= 2; ++$k) {
+		for ($k = 1; $k <= 2; ++$k) {
 			$hex_guid_to_guid_str .= substr($hex_guid, 16 - 2 * $k, 2);
 		}
-		$hex_guid_to_guid_str .= '-' . substr($hex_guid, 16, 4);
-		$hex_guid_to_guid_str .= '-' . substr($hex_guid, 20);
+		$hex_guid_to_guid_str .= '-'.substr($hex_guid, 16, 4);
+		$hex_guid_to_guid_str .= '-'.substr($hex_guid, 20);
 
 		return strtoupper($hex_guid_to_guid_str);
 	}
@@ -1830,11 +1830,11 @@ 
 	 * @return string
 	 */
 	public function formatGuid2ForFilterUser($guid) {
-		if(!is_string($guid)) {
+		if (!is_string($guid)) {
 			throw new \InvalidArgumentException('String expected');
 		}
 		$blocks = explode('-', $guid);
-		if(count($blocks) !== 5) {
+		if (count($blocks) !== 5) {
 			/*
 			 * Why not throw an Exception instead? This method is a utility
 			 * called only when trying to figure out whether a "missing" known
@@ -1847,20 +1847,20 @@ 
 			 * user. Instead we write a log message.
 			 */
 			\OC::$server->getLogger()->info(
-				'Passed string does not resemble a valid GUID. Known UUID ' .
+				'Passed string does not resemble a valid GUID. Known UUID '.
 				'({uuid}) probably does not match UUID configuration.',
-				[ 'app' => 'user_ldap', 'uuid' => $guid ]
+				['app' => 'user_ldap', 'uuid' => $guid]
 			);
 			return $guid;
 		}
-		for($i=0; $i < 3; $i++) {
+		for ($i = 0; $i < 3; $i++) {
 			$pairs = str_split($blocks[$i], 2);
 			$pairs = array_reverse($pairs);
 			$blocks[$i] = implode('', $pairs);
 		}
-		for($i=0; $i < 5; $i++) {
+		for ($i = 0; $i < 5; $i++) {
 			$pairs = str_split($blocks[$i], 2);
-			$blocks[$i] = '\\' . implode('\\', $pairs);
+			$blocks[$i] = '\\'.implode('\\', $pairs);
 		}
 		return implode('', $blocks);
 	}
@@ -1876,12 +1876,12 @@ 
 		$domainDN = $this->getDomainDNFromDN($dn);
 		$cacheKey = 'getSID-'.$domainDN;
 		$sid = $this->connection->getFromCache($cacheKey);
-		if(!is_null($sid)) {
+		if (!is_null($sid)) {
 			return $sid;
 		}
 
 		$objectSid = $this->readAttribute($domainDN, 'objectsid');
-		if(!is_array($objectSid) || empty($objectSid)) {
+		if (!is_array($objectSid) || empty($objectSid)) {
 			$this->connection->writeToCache($cacheKey, false);
 			return false;
 		}
@@ -1939,12 +1939,12 @@ 
 		$belongsToBase = false;
 		$bases = $this->helper->sanitizeDN($bases);
 
-		foreach($bases as $base) {
+		foreach ($bases as $base) {
 			$belongsToBase = true;
-			if(mb_strripos($dn, $base, 0, 'UTF-8') !== (mb_strlen($dn, 'UTF-8')-mb_strlen($base, 'UTF-8'))) {
+			if (mb_strripos($dn, $base, 0, 'UTF-8') !== (mb_strlen($dn, 'UTF-8') - mb_strlen($base, 'UTF-8'))) {
 				$belongsToBase = false;
 			}
-			if($belongsToBase) {
+			if ($belongsToBase) {
 				break;
 			}
 		}
@@ -1973,16 +1973,16 @@ 
 	 * @return string containing the key or empty if none is cached
 	 */
 	private function getPagedResultCookie($base, $filter, $limit, $offset) {
-		if($offset === 0) {
+		if ($offset === 0) {
 			return '';
 		}
 		$offset -= $limit;
 		//we work with cache here
-		$cacheKey = 'lc' . crc32($base) . '-' . crc32($filter) . '-' . (int)$limit . '-' . (int)$offset;
+		$cacheKey = 'lc'.crc32($base).'-'.crc32($filter).'-'.(int) $limit.'-'.(int) $offset;
 		$cookie = '';
-		if(isset($this->cookies[$cacheKey])) {
+		if (isset($this->cookies[$cacheKey])) {
 			$cookie = $this->cookies[$cacheKey];
-			if(is_null($cookie)) {
+			if (is_null($cookie)) {
 				$cookie = '';
 			}
 		}
@@ -2000,7 +2000,7 @@ 
 	 * @return bool
 	 */
 	public function hasMoreResults() {
-		if(empty($this->lastCookie) && $this->lastCookie !== '0') {
+		if (empty($this->lastCookie) && $this->lastCookie !== '0') {
 			// as in RFC 2696, when all results are returned, the cookie will
 			// be empty.
 			return false;
@@ -2020,8 +2020,8 @@ 
 	 */
 	private function setPagedResultCookie($base, $filter, $limit, $offset, $cookie) {
 		// allow '0' for 389ds
-		if(!empty($cookie) || $cookie === '0') {
-			$cacheKey = 'lc' . crc32($base) . '-' . crc32($filter) . '-' . (int)$limit . '-' . (int)$offset;
+		if (!empty($cookie) || $cookie === '0') {
+			$cacheKey = 'lc'.crc32($base).'-'.crc32($filter).'-'.(int) $limit.'-'.(int) $offset;
 			$this->cookies[$cacheKey] = $cookie;
 			$this->lastCookie = $cookie;
 		}
@@ -2051,16 +2051,16 @@ 
 	private function initPagedSearch($filter, $bases, $attr, $limit, $offset) {
 		$pagedSearchOK = false;
 		if ($limit !== 0) {
-			$offset = (int)$offset; //can be null
+			$offset = (int) $offset; //can be null
 			\OCP\Util::writeLog('user_ldap',
 				'initializing paged search for  Filter '.$filter.' base '.print_r($bases, true)
-				.' attr '.print_r($attr, true). ' limit ' .$limit.' offset '.$offset,
+				.' attr '.print_r($attr, true).' limit '.$limit.' offset '.$offset,
 				ILogger::DEBUG);
 			//get the cookie from the search for the previous search, required by LDAP
-			foreach($bases as $base) {
+			foreach ($bases as $base) {
 
 				$cookie = $this->getPagedResultCookie($base, $filter, $limit, $offset);
-				if(empty($cookie) && $cookie !== "0" && ($offset > 0)) {
+				if (empty($cookie) && $cookie !== "0" && ($offset > 0)) {
 					// no cookie known from a potential previous search. We need
 					// to start from 0 to come to the desired page. cookie value
 					// of '0' is valid, because 389ds
@@ -2070,17 +2070,17 @@ 
 					//still no cookie? obviously, the server does not like us. Let's skip paging efforts.
 					// '0' is valid, because 389ds
 					//TODO: remember this, probably does not change in the next request...
-					if(empty($cookie) && $cookie !== '0') {
+					if (empty($cookie) && $cookie !== '0') {
 						$cookie = null;
 					}
 				}
-				if(!is_null($cookie)) {
+				if (!is_null($cookie)) {
 					//since offset = 0, this is a new search. We abandon other searches that might be ongoing.
 					$this->abandonPagedSearch();
 					$pagedSearchOK = $this->invokeLDAPMethod('controlPagedResult',
 						$this->connection->getConnectionResource(), $limit,
 						false, $cookie);
-					if(!$pagedSearchOK) {
+					if (!$pagedSearchOK) {
 						return false;
 					}
 					\OCP\Util::writeLog('user_ldap', 'Ready for a paged search', ILogger::DEBUG);
@@ -2103,7 +2103,7 @@ 
 			$this->abandonPagedSearch();
 			// in case someone set it to 0 … use 500, otherwise no results will
 			// be returned.
-			$pageSize = (int)$this->connection->ldapPagingSize > 0 ? (int)$this->connection->ldapPagingSize : 500;
+			$pageSize = (int) $this->connection->ldapPagingSize > 0 ? (int) $this->connection->ldapPagingSize : 500;
 			$pagedSearchOK = $this->invokeLDAPMethod('controlPagedResult',
 				$this->connection->getConnectionResource(),
 				$pageSize, false, '');

