ldap_add(): Invalid syntax when creating group with default objectClass groupOfNames in LDAPGroupManager

Summary

After integrating Nextcloud with LDAP (Active Directory), I noticed that groups created via the Web UI were not being created in LDAP. Checking the PHP logs revealed the following error:
ldap_add(): Add: Invalid syntax at /nextcloud/apps/ldap_write_support/lib/LDAPGroupManager.php#72

I inspected the code inside the file:

apps/ldap_write_support/lib/LDAPGroupManager.php

and found that the function buildNewEntry() was creating a group entry using the objectClass groupOfNames and assigning an empty string to the member attribute:

'objectClass' => ['groupOfNames', 'top'],
'member' => ['']

This causes a syntax error when calling ldap_add(), because:
The groupOfNames object class requires at least one valid member DN.
An empty string is not a valid DN.
Active Directory often does not support groupOfNames for regular group creation.

Steps to reproduce

1. Set up Nextcloud with LDAP integration (in our case, Active Directory).
2. Try to create a group using the LDAP write support app (via Web UI or API).
3. Observe the logs when the creation fails.

Expected behaviour

The group should be created successfully in LDAP via the createGroup() method.

Actual behaviour

An error occurs when trying to create the group:
ldap_add(): Add: Invalid syntax at /nextcloud/apps/ldap_write_support/lib/LDAPGroupManager.php#72
This seems to be due to the objectClass used (groupOfNames) and the presence of an empty member attribute in the default implementation of buildNewEntry().

Temporary workaround

We modified the buildNewEntry() method to work correctly with our Active Directory setup by using the following changes:

Before:

private function buildNewEntry($gid): array {
  return [
  	'objectClass' => ['groupOfNames', 'top'],
  	'cn' => $gid,
  	'member' => ['']
  ];
}

After:

private function buildNewEntry($gid): array {
    return [
        'objectClass' => ['group', 'top'],
        'cn' => $gid,
        'sAMAccountName' => $gid
    ];
}

This allowed group creation to proceed successfully.

Notes

The default method uses groupOfNames, which requires a valid member DN. However, since no member is available during group creation, it leads to an invalid syntax error.

group with sAMAccountName is more compatible with Active Directory, especially when no member is provided initially.

Not sure if this would break compatibility with other directory types (e.g., OpenLDAP), so a detection mechanism might be necessary.

Server configuration

Web server: Nginx

Database: PostgreSQL

PHP version: 8.3

Nextcloud version: 31.0.5

Start with apps/ldap_write_support/lib/LDAPGroupManager.php, especially buildNewEntry() and createGroup(), and reproduce the ldap_add() failure using the Active Directory setup described. Determine how groupOfNames and the empty member value affect supported directory types, then verify that group creation succeeds without breaking the stated OpenLDAP compatibility concern.