storage: add group provider service and sharing SQL driver

[ishank011]

Group sharing support in Reva. Fixes 100+ failures and once we add the correct LDAP group filters and fix this owncloud/core#38382, there should be a lot more.

[update-docs]

Thanks for opening this pull request! The maintainers of this repository would appreciate it if you would create a changelog item based on your changes.

[ishank011]

@butonic this is ready for review. It adds the missing config from reva and upgrades the reva and CS3APIs versions.

[ishank011]

@butonic only the LDAP group filters need to be fixed:

ocis/storage/pkg/flagset/ldap.go

Lines 73 to 104 in b8c9d98

	// Group specific filters
	// These might not work at the moment. Need to be fixed
	&cli.StringFlag{
	Name: "ldap-groupfilter",
	Value: "(&(objectclass=posixGroup)(|(ownclouduuid={{.OpaqueId}})(cn={{.OpaqueId}})))",
	Usage: "LDAP filter used when getting a group. The CS3 groupid properties {{.OpaqueId}} and {{.Idp}} are available.",
	EnvVars: []string{"STORAGE_LDAP_GROUPFILTER"},
	Destination: &cfg.Reva.LDAP.GroupFilter,
	},
	&cli.StringFlag{
	Name: "ldap-groupattributefilter",
	Value: "(&(objectclass=posixGroup)({{attr}}={{value}}))",
	Usage: "LDAP filter used when searching for a group by claim/attribute. {{attr}} will be replaced with the attribute, {{value}} with the value.",
	EnvVars: []string{"STORAGE_LDAP_GROUPATTRIBUTEFILTER"},
	Destination: &cfg.Reva.LDAP.GroupAttributeFilter,
	},
	&cli.StringFlag{
	Name: "ldap-groupfindfilter",
	Value: "(&(objectclass=posixGroup)(|(cn={{query}}*)(displayname={{query}}*)(mail={{query}}*)))",
	Usage: "LDAP filter used when searching for group recipients. {{query}} will be replaced with the search query",
	EnvVars: []string{"STORAGE_LDAP_GROUPFINDFILTER"},
	Destination: &cfg.Reva.LDAP.GroupFindFilter,
	},
	&cli.StringFlag{
	Name: "ldap-groupmemberfilter",
	// FIXME the storage implementation needs to use the members overlay to get the cn when it only has the uuid
	Value: "(&(objectclass=posixAccount)(ownclouduuid={{.OpaqueId}}*))", // This filter will never work
	Usage: "LDAP filter used when getting the members of a group. The CS3 groupid properties {{.OpaqueId}} and {{.Idp}} are available.",
	EnvVars: []string{"STORAGE_LDAP_GROUPMEMBERFILTER"},
	Destination: &cfg.Reva.LDAP.GroupMemberFilter,
	},

[butonic]

cool, this brings us a lot closer. Could you move the sql and rest specific config flags to dedicated files? similar to the ldap.go.

things I noticed while testing:

• requires wiping the share.json because the persisted data cannot be unmarshaled ... this is would be breaking change. since we are in tech preview I'm ok with this. but
  • please add a changelog.
• searching for phy the physics-lovers group shows up and I can share with it but the 'shared with me' list when logged in as another user does not show them, so I cannot accept them.
• the ldap filters need to be configured for the given ldap server.
  • we need to make sure glauth can handle them and maybe update the filters. ownclouduuid is understood by glauth

[ishank011]

• searching for phy the physics-lovers group shows up and I can share with it but the 'shared with me' list when logged in as another user does not show them, so I cannot accept them.

This means that the ldap-groupfindfilter and ldap-groupattributefilter are configured correctly for this deployment, but the ldap-usergroupfilter is not. It even says here that it'll never work since we're using the user's opaque ID to filter out groups; we need the memberof construct.

ocis/storage/pkg/flagset/ldap.go

Lines 63 to 71 in b8c9d98

	&cli.StringFlag{
	Name: "ldap-usergroupfilter",
	// FIXME the storage implementation needs to use the memberof overlay to get the cn when it only has the uuid,
	// because the ldap schema either uses the dn or the member(of) attributes to establish membership
	Value: "(&(objectclass=posixGroup)(ownclouduuid={{.OpaqueId}}*))", // This filter will never work
	Usage: "LDAP filter used when getting the groups of a user. The CS3 userid properties {{.OpaqueId}} and {{.Idp}} are available.",
	EnvVars: []string{"STORAGE_LDAP_USERGROUPFILTER"},
	Destination: &cfg.Reva.LDAP.UserGroupFilter,
	},

When a user logs in, we call the GetUserGroups method to get the list of groups and filter out the received shares based on this list. Since it doesn't work at the moment, the shares are not displayed for the recipient.

[sonarcloud]

Kudos, SonarCloud Quality Gate passed!

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
No Duplication information