Add domain blacklist/whitelist for guest creation

[pmaier1]

As an administrator I want to be able to restrict guest creation to certain domains. This means that I want to specify that e.g. *@badcompany.com may not be invited. For this a blacklist would fit. I can imagine that you also might want to restrict guest creation to *@goodcompany.com. For that a whitelist would be appropriate.

TBD.

[cortho]

related: #40

[PVince81]

Talked with @pmaier1 and @cdamken yesterday about this.

Basically the problem we have now with LDAP is as follows: we can only detect duplicate email addresses from the guest app if said email address is already known to ownCloud, which means that there is an entry in the oc_accounts table. When using LDAP, the admin needs to setup a user:sync cron service to synchronize the accounts table with LDAP users periodically. This means that if a new user was just added in LDAP but not synced to ownCloud yet, ownCloud doesn't know about said user.

This means that in this time window, someone else could create a guest account using the email address from that new user.

Furthermore, it is also possible that a user exists in LDAP but is not exposed to ownCloud yet. For example said user is part of another team and is not allowed to use this ownCloud instance. Later on, said user changes teams or project and now gets access to ownCloud. If in the meantime someone attempted to share something with that user's email address, that would also result in a guest user creation.

To cover both these cases, the admin would use the blacklist feature from this ticket to blacklist the company's own domain name to avoid creation of guest users for users who should not get access, and this way avoid the potential existence of duplicate accounts (guest account with email + future LDAP account with email).

We agreed that the blacklist feature would be necessary to fix the above issues.

Regarding the whitelist, it doesn't seem that useful and we should leave this for another time.

@pmaier1 should we get the blacklist implementation in the current guests app release or the next one ? I think the implementation is likely 1-2md including unit tests if we use regexps. If we use direct matching only it might be less than 1md.

@cortho your feedback also appreciated 😄

[cortho]

A blacklist looks to me the way we want to go (think of #40 too). Even w/o regarding LDAP issues I cannot see benefits of a white list here.
Checking for a lowercase substring check is sufficient, when we always want to check the string, which follows the @ character, regex would be required when we want to catch all subdomains as well (do we?)

[cortho]

Concerning the LDAP issue - is it intended, that guests are synced as well? If not, why not just have the code never syncing users who have the configvalue isGuest===true?
I see, the point is, that we do not want to create guest users that might be in ldap.

[PVince81]

do not want to create guest users that might be in ldap.

=> do not want to create guest users for email addresses that might exist in LDAP

Yes, exactly. There are no guest users directly in LDAP as the guests app create them in the local DB backend.

@cortho do you have time to work on this ? We still need to clarify whether we want regexp for subdomain or single string matching.

[cortho]

@PVince81 basically I have time, I'm on holiday from tomorrow until Nov 1st, however

[PVince81]

@cortho cool, assigning to you then. Thanks

[pmaier1]

I don't see the need for regexp matching but we need a wildcard engine to be able to cover all subdomains in one entry.