Merge pull request #10060 from 2403905/issue-10051

prevent adding the federated users as members of the space

changelog/unreleased/fix-ocm-space-sharing.md

@@ -0,0 +1,6 @@
+Bugfix: fix ocm space sharing
+
+We prevent adding the federated users as members of the space.
+
+https://github.com/owncloud/ocis/pull/10060
+https://github.com/owncloud/ocis/issues/10051

services/graph/pkg/service/v0/api_driveitem_permissions.go

@@ -325,6 +325,14 @@ func (s DriveItemPermissionsService) SpaceRootInvite(ctx context.Context, driveI
 		return libregraph.Permission{}, errorcode.New(errorcode.InvalidRequest, "unsupported space type")
 	}
 
+	if s.config.IncludeOCMSharees && len(invite.GetRecipients()) > 0 {
+		objectID := invite.GetRecipients()[0].GetObjectId()
+		_, err := s.identityCache.GetAcceptedUser(ctx, objectID)
+		if err == nil {
+			return libregraph.Permission{}, errorcode.New(errorcode.NotAllowed, "federated user can not become a space member")
+		}
+	}
+
 	rootResourceID := space.GetRoot()
 	return s.Invite(ctx, rootResourceID, invite)
 }