diff --git a/src/app/Backends/IMAP.php b/src/app/Backends/IMAP.php
index c8df9445..7100a356 100644
--- a/src/app/Backends/IMAP.php
+++ b/src/app/Backends/IMAP.php
@@ -1,779 +1,785 @@
 <?php
 
 namespace App\Backends;
 
 use App\Group;
 use App\Resource;
 use App\SharedFolder;
 use App\User;
+use App\Utils;
 
 class IMAP
 {
     /** @const array Group settings used by the backend */
     public const GROUP_SETTINGS = [];
 
     /** @const array Resource settings used by the backend */
     public const RESOURCE_SETTINGS = [
         'folder',
         'invitation_policy',
     ];
 
     /** @const array Shared folder settings used by the backend */
     public const SHARED_FOLDER_SETTINGS = [
         'folder',
         'acl',
     ];
 
     /** @const array User settings used by the backend */
     public const USER_SETTINGS = [];
 
 
     /** @const array Maps Kolab permissions to IMAP permissions */
     private const ACL_MAP = [
         'read-only' => 'lrs',
         'read-write' => 'lrswitedn',
         'full' => 'lrswipkxtecdn',
     ];
 
     /**
      * Delete a group.
      *
      * @param \App\Group $group Group
      *
      * @return bool True if a group was deleted successfully, False otherwise
      * @throws \Exception
      */
     public static function deleteGroup(Group $group): bool
     {
         $domainName = explode('@', $group->email, 2)[1];
 
         // Cleanup ACL
         // FIXME: Since all groups in Kolab4 have email address,
         //        should we consider using it in ACL instead of the name?
         //        Also we need to decide what to do and configure IMAP appropriately,
         //        right now groups in ACL does not work for me at all.
         // Commented out in favor of a nightly cleanup job, for performance reasons
         // \App\Jobs\IMAP\AclCleanupJob::dispatch($group->name, $domainName);
 
         return true;
     }
 
     /**
      * Create a mailbox.
      *
      * @param \App\User $user User
      *
      * @return bool True if a mailbox was created successfully, False otherwise
      * @throws \Exception
      */
     public static function createUser(User $user): bool
     {
         $config = self::getConfig();
         $imap = self::initIMAP($config);
 
         $mailbox = self::toUTF7('user/' . $user->email);
 
         // Mailbox already exists
         if (self::folderExists($imap, $mailbox)) {
             $imap->closeConnection();
             self::createDefaultFolders($user);
             return true;
         }
 
         // Create the mailbox
         if (!$imap->createFolder($mailbox)) {
             \Log::error("Failed to create mailbox {$mailbox}");
             $imap->closeConnection();
             return false;
         }
 
         // Wait until it's propagated (for Cyrus Murder setup)
         // FIXME: Do we still need this?
         if (strpos($imap->conn->data['GREETING'] ?? '', 'Cyrus IMAP Murder') !== false) {
             $tries = 30;
             while ($tries-- > 0) {
                 $folders = $imap->listMailboxes('', $mailbox);
                 if (is_array($folders) && count($folders)) {
                     break;
                 }
                 sleep(1);
                 $imap->closeConnection();
                 $imap = self::initIMAP($config);
             }
         }
 
         // Set quota
         $quota = $user->countEntitlementsBySku('storage') * 1048576;
         if ($quota) {
             $imap->setQuota($mailbox, ['storage' => $quota]);
         }
 
         self::createDefaultFolders($user);
 
         $imap->closeConnection();
 
         return true;
     }
 
     /**
      * Create default folders for the user.
      *
      * @param \App\User $user User
      */
     public static function createDefaultFolders(User $user): void
     {
         if ($defaultFolders = \config('imap.default_folders')) {
             $config = self::getConfig();
             // Log in as user to set private annotations and subscription state
             $imap = self::initIMAP($config, $user->email);
             foreach ($defaultFolders as $name => $folderconfig) {
                 try {
                     $mailbox = self::toUTF7($name);
                     self::createFolder($imap, $mailbox, true, $folderconfig['metadata']);
                 } catch (\Exception $e) {
                     \Log::warning("Failed to create the default folder. " . $e->getMessage());
                 }
             }
             $imap->closeConnection();
         }
     }
 
     /**
      * Delete a mailbox.
      *
      * @param \App\User $user User
      *
      * @return bool True if a mailbox was deleted successfully, False otherwise
      * @throws \Exception
      */
     public static function deleteUser(User $user): bool
     {
         $config = self::getConfig();
         $imap = self::initIMAP($config);
 