apps/user_ldap/lib/UserPluginManager.php

Indentation +179 added lines, -179 removed lines

@@ -28,183 +28,183 @@
 
 class UserPluginManager {
 
-	public $test = false;
-
-	private $respondToActions = 0;
-
-	private $which = [
-		Backend::CREATE_USER => null,
-		Backend::SET_PASSWORD => null,
-		Backend::GET_HOME => null,
-		Backend::GET_DISPLAYNAME => null,
-		Backend::SET_DISPLAYNAME => null,
-		Backend::PROVIDE_AVATAR => null,
-		Backend::COUNT_USERS => null,
-		'deleteUser' => null
-	];
-
-	/**
-	 * @return int All implemented actions, except for 'deleteUser'
-	 */
-	public function getImplementedActions() {
-		return $this->respondToActions;
-	}
-
-	/**
-	 * Registers a user plugin that may implement some actions, overriding User_LDAP's user actions.
-	 *
-	 * @param ILDAPUserPlugin $plugin
-	 */
-	public function register(ILDAPUserPlugin $plugin) {
-		$respondToActions = $plugin->respondToActions();
-		$this->respondToActions |= $respondToActions;
-
-		foreach($this->which as $action => $v) {
-			if (is_int($action) && (bool)($respondToActions & $action)) {
-				$this->which[$action] = $plugin;
-				\OC::$server->getLogger()->debug("Registered action ".$action." to plugin ".get_class($plugin), ['app' => 'user_ldap']);
-			}
-		}
-		if (method_exists($plugin,'deleteUser')) {
-			$this->which['deleteUser'] = $plugin;
-			\OC::$server->getLogger()->debug("Registered action deleteUser to plugin ".get_class($plugin), ['app' => 'user_ldap']);
-		}
-	}
-
-	/**
-	 * Signal if there is a registered plugin that implements some given actions
-	 * @param int $actions Actions defined in \OC\User\Backend, like Backend::CREATE_USER
-	 * @return bool
-	 */
-	public function implementsActions($actions) {
-		return ($actions & $this->respondToActions) == $actions;
-	}
-
-	/**
-	 * Create a new user in LDAP Backend
-	 *
-	 * @param string $username The username of the user to create
-	 * @param string $password The password of the new user
-	 * @return string | false The user DN if user creation was successful.
-	 * @throws \Exception
-	 */
-	public function createUser($username, $password) {
-		$plugin = $this->which[Backend::CREATE_USER];
-
-		if ($plugin) {
-			return $plugin->createUser($username,$password);
-		}
-		throw new \Exception('No plugin implements createUser in this LDAP Backend.');
-	}
-
-	/**
-	 * Change the password of a user*
-	 * @param string $uid The username
-	 * @param string $password The new password
-	 * @return bool
-	 * @throws \Exception
-	 */
-	public function setPassword($uid, $password) {
-		$plugin = $this->which[Backend::SET_PASSWORD];
-
-		if ($plugin) {
-			return $plugin->setPassword($uid,$password);
-		}
-		throw new \Exception('No plugin implements setPassword in this LDAP Backend.');
-	}
-
-	/**
-	 * checks whether the user is allowed to change his avatar in Nextcloud
-	 * @param string $uid the Nextcloud user name
-	 * @return boolean either the user can or cannot
-	 * @throws \Exception
-	 */
-	public function canChangeAvatar($uid) {
-		$plugin = $this->which[Backend::PROVIDE_AVATAR];
-
-		if ($plugin) {
-			return $plugin->canChangeAvatar($uid);
-		}
-		throw new \Exception('No plugin implements canChangeAvatar in this LDAP Backend.');
-	}
-
-	/**
-	 * Get the user's home directory
-	 * @param string $uid the username
-	 * @return boolean
-	 * @throws \Exception
-	 */
-	public function getHome($uid) {
-		$plugin = $this->which[Backend::GET_HOME];
-
-		if ($plugin) {
-			return $plugin->getHome($uid);
-		}
-		throw new \Exception('No plugin implements getHome in this LDAP Backend.');
-	}
-
-	/**
-	 * Get display name of the user
-	 * @param string $uid user ID of the user
-	 * @return string display name
-	 * @throws \Exception
-	 */
-	public function getDisplayName($uid) {
-		$plugin = $this->which[Backend::GET_DISPLAYNAME];
-
-		if ($plugin) {
-			return $plugin->getDisplayName($uid);
-		}
-		throw new \Exception('No plugin implements getDisplayName in this LDAP Backend.');
-	}
-
-	/**
-	 * Set display name of the user
-	 * @param string $uid user ID of the user
-	 * @param string $displayName new user's display name
-	 * @return string display name
-	 * @throws \Exception
-	 */
-	public function setDisplayName($uid, $displayName) {
-		$plugin = $this->which[Backend::SET_DISPLAYNAME];
-
-		if ($plugin) {
-			return $plugin->setDisplayName($uid, $displayName);
-		}
-		throw new \Exception('No plugin implements setDisplayName in this LDAP Backend.');
-	}
-
-	/**
-	 * Count the number of users
-	 * @return int|bool
-	 * @throws \Exception
-	 */
-	public function countUsers() {
-		$plugin = $this->which[Backend::COUNT_USERS];
-
-		if ($plugin) {
-			return $plugin->countUsers();
-		}
-		throw new \Exception('No plugin implements countUsers in this LDAP Backend.');
-	}
-
-	/**
-	 * @return bool
-	 */
-	public function canDeleteUser() {
-		return $this->which['deleteUser'] !== null;
-	}
-
-	/**
-	 * @param $uid
-	 * @return bool
-	 * @throws \Exception
-	 */
-	public function deleteUser($uid) {
-		$plugin = $this->which['deleteUser'];
-		if ($plugin) {
-			return $plugin->deleteUser($uid);
-		}
-		throw new \Exception('No plugin implements deleteUser in this LDAP Backend.');
-	}
+    public $test = false;
+
+    private $respondToActions = 0;
+
+    private $which = [
+        Backend::CREATE_USER => null,
+        Backend::SET_PASSWORD => null,
+        Backend::GET_HOME => null,
+        Backend::GET_DISPLAYNAME => null,
+        Backend::SET_DISPLAYNAME => null,
+        Backend::PROVIDE_AVATAR => null,
+        Backend::COUNT_USERS => null,
+        'deleteUser' => null
+    ];
+
+    /**
+     * @return int All implemented actions, except for 'deleteUser'
+     */
+    public function getImplementedActions() {
+        return $this->respondToActions;
+    }
+
+    /**
+     * Registers a user plugin that may implement some actions, overriding User_LDAP's user actions.
+     *
+     * @param ILDAPUserPlugin $plugin
+     */
+    public function register(ILDAPUserPlugin $plugin) {
+        $respondToActions = $plugin->respondToActions();
+        $this->respondToActions |= $respondToActions;
+
+        foreach($this->which as $action => $v) {
+            if (is_int($action) && (bool)($respondToActions & $action)) {
+                $this->which[$action] = $plugin;
+                \OC::$server->getLogger()->debug("Registered action ".$action." to plugin ".get_class($plugin), ['app' => 'user_ldap']);
+            }
+        }
+        if (method_exists($plugin,'deleteUser')) {
+            $this->which['deleteUser'] = $plugin;
+            \OC::$server->getLogger()->debug("Registered action deleteUser to plugin ".get_class($plugin), ['app' => 'user_ldap']);
+        }
+    }
+
+    /**
+     * Signal if there is a registered plugin that implements some given actions
+     * @param int $actions Actions defined in \OC\User\Backend, like Backend::CREATE_USER
+     * @return bool
+     */
+    public function implementsActions($actions) {
+        return ($actions & $this->respondToActions) == $actions;
+    }
+
+    /**
+     * Create a new user in LDAP Backend
+     *
+     * @param string $username The username of the user to create
+     * @param string $password The password of the new user
+     * @return string | false The user DN if user creation was successful.
+     * @throws \Exception
+     */
+    public function createUser($username, $password) {
+        $plugin = $this->which[Backend::CREATE_USER];
+
+        if ($plugin) {
+            return $plugin->createUser($username,$password);
+        }
+        throw new \Exception('No plugin implements createUser in this LDAP Backend.');
+    }
+
+    /**
+     * Change the password of a user*
+     * @param string $uid The username
+     * @param string $password The new password
+     * @return bool
+     * @throws \Exception
+     */
+    public function setPassword($uid, $password) {
+        $plugin = $this->which[Backend::SET_PASSWORD];
+
+        if ($plugin) {
+            return $plugin->setPassword($uid,$password);
+        }
+        throw new \Exception('No plugin implements setPassword in this LDAP Backend.');
+    }
+
+    /**
+     * checks whether the user is allowed to change his avatar in Nextcloud
+     * @param string $uid the Nextcloud user name
+     * @return boolean either the user can or cannot
+     * @throws \Exception
+     */
+    public function canChangeAvatar($uid) {
+        $plugin = $this->which[Backend::PROVIDE_AVATAR];
+
+        if ($plugin) {
+            return $plugin->canChangeAvatar($uid);
+        }
+        throw new \Exception('No plugin implements canChangeAvatar in this LDAP Backend.');
+    }
+
+    /**
+     * Get the user's home directory
+     * @param string $uid the username
+     * @return boolean
+     * @throws \Exception
+     */
+    public function getHome($uid) {
+        $plugin = $this->which[Backend::GET_HOME];
+
+        if ($plugin) {
+            return $plugin->getHome($uid);
+        }
+        throw new \Exception('No plugin implements getHome in this LDAP Backend.');
+    }
+
+    /**
+     * Get display name of the user
+     * @param string $uid user ID of the user
+     * @return string display name
+     * @throws \Exception
+     */
+    public function getDisplayName($uid) {
+        $plugin = $this->which[Backend::GET_DISPLAYNAME];
+
+        if ($plugin) {
+            return $plugin->getDisplayName($uid);
+        }
+        throw new \Exception('No plugin implements getDisplayName in this LDAP Backend.');
+    }
+
+    /**
+     * Set display name of the user
+     * @param string $uid user ID of the user
+     * @param string $displayName new user's display name
+     * @return string display name
+     * @throws \Exception
+     */
+    public function setDisplayName($uid, $displayName) {
+        $plugin = $this->which[Backend::SET_DISPLAYNAME];
+
+        if ($plugin) {
+            return $plugin->setDisplayName($uid, $displayName);
+        }
+        throw new \Exception('No plugin implements setDisplayName in this LDAP Backend.');
+    }
+
+    /**
+     * Count the number of users
+     * @return int|bool
+     * @throws \Exception
+     */
+    public function countUsers() {
+        $plugin = $this->which[Backend::COUNT_USERS];
+
+        if ($plugin) {
+            return $plugin->countUsers();
+        }
+        throw new \Exception('No plugin implements countUsers in this LDAP Backend.');
+    }
+
+    /**
+     * @return bool
+     */
+    public function canDeleteUser() {
+        return $this->which['deleteUser'] !== null;
+    }
+
+    /**
+     * @param $uid
+     * @return bool
+     * @throws \Exception
+     */
+    public function deleteUser($uid) {
+        $plugin = $this->which['deleteUser'];
+        if ($plugin) {
+            return $plugin->deleteUser($uid);
+        }
+        throw new \Exception('No plugin implements deleteUser in this LDAP Backend.');
+    }
 }

