Repository navigation
[Admin] LDAP: user's attribute gidNumber is used for group relations #11148
Description
Activity
ldap:show-remnantsis only useful for deleted users and has nothing to do with this.Otherwise yes we should document that gidNumber is used for group membership even when something else (like member) is set for group<>member association.
Also note that there is a config entry for which attribute stores the gidNumber but it seems not exposed in the UI, should be double-checked.The behavior is real and undocumented. When a user's
gidNumberattribute matches thegidNumberof a group entry, Nextcloud treats the user as a member of that group regardless of whatldapGroupMemberAssocAttris configured to (e.g.member,memberUid). This is the POSIX primary group mechanism.The relevant doc file is
admin_manual/configuration_user/user_auth_ldap_api.rst. TheldapGidNumberconfig key is shown in examples (line 125) andgidNumberappears as a valid value forldapGroupMemberAssocAttr(line 260), but neither place explains the implicit primary-group matching side effect or that it operates independently of the member association attribute setting.Worth adding a note to the group membership section explaining this behavior, including the fact that the
ldapGidNumberattribute name is configurable but not exposed in the UI.Same thing for
primaryGroupIDI believe (which is the equivalent ofgidNumberbut for ActiveDirectory as far as I understand).
If
gidNumberfrom user entry matchesgidNumberfrom group, user will also be considered as part of this group. Then after removing a user from LDAP group, and cleanup withldap:show-remnants, user is still shown as a group member in web-interface and occ output.Should be noted in documentation, as it may lead to raising a ticket from customers, who tries to remove users
Documentation source:
https://github.com/nextcloud/documentation/blob/master/admin_manual/configuration_user/user_auth_ldap_api.rst
or
https://github.com/nextcloud/documentation/blob/master/admin_manual/configuration_user/user_auth_ldap_cleanup.rst