         $mailbox = self::toUTF7('user/' . $user->email);
 
         // To delete the mailbox cyrus-admin needs extra permissions
         $imap->setACL($mailbox, $config['user'], 'c');
 
         // Delete the mailbox (no need to delete subfolders?)
         $result = $imap->deleteFolder($mailbox);
 
         if (!$result) {
             // Ignore the error if the folder doesn't exist (maybe it was removed already).
             if (!self::folderExists($imap, $mailbox)) {
                 \Log::info("The mailbox to delete was already removed: $mailbox");
                 $result = true;
             }
         }
 
         $imap->closeConnection();
 
         // Cleanup ACL
         // Commented out in favor of a nightly cleanup job, for performance reasons
         // \App\Jobs\IMAP\AclCleanupJob::dispatch($user->email);
 
         return $result;
     }
 
     /**
      * Update a mailbox (quota).
      *
      * @param \App\User $user User
      *
      * @return bool True if a mailbox was updated successfully, False otherwise
      * @throws \Exception
      */
     public static function updateUser(User $user): bool
     {
         $config = self::getConfig();
         $imap = self::initIMAP($config);
 
         $mailbox = self::toUTF7('user/' . $user->email);
         $result = true;
 
         // Set quota
         $quota = $user->countEntitlementsBySku('storage') * 1048576;
         if ($quota) {
             $result = $imap->setQuota($mailbox, ['storage' => $quota]);
         }
 
         $imap->closeConnection();
 
         return $result;
     }
 
     /**
      * Create a resource.
      *
      * @param \App\Resource $resource Resource
      *
      * @return bool True if a resource was created successfully, False otherwise
      * @throws \Exception
      */
     public static function createResource(Resource $resource): bool
     {
         $config = self::getConfig();
         $imap = self::initIMAP($config);
 
         $settings = $resource->getSettings(['invitation_policy', 'folder']);
         $mailbox = self::toUTF7($settings['folder']);
+        $metadata = ['/shared/vendor/kolab/folder-type' => 'event'];
 
-        $acl = null;
+        $acl = [];
         if (!empty($settings['invitation_policy'])) {
             if (preg_match('/^manual:(\S+@\S+)$/', $settings['invitation_policy'], $m)) {
                 $acl = ["{$m[1]}, full"];
             }
         }
-        self::createFolder($imap, $mailbox, false, ['/shared/vendor/kolab/folder-type' => 'event'], $acl);
+
+        self::createFolder($imap, $mailbox, false, $metadata, Utils::ensureAclPostPermission($acl));
 
         $imap->closeConnection();
 
         return true;
     }
 
     /**
      * Update a resource.
      *
      * @param \App\Resource $resource Resource
      * @param array         $props    Old resource properties
      *
      * @return bool True if a resource was updated successfully, False otherwise
      * @throws \Exception
      */
     public static function updateResource(Resource $resource, array $props = []): bool
     {
         $config = self::getConfig();
         $imap = self::initIMAP($config);
 
         $settings = $resource->getSettings(['invitation_policy', 'folder']);
         $folder = $settings['folder'];
         $mailbox = self::toUTF7($folder);
 
         // Rename the mailbox (only possible if we have the old folder)
         if (!empty($props['folder']) && $props['folder'] != $folder) {
             $oldMailbox = self::toUTF7($props['folder']);
 
             if (!$imap->renameFolder($oldMailbox, $mailbox)) {
                 \Log::error("Failed to rename mailbox {$oldMailbox} to {$mailbox}");
                 $imap->closeConnection();
                 return false;
             }
         }
 
         // ACL
         $acl = [];
         if (!empty($settings['invitation_policy'])) {
             if (preg_match('/^manual:(\S+@\S+)$/', $settings['invitation_policy'], $m)) {
                 $acl = ["{$m[1]}, full"];
             }
         }
-        self::aclUpdate($imap, $mailbox, $acl);
+
+        self::aclUpdate($imap, $mailbox, Utils::ensureAclPostPermission($acl));
 
         $imap->closeConnection();
 
         return true;
     }
 
     /**
      * Delete a resource.
      *
      * @param \App\Resource $resource Resource
      *
      * @return bool True if a resource was deleted successfully, False otherwise
      * @throws \Exception
      */
     public static function deleteResource(Resource $resource): bool
     {
         $config = self::getConfig();
         $imap = self::initIMAP($config);
 
