Skip to content

Users are not automatically removed from Keycloak groups #1472

Description

@OScaleSven

My Nextcloud version is: 34.0.1

My user_oidc version is: 8.10.1

Steps to reproduce

  1. Configure Nextcloud with user_oidc to provision users and groups from Keycloak
  2. Enable unique user IDs
  3. Use a regular expressions such as /^wolke/ to filter groups

Expected behaviour

When users are added to or removed from groups in Keycloak a users should be added or removed from a group when they log in, depending on whether they are a member of the group.

Actual behaviour

Users are added to groups, but never removed from groups.

Debugging results

The removal code, that should remove users from groups only considers the group ID, not the group name, so the regular expression is useless, because it works on a random ID.

This patch fixed the issue for me:

--- a/lib/Service/ProvisioningService.php
+++ b/lib/Service/ProvisioningService.php
@@ -758,7 +758,8 @@
 		$userGroups = $this->groupManager->getUserGroups($user);
 		foreach ($userGroups as $group) {
 			if (!in_array($group->getGID(), array_column($syncGroups, 'gid'))) {
-				if ($groupsWhitelistRegex && !preg_match($groupsWhitelistRegex, $group->getGID())) {
+				$groupNameToMatch = $group->getDisplayName() ?? $group->getGID();
+				if ($groupsWhitelistRegex && !preg_match($groupsWhitelistRegex, $groupNameToMatch)) {
 					continue;
 				}
 				$group->removeUser($user);

The patch seems not to be compatible with the current master branch, but the issue should be fixed in upstream.

Thanks!

Metadata

Metadata

Assignees

Labels

Type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions