LDAP avatar download is pixelated / LDAP write reduces avatar quality in LDAP itself

How to use GitHub

• Please use the 👍 reaction to show that you are affected by the same issue.
• Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
• Subscribe to receive notifications on status change and new comments.

Steps to reproduce

1. Setup OpenLDAP with Nextcloud
2. Add jpegPhoto to LDAP users (~20-30 KB, ~600x600 for HiDPI screens) -> Refresh tool viewing LDAP to confirm full quality is in LDAP
3. Login to Nextcloud with any of these users to force LDAP sync of avatar

Expected behaviour

5. Visit Nextcloud user settings page to see profile photo —> See avatar that is a high quality resize of what was pulled from LDAP
   If Nextcloud has the ldap_write_support module enabled (with avatar updating setting enabled), and if Nextcloud has write access to OpenLDAP:
6. Go back to your viewing tool for OpenLDAP and check jpegPhoto for users —> View that the jpegPhoto was not changed just because Nextcloud downloaded and resized it

Actual behaviour

5. Visit Nextcloud user settings page to see profile photo —> View low quality and pixelated version of avatar
   If Nextcloud has the ldap_write_support module enabled (with avatar updating setting enabled), and if Nextcloud has write access to OpenLDAP:
6. Go back to your viewing tool for OpenLDAP and check jpegPhoto for users —> View that the jpegPhoto was updated and made low quality

Server configuration

Operating system: Ubuntu

Web server: nginx

Database: MariaDB

PHP version: PHP 7.4

Nextcloud version: 21.0.3

Updated from an older Nextcloud/ownCloud or fresh install: Regular updated since NC 18

Where did you install Nextcloud from:

Signing status:

No errors have been found.

List of activated apps:

N/A

Nextcloud configuration:

{
    "system": {
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "***REMOVED SENSITIVE VALUE***"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "mysql",
        "version": "21.0.3.1",
        "overwrite.cli.url": "***REMOVED SENSITIVE VALUE***",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "mysql.utf8mb4": true,
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "memcache.local": "\\OC\\Memcache\\APCu",
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "filelocking.enabled": "true",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": 0,
            "dbindex": 0,
            "timeout": 1.5
        },
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpmode": "smtp",
        "mail_sendmailmode": "smtp",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpauthtype": "LOGIN",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpsecure": "ssl",
        "mail_smtpauth": 1,
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpport": "465",
        "twofactor_enforced": "true",
        "twofactor_enforced_groups": [
            "admin"
        ],
        "twofactor_enforced_excluded_groups": [],
        "updater.release.channel": "stable",
        "maintenance": false,
        "theme": "",
        "loglevel": 2,
        "preview_max_x": "2048",
        "preview_max_y": "2048",
        "jpeg_quality": "90",
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "default_phone_region": "US",
        "ldapProviderFactory": "OCA\\User_LDAP\\LDAPProviderFactory"
    }
}

Are you using external storage, if yes which one: No

Are you using encryption: No

Are you using an external user-backend, if yes which one: OpenLDAP

LDAP configuration (delete this part if not used)

N/A

Client configuration

Browser: N/A

Operating system: N/A

Logs

Web server error log

N/A

Nextcloud log (data/nextcloud.log)

No lines related to avatar / user login=; log level is set to to 2 (WARN).

Browser log

N/A

Start by tracing avatar synchronization and the ldap_write_support path for OpenLDAP users, using the reproduction steps with a 600x600 jpegPhoto as the first check. Done means the Nextcloud avatar remains a high-quality resize and downloading it does not replace the original jpegPhoto in LDAP; the payload names no files or tests.