apps/user_ldap/lib/WizardResult.php

Indentation +40 added lines, -40 removed lines

@@ -29,50 +29,50 @@
 namespace OCA\User_LDAP;
 
 class WizardResult {
-	protected $changes = [];
-	protected $options = [];
-	protected $markedChange = false;
+    protected $changes = [];
+    protected $options = [];
+    protected $markedChange = false;
 
-	/**
-	 * @param string $key
-	 * @param mixed $value
-	 */
-	public function addChange($key, $value) {
-		$this->changes[$key] = $value;
-	}
+    /**
+     * @param string $key
+     * @param mixed $value
+     */
+    public function addChange($key, $value) {
+        $this->changes[$key] = $value;
+    }
 
 	
-	public function markChange() {
-		$this->markedChange = true;
-	}
+    public function markChange() {
+        $this->markedChange = true;
+    }
 
-	/**
-	 * @param string $key
-	 * @param array|string $values
-	 */
-	public function addOptions($key, $values) {
-		if(!is_array($values)) {
-			$values = [$values];
-		}
-		$this->options[$key] = $values;
-	}
+    /**
+     * @param string $key
+     * @param array|string $values
+     */
+    public function addOptions($key, $values) {
+        if(!is_array($values)) {
+            $values = [$values];
+        }
+        $this->options[$key] = $values;
+    }
 
-	/**
-	 * @return bool
-	 */
-	public function hasChanges() {
-		return (count($this->changes) > 0 || $this->markedChange);
-	}
+    /**
+     * @return bool
+     */
+    public function hasChanges() {
+        return (count($this->changes) > 0 || $this->markedChange);
+    }
 
-	/**
-	 * @return array
-	 */
-	public function getResultArray() {
-		$result = [];
-		$result['changes'] = $this->changes;
-		if(count($this->options) > 0) {
-			$result['options'] = $this->options;
-		}
-		return $result;
-	}
+    /**
+     * @return array
+     */
+    public function getResultArray() {
+        $result = [];
+        $result['changes'] = $this->changes;
+        if(count($this->options) > 0) {
+            $result['options'] = $this->options;
+        }
+        return $result;
+    }
 }

Spacing +2 added lines, -2 removed lines

@@ -51,7 +51,7 @@ 
 	 * @param array|string $values
 	 */
 	public function addOptions($key, $values) {
-		if(!is_array($values)) {
+		if (!is_array($values)) {
 			$values = [$values];
 		}
 		$this->options[$key] = $values;
@@ -70,7 +70,7 @@ 
 	public function getResultArray() {
 		$result = [];
 		$result['changes'] = $this->changes;
-		if(count($this->options) > 0) {
+		if (count($this->options) > 0) {
 			$result['options'] = $this->options;
 		}
 		return $result;

apps/user_ldap/lib/Configuration.php

Indentation +510 added lines, -510 removed lines

@@ -40,543 +40,543 @@
  * @property string ldapUserAvatarRule
  */
 class Configuration {
-	const AVATAR_PREFIX_DEFAULT = 'default';
-	const AVATAR_PREFIX_NONE = 'none';
-	const AVATAR_PREFIX_DATA_ATTRIBUTE = 'data:';
+    const AVATAR_PREFIX_DEFAULT = 'default';
+    const AVATAR_PREFIX_NONE = 'none';
+    const AVATAR_PREFIX_DATA_ATTRIBUTE = 'data:';
 
-	protected $configPrefix = null;
-	protected $configRead = false;
-	/**
-	 * @var string[] pre-filled with one reference key so that at least one entry is written on save request and
-	 *               the config ID is registered
-	 */
-	protected $unsavedChanges = ['ldapConfigurationActive' => 'ldapConfigurationActive'];
+    protected $configPrefix = null;
+    protected $configRead = false;
+    /**
+     * @var string[] pre-filled with one reference key so that at least one entry is written on save request and
+     *               the config ID is registered
+     */
+    protected $unsavedChanges = ['ldapConfigurationActive' => 'ldapConfigurationActive'];
 
-	//settings
-	protected $config = [
-		'ldapHost' => null,
-		'ldapPort' => null,
-		'ldapBackupHost' => null,
-		'ldapBackupPort' => null,
-		'ldapBase' => null,
-		'ldapBaseUsers' => null,
-		'ldapBaseGroups' => null,
-		'ldapAgentName' => null,
-		'ldapAgentPassword' => null,
-		'ldapTLS' => null,
-		'turnOffCertCheck' => null,
-		'ldapIgnoreNamingRules' => null,
-		'ldapUserDisplayName' => null,
-		'ldapUserDisplayName2' => null,
-		'ldapUserAvatarRule' => null,
-		'ldapGidNumber' => null,
-		'ldapUserFilterObjectclass' => null,
-		'ldapUserFilterGroups' => null,
-		'ldapUserFilter' => null,
-		'ldapUserFilterMode' => null,
-		'ldapGroupFilter' => null,
-		'ldapGroupFilterMode' => null,
-		'ldapGroupFilterObjectclass' => null,
-		'ldapGroupFilterGroups' => null,
-		'ldapGroupDisplayName' => null,
-		'ldapGroupMemberAssocAttr' => null,
-		'ldapLoginFilter' => null,
-		'ldapLoginFilterMode' => null,
-		'ldapLoginFilterEmail' => null,
-		'ldapLoginFilterUsername' => null,
-		'ldapLoginFilterAttributes' => null,
-		'ldapQuotaAttribute' => null,
-		'ldapQuotaDefault' => null,
-		'ldapEmailAttribute' => null,
-		'ldapCacheTTL' => null,
-		'ldapUuidUserAttribute' => 'auto',
-		'ldapUuidGroupAttribute' => 'auto',
-		'ldapOverrideMainServer' => false,
-		'ldapConfigurationActive' => false,
-		'ldapAttributesForUserSearch' => null,
-		'ldapAttributesForGroupSearch' => null,
-		'ldapExperiencedAdmin' => false,
-		'homeFolderNamingRule' => null,
-		'hasMemberOfFilterSupport' => false,
-		'useMemberOfToDetectMembership' => true,
-		'ldapExpertUsernameAttr' => null,
-		'ldapExpertUUIDUserAttr' => null,
-		'ldapExpertUUIDGroupAttr' => null,
-		'lastJpegPhotoLookup' => null,
-		'ldapNestedGroups' => false,
-		'ldapPagingSize' => null,
-		'turnOnPasswordChange' => false,
-		'ldapDynamicGroupMemberURL' => null,
-		'ldapDefaultPPolicyDN' => null,
-		'ldapExtStorageHomeAttribute' => null,
-	];
+    //settings
+    protected $config = [
+        'ldapHost' => null,
+        'ldapPort' => null,
+        'ldapBackupHost' => null,
+        'ldapBackupPort' => null,
+        'ldapBase' => null,
+        'ldapBaseUsers' => null,
+        'ldapBaseGroups' => null,
+        'ldapAgentName' => null,
+        'ldapAgentPassword' => null,
+        'ldapTLS' => null,
+        'turnOffCertCheck' => null,
+        'ldapIgnoreNamingRules' => null,
+        'ldapUserDisplayName' => null,
+        'ldapUserDisplayName2' => null,
+        'ldapUserAvatarRule' => null,
+        'ldapGidNumber' => null,
+        'ldapUserFilterObjectclass' => null,
+        'ldapUserFilterGroups' => null,
+        'ldapUserFilter' => null,
+        'ldapUserFilterMode' => null,
+        'ldapGroupFilter' => null,
+        'ldapGroupFilterMode' => null,
+        'ldapGroupFilterObjectclass' => null,
+        'ldapGroupFilterGroups' => null,
+        'ldapGroupDisplayName' => null,
+        'ldapGroupMemberAssocAttr' => null,
+        'ldapLoginFilter' => null,
+        'ldapLoginFilterMode' => null,
+        'ldapLoginFilterEmail' => null,
+        'ldapLoginFilterUsername' => null,
+        'ldapLoginFilterAttributes' => null,
+        'ldapQuotaAttribute' => null,
+        'ldapQuotaDefault' => null,
+        'ldapEmailAttribute' => null,
+        'ldapCacheTTL' => null,
+        'ldapUuidUserAttribute' => 'auto',
+        'ldapUuidGroupAttribute' => 'auto',
+        'ldapOverrideMainServer' => false,
+        'ldapConfigurationActive' => false,
+        'ldapAttributesForUserSearch' => null,
+        'ldapAttributesForGroupSearch' => null,
+        'ldapExperiencedAdmin' => false,
+        'homeFolderNamingRule' => null,
+        'hasMemberOfFilterSupport' => false,
+        'useMemberOfToDetectMembership' => true,
+        'ldapExpertUsernameAttr' => null,
+        'ldapExpertUUIDUserAttr' => null,
+        'ldapExpertUUIDGroupAttr' => null,
+        'lastJpegPhotoLookup' => null,
+        'ldapNestedGroups' => false,
+        'ldapPagingSize' => null,
+        'turnOnPasswordChange' => false,
+        'ldapDynamicGroupMemberURL' => null,
+        'ldapDefaultPPolicyDN' => null,
+        'ldapExtStorageHomeAttribute' => null,
+    ];
 