         $settings = $resource->getSettings(['folder']);
         $mailbox = self::toUTF7($settings['folder']);
 
         // To delete the mailbox cyrus-admin needs extra permissions
         $imap->setACL($mailbox, $config['user'], 'c');
 
         // Delete the mailbox (no need to delete subfolders?)
         $result = $imap->deleteFolder($mailbox);
 
         $imap->closeConnection();
 
         return $result;
     }
 
     /**
      * Create a shared folder.
      *
      * @param \App\SharedFolder $folder Shared folder
      *
      * @return bool True if a falder was created successfully, False otherwise
      * @throws \Exception
      */
     public static function createSharedFolder(SharedFolder $folder): bool
     {
         $config = self::getConfig();
         $imap = self::initIMAP($config);
 
         $settings = $folder->getSettings(['acl', 'folder']);
-        $acl = !empty($settings['acl']) ? json_decode($settings['acl'], true) : null;
+        $acl = !empty($settings['acl']) ? json_decode($settings['acl'], true) : [];
         $mailbox = self::toUTF7($settings['folder']);
+        $metadata = ['/shared/vendor/kolab/folder-type' => $folder->type];
 
-        self::createFolder($imap, $mailbox, false, ['/shared/vendor/kolab/folder-type' => $folder->type], $acl);
+        self::createFolder($imap, $mailbox, false, $metadata, Utils::ensureAclPostPermission($acl));
 
         $imap->closeConnection();
 
         return true;
     }
 
     /**
      * Update a shared folder.
      *
      * @param \App\SharedFolder $folder Shared folder
      * @param array             $props  Old folder properties
      *
      * @return bool True if a falder was updated successfully, False otherwise
      * @throws \Exception
      */
     public static function updateSharedFolder(SharedFolder $folder, array $props = []): bool
     {
         $config = self::getConfig();
         $imap = self::initIMAP($config);
 
         $settings = $folder->getSettings(['acl', 'folder']);
         $acl = !empty($settings['acl']) ? json_decode($settings['acl'], true) : null;
         $folder = $settings['folder'];
         $mailbox = self::toUTF7($folder);
 
         // Rename the mailbox
         if (!empty($props['folder']) && $props['folder'] != $folder) {
             $oldMailbox = self::toUTF7($props['folder']);
 
             if (!$imap->renameFolder($oldMailbox, $mailbox)) {
                 \Log::error("Failed to rename mailbox {$oldMailbox} to {$mailbox}");
                 $imap->closeConnection();
                 return false;
             }
         }
 
         // Note: Shared folder type does not change
 
         // ACL
-        self::aclUpdate($imap, $mailbox, $acl);
+        self::aclUpdate($imap, $mailbox, Utils::ensureAclPostPermission($acl));
 
         $imap->closeConnection();
 
         return true;
     }
 
     /**
      * Delete a shared folder.
      *
      * @param \App\SharedFolder $folder Shared folder
      *
      * @return bool True if a falder was deleted successfully, False otherwise
      * @throws \Exception
      */
     public static function deleteSharedFolder(SharedFolder $folder): bool
     {
         $config = self::getConfig();
         $imap = self::initIMAP($config);
 
         $settings = $folder->getSettings(['folder']);
         $mailbox = self::toUTF7($settings['folder']);
 
         // To delete the mailbox cyrus-admin needs extra permissions
         $imap->setACL($mailbox, $config['user'], 'c');
 
         // Delete the mailbox
         $result = $imap->deleteFolder($mailbox);
 
         $imap->closeConnection();
 
         return $result;
     }
 
     /**
      * Check if a shared folder is set up.
      *
      * @param string $folder Folder name, e.g. shared/Resources/Name@domain.tld
      *
      * @return bool True if a folder exists and is set up, False otherwise
      */
     public static function verifySharedFolder(string $folder): bool
     {
         $config = self::getConfig();
         $imap = self::initIMAP($config);
 
         // Convert the folder from UTF8 to UTF7-IMAP
         if (\preg_match('#^(shared/|shared/Resources/)(.+)(@[^@]+)$#', $folder, $matches)) {
             $folderName = self::toUTF7($matches[2]);
             $folder = $matches[1] . $folderName . $matches[3];
         }
 
         // FIXME: just listMailboxes() does not return shared folders at all
 
         $metadata = $imap->getMetadata($folder, ['/shared/vendor/kolab/folder-type']);
 
