nextcloud / apps

🚚 This is an archive. Let us know if you want to take over maintainership of any of these apps
11 stars 29 forks source link

IMAP: Restrict domain in existing install -> new users created, not using existing ones #40

Closed t0mcat1337 closed 6 years ago

t0mcat1337 commented 6 years ago

Affected apps

user_external

Steps to reproduce

  1. Activate user_external, add to config.php:
    
    'user_backends' =>
    array (
    0 =>
    array (
      'class' => 'OC_User_IMAP',
      'arguments' =>
      array (
        0 => '{localhost:993/imap/ssl/novalidate-cert}',
      ),
    ),
    ),
(NOTICE: NO Domain Restriction!!)

2. Login with a valid IMAP Mail Adress (user@example.com)
3. User is created as "user@example.com" (verified by logging in as an NC Admin)
4. Put some Data in Nextcloud
5. Log Off
6. Decide to restrict access to domain "example.com" only, so change config.php:

'user_backends' => array ( 0 => array ( 'class' => 'OC_User_IMAP', 'arguments' => array ( 0 => '{localhost:993/imap/ssl/novalidate-cert}', 'example.com' ), ), ),


(NOTICE: Domain "example.com" added to array)

7. Again login with the valid IMAP User "user@example.com"
8. The first login wizard appears, so the user seems to be a new one. Indeed the data from step 4 is away.
9. Login as NC Admin, notice there are now two users: "user" and "user@example.com"
10. Change back the config.php not to restrict to "example.com"
11. Login as "user@example.com"
12. The data from step 4 is available again.

The behaviour of user_external is as documented; when restricted to a domain, the domain part is stripped while creating the new user, so the username is just "user".
This is quite fine for fresh installations. 
But in existing installations, when this option wasn't initially set in config.php and setting it later (for whatever reason), existing users can't access their data any more.

Can't there be an option for this, speaking, not to strip the domain part but restrict to a domain? This won't break existing installations, when one decides to activate domain restrictions later.
Or could the app check, if there already are users with this domain part and use them further?

**Server version:** (see your admin page)
12.0.3