refactoring

Author: kathrin-7978

README.md

@@ -78,7 +78,7 @@ $CONFIG = array (
     //                      This will only be effective if oidc_login_update_avatar is enabled.
     //   * is_admin:     If this value is truthy, the user is added to the admin group (optional)
     //   * birthdate:    Since attribute 'birthdate' is supported from NC version 30 onwards, this attribute
-    //                   can be mapped too.
+    //                   can be mapped too. Accepted format: YYYY-MM-DD
     //
     // The attributes in the OIDC response are flattened by adding the nested
     // array key as the prefix and an underscore. Thus,
@@ -112,7 +112,7 @@ $CONFIG = array (
     // https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims
     //
     // note: on Keycloak, OIDC name claim = "${given_name} ${family_name}" or one of them if any is missing
-    // note: for ID Austria, OIDC name claim = array('family_name', 'given_name')
+    // note: for other IdPs providing given name and family name separately: OIDC name claim = array('family_name', 'given_name')
     //
     'oidc_login_attributes' => array (
         'id' => 'sub',
@@ -201,9 +201,9 @@ $CONFIG = array (
     // Enable use of WebDAV via OIDC bearer token.
     'oidc_login_webdav_enabled' => false,
 
-    // Enable removal of special characters in UID.
+    // Enable removal of special characters in UID. Removal by converting to URL-safe Base64.
     // The default value is false.
-    'oidc_login_allow_special_characters' => true,
+    'oidc_login_remove_special_characters' => false,
 
     // Enable authentication with user/password for DAV clients that do not
     // support token authentication (e.g. DAVx⁵)

lib/Service/AttributeMap.php

@@ -87,22 +87,12 @@ public function __construct(IConfig $config)
         }
     }
 
-    /**
-     * Function to remove unallowed characters.
-     *
-     * @param mixed $data
-     */
-    public function base64url_encode($data): string
-    {
-        return rtrim(strtr(base64_encode($data), '+/', '-_'), '=');
-    }
-
     /**
      * Get ID from profile.
      */
     public function id(array $profile): ?string
     {
-        if (true === $this->config->getSystemValue('oidc_login_allow_special_characters', false)) {
+        if (true === $this->config->getSystemValue('oidc_login_remove_special_characters', false)) {
             return self::base64url_encode(self::get($this->_id, $profile));
         }
 
@@ -231,6 +221,16 @@ public function managesAdmin(): bool
         return null !== $this->_isAdmin;
     }
 
+    /**
+     * Function to remove unallowed characters.
+     *
+     * @param mixed $data
+     */
+    private static function base64url_encode($data): string
+    {
+        return rtrim(strtr(base64_encode($data), '+/', '-_'), '=');
+    }
+
     private static function get(string $attr, array $profile)
     {
         if (null !== $attr && \array_key_exists($attr, $profile)) {
@@ -249,4 +249,5 @@ private static function getFullDisplayName(array|string $attr, array $profile):
 
         return implode(' ', $nameArr);
     }
-}
+
+}

lib/Service/LoginService.php

@@ -375,9 +375,19 @@ private function updateBasicProfile(IUser $user, array $profile): void
 
         // Set Birthdate
         if (null !== ($birthdate = $this->attr->birthdate($profile))) {
-            $account = $this->accountManager->getAccount($user);
-            $account->setProperty(IAccountManager::PROPERTY_BIRTHDATE, $birthdate, IAccountManager::SCOPE_LOCAL, IAccountManager::NOT_VERIFIED);
-            $this->accountManager->updateAccount($account);
+            $validateBirthdate = $this->validateBirthdate($birthdate);
+            if (null !== $validateBirthdate) {
+                $account = $this->accountManager->getAccount($user);
+                $account->setProperty(
+                    IAccountManager::PROPERTY_BIRTHDATE,
+                    $validateBirthdate,
+                    IAccountManager::SCOPE_LOCAL,
+                    IAccountManager::NOT_VERIFIED
+                );
+                $this->accountManager->updateAccount($account);
+            } else {
+                $this->logger->debug("Skipping invalid birthdate for user: {$user->getUID()}");
+            }
         }
 
         // Set quota
@@ -544,4 +554,33 @@ private function flatten(array $array, string $prefix = ''): array
 
         return $result;
     }
-}
+
+    /**
+     * Validate and normalize birthdate according to OIDC spec.
+     * Only accepts full dates in YYYY-MM-DD format.
+     */
+    private function validateBirthdate(string $birthdate): ?string
+    {
+        $birthdate = trim($birthdate);
+
+        if (empty($birthdate)) {
+            return null;
+        }
+
+        if (!preg_match('/^\d{4}-\d{2}-\d{2}$/', $birthdate)) {
+            $this->logger->debug("Birthdate must be in YYYY-MM-DD format, got: {$birthdate}");
+
+            return null;
+        }
+
+        $date = \DateTime::createFromFormat('Y-m-d', $birthdate);
+        if (!$date || $date->format('Y-m-d') !== $birthdate) {
+            $this->logger->debug("Invalid birthdate value: {$birthdate}");
+
+            return null;
+        }
+
+        return $birthdate;
+    }
+
+}