LDAP-Group Folder Sharing

[MatzeFix]

Hey Together,

we had a problem with sharing folders to LDAP-Groups. In this case I want to reference to the issue which was reported in the past -> #20133
We have exact the same. In this post you can see my answers - because of no reaction I open a new bug report.

If needed I can create the bug-report template (don't know the exact name of it).

The problem is still there, also with update to 18.03 -> for this reason we found a workaround which works good.

I will copy the important things from the bug report (from the Link)

From dea-75:
Now, using the solution in #19970 NEW LDAP groups in Nextcloud 18.0.3 are visible.
But if I try to share a directory to a NEW LDAP GROUP, the share is activated, but users in the LDAP group don’t see the share.
If I try to share directly to LDAP user (no the LDAP GROUP), works fine.
Is the problem related?

Steps to reproduce
Nextcloud 18.0.3, only LDAP users and groups. Apply patch in #19970. Now LDAP groups are visible.

Expected behaviour
When I share a folder to a new added LDAP group, share is activated, but users in the LDAP group doesn't see the share. If I share to singles LDAP users works fine (the problem is present ONLY for LDAP groups).
If I create a local groups (to test) and insert several LDAP users in the local group, works fine.
NO APP "Group folders" installed.

OS: Debian 10
Apache 2.4 (Debian)
PHP 7.3 - FPM (Debian 10)
Nextcloud 18.0.3 with #19970 applied
LDAP users app installed, last version.
No extenal storage, No encryption.

=> This issue is fixed for @dea-75 but on our side we have still this issue.

In the following is the reaction of my side (also the workaround)

From me (MatzeFix)

Hey together,
we have the same system as dea-75 -> also Version 18.03 and the same system-versions.
We also have the same problem.
@dea-75 did you make a workaround or some steps to fix that?

I tested this problem in Version 18.00; 18.02 and 18.03 and got always the same result.
Sharing folders with LDAP groups don't work (like dea-75 discribed).

We tested the LDAP connection and the results of the requests. All works perfekt, but we can't share folders with LDAP groups.
I don't know what to do, to fix it.... I also tested it in the past with Group-Folders (this works perfect).

=====
Hey together,
I found a workaround to the problem - which is not pretty nice but it works.
Actual status:
At the moment, it's possible to to share folders to LDAP-Groups. But the LDAP-Group Members don't see the shared folder.
Workaround:
In the database there is a table called oc_share which organize all shared folders with names etc.
This table has the attribute "accepted". By default this entry has the value 0. If you change all entries with accepted = 0 to accepted = 1 -> the shared folders and files will be avaliable for the LDAP-Group members on their own root-directory.
I tested this workaround for 18.02 and 18.03 and it works.
Maybe the feature -> accept shared folders an document has a bug.
We also made some config changes with the option following options to true and false (also with relogin after change an so on), but it doesn't change the problem.
• Set to true to enable that internal shares need to be accepted by the users $
• Users can change this for their account in their personal sharing settings
/
'sharing.enable_share_accept' => false,
/*
• Set to true to enforce that internal shares need to be accepted
*/
'sharing.force_share_accept' => false,

[addy90]

In #19988 I wrote about something similar. I had your workaround as idea, too, to set accepted = 1 on the group entry, but I was not brave enough to change the table defaults as in my case I get all users but the last one to see the shared folder from an ldap group.
I could confirm that the two config options you mention did not change a thing, did not solve anything.

[kklem0]

I had this issue, clearing cache worked for me.
redis-cli -p 6379 FLUSHALL
And I've submitted a fix for #19988 , clear the cache after applying the fix.

There are still some weird issues in LDAP when I looked at the code last night but with these 2 fixes I could live now.

[MatzeFix]

Hey @clementhk,

is the cache also cleared when I restart the whole Maschine?

In our case we restart all servers every night.
If not I will test the flush command.
Thank you for taking care :)

[kklem0]

Hey @clementhk,

is the cache also cleared when I restart the whole Maschine?

In our case we restart all servers every night.
If not I will test the flush command.
Thank you for taking care :)

If you're using redis then yes, restarting clears the cache.
I think you only need to do it one time and it works from that on.

[jp1337]

I have a issue which may be related.

Nextcloud: 18.0.4
Database: MariaDB 10.3.22-0+deb10u1
Apache2: 2.4.38-3+deb10u3
PHP: 7.3.14-1~deb10u1

Description:
When I share a folder with a group I am no member of the shared folder is not visible for members of the target group. When I am a member of the target group the folder is visible.
Does this also apply for your issue @MatzeFix ?

I don't think that redis is related to the issue.

[jp1337]

Okay, after some more debugging and the help of @MatzeFix issue description I changed the default value of the accepted field in oc_share to 1. I am definitly aware, that this is a security issue and I do not recommend doing that.

The SQL I used:

UPDATE `oc_share` SET accepted = 1 WHERE accepted = 0;
ALTER TABLE `oc_share` CHANGE `accepted` `accepted` SMALLINT(6) NOT NULL DEFAULT '1';

[jp1337]

What I forgot to mention is, that my target user (who receives the shared folder) got no prompt to accept the share and has configured to automatically accept all shared folders.
I think this means, that the issue has to be fixed in the code and not in configuration.

[MatzeFix]

What I forgot to mention is, that my target user (who receives the shared folder) got no prompt to accept the share and has configured to automatically accept all shared folders.
I think this means, that the issue has to be fixed in the code and not in configuration.

Hey @jpylypiw - that sounds like my problem. As you said in your last statement - there is no option to accept the shared folder for users. Also with the configured statement it does not exists.
For this reason you changed the database yourself. This would be my last option, because I don't want to take any risks if some updates rebuild the tables.

But for me it works good - I hope this bug will be fixed.
At the moment I haven't tested the anwer from @clementhk so I don't know if it helps. :)