-	/**
-	 * @param string $configPrefix
-	 * @param bool $autoRead
-	 */
-	public function __construct($configPrefix, $autoRead = true) {
-		$this->configPrefix = $configPrefix;
-		if($autoRead) {
-			$this->readConfiguration();
-		}
-	}
+    /**
+     * @param string $configPrefix
+     * @param bool $autoRead
+     */
+    public function __construct($configPrefix, $autoRead = true) {
+        $this->configPrefix = $configPrefix;
+        if($autoRead) {
+            $this->readConfiguration();
+        }
+    }
 
-	/**
-	 * @param string $name
-	 * @return mixed|null
-	 */
-	public function __get($name) {
-		if(isset($this->config[$name])) {
-			return $this->config[$name];
-		}
-		return null;
-	}
+    /**
+     * @param string $name
+     * @return mixed|null
+     */
+    public function __get($name) {
+        if(isset($this->config[$name])) {
+            return $this->config[$name];
+        }
+        return null;
+    }
 
-	/**
-	 * @param string $name
-	 * @param mixed $value
-	 */
-	public function __set($name, $value) {
-		$this->setConfiguration([$name => $value]);
-	}
+    /**
+     * @param string $name
+     * @param mixed $value
+     */
+    public function __set($name, $value) {
+        $this->setConfiguration([$name => $value]);
+    }
 
-	/**
-	 * @return array
-	 */
-	public function getConfiguration() {
-		return $this->config;
-	}
+    /**
+     * @return array
+     */
+    public function getConfiguration() {
+        return $this->config;
+    }
 
-	/**
-	 * set LDAP configuration with values delivered by an array, not read
-	 * from configuration. It does not save the configuration! To do so, you
-	 * must call saveConfiguration afterwards.
-	 * @param array $config array that holds the config parameters in an associated
-	 * array
-	 * @param array &$applied optional; array where the set fields will be given to
-	 * @return false|null
-	 */
-	public function setConfiguration($config, &$applied = null) {
-		if(!is_array($config)) {
-			return false;
-		}
+    /**
+     * set LDAP configuration with values delivered by an array, not read
+     * from configuration. It does not save the configuration! To do so, you
+     * must call saveConfiguration afterwards.
+     * @param array $config array that holds the config parameters in an associated
+     * array
+     * @param array &$applied optional; array where the set fields will be given to
+     * @return false|null
+     */
+    public function setConfiguration($config, &$applied = null) {
+        if(!is_array($config)) {
+            return false;
+        }
 
-		$cta = $this->getConfigTranslationArray();
-		foreach($config as $inputKey => $val) {
-			if(strpos($inputKey, '_') !== false && array_key_exists($inputKey, $cta)) {
-				$key = $cta[$inputKey];
-			} elseif(array_key_exists($inputKey, $this->config)) {
-				$key = $inputKey;
-			} else {
-				continue;
-			}
+        $cta = $this->getConfigTranslationArray();
+        foreach($config as $inputKey => $val) {
+            if(strpos($inputKey, '_') !== false && array_key_exists($inputKey, $cta)) {
+                $key = $cta[$inputKey];
+            } elseif(array_key_exists($inputKey, $this->config)) {
+                $key = $inputKey;
+            } else {
+                continue;
+            }
 
-			$setMethod = 'setValue';
-			switch($key) {
-				case 'ldapAgentPassword':
-					$setMethod = 'setRawValue';
-					break;
-				case 'homeFolderNamingRule':
-					$trimmedVal = trim($val);
-					if ($trimmedVal !== '' && strpos($val, 'attr:') === false) {
-						$val = 'attr:'.$trimmedVal;
-					}
-					break;
-				case 'ldapBase':
-				case 'ldapBaseUsers':
-				case 'ldapBaseGroups':
-				case 'ldapAttributesForUserSearch':
-				case 'ldapAttributesForGroupSearch':
-				case 'ldapUserFilterObjectclass':
-				case 'ldapUserFilterGroups':
-				case 'ldapGroupFilterObjectclass':
-				case 'ldapGroupFilterGroups':
-				case 'ldapLoginFilterAttributes':
-					$setMethod = 'setMultiLine';
-					break;
-			}
-			$this->$setMethod($key, $val);
-			if(is_array($applied)) {
-				$applied[] = $inputKey;
-				// storing key as index avoids duplication, and as value for simplicity
-			}
-			$this->unsavedChanges[$key] = $key;
-		}
-		return null;
-	}
+            $setMethod = 'setValue';
+            switch($key) {
+                case 'ldapAgentPassword':
+                    $setMethod = 'setRawValue';
+                    break;
+                case 'homeFolderNamingRule':
+                    $trimmedVal = trim($val);
+                    if ($trimmedVal !== '' && strpos($val, 'attr:') === false) {
+                        $val = 'attr:'.$trimmedVal;
+                    }
+                    break;
+                case 'ldapBase':
+                case 'ldapBaseUsers':
+                case 'ldapBaseGroups':
+                case 'ldapAttributesForUserSearch':
+                case 'ldapAttributesForGroupSearch':
+                case 'ldapUserFilterObjectclass':
+                case 'ldapUserFilterGroups':
+                case 'ldapGroupFilterObjectclass':
+                case 'ldapGroupFilterGroups':
+                case 'ldapLoginFilterAttributes':
+                    $setMethod = 'setMultiLine';
+                    break;
+            }
+            $this->$setMethod($key, $val);
+            if(is_array($applied)) {
+                $applied[] = $inputKey;
+                // storing key as index avoids duplication, and as value for simplicity
+            }
+            $this->unsavedChanges[$key] = $key;
+        }
+        return null;
+    }
 
