[Bug]: LDAP "users" filter is not used

[inDane]

⚠️ This issue respects the following points: ⚠️

• This is not a troubleshooting question, general support matter, or webserver/proxy problem, but likely a bug (if unsure, ask the Community Help Forum).
• This issue is not already reported on Github OR solved at the Community Help Forum (I've searched!).
• I'm using a maintained major version of Nextcloud Server and tested against the latest patch level. (Supported major versions and current patch levels).
• I agree to follow Nextcloud's Code of Conduct.
• I've tried my best to provide clear reproduction steps that someone unfamiliar with this bug could use to reproduce it.

Bug description

The LDAP "users" filter does not prevent access to users that are present in LDAP, but not in the specified filter.
On the LDAP "Users" tab: " The filter specifies which LDAP users shall have access to the Nextcloud instance [...]". This does not hold up and is not true. It is either a regression or a design-philosophy change. The filter here does not prevent users to log in and use the instance.

One can however, limit the access to the instance via "login attributes". If you put your filter here and add e.g. (uid=%uid) to it, it effectively limits access to the specified filter.

In my opinion, this is a bug. It was not present in version 32.0.x, it is present in version 33.0.9.
If it is a design choice, then it is still misleading, because of the sentence in "users"-tab ("The filter specifies which LDAP users shall have access..."). Also, why would you specify a filter, that has no effect and then add the filter to the login attributes?

On the wiki it says "In order to control which LDAP users can login to your Nextcloud server use the Login Attributes tab." this is in conflict with the "users"-sentence, I've mentioned before.

Steps to reproduce

1. Add LDAP Filter in "Users" tab ("Edit LDAP Query")
2. Try to login with an account that is not found in that query.
3. Login successful.

Expected behavior

1. Add LDAP Filter in "Users" tab ("Edit LDAP Query")
2. Try to login with an account that is not found in that query.
3. Login un-successful.

Nextcloud Server version

33

Operating system

Debian/Ubuntu

PHP engine version

PHP 8.3

Web server

Apache (supported)

Database engine version

PostgreSQL

Is this bug present after an update or on a fresh install?

Upgraded to a MAJOR version (ex. 31 to 32)

Are you using the Nextcloud Server Encryption module?

No response

What user-backends are you using?

• Default user-backend (database)
• LDAP/ Active Directory
• SSO - SAML
• Other

Configuration report

{
    "system": {
        "passwordsalt": "***REMOVED SENSITIVE VALUE***",
        "secret": "***REMOVED SENSITIVE VALUE***",
        "trusted_domains": [
            "localhost",
            "example.com",
            "example.com"
        ],
        "datadirectory": "***REMOVED SENSITIVE VALUE***",
        "dbtype": "pgsql",
        "version": "33.0.9.1",
        "overwrite.cli.url": "https:\/\/example.com",
        "dbname": "***REMOVED SENSITIVE VALUE***",
        "dbhost": "***REMOVED SENSITIVE VALUE***",
        "dbport": "",
        "dbtableprefix": "oc_",
        "dbuser": "***REMOVED SENSITIVE VALUE***",
        "dbpassword": "***REMOVED SENSITIVE VALUE***",
        "installed": true,
        "instanceid": "***REMOVED SENSITIVE VALUE***",
        "htaccess.RewriteBase": "\/",
        "check_for_working_htaccess": "true",
        "remember_login_cookie_lifetime": "604800",
        "session_lifetime": "86400",
        "session_keepalive": true,
        "auto_logout": false,
        "mail_from_address": "***REMOVED SENSITIVE VALUE***",
        "mail_smtpmode": "smtp",
        "mail_sendmailmode": "smtp",
        "mail_domain": "***REMOVED SENSITIVE VALUE***",
        "mail_smtphost": "***REMOVED SENSITIVE VALUE***",
        "default_phone_region": "DE",
        "skeletondirectory": " ",
        "profile.enabled": false,
        "quota_include_external_storage": false,
        "default_language": "de",
        "default_locale": "de_DE",
        "knowledgebaseenabled": false,
        "upgrade.disable-web": "true",
        "updater.release.channel": "stable",
        "maintenance_window_start": "1",
        "loglevel": 1,
        "log_type": "file",
        "logfile": "\/tmpnxcl\/nxcl_log_path\/nextcloud.log",
        "trashbin_retention_obligation": "auto, 30",
        "versions_retention_obligation": "auto, 30",
        "activity_expire_days": "14",
        "enable_previews": "false",
        "preview_max_x": "1024",
        "preview_max_y": "768",
        "preview_max_scale_factor": "1",
        "enabledPreviewProviders": [
            "OC\\Preview\\PNG",
            "OC\\Preview\\JPEG",
            "OC\\Preview\\GIF",
            "OC\\Preview\\BMP",
            "OC\\Preview\\XBitmap",
            "OC\\Preview\\Movie",
            "OC\\Preview\\MP3",
            "OC\\Preview\\TXT",
            "OC\\Preview\\MarkDown",
            "OC\\Preview\\MP4"
        ],
        "auth.bruteforce.protection.enabled": "true",
        "overwriteprotocol": "https",
        "forbidden_filenames": [
            ".htaccess",
            "Thumbs.db",
            "thumbs.db"
        ],
        "check_data_directory_permissions": "true",
        "memcache.local": "\\OC\\Memcache\\APCu",
        "memcache.distributed": "\\OC\\Memcache\\Redis",
        "redis": {
            "host": "***REMOVED SENSITIVE VALUE***",
            "port": "6379"
        },
        "memcache.locking": "\\OC\\Memcache\\Redis",
        "filelocking.enabled": "true",
        "ldapProviderFactory": "OCA\\User_LDAP\\LDAPProviderFactory",
        "lost_password_link": "https:\/\/REDACTED",
        "trusted_proxies": "***REMOVED SENSITIVE VALUE***",
        "share_folder": "\/Shared_with_me",
        "mail_smtpport": "587",
        "maintenance": false,
        "auth.webauthn.enabled": false,
        "mail_smtpsecure": "tls",
        "mail_smtpauth": 1,
        "mail_smtpname": "***REMOVED SENSITIVE VALUE***",
        "mail_smtppassword": "***REMOVED SENSITIVE VALUE***",
        "cache_path": "\/tmpnxcl\/nxcl_cache_path",
        "files.chunked_upload.max_size": 314572800
    }
}

List of activated Apps

Nextcloud Signing status

Nextcloud Logs

Additional info

No response

[joshtrichards]

The implementation remains the same and the documentation is accurate. However it does appear.tbe hint text in the UI was cut and paste when porting to the new UI:

server/apps/user_ldap/src/components/SettingsTabs/UsersTab.vue

Line 41 in 4d7d05e

:helperText="t('user_ldap', 'The filter specifies which LDAP users shall have access to the {instanceName} instance.', { instanceName })" />