nextcloud / nextcloud/user_saml
When you create a new user in ldap, user_saml does not notice that
Nobody has claimed this yet.
- Dominant language
- PHP
- Stars
- 104
- Forks
- 85
- Avg merge
- 1d 15h
- Merged PRs (30d)
- 16
Description
- create a new user, which can authenticate over saml (but also gets created in a ldap directory)
- try to login directly afterwards
Expected behaviour
User is able to login.
Actual behaviour
User gets the "user not provonised" message. and can not login.
The problem seems to be, that ldap uses the ldap cache and does not renew it. When setting the ldap cache shorter or invalidate it, the user can login.
It seems that the ldap plugin does not have the same problem, when logging in over the ldap plugin.
So user_saml should force the ldap plugin invalidate it's cache on login. (or at least when the user is not found).
Server configuration
nextcloud 13.0.2
ldap plugin and user_saml plugin configured.
In user_saml plugin option "Only allow authentication if an account exists on some other backend. (e.g. LDAP)" is activated.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the user_saml login flow for accounts checked against another backend, then inspect how the LDAP plugin cache is consulted when a newly created user is not found. Done means a user created in LDAP can authenticate over SAML immediately without receiving the "user not provisioned" message.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 32/100