-	public function readConfiguration() {
-		if(!$this->configRead && !is_null($this->configPrefix)) {
-			$cta = array_flip($this->getConfigTranslationArray());
-			foreach($this->config as $key => $val) {
-				if(!isset($cta[$key])) {
-					//some are determined
-					continue;
-				}
-				$dbKey = $cta[$key];
-				switch($key) {
-					case 'ldapBase':
-					case 'ldapBaseUsers':
-					case 'ldapBaseGroups':
-					case 'ldapAttributesForUserSearch':
-					case 'ldapAttributesForGroupSearch':
-					case 'ldapUserFilterObjectclass':
-					case 'ldapUserFilterGroups':
-					case 'ldapGroupFilterObjectclass':
-					case 'ldapGroupFilterGroups':
-					case 'ldapLoginFilterAttributes':
-						$readMethod = 'getMultiLine';
-						break;
-					case 'ldapIgnoreNamingRules':
-						$readMethod = 'getSystemValue';
-						$dbKey = $key;
-						break;
-					case 'ldapAgentPassword':
-						$readMethod = 'getPwd';
-						break;
-					case 'ldapUserDisplayName2':
-					case 'ldapGroupDisplayName':
-						$readMethod = 'getLcValue';
-						break;
-					case 'ldapUserDisplayName':
-					default:
-						// user display name does not lower case because
-						// we rely on an upper case N as indicator whether to
-						// auto-detect it or not. FIXME
-						$readMethod = 'getValue';
-						break;
-				}
-				$this->config[$key] = $this->$readMethod($dbKey);
-			}
-			$this->configRead = true;
-		}
-	}
+    public function readConfiguration() {
+        if(!$this->configRead && !is_null($this->configPrefix)) {
+            $cta = array_flip($this->getConfigTranslationArray());
+            foreach($this->config as $key => $val) {
+                if(!isset($cta[$key])) {
+                    //some are determined
+                    continue;
+                }
+                $dbKey = $cta[$key];
+                switch($key) {
+                    case 'ldapBase':
+                    case 'ldapBaseUsers':
+                    case 'ldapBaseGroups':
+                    case 'ldapAttributesForUserSearch':
+                    case 'ldapAttributesForGroupSearch':
+                    case 'ldapUserFilterObjectclass':
+                    case 'ldapUserFilterGroups':
+                    case 'ldapGroupFilterObjectclass':
+                    case 'ldapGroupFilterGroups':
+                    case 'ldapLoginFilterAttributes':
+                        $readMethod = 'getMultiLine';
+                        break;
+                    case 'ldapIgnoreNamingRules':
+                        $readMethod = 'getSystemValue';
+                        $dbKey = $key;
+                        break;
+                    case 'ldapAgentPassword':
+                        $readMethod = 'getPwd';
+                        break;
+                    case 'ldapUserDisplayName2':
+                    case 'ldapGroupDisplayName':
+                        $readMethod = 'getLcValue';
+                        break;
+                    case 'ldapUserDisplayName':
+                    default:
+                        // user display name does not lower case because
+                        // we rely on an upper case N as indicator whether to
+                        // auto-detect it or not. FIXME
+                        $readMethod = 'getValue';
+                        break;
+                }
+                $this->config[$key] = $this->$readMethod($dbKey);
+            }
+            $this->configRead = true;
+        }
+    }
 
-	/**
-	 * saves the current config changes in the database
-	 */
-	public function saveConfiguration() {
-		$cta = array_flip($this->getConfigTranslationArray());
-		foreach($this->unsavedChanges as $key) {
-			$value = $this->config[$key];
-			switch ($key) {
-				case 'ldapAgentPassword':
-					$value = base64_encode($value);
-					break;
-				case 'ldapBase':
-				case 'ldapBaseUsers':
-				case 'ldapBaseGroups':
-				case 'ldapAttributesForUserSearch':
-				case 'ldapAttributesForGroupSearch':
-				case 'ldapUserFilterObjectclass':
-				case 'ldapUserFilterGroups':
-				case 'ldapGroupFilterObjectclass':
-				case 'ldapGroupFilterGroups':
-				case 'ldapLoginFilterAttributes':
-					if(is_array($value)) {
-						$value = implode("\n", $value);
-					}
-					break;
-				//following options are not stored but detected, skip them
-				case 'ldapIgnoreNamingRules':
-				case 'ldapUuidUserAttribute':
-				case 'ldapUuidGroupAttribute':
-					continue 2;
-			}
-			if(is_null($value)) {
-				$value = '';
-			}
-			$this->saveValue($cta[$key], $value);
-		}
-		$this->saveValue('_lastChange', time());
-		$this->unsavedChanges = [];
-	}
+    /**
+     * saves the current config changes in the database
+     */
+    public function saveConfiguration() {
+        $cta = array_flip($this->getConfigTranslationArray());
+        foreach($this->unsavedChanges as $key) {
+            $value = $this->config[$key];
+            switch ($key) {
+                case 'ldapAgentPassword':
+                    $value = base64_encode($value);
+                    break;
+                case 'ldapBase':
+                case 'ldapBaseUsers':
+                case 'ldapBaseGroups':
+                case 'ldapAttributesForUserSearch':
+                case 'ldapAttributesForGroupSearch':
+                case 'ldapUserFilterObjectclass':
+                case 'ldapUserFilterGroups':
+                case 'ldapGroupFilterObjectclass':
+                case 'ldapGroupFilterGroups':
+                case 'ldapLoginFilterAttributes':
+                    if(is_array($value)) {
+                        $value = implode("\n", $value);
+                    }
+                    break;
+                //following options are not stored but detected, skip them
+                case 'ldapIgnoreNamingRules':
+                case 'ldapUuidUserAttribute':
+                case 'ldapUuidGroupAttribute':
+                    continue 2;
+            }
+            if(is_null($value)) {
+                $value = '';
+            }
+            $this->saveValue($cta[$key], $value);
+        }
+        $this->saveValue('_lastChange', time());
+        $this->unsavedChanges = [];
+    }
 
-	/**
-	 * @param string $varName
-	 * @return array|string
-	 */
-	protected function getMultiLine($varName) {
-		$value = $this->getValue($varName);
-		if(empty($value)) {
-			$value = '';
-		} else {
-			$value = preg_split('/\r\n|\r|\n/', $value);
-		}
+    /**
+     * @param string $varName
+     * @return array|string
+     */
+    protected function getMultiLine($varName) {
+        $value = $this->getValue($varName);
+        if(empty($value)) {
+            $value = '';
+        } else {
+            $value = preg_split('/\r\n|\r|\n/', $value);
+        }
 
-		return $value;
-	}
+        return $value;
+    }
 
-	/**
-	 * Sets multi-line values as arrays
-	 * 
-	 * @param string $varName name of config-key
-	 * @param array|string $value to set
-	 */
-	protected function setMultiLine($varName, $value) {
-		if(empty($value)) {
-			$value = '';
-		} else if (!is_array($value)) {
-			$value = preg_split('/\r\n|\r|\n|;/', $value);
-			if($value === false) {
-				$value = '';
-			}
-		}
+    /**
+     * Sets multi-line values as arrays
+     * 
+     * @param string $varName name of config-key
+     * @param array|string $value to set
+     */
+    protected function setMultiLine($varName, $value) {
+        if(empty($value)) {
+            $value = '';
+        } else if (!is_array($value)) {
+            $value = preg_split('/\r\n|\r|\n|;/', $value);
+            if($value === false) {
+                $value = '';
+            }
+        }
 
-		if(!is_array($value)) {
-			$finalValue = trim($value);
-		} else {
-			$finalValue = [];
-			foreach($value as $key => $val) {
-				if(is_string($val)) {
-					$val = trim($val);
-					if ($val !== '') {
-						//accidental line breaks are not wanted and can cause
-						// odd behaviour. Thus, away with them.
-						$finalValue[] = $val;
-					}
-				} else {
-					$finalValue[] = $val;
-				}
-			}
-		}
+        if(!is_array($value)) {
+            $finalValue = trim($value);
+        } else {
+            $finalValue = [];
+            foreach($value as $key => $val) {
+                if(is_string($val)) {
+                    $val = trim($val);
+                    if ($val !== '') {
+                        //accidental line breaks are not wanted and can cause
+                        // odd behaviour. Thus, away with them.
+                        $finalValue[] = $val;
+                    }
+                } else {
+                    $finalValue[] = $val;
+                }
+            }
+        }
 
-		$this->setRawValue($varName, $finalValue);
-	}
+        $this->setRawValue($varName, $finalValue);
+    }
 
-	/**
-	 * @param string $varName
-	 * @return string
-	 */
-	protected function getPwd($varName) {
-		return base64_decode($this->getValue($varName));
-	}
+    /**
+     * @param string $varName
+     * @return string
+     */
+    protected function getPwd($varName) {
+        return base64_decode($this->getValue($varName));
+    }
 
-	/**
-	 * @param string $varName
-	 * @return string
-	 */
-	protected function getLcValue($varName) {
-		return mb_strtolower($this->getValue($varName), 'UTF-8');
-	}
+    /**
+     * @param string $varName
+     * @return string
+     */
+    protected function getLcValue($varName) {
+        return mb_strtolower($this->getValue($varName), 'UTF-8');
+    }
 
-	/**
-	 * @param string $varName
-	 * @return string
-	 */
-	protected function getSystemValue($varName) {
-		//FIXME: if another system value is added, softcode the default value
-		return \OC::$server->getConfig()->getSystemValue($varName, false);
-	}
+    /**
+     * @param string $varName
+     * @return string
+     */
+    protected function getSystemValue($varName) {
+        //FIXME: if another system value is added, softcode the default value
+        return \OC::$server->getConfig()->getSystemValue($varName, false);
+    }
 
