LDAP group listing drops primary-group members when pagination is applied
Open
@hweihwang is already working on this.
Since Oct 13, 2025.
0. Needs triage
31-feedback
bug
- Dominant language
- PHP
- Stars
- 36.9k
- Forks
- 5.2k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 713
Description
Steps to reproduce
- Configure user_ldap against Active Directory where “Domain Users” membership is primarily granted via
primaryGroupID. - Log in as an admin and open Settings → Accounts → Groups → Domain Users.
- Scroll through the member list (pagination enabled by the provisioning API).
Expected behaviour
All ~1K members appear, matching occ group:list "Domain Users".
Actual behaviour
Only the ~27 accounts explicitly present in the group’s member attribute are shown. The badge/count stays correct.
Technical analysis
apps/provisioning_api/lib/Controller/GroupsController.php:195uses$group->searchUsers($search, $limit, $offset)to feed the Accounts UI.lib/private/Group/Group.php:209delegates to LDAP’susersInGroup().apps/user_ldap/lib/Group_LDAP.php:899-975merges direct members withgetUsersInPrimaryGroup()/getUsersInGidNumber()before applyingarray_slice(). Because the helper calls receive the same limit/offset, primary-group members are truncated.occ group:listcalls the same method without limit/offset, so it still shows all members.
Proposal
Fetch primary-group/gidNumber members without passing the limit/offset (or fetch unlimited and only slice after merging), or have the provisioning API skip pagination for LDAP backends that rely on those helpers.
Environment
Nextcloud Enterprise 31.0.7, user_ldap 1.22.0, AD with primaryGroupID.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.