LDAP - more flexibility in group-member-association

[Peter2121]

Actually, user_ldap application does not permit to precise the exact configuration of the directory in terms of groups membership. The only parameter we can choose is 'Group-Member association', where one cannot mention a particular attribute's name, only selection from drop-down list is possible. Later, the application use this choice to select an attribute name AND select the supposed type of content of this attribute (DN or UID).
Unfortunately, there is no standard of groups implementation in LDAP. There are several types of implementation that cannot be used with NextCloud. So, NextCloud should be a little bit more flexible:

• Ask the name of attribute, used for group-member association at the level of groups (membreuid, members,...), the name of the attribute could be done as a text, not only as a selection from a list;
• Ask the type of data, used in this attribute (DN or an attribute's content);
• If the type of data is NOT DN - ask the name of user's attribute, used to create the association (uid, mail, samaccoutname,...).

I think that such improvement (with good documentation) could decrease the number of questions about LDAP configuration and bug-reports about LDAP groups not working.

[MorrisJobke]

cc @nextcloud/ldap

[blizzz]

Good idea. Implementation requires some refactoring of this handling, but would improve the code in fact. Personally, I won't have resources for this however. As always, PRs are welcome and supported :)

[blizzz]

Ah, that said, I would leave the most common options as they are and only offer the switching to a self-defined attribute as another option. Otherwise it would be just too complicated for people with little knowledge of LDAP. And too inconvenient for others.

[Peter2121]

Sure, all this staff should be available in 'expert' tab, the default options are not so bad ;)

[Rincewind34]

Any progress on this feature? What exactly does "Dynamic Group Member URL" in advanced->directory settings? Seems that's not documented at all.