Missing oc_share entries for SAML-provisioned users in existing groups after SAML-provisioning

Aperta
  • Qualcosa non va?
#897 3 commenti 1 reazione 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
30/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Ferma
Stack tecnologico
mariadb, php
Ambito
authentication, authorization, databases

Direzione di ricerca

Inizia riproducendo il provisioning SAML in un gruppo esistente con una cartella condivisa, quindi esamina come vengono gestite le aggiunte a oc_group_user e se vengono generate le corrispondenti voci oc_share. Confronta il percorso di provisioning con l’aggiunta manuale di un utente a un gruppo; l’issue è completata quando gli utenti appena sottoposti a provisioning o assegnati possono accedere alle risorse esistenti condivise con il gruppo senza il workaround del trigger del database.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

0. Needs triage bug
How to use GitHub
  • Please use the 👍 reaction to show that you are affected by the same issue.
  • Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
  • Subscribe to receive notifications on status change and new comments.
Steps to reproduce
  1. Provision a new user via SAML and ensure they are automatically assigned to an existing group (e.g., Group A) that has shared folders (e.g., Folder A).
  2. Log in as the newly provisioned user.
  3. Verify whether the group-shared folder (e.g., Folder A) is visible and accessible to the user.

Alternative scenario:

  1. Log in as an existing user.
  2. Assign the user to a new SAML-provisioned group (e.g., Group B) that has shared folders (e.g., Folder B).
  3. Verify whether the newly assigned group-shared folder (e.g., Folder B) is visible and accessible to the user.
Expected behaviour

When a user is added to a SAML-provisioned group, shared folders and files that were previously assigned to the group should be automatically available to the new user. Entries in the oc_share table should be generated accordingly, ensuring access to group-shared resources.

For example:

  • Folder A is shared with Group A.
  • User X is added to the system and automatically assigned to SAML Group A.
  • User X should immediately see Folder A and have access to the shared content, with corresponding entries in the oc_share table.
Actual behaviour

Currently, when a new user is provisioned via SAML and added to an existing group (e.g., Group A), the group-shared files and folders (e.g., Folder A) do not appear for the user. Although the share exists, no entries are created in the oc_share table to provide access.

If you manually add the user to the group through the Nextcloud backend or reassign the permissions on the folders, the oc_share entries are correctly created, and the user gains access to the shared resources.

This issue did not exist in version 5.27 but appears to be a regression in the current version.

Workaround (temporary fix):

In my instance, I’ve created a trigger for the oc_group_user table that temporarily addresses the issue. The trigger ensures that whenever a new gid-uid combination is added, the corresponding entries in the oc_share table are created or deleted accordingly. However, this should not be considered a permanent solution, as it only works as a temporary fix to handle the missing share entries in this specific instance.

Server configuration

Official Nextcloud Docker (nextcloud:30)

Web server: Apache/Nginx
Database: MariaDB
PHP version: 8.2.24
Nextcloud version: 30.0.0

Lingua principale
PHP
Stelle
106
Fork
84
Merge medio
1g 11h
PR unite (30g)
14

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di nextcloud/user_saml

Tutte le issue di nextcloud/user_saml

Issue simili

Altre issue su PHP

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.