Don't create stripped account

[Thom1b]

Steps to reproduce

1. Login as "user1" instead of "user1@example.org"

Expected behaviour

Deny "user1" to login

Actual behaviour

Nextcloud creates a "user1" database account

Affected Authentication backend

IMAP backend with "strip domain part" setting to false

My user_external config

$CONFIG = array ( 'user_backends' =>
array ( 0 =>
array ( 'class' => 'OC_User_IMAP', 'arguments' =>
array ( 0 => 'localhost', 1 => 143, 2 => NULL, 3 => 'example.org', 4 => false, ),
),
),
);

Server configuration

User External App version: (see Nextcloud apps page) 0.9.0

Operating system: Slackware Linux

Web server: nginx-1.16.1

Database: Mariadb

PHP version: 7.3.16

Nextcloud version: (see Nextcloud admin page) 17.0.5.

Updated from an older Nextcloud/ownCloud or fresh install: Updated

Where did you install Nextcloud from: From official tarball

As you can see I set up "strip domain part" to false. So my IMAP users accounts are like "user1@example.org" in nextcloud, etc. "user1" account doesn't exist but if "user1@example.org" tries to login as "user1" instead of "user1@example.org", "user1" database account is created instead of deny it to login.

I think this is a bug in user_external because with "user_external" disabled, nextcloud denies the user to login. Anyway, is there a way to deny imap users to login with only the first part of their imap address?

Thanks, have a nice day!

[violoncelloCH]

Thanks, closing this as duplicate of #128

[j0rgan]

This is still an issue when trying to connect via caldav. Although it denies the login, the account is created. Steps to reproduce:

• configure as intended
• try to sync calendar (with iCal for example)

The apple ical will assume it is allowed to login, and then it will attempt to sync. It will not sync, however new account with stripped domain is created. Same for syncing carddav.