{"action":"created","issue":{"url":"https://api.github.com/repos/owncloud/core/issues/23558","repository_url":"https://api.github.com/repos/owncloud/core","labels_url":"https://api.github.com/repos/owncloud/core/issues/23558/labels{/name}","comments_url":"https://api.github.com/repos/owncloud/core/issues/23558/comments","events_url":"https://api.github.com/repos/owncloud/core/issues/23558/events","html_url":"https://github.com/owncloud/core/issues/23558","id":143253096,"number":23558,"title":"User account table and user locking/blacklist","user":{"login":"karlitschek","id":867445,"avatar_url":"https://avatars.githubusercontent.com/u/867445?v=3","gravatar_id":"","url":"https://api.github.com/users/karlitschek","html_url":"https://github.com/karlitschek","followers_url":"https://api.github.com/users/karlitschek/followers","following_url":"https://api.github.com/users/karlitschek/following{/other_user}","gists_url":"https://api.github.com/users/karlitschek/gists{/gist_id}","starred_url":"https://api.github.com/users/karlitschek/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/karlitschek/subscriptions","organizations_url":"https://api.github.com/users/karlitschek/orgs","repos_url":"https://api.github.com/users/karlitschek/repos","events_url":"https://api.github.com/users/karlitschek/events{/privacy}","received_events_url":"https://api.github.com/users/karlitschek/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/owncloud/core/labels/enhancement","name":"enhancement","color":"02e10c"},{"url":"https://api.github.com/repos/owncloud/core/labels/overview","name":"overview","color":"fef2c0"},{"url":"https://api.github.com/repos/owncloud/core/labels/settings:users","name":"settings:users","color":"02d7e1"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/owncloud/core/milestones/62","html_url":"https://github.com/owncloud/core/milestones/9.1-current","labels_url":"https://api.github.com/repos/owncloud/core/milestones/62/labels","id":1322460,"number":62,"title":"9.1-current","description":"","creator":{"login":"MorrisJobke","id":245432,"avatar_url":"https://avatars.githubusercontent.com/u/245432?v=3","gravatar_id":"","url":"https://api.github.com/users/MorrisJobke","html_url":"https://github.com/MorrisJobke","followers_url":"https://api.github.com/users/MorrisJobke/followers","following_url":"https://api.github.com/users/MorrisJobke/following{/other_user}","gists_url":"https://api.github.com/users/MorrisJobke/gists{/gist_id}","starred_url":"https://api.github.com/users/MorrisJobke/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MorrisJobke/subscriptions","organizations_url":"https://api.github.com/users/MorrisJobke/orgs","repos_url":"https://api.github.com/users/MorrisJobke/repos","events_url":"https://api.github.com/users/MorrisJobke/events{/privacy}","received_events_url":"https://api.github.com/users/MorrisJobke/received_events","type":"User","site_admin":false},"open_issues":715,"closed_issues":261,"state":"open","created_at":"2015-09-24T16:30:14Z","updated_at":"2016-03-30T11:43:49Z","due_on":null,"closed_at":null},"comments":8,"created_at":"2016-03-24T13:57:14Z","updated_at":"2016-03-30T12:17:32Z","closed_at":null,"body":"## User Account Table \r\n\r\n# Requirements\r\nMore and more features within ownCloud (either during migration or in live operations) require to list all users which are available in ownCloud. Especially during migration we have been heavily facing issues with user backend apps not being present and with bad performance impacts since the user information has to be queried from an external system which in addition leads to slower processing and latency. Especially the latency issue in the area of LDAP has been targeted by some bigger installations by heavy master slave ldap setups.\r\nFuthermore any user related api we use requires pagination to allow proper low memory and low latency processing – nobody wants to load half a million user objects into ram before further processing. Proper pagination can only be implemented if all users are kept in one place.\r\n\r\n# Feature description\r\nThere will be a new table in the database oc_user_accounts. All user backends will be 'degraded' to authentication backends – we basically only need them to perform authentication.