From 55b7c305519765895c00b7892ab00f1b85b0491e Mon Sep 17 00:00:00 2001 From: Carl Schwan Date: Wed, 22 Jul 2026 11:43:42 +0200 Subject: [PATCH] fix: Check group allow list based on the display name Since a few versions ago, we use ICreateNamedGroupBackend to create group on the default database backend. This will use the display name as GID unless the display name is too long and in that case will use a random GID. This random GID is impossible to match with the regex. Signed-off-by: Carl Schwan --- lib/Service/ProvisioningService.php | 21 +++++++++++++++------ 1 file changed, 15 insertions(+), 6 deletions(-) diff --git a/lib/Service/ProvisioningService.php b/lib/Service/ProvisioningService.php index 20ab7f4f..069f7431 100644 --- a/lib/Service/ProvisioningService.php +++ b/lib/Service/ProvisioningService.php @@ -762,13 +762,22 @@ public function provisionUserGroups(IUser $user, int $providerId, object $idToke return null; } - $userGroups = $this->groupManager->getUserGroupIds($user); - foreach ($userGroups as $groupGID) { - if (!in_array($groupGID, array_column($syncGroups, 'gid'))) { - if ($groupsWhitelistRegex && !preg_match($groupsWhitelistRegex, $groupGID)) { - continue; + if ($groupsWhitelistRegex) { + $userGroups = $this->groupManager->getUserGroups($user); + foreach ($userGroups as $group) { + if (!in_array($group->getGID(), array_column($syncGroups, 'gid'))) { + if (!preg_match($groupsWhitelistRegex, $group->getDisplayName())) { + continue; + } + $group->removeUser($user); + } + } + } else { + $userGroupIds = $this->groupManager->getUserGroupIds($user); + foreach ($userGroupIds as $groupGID) { + if (!in_array($groupGID, array_column($syncGroups, 'gid'))) { + $this->groupManager->get($groupGID)?->removeUser($user); } - $this->groupManager->get($groupGID)?->removeUser($user); } }