nextcloud / nextcloud/user_oidc

Access to group shares is not granted when adding a user to a group

Open
#827 3 comments 6 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug priority: normal
Dominant language
PHP
Stars
181
Forks
60
Avg merge
7h 34m
Merged PRs (30d)
26

Description

When a user, who already logged in via OIDC once, gets added to a group, the user does not get access to shares granted to these groups.

Steps to reproduce
  1. Set up a nextcloud instance (tested with 28.0.3 using Docker) with this app.
  2. Configure your identity provider. Make sure to enable group provisioning and adjust the groups claim name if necessary.
  3. At your IDP, create two users Alice and Bob. Alice should be a member of "testgroup", Bob not.
  4. Sign in to the Nextcloud both using Alice and Bob one after the other. (We have to sign in as Alice so the "testgroup" will be created in our Nextcloud. We have to sign in as Bob because the bug only occurs if a user already exists before assigning the group membership.)
  5. As Alice, create a folder and share it with the group "testgroup".
  6. At your IDP, add Bob to the "testgroup" group.
  7. Sign in as Bob to the Nextcloud. Bob won't be able to see the folder although he's a member of "testgroup" (membership can be confirmed by visiting /settings/user).
  8. As an administrator, remove and re-add Bob from/to "testgroup"
  9. Sign in as Bob again. Now, Bob is able to see the folder shared by Alice.
Expected behavior

Bob should be able to see the folder in step 7.

Additional context

This bug seems to be caused by some changes in Nextcloud 28. Performing the steps from above using Nextcloud 27.0.0, the behavior is as expected. Other OIDC apps also seem to be affected (e. g. https://github.com/pulsejet/nextcloud-oidc-login/issues/256).

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

The issue names no files or tests. First reproduce the OIDC group-provisioning flow on Nextcloud 28.0.3, then compare the group membership and share-access handling with Nextcloud 27. Done means a user added to an existing group can access that group's shared folder after signing in, without being removed and re-added.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
authentication, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.