\r\n\r\n![1](https://cloud.githubusercontent.com/assets/867445/14018951/b65faa06-f1a6-11e5-95bc-5d95819ebb93.jpg)\r\n\r\n\r\n![2](https://cloud.githubusercontent.com/assets/867445/14018966/c5f3d550-f1a6-11e5-9bd8-26ea5906cfaf.jpg)\r\n\r\nThe database design is influenced by one design decision we have to take: do we allow multiple authentications for one user? This would allow one user to login via ldap as well as shibboleth as well as user/password. As of today this is only possible for ldap and shibboleth because of we make sure that login names match up magically. Having multiple authentication mechanisms assigned to one account would leverage this to a more general approach.\r\n\r\n## Migration\r\nMigration of the regular database user backend will happen during upgrade. Any other backend will need to use an occ command – this is necessary since this might take a very long time.\r\nWe can think about preparing a pre-script to be executed so that oc_user_accounts can apready be populated upfront.\r\nThe occ command will basically grab all users from a given user backend and move the information into the table oc_user_accounts.\r\n\r\n\r\n## Vcard handling and related functionalities\r\nThe user will maintain his vcard in the personal page. Upon change we will sync the vcard down to the system addressbook which is used for fed syncing of contacts.\r\nThe vcard will hold the avatar as well – for now we shall not touch the avatar handling, keep the current storage location and import the avatar into the vcard upon change.\r\n\r\n## locking/blacklisting\r\nA new occ command will be added to lock and unlock a specific user. This can be used with a user account is locked in the backend LDAP but there are still valid PHP session open. A user who is blakclisted/locked/disabled can't do any action in ownCloud even if authenticated.\r\n\r\n\r\n## Design goal\r\nWe need to make sure that the IUserManager interface and all related interfaces stay untouched.\r\nWe will deprecate any interface which is related to the user backend.\r\nWe need to make sure that existing user backend implementation continue to work.\r\nWe should provide a general purpose tool which will migrate user accounts from any given user backend to the accounts table.\r\n\r\n\r\n\r\n## Open Questions\r\nUser management UI changes to deflect multiple auths mechanisms per user\r\ntouch group handling as well?\r\nArthur will provide a list of use cases about LDAP which need to be taken into account\r\nHow to sync heavy backends like LDAP with the user accounts table?\r\nHow do we perform the mapping of authentications to users?\r\nDo we autoprovision a user as soon as it logs in?\r\nShall the migration touch sharing and other components already? As in move from legacy_login to the real it?\r\n\r\n\r\n\r\n\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/owncloud/core/issues/comments/203403909","html_url":"https://github.com/owncloud/core/issues/23558#issuecomment-203403909","issue_url":"https://api.github.com/repos/owncloud/core/issues/23558","id":203403909,"user":{"login":"MTRichards","id":1818977,"avatar_url":"https://avatars.githubusercontent.com/u/1818977?v=3","gravatar_id":"","url":"https://api.github.com/users/MTRichards","html_url":"https://github.com/MTRichards","followers_url":"https://api.github.com/users/MTRichards/followers","following_url":"https://api.github.com/users/MTRichards/following{/other_user}","gists_url":"https://api.github.com/users/MTRichards/gists{/gist_id}","starred_url":"https://api.github.com/users/MTRichards/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/MTRichards/subscriptions","organizations_url":"https://api.github.com/users/MTRichards/orgs","repos_url":"https://api.github.com/users/MTRichards/repos","events_url":"https://api.github.com/users/MTRichards/events{/privacy}","received_events_url":"https://api.github.com/users/MTRichards/received_events","type":"User","site_admin":false},"created_at":"2016-03-30T12:17:32Z","updated_at":"2016-03-30T12:17:32Z","body":"We would change the boolean to an int to cover more than two possible scenarios: Disabled, enabled, and disabled (shares available)\r\n"}}