-	/**
-	 * @param string $varName
-	 * @return string
-	 */
-	protected function getValue($varName) {
-		static $defaults;
-		if(is_null($defaults)) {
-			$defaults = $this->getDefaults();
-		}
-		return \OC::$server->getConfig()->getAppValue('user_ldap',
-										$this->configPrefix.$varName,
-										$defaults[$varName]);
-	}
+    /**
+     * @param string $varName
+     * @return string
+     */
+    protected function getValue($varName) {
+        static $defaults;
+        if(is_null($defaults)) {
+            $defaults = $this->getDefaults();
+        }
+        return \OC::$server->getConfig()->getAppValue('user_ldap',
+                                        $this->configPrefix.$varName,
+                                        $defaults[$varName]);
+    }
 
-	/**
-	 * Sets a scalar value.
-	 * 
-	 * @param string $varName name of config key
-	 * @param mixed $value to set
-	 */
-	protected function setValue($varName, $value) {
-		if(is_string($value)) {
-			$value = trim($value);
-		}
-		$this->config[$varName] = $value;
-	}
+    /**
+     * Sets a scalar value.
+     * 
+     * @param string $varName name of config key
+     * @param mixed $value to set
+     */
+    protected function setValue($varName, $value) {
+        if(is_string($value)) {
+            $value = trim($value);
+        }
+        $this->config[$varName] = $value;
+    }
 
-	/**
-	 * Sets a scalar value without trimming.
-	 *
-	 * @param string $varName name of config key
-	 * @param mixed $value to set
-	 */
-	protected function setRawValue($varName, $value) {
-		$this->config[$varName] = $value;
-	}
+    /**
+     * Sets a scalar value without trimming.
+     *
+     * @param string $varName name of config key
+     * @param mixed $value to set
+     */
+    protected function setRawValue($varName, $value) {
+        $this->config[$varName] = $value;
+    }
 
-	/**
-	 * @param string $varName
-	 * @param string $value
-	 * @return bool
-	 */
-	protected function saveValue($varName, $value) {
-		\OC::$server->getConfig()->setAppValue(
-			'user_ldap',
-			$this->configPrefix.$varName,
-			$value
-		);
-		return true;
-	}
+    /**
+     * @param string $varName
+     * @param string $value
+     * @return bool
+     */
+    protected function saveValue($varName, $value) {
+        \OC::$server->getConfig()->setAppValue(
+            'user_ldap',
+            $this->configPrefix.$varName,
+            $value
+        );
+        return true;
+    }
 
-	/**
-	 * @return array an associative array with the default values. Keys are correspond
-	 * to config-value entries in the database table
-	 */
-	public function getDefaults() {
-		return [
-			'ldap_host'                         => '',
-			'ldap_port'                         => '',
-			'ldap_backup_host'                  => '',
-			'ldap_backup_port'                  => '',
-			'ldap_override_main_server'         => '',
-			'ldap_dn'                           => '',
-			'ldap_agent_password'               => '',
-			'ldap_base'                         => '',
-			'ldap_base_users'                   => '',
-			'ldap_base_groups'                  => '',
-			'ldap_userlist_filter'              => '',
-			'ldap_user_filter_mode'             => 0,
-			'ldap_userfilter_objectclass'       => '',
-			'ldap_userfilter_groups'            => '',
-			'ldap_login_filter'                 => '',
-			'ldap_login_filter_mode'            => 0,
-			'ldap_loginfilter_email'            => 0,
-			'ldap_loginfilter_username'         => 1,
-			'ldap_loginfilter_attributes'       => '',
-			'ldap_group_filter'                 => '',
-			'ldap_group_filter_mode'            => 0,
-			'ldap_groupfilter_objectclass'      => '',
-			'ldap_groupfilter_groups'           => '',
-			'ldap_gid_number'                   => 'gidNumber',
-			'ldap_display_name'                 => 'displayName',
-			'ldap_user_display_name_2'			=> '',
-			'ldap_group_display_name'           => 'cn',
-			'ldap_tls'                          => 0,
-			'ldap_quota_def'                    => '',
-			'ldap_quota_attr'                   => '',
-			'ldap_email_attr'                   => '',
-			'ldap_group_member_assoc_attribute' => '',
-			'ldap_cache_ttl'                    => 600,
-			'ldap_uuid_user_attribute'          => 'auto',
-			'ldap_uuid_group_attribute'         => 'auto',
-			'home_folder_naming_rule'           => '',
-			'ldap_turn_off_cert_check'          => 0,
-			'ldap_configuration_active'         => 0,
-			'ldap_attributes_for_user_search'   => '',
-			'ldap_attributes_for_group_search'  => '',
-			'ldap_expert_username_attr'         => '',
-			'ldap_expert_uuid_user_attr'        => '',
-			'ldap_expert_uuid_group_attr'       => '',
-			'has_memberof_filter_support'       => 0,
-			'use_memberof_to_detect_membership' => 1,
-			'last_jpegPhoto_lookup'             => 0,
-			'ldap_nested_groups'                => 0,
-			'ldap_paging_size'                  => 500,
-			'ldap_turn_on_pwd_change'           => 0,
-			'ldap_experienced_admin'            => 0,
-			'ldap_dynamic_group_member_url'     => '',
-			'ldap_default_ppolicy_dn'           => '',
-			'ldap_user_avatar_rule'             => 'default',
-			'ldap_ext_storage_home_attribute'   => '',
-		];
-	}
+    /**
+     * @return array an associative array with the default values. Keys are correspond
+     * to config-value entries in the database table
+     */
+    public function getDefaults() {
+        return [
+            'ldap_host'                         => '',
+            'ldap_port'                         => '',
+            'ldap_backup_host'                  => '',
+            'ldap_backup_port'                  => '',
+            'ldap_override_main_server'         => '',
+            'ldap_dn'                           => '',
+            'ldap_agent_password'               => '',
+            'ldap_base'                         => '',
+            'ldap_base_users'                   => '',
+            'ldap_base_groups'                  => '',
+            'ldap_userlist_filter'              => '',
+            'ldap_user_filter_mode'             => 0,
+            'ldap_userfilter_objectclass'       => '',
+            'ldap_userfilter_groups'            => '',
+            'ldap_login_filter'                 => '',
+            'ldap_login_filter_mode'            => 0,
+            'ldap_loginfilter_email'            => 0,
+            'ldap_loginfilter_username'         => 1,
+            'ldap_loginfilter_attributes'       => '',
+            'ldap_group_filter'                 => '',
+            'ldap_group_filter_mode'            => 0,
+            'ldap_groupfilter_objectclass'      => '',
+            'ldap_groupfilter_groups'           => '',
+            'ldap_gid_number'                   => 'gidNumber',
+            'ldap_display_name'                 => 'displayName',
+            'ldap_user_display_name_2'			=> '',
+            'ldap_group_display_name'           => 'cn',
+            'ldap_tls'                          => 0,
+            'ldap_quota_def'                    => '',
+            'ldap_quota_attr'                   => '',
+            'ldap_email_attr'                   => '',
+            'ldap_group_member_assoc_attribute' => '',
+            'ldap_cache_ttl'                    => 600,
+            'ldap_uuid_user_attribute'          => 'auto',
+            'ldap_uuid_group_attribute'         => 'auto',
+            'home_folder_naming_rule'           => '',
+            'ldap_turn_off_cert_check'          => 0,
+            'ldap_configuration_active'         => 0,
+            'ldap_attributes_for_user_search'   => '',
+            'ldap_attributes_for_group_search'  => '',
+            'ldap_expert_username_attr'         => '',
+            'ldap_expert_uuid_user_attr'        => '',
+            'ldap_expert_uuid_group_attr'       => '',
+            'has_memberof_filter_support'       => 0,
+            'use_memberof_to_detect_membership' => 1,
+            'last_jpegPhoto_lookup'             => 0,
+            'ldap_nested_groups'                => 0,
+            'ldap_paging_size'                  => 500,
+            'ldap_turn_on_pwd_change'           => 0,
+            'ldap_experienced_admin'            => 0,
+            'ldap_dynamic_group_member_url'     => '',
+            'ldap_default_ppolicy_dn'           => '',
+            'ldap_user_avatar_rule'             => 'default',
+            'ldap_ext_storage_home_attribute'   => '',
+        ];
+    }
 
