[stable8.1]Properly nest groups when using memberOf to detect group membership, fixes #17759

[GreenArchon]

Backport of #18042 , approval #18042 (comment)

This backport is also under MIT license.

[ghost]

Thanks a lot for your contribution!
Contributions to the core repo require a signed contributors agreement http://owncloud.org/about/contributor-agreement/

Alternatively you can add a comment here where you state that this contribution is MIT licensed.

Some more details about out pull request workflow can be found here: http://owncloud.org/code-reviews-on-github/

[karlitschek]

@blizzz what do you think?

[MorrisJobke]

@blizzz what do you think?

I guess he also wants the backport ;) #18042 (comment)

[MorrisJobke]

@owncloud-bot this is okay to test

[DeepDiver1975]

let's hold back this merge until #18042 is in master

[ghost]

🚀 Test PASSed.🚀

[PVince81]

#18042 is still requiring review/attention

[MorrisJobke]

cc @blizzz @davivel

[davivel]

@MorrisJobke, me, sure? I don't know what is this about :S

[blizzz]

looks good, tested, works, 👍

@davitol maybe?

[davitol]

@davitol maybe? I`ve just tested and I think it is not solved
Nested Groups checkbox checked

Active Directory configuration (ABarr is inside group1; group1 is inside group2)

[blizzz]

@davitol you need to check in the user management whether a member of group1 is also shown when you click on group2. Don't forget to check "Nested groups" in advanced settings. See reproduction steps here #17759

[MorrisJobke]

@davivel Sorry I always mixup your username with the one of @davitol 😕 :P

[davitol]

The user does not appear in group 1 or group2, only when clicking in Everyone

[blizzz]

@davitol might it be some caching thing? can you give the owncloud config, just to check? it worked fine for me here.

[MellonQ]

Hi!
In order to operate properly search for nested groups in Active Directory you have not to use expression like "(memberof=CN=ownCloud Users,OU=Groups,DC=example,DC=com)" because it looks only for direct group membership. In AD there is "special-M$" search OID for this purposes (discribed here - https://msdn.microsoft.com/en-us/library/aa746475%28v=vs.85%29.aspx), so the correct search filter is:
(memberof:1.2.840.113556.1.4.1941:=CN=ownCloud Users,OU=Groups,DC=example,DC=com)

[MorrisJobke]

@cmonteroluque I will move this to 8.1.3

[davitol]

It worked OK for me switching the BP patch to oc server: version":"8.1.2.1","versionstring":"8.1.2"

[davitol]

👍 Waiting for another reviewer 😸

[blizzz]

@MellonQ that's interesting and probably worth an improvement for the future (>= OC 9.0). However, it would be very MS specific and we cannot guess the directory server in use. Maybe you are interested in following this idea and doing a PR against master? Or open a new issue as feature request with those details, so they do not get lost, at least.

[blizzz]

@davitol I reviewed already here #18123 (comment), let's merge

[davitol]

@cmonteroluque @DeepDiver1975 @blizzz Maybe it would be necessary a 'forwardport' to 8.2.X ?

[MorrisJobke]

@cmonteroluque @DeepDiver1975 @blizzz Maybe it would be necessary a 'forwardport' to 8.2.X ?

It is already in master: #18042