From 3f39bb530e1b9ef634a1517122ae9dd8ecd5a574 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Dani=C3=ABl=20Franke?= <df@ponc.tech>
Date: Mon, 20 Feb 2023 13:33:07 +0100
Subject: [PATCH] Integrate feedback.

---
 .../examples/ocis_ldap/docker-compose.yml     |  3 +-
 services/graph/pkg/identity/ldap.go           | 29 ++++++++++---------
 2 files changed, 16 insertions(+), 16 deletions(-)

diff --git a/deployments/examples/ocis_ldap/docker-compose.yml b/deployments/examples/ocis_ldap/docker-compose.yml
index 2de5e021d..7415b6e71 100644
--- a/deployments/examples/ocis_ldap/docker-compose.yml
+++ b/deployments/examples/ocis_ldap/docker-compose.yml
@@ -84,12 +84,11 @@ services:
       OCIS_URL: https://${OCIS_DOMAIN:-ocis.owncloud.test}
       OCIS_LOG_LEVEL: ${OCIS_LOG_LEVEL:-info}
       OCIS_LOG_COLOR: "${OCIS_LOG_COLOR:-false}"
-      GRAPH_LOG_LEVEL: "debug"
       PROXY_TLS: "false" # do not use SSL between Traefik and oCIS
       # INSECURE: needed if oCIS / Traefik is using self generated certificates
       OCIS_INSECURE: "${INSECURE:-false}"
       # basic auth (not recommended, but needed for eg. WebDav clients that do not support OpenID Connect)
-      PROXY_ENABLE_BASIC_AUTH: "${PROXY_ENABLE_BASIC_AUTH:-true}"
+      PROXY_ENABLE_BASIC_AUTH: "${PROXY_ENABLE_BASIC_AUTH:-false}"
       # admin user password
     volumes:
       - ocis-config:/etc/ocis
diff --git a/services/graph/pkg/identity/ldap.go b/services/graph/pkg/identity/ldap.go
index 09522802b..b126204b5 100644
--- a/services/graph/pkg/identity/ldap.go
+++ b/services/graph/pkg/identity/ldap.go
@@ -178,19 +178,21 @@ func (i *LDAP) DeleteUser(ctx context.Context, nameOrID string) error {
 		return err
 	}
 
-	// Find all the groups that this user was a member of and remove it from there
-	groupEntries, err := i.getLDAPGroupsByFilter(fmt.Sprintf("(%s=%s)", i.groupAttributeMap.member, e.DN), true, false)
-	if err != nil {
-		return err
-	}
-	for _, group := range groupEntries {
-		logger.Debug().Str("group", group.DN).Str("user", e.DN).Msg("Cleaning up group membership")
+	if !i.refintEnabled {
+		// Find all the groups that this user was a member of and remove it from there
+		groupEntries, err := i.getLDAPGroupsByFilter(fmt.Sprintf("(%s=%s)", i.groupAttributeMap.member, e.DN), true, false)
+		if err != nil {
+			return err
+		}
+		for _, group := range groupEntries {
+			logger.Debug().Str("group", group.DN).Str("user", e.DN).Msg("Cleaning up group membership")
 
-		if mr, err := i.removeEntryByDNAndAttributeFromEntry(group, e.DN, i.groupAttributeMap.member); err == nil {
-			if err = i.conn.Modify(mr); err != nil {
-				// Errors when deleting the memberships are only logged as warnings but not returned
-				// to the user as we already successfully deleted the users itself
-				logger.Warn().Str("group", group.DN).Str("user", e.DN).Err(err).Msg("failed to remove member")
+			if mr, err := i.removeEntryByDNAndAttributeFromEntry(group, e.DN, i.groupAttributeMap.member); err == nil {
+				if err = i.conn.Modify(mr); err != nil {
+					// Errors when deleting the memberships are only logged as warnings but not returned
+					// to the user as we already successfully deleted the users itself
+					logger.Warn().Str("group", group.DN).Str("user", e.DN).Err(err).Msg("failed to remove member")
+				}
 			}
 		}
 	}
@@ -553,8 +555,7 @@ func (i *LDAP) renameMemberInGroup(ctx context.Context, group *ldap.Entry, oldMe
 		var lerr *ldap.Error
 		if errors.As(err, &lerr) {
 			if lerr.ResultCode == ldap.LDAPResultNoSuchObject {
-				groupID := group.GetEqualFoldAttributeValue(i.groupAttributeMap.id)
-				logger.Warn().Str("group", groupID).Msg("Group no longer exists")
+				logger.Warn().Str("group", group.DN).Msg("Group no longer exists")
 				return nil
 			} else if lerr.ResultCode == ldap.LDAPResultNoSuchAttribute {
 				logger.Warn().