-	/**
-	 * @return array that maps internal variable names to database fields
-	 */
-	public function getConfigTranslationArray() {
-		//TODO: merge them into one representation
-		static $array = [
-			'ldap_host'                         => 'ldapHost',
-			'ldap_port'                         => 'ldapPort',
-			'ldap_backup_host'                  => 'ldapBackupHost',
-			'ldap_backup_port'                  => 'ldapBackupPort',
-			'ldap_override_main_server'         => 'ldapOverrideMainServer',
-			'ldap_dn'                           => 'ldapAgentName',
-			'ldap_agent_password'               => 'ldapAgentPassword',
-			'ldap_base'                         => 'ldapBase',
-			'ldap_base_users'                   => 'ldapBaseUsers',
-			'ldap_base_groups'                  => 'ldapBaseGroups',
-			'ldap_userfilter_objectclass'       => 'ldapUserFilterObjectclass',
-			'ldap_userfilter_groups'            => 'ldapUserFilterGroups',
-			'ldap_userlist_filter'              => 'ldapUserFilter',
-			'ldap_user_filter_mode'             => 'ldapUserFilterMode',
-			'ldap_user_avatar_rule'             => 'ldapUserAvatarRule',
-			'ldap_login_filter'                 => 'ldapLoginFilter',
-			'ldap_login_filter_mode'            => 'ldapLoginFilterMode',
-			'ldap_loginfilter_email'            => 'ldapLoginFilterEmail',
-			'ldap_loginfilter_username'         => 'ldapLoginFilterUsername',
-			'ldap_loginfilter_attributes'       => 'ldapLoginFilterAttributes',
-			'ldap_group_filter'                 => 'ldapGroupFilter',
-			'ldap_group_filter_mode'            => 'ldapGroupFilterMode',
-			'ldap_groupfilter_objectclass'      => 'ldapGroupFilterObjectclass',
-			'ldap_groupfilter_groups'           => 'ldapGroupFilterGroups',
-			'ldap_gid_number'                   => 'ldapGidNumber',
-			'ldap_display_name'                 => 'ldapUserDisplayName',
-			'ldap_user_display_name_2'			=> 'ldapUserDisplayName2',
-			'ldap_group_display_name'           => 'ldapGroupDisplayName',
-			'ldap_tls'                          => 'ldapTLS',
-			'ldap_quota_def'                    => 'ldapQuotaDefault',
-			'ldap_quota_attr'                   => 'ldapQuotaAttribute',
-			'ldap_email_attr'                   => 'ldapEmailAttribute',
-			'ldap_group_member_assoc_attribute' => 'ldapGroupMemberAssocAttr',
-			'ldap_cache_ttl'                    => 'ldapCacheTTL',
-			'home_folder_naming_rule'           => 'homeFolderNamingRule',
-			'ldap_turn_off_cert_check'          => 'turnOffCertCheck',
-			'ldap_configuration_active'         => 'ldapConfigurationActive',
-			'ldap_attributes_for_user_search'   => 'ldapAttributesForUserSearch',
-			'ldap_attributes_for_group_search'  => 'ldapAttributesForGroupSearch',
-			'ldap_expert_username_attr'         => 'ldapExpertUsernameAttr',
-			'ldap_expert_uuid_user_attr'        => 'ldapExpertUUIDUserAttr',
-			'ldap_expert_uuid_group_attr'       => 'ldapExpertUUIDGroupAttr',
-			'has_memberof_filter_support'       => 'hasMemberOfFilterSupport',
-			'use_memberof_to_detect_membership' => 'useMemberOfToDetectMembership',
-			'last_jpegPhoto_lookup'             => 'lastJpegPhotoLookup',
-			'ldap_nested_groups'                => 'ldapNestedGroups',
-			'ldap_paging_size'                  => 'ldapPagingSize',
-			'ldap_turn_on_pwd_change'           => 'turnOnPasswordChange',
-			'ldap_experienced_admin'            => 'ldapExperiencedAdmin',
-			'ldap_dynamic_group_member_url'     => 'ldapDynamicGroupMemberURL',
-			'ldap_default_ppolicy_dn'           => 'ldapDefaultPPolicyDN',
-			'ldap_ext_storage_home_attribute'   => 'ldapExtStorageHomeAttribute',
-			'ldapIgnoreNamingRules'             => 'ldapIgnoreNamingRules',	// sysconfig
-		];
-		return $array;
-	}
+    /**
+     * @return array that maps internal variable names to database fields
+     */
+    public function getConfigTranslationArray() {
+        //TODO: merge them into one representation
+        static $array = [
+            'ldap_host'                         => 'ldapHost',
+            'ldap_port'                         => 'ldapPort',
+            'ldap_backup_host'                  => 'ldapBackupHost',
+            'ldap_backup_port'                  => 'ldapBackupPort',
+            'ldap_override_main_server'         => 'ldapOverrideMainServer',
+            'ldap_dn'                           => 'ldapAgentName',
+            'ldap_agent_password'               => 'ldapAgentPassword',
+            'ldap_base'                         => 'ldapBase',
+            'ldap_base_users'                   => 'ldapBaseUsers',
+            'ldap_base_groups'                  => 'ldapBaseGroups',
+            'ldap_userfilter_objectclass'       => 'ldapUserFilterObjectclass',
+            'ldap_userfilter_groups'            => 'ldapUserFilterGroups',
+            'ldap_userlist_filter'              => 'ldapUserFilter',
+            'ldap_user_filter_mode'             => 'ldapUserFilterMode',
+            'ldap_user_avatar_rule'             => 'ldapUserAvatarRule',
+            'ldap_login_filter'                 => 'ldapLoginFilter',
+            'ldap_login_filter_mode'            => 'ldapLoginFilterMode',
+            'ldap_loginfilter_email'            => 'ldapLoginFilterEmail',
+            'ldap_loginfilter_username'         => 'ldapLoginFilterUsername',
+            'ldap_loginfilter_attributes'       => 'ldapLoginFilterAttributes',
+            'ldap_group_filter'                 => 'ldapGroupFilter',
+            'ldap_group_filter_mode'            => 'ldapGroupFilterMode',
+            'ldap_groupfilter_objectclass'      => 'ldapGroupFilterObjectclass',
+            'ldap_groupfilter_groups'           => 'ldapGroupFilterGroups',
+            'ldap_gid_number'                   => 'ldapGidNumber',
+            'ldap_display_name'                 => 'ldapUserDisplayName',
+            'ldap_user_display_name_2'			=> 'ldapUserDisplayName2',
+            'ldap_group_display_name'           => 'ldapGroupDisplayName',
+            'ldap_tls'                          => 'ldapTLS',
+            'ldap_quota_def'                    => 'ldapQuotaDefault',
+            'ldap_quota_attr'                   => 'ldapQuotaAttribute',
+            'ldap_email_attr'                   => 'ldapEmailAttribute',
+            'ldap_group_member_assoc_attribute' => 'ldapGroupMemberAssocAttr',
+            'ldap_cache_ttl'                    => 'ldapCacheTTL',
+            'home_folder_naming_rule'           => 'homeFolderNamingRule',
+            'ldap_turn_off_cert_check'          => 'turnOffCertCheck',
+            'ldap_configuration_active'         => 'ldapConfigurationActive',
+            'ldap_attributes_for_user_search'   => 'ldapAttributesForUserSearch',
+            'ldap_attributes_for_group_search'  => 'ldapAttributesForGroupSearch',
+            'ldap_expert_username_attr'         => 'ldapExpertUsernameAttr',
+            'ldap_expert_uuid_user_attr'        => 'ldapExpertUUIDUserAttr',
+            'ldap_expert_uuid_group_attr'       => 'ldapExpertUUIDGroupAttr',
+            'has_memberof_filter_support'       => 'hasMemberOfFilterSupport',
+            'use_memberof_to_detect_membership' => 'useMemberOfToDetectMembership',
+            'last_jpegPhoto_lookup'             => 'lastJpegPhotoLookup',
+            'ldap_nested_groups'                => 'ldapNestedGroups',
+            'ldap_paging_size'                  => 'ldapPagingSize',
+            'ldap_turn_on_pwd_change'           => 'turnOnPasswordChange',
+            'ldap_experienced_admin'            => 'ldapExperiencedAdmin',
+            'ldap_dynamic_group_member_url'     => 'ldapDynamicGroupMemberURL',
+            'ldap_default_ppolicy_dn'           => 'ldapDefaultPPolicyDN',
+            'ldap_ext_storage_home_attribute'   => 'ldapExtStorageHomeAttribute',
+            'ldapIgnoreNamingRules'             => 'ldapIgnoreNamingRules',	// sysconfig
+        ];
+        return $array;
+    }
 
-	/**
-	 * @param string $rule
-	 * @return array
-	 * @throws \RuntimeException
-	 */
-	public function resolveRule($rule) {
-		if($rule === 'avatar') {
-			return $this->getAvatarAttributes();
-		}
-		throw new \RuntimeException('Invalid rule');
-	}
+    /**
+     * @param string $rule
+     * @return array
+     * @throws \RuntimeException
+     */
+    public function resolveRule($rule) {
+        if($rule === 'avatar') {
+            return $this->getAvatarAttributes();
+        }
+        throw new \RuntimeException('Invalid rule');
+    }
 
-	public function getAvatarAttributes() {
-		$value = $this->ldapUserAvatarRule ?: self::AVATAR_PREFIX_DEFAULT;
-		$defaultAttributes = ['jpegphoto', 'thumbnailphoto'];
+    public function getAvatarAttributes() {
+        $value = $this->ldapUserAvatarRule ?: self::AVATAR_PREFIX_DEFAULT;
+        $defaultAttributes = ['jpegphoto', 'thumbnailphoto'];
 
