Skip to content

docs(admin): warn that LDAP gidNumber keeps group membership #15715

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
whoalin1 wants to merge 2 commits into
base: master
Choose a base branch
from
Open

docs(admin): warn that LDAP gidNumber keeps group membership #15715

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ab6443f
docs(admin): warn that LDAP gidNumber keeps group membership
whoalin1 Oct 6, 2026
c17a053
docs(admin): drop unclear show-remnants paragraph from LDAP gidNumber…
whoalin1 Oct 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions admin_manual/configuration_user/user_auth_ldap.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -392,6 +392,21 @@ Group Member association:

* Example: *uniquemember*

.. warning::
Matching a user's ``gidNumber`` to a group's ``gidNumber`` also makes
Nextcloud treat that user as a member of the group. This is the POSIX
primary-group mechanism. It applies **in addition to** (and independently
of) whatever you configure here — for example ``member``, ``memberUid``,
or ``uniqueMember``.

So after you remove a user from an LDAP group via the usual membership
attribute, they may still appear as a member in the web UI and in
``occ`` output while their ``gidNumber`` still matches the group's. The
same idea applies to Active Directory ``primaryGroupID``. The attribute
name used for the user-side value is configurable as ``ldapGidNumber``
(default ``gidNumber``) via the LDAP configuration API / ``occ``, but it
is not exposed in the admin UI.

Nested groups:
Enable group member retrieval from sub groups.

Expand Down