Add force lower/uppercase setting for LDAP UUIDs
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 36.9k
- Forks
- 5.2k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 713
Description
Nextcloud usernames are case sensitive. Per default, the user_ldap app uses the ObjectGUID and similar attributes as the username.
Per RFC4122 UUIDs are not case sensitive. This results in unexpected behavior which has already been reported, for example when combining LDAP with OIDC or SAML ( https://github.com/nextcloud/user_saml/issues/406 https://github.com/nextcloud/user_saml/issues/563 ).
Confusing the situation even more: the different handling of upper and lower case UUIDs by different LDAP servers. For example, LDAP via Samba returns uppercase ObjectGUIDs while OpenLDAP (for example via UCS) uses lowercase UUIDs. This makes migrating from one directory service to another, while keeping users in Nextcloud, very difficult. Dumping the database, replacing the UUIDs with their upper or lower case alternative, inserting the dump again and moving the user data directories in theory does work.
However, du to the fact that Nextcloud user_ldap uses UUIDs for mapping case sensitive usernames and UUIDs per definition are not case sensitive, the app should provide some kind of mechanism to deal with the issue.
Describe the solution you'd like
The "Expert" tab of the user_ldap configuration wizard should have a new configuration option in the "Override UUID detection" section. The configuration option should let a admin choose one of 3 options:
- Accept upper/lower case as returned from directory service (default)
- Convert UUIDs to lower case
- Convert UUIDs to upper case
Describe alternatives you've considered
When migrating to a different LDAP directory, the database needs to be updated. When combining LDAP with OIDC or SAML, for example Keycloak allows to convert UUIDs to lower or uppercase with script mappers (https://github.com/netzbegruenung/keycloak-scriptmapper-ldap-id).
Additional context
None.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in the user_ldap configuration wizard's Expert tab, specifically the "Override UUID detection" section described in the issue. Trace where LDAP UUIDs are read and used as usernames, then identify the relevant tests or entry points for configuration and UUID mapping. Done means admins can select the default, lowercase, or uppercase behavior and the selected normalization is consistently applied.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- authentication
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100