nextcloud / nextcloud/user_oidc
Users are not automatically removed from Keycloak groups
@CarlSchwan is already working on this.
Since Jul 22, 2026.
- Dominant language
- PHP
- Stars
- 181
- Forks
- 60
- Avg merge
- 7h 34m
- Merged PRs (30d)
- 26
Description
My Nextcloud version is: 34.0.1
My user_oidc version is: 8.10.1
Steps to reproduce
- Configure Nextcloud with user_oidc to provision users and groups from Keycloak
- Enable unique user IDs
- Use a regular expressions such as /^wolke/ to filter groups
Expected behaviour
When users are added to or removed from groups in Keycloak a users should be added or removed from a group when they log in, depending on whether they are a member of the group.
Actual behaviour
Users are added to groups, but never removed from groups.
Debugging results
The removal code, that should remove users from groups only considers the group ID, not the group name, so the regular expression is useless, because it works on a random ID.
This patch fixed the issue for me:
--- a/lib/Service/ProvisioningService.php
+++ b/lib/Service/ProvisioningService.php
@@ -758,7 +758,8 @@
$userGroups = $this->groupManager->getUserGroups($user);
foreach ($userGroups as $group) {
if (!in_array($group->getGID(), array_column($syncGroups, 'gid'))) {
- if ($groupsWhitelistRegex && !preg_match($groupsWhitelistRegex, $group->getGID())) {
+ $groupNameToMatch = $group->getDisplayName() ?? $group->getGID();
+ if ($groupsWhitelistRegex && !preg_match($groupsWhitelistRegex, $groupNameToMatch)) {
continue;
}
$group->removeUser($user);
The patch seems not to be compatible with the current master branch, but the issue should be fixed in upstream.
Thanks!
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.