nextcloud / nextcloud/user_oidc
Access to group shares is not granted when adding a user to a group
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 181
- Forks
- 60
- Avg merge
- 7h 34m
- Merged PRs (30d)
- 26
Description
When a user, who already logged in via OIDC once, gets added to a group, the user does not get access to shares granted to these groups.
Steps to reproduce
- Set up a nextcloud instance (tested with 28.0.3 using Docker) with this app.
- Configure your identity provider. Make sure to enable group provisioning and adjust the groups claim name if necessary.
- At your IDP, create two users Alice and Bob. Alice should be a member of "testgroup", Bob not.
- Sign in to the Nextcloud both using Alice and Bob one after the other. (We have to sign in as Alice so the "testgroup" will be created in our Nextcloud. We have to sign in as Bob because the bug only occurs if a user already exists before assigning the group membership.)
- As Alice, create a folder and share it with the group "testgroup".
- At your IDP, add Bob to the "testgroup" group.
- Sign in as Bob to the Nextcloud. Bob won't be able to see the folder although he's a member of "testgroup" (membership can be confirmed by visiting
/settings/user). - As an administrator, remove and re-add Bob from/to "testgroup"
- Sign in as Bob again. Now, Bob is able to see the folder shared by Alice.
Expected behavior
Bob should be able to see the folder in step 7.
Additional context
This bug seems to be caused by some changes in Nextcloud 28. Performing the steps from above using Nextcloud 27.0.0, the behavior is as expected. Other OIDC apps also seem to be affected (e. g. https://github.com/pulsejet/nextcloud-oidc-login/issues/256).
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names no files or tests. First reproduce the OIDC group-provisioning flow on Nextcloud 28.0.3, then compare the group membership and share-access handling with Nextcloud 27. Done means a user added to an existing group can access that group's shared folder after signing in, without being removed and re-added.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- authentication, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100