-		if($value === self::AVATAR_PREFIX_NONE) {
-			return [];
-		}
-		if(strpos($value, self::AVATAR_PREFIX_DATA_ATTRIBUTE) === 0) {
-			$attribute = trim(substr($value, strlen(self::AVATAR_PREFIX_DATA_ATTRIBUTE)));
-			if($attribute === '') {
-				return $defaultAttributes;
-			}
-			return [strtolower($attribute)];
-		}
-		if($value !== self::AVATAR_PREFIX_DEFAULT) {
-			\OC::$server->getLogger()->warning('Invalid config value to ldapUserAvatarRule; falling back to default.');
-		}
-		return $defaultAttributes;
-	}
+        if($value === self::AVATAR_PREFIX_NONE) {
+            return [];
+        }
+        if(strpos($value, self::AVATAR_PREFIX_DATA_ATTRIBUTE) === 0) {
+            $attribute = trim(substr($value, strlen(self::AVATAR_PREFIX_DATA_ATTRIBUTE)));
+            if($attribute === '') {
+                return $defaultAttributes;
+            }
+            return [strtolower($attribute)];
+        }
+        if($value !== self::AVATAR_PREFIX_DEFAULT) {
+            \OC::$server->getLogger()->warning('Invalid config value to ldapUserAvatarRule; falling back to default.');
+        }
+        return $defaultAttributes;
+    }
 
 }

Spacing +29 added lines, -29 removed lines

@@ -117,7 +117,7 @@ 
 	 */
 	public function __construct($configPrefix, $autoRead = true) {
 		$this->configPrefix = $configPrefix;
-		if($autoRead) {
+		if ($autoRead) {
 			$this->readConfiguration();
 		}
 	}
@@ -127,7 +127,7 @@ 
 	 * @return mixed|null
 	 */
 	public function __get($name) {
-		if(isset($this->config[$name])) {
+		if (isset($this->config[$name])) {
 			return $this->config[$name];
 		}
 		return null;
@@ -158,22 +158,22 @@ 
 	 * @return false|null
 	 */
 	public function setConfiguration($config, &$applied = null) {
-		if(!is_array($config)) {
+		if (!is_array($config)) {
 			return false;
 		}
 
 		$cta = $this->getConfigTranslationArray();
-		foreach($config as $inputKey => $val) {
-			if(strpos($inputKey, '_') !== false && array_key_exists($inputKey, $cta)) {
+		foreach ($config as $inputKey => $val) {
+			if (strpos($inputKey, '_') !== false && array_key_exists($inputKey, $cta)) {
 				$key = $cta[$inputKey];
-			} elseif(array_key_exists($inputKey, $this->config)) {
+			} elseif (array_key_exists($inputKey, $this->config)) {
 				$key = $inputKey;
 			} else {
 				continue;
 			}
 
 			$setMethod = 'setValue';
-			switch($key) {
+			switch ($key) {
 				case 'ldapAgentPassword':
 					$setMethod = 'setRawValue';
 					break;
@@ -197,7 +197,7 @@ 
 					break;
 			}
 			$this->$setMethod($key, $val);
-			if(is_array($applied)) {
+			if (is_array($applied)) {
 				$applied[] = $inputKey;
 				// storing key as index avoids duplication, and as value for simplicity
 			}
@@ -207,15 +207,15 @@ 
 	}
 
 	public function readConfiguration() {
-		if(!$this->configRead && !is_null($this->configPrefix)) {
+		if (!$this->configRead && !is_null($this->configPrefix)) {
 			$cta = array_flip($this->getConfigTranslationArray());
-			foreach($this->config as $key => $val) {
-				if(!isset($cta[$key])) {
+			foreach ($this->config as $key => $val) {
+				if (!isset($cta[$key])) {
 					//some are determined
 					continue;
 				}
 				$dbKey = $cta[$key];
-				switch($key) {
+				switch ($key) {
 					case 'ldapBase':
 					case 'ldapBaseUsers':
 					case 'ldapBaseGroups':
@@ -258,7 +258,7 @@ 
 	 */
 	public function saveConfiguration() {
 		$cta = array_flip($this->getConfigTranslationArray());
-		foreach($this->unsavedChanges as $key) {
+		foreach ($this->unsavedChanges as $key) {
 			$value = $this->config[$key];
 			switch ($key) {
 				case 'ldapAgentPassword':
@@ -274,7 +274,7 @@ 
 				case 'ldapGroupFilterObjectclass':
 				case 'ldapGroupFilterGroups':
 				case 'ldapLoginFilterAttributes':
-					if(is_array($value)) {
+					if (is_array($value)) {
 						$value = implode("\n", $value);
 					}
 					break;
@@ -284,7 +284,7 @@ 
 				case 'ldapUuidGroupAttribute':
 					continue 2;
 			}
-			if(is_null($value)) {
+			if (is_null($value)) {
 				$value = '';
 			}
 			$this->saveValue($cta[$key], $value);
@@ -299,7 +299,7 @@ 
 	 */
 	protected function getMultiLine($varName) {
 		$value = $this->getValue($varName);
-		if(empty($value)) {
+		if (empty($value)) {
 			$value = '';
 		} else {
 			$value = preg_split('/\r\n|\r|\n/', $value);
@@ -315,21 +315,21 @@ 
 	 * @param array|string $value to set
 	 */
 	protected function setMultiLine($varName, $value) {
-		if(empty($value)) {
+		if (empty($value)) {
 			$value = '';
 		} else if (!is_array($value)) {
 			$value = preg_split('/\r\n|\r|\n|;/', $value);
-			if($value === false) {
+			if ($value === false) {
 				$value = '';
 			}
 		}
 
-		if(!is_array($value)) {
+		if (!is_array($value)) {
 			$finalValue = trim($value);
 		} else {
 			$finalValue = [];
-			foreach($value as $key => $val) {
-				if(is_string($val)) {
+			foreach ($value as $key => $val) {
+				if (is_string($val)) {
 					$val = trim($val);
 					if ($val !== '') {
 						//accidental line breaks are not wanted and can cause
@@ -376,7 +376,7 @@ 
 	 */
 	protected function getValue($varName) {
 		static $defaults;
-		if(is_null($defaults)) {
+		if (is_null($defaults)) {
 			$defaults = $this->getDefaults();
 		}
 		return \OC::$server->getConfig()->getAppValue('user_ldap',
@@ -391,7 +391,7 @@ 
 	 * @param mixed $value to set
 	 */
 	protected function setValue($varName, $value) {
-		if(is_string($value)) {
+		if (is_string($value)) {
 			$value = trim($value);
 		}
 		$this->config[$varName] = $value;
@@ -542,7 +542,7 @@ 
 			'ldap_dynamic_group_member_url'     => 'ldapDynamicGroupMemberURL',
 			'ldap_default_ppolicy_dn'           => 'ldapDefaultPPolicyDN',
 			'ldap_ext_storage_home_attribute'   => 'ldapExtStorageHomeAttribute',
-			'ldapIgnoreNamingRules'             => 'ldapIgnoreNamingRules',	// sysconfig
+			'ldapIgnoreNamingRules'             => 'ldapIgnoreNamingRules', // sysconfig
 		];
 		return $array;
 	}
@@ -553,7 +553,7 @@ 
 	 * @throws \RuntimeException
 	 */
 	public function resolveRule($rule) {
-		if($rule === 'avatar') {
+		if ($rule === 'avatar') {
 			return $this->getAvatarAttributes();
 		}
 		throw new \RuntimeException('Invalid rule');
@@ -563,17 +563,17 @@ 
 		$value = $this->ldapUserAvatarRule ?: self::AVATAR_PREFIX_DEFAULT;
 		$defaultAttributes = ['jpegphoto', 'thumbnailphoto'];
 
-		if($value === self::AVATAR_PREFIX_NONE) {
+		if ($value === self::AVATAR_PREFIX_NONE) {
 			return [];
 		}
-		if(strpos($value, self::AVATAR_PREFIX_DATA_ATTRIBUTE) === 0) {
+		if (strpos($value, self::AVATAR_PREFIX_DATA_ATTRIBUTE) === 0) {
 			$attribute = trim(substr($value, strlen(self::AVATAR_PREFIX_DATA_ATTRIBUTE)));
-			if($attribute === '') {
+			if ($attribute === '') {
 				return $defaultAttributes;
 			}
 			return [strtolower($attribute)];
 		}
-		if($value !== self::AVATAR_PREFIX_DEFAULT) {
+		if ($value !== self::AVATAR_PREFIX_DEFAULT) {
 			\OC::$server->getLogger()->warning('Invalid config value to ldapUserAvatarRule; falling back to default.');
 		}
 		return $defaultAttributes;