         $imap->closeConnection();
 
         // Note: We have to use error code to distinguish an error from "no mailbox" response
 
         if ($imap->errornum === \rcube_imap_generic::ERROR_NO) {
             return false;
         }
 
         if ($imap->errornum !== \rcube_imap_generic::ERROR_OK) {
             throw new \Exception("Failed to get folder metadata from IMAP");
         }
 
         return true;
     }
 
     /**
      * Convert UTF8 string to UTF7-IMAP encoding
      */
     public static function toUTF7(string $string): string
     {
         return \mb_convert_encoding($string, 'UTF7-IMAP', 'UTF8');
     }
 
     /**
      * Check if an account is set up
      *
      * @param string $username User login (email address)
      *
      * @return bool True if an account exists and is set up, False otherwise
      */
     public static function verifyAccount(string $username): bool
     {
         $config = self::getConfig();
         $imap = self::initIMAP($config);
 
         $mailbox = self::toUTF7('user/' . $username);
 
         // Mailbox already exists
         if (self::folderExists($imap, $mailbox)) {
             $imap->closeConnection();
             return true;
         }
 
         $imap->closeConnection();
         return false;
     }
 
     /**
      * Check if an account is set up
      *
      * @param string $username User login (email address)
      *
      * @return bool True if an account exists and is set up, False otherwise
      */
     public static function verifyDefaultFolders(string $username): bool
     {
         $config = self::getConfig();
         $imap = self::initIMAP($config, $username);
 
         foreach (\config('imap.default_folders') as $mb => $_metadata) {
             $mailbox = self::toUTF7($mb);
             if (!self::folderExists($imap, $mailbox)) {
                 $imap->closeConnection();
                 return false;
             }
         }
 
         $imap->closeConnection();
         return true;
     }
 
     /**
      * Check if we can connect to the imap server
      *
      * @return bool True on success
      */
     public static function healthcheck(): bool
     {
         $config = self::getConfig();
         $imap = self::initIMAP($config);
         $imap->closeConnection();
         return true;
     }
 
     /**
      * Remove ACL for a specified user/group anywhere in the IMAP
      *
      * @param string $ident  ACL identifier (user email or e.g. group name)
      * @param string $domain ACL domain
      */
     public static function aclCleanup(string $ident, string $domain = ''): void
     {
         $config = self::getConfig();
         $imap = self::initIMAP($config);
 
         if (strpos($ident, '@')) {
             $domain = explode('@', $ident, 2)[1];
         }
 
         $callback = function ($folder) use ($imap, $ident) {
             $acl = $imap->getACL($folder);
             if (is_array($acl) && isset($acl[$ident])) {
                 \Log::info("Cleanup: Removing {$ident} from ACL on {$folder}");
                 $imap->deleteACL($folder, $ident);
             }
         };
 
         $folders = $imap->listMailboxes('', "user/*@{$domain}");
 
         if (!is_array($folders)) {
             $imap->closeConnection();
             throw new \Exception("Failed to get IMAP folders");
         }
 
         array_walk($folders, $callback);
 
         $folders = $imap->listMailboxes('', "shared/*@{$domain}");
 
         if (!is_array($folders)) {
             $imap->closeConnection();
             throw new \Exception("Failed to get IMAP folders");
         }
 
         array_walk($folders, $callback);
 
         $imap->closeConnection();
     }
 
     /**
      * Remove ACL entries pointing to non-existent users/groups, for a specified domain
      *
      * @param string $domain  Domain namespace
      * @param bool   $dry_run Output ACL entries to delete, but do not delete
      */
     public static function aclCleanupDomain(string $domain, bool $dry_run = false): void
     {
         $config = self::getConfig();
         $imap = self::initIMAP($config);
 
         // Collect available (existing) users/groups
         // FIXME: Should we limit this to the requested domain or account?
         // FIXME: For groups should we use name or email?
         $idents = User::pluck('email')
             // ->concat(Group::pluck('name'))
             ->concat(['anyone', 'anonymous', $config['user']])
             ->all();
 
         $callback = function ($folder) use ($imap, $idents, $dry_run) {
             $acl = $imap->getACL($folder);
             if (is_array($acl)) {
                 $owner = null;
                 if (preg_match('|^user/([^/@]+).*@([^@/]+)$|', $folder, $m)) {
                     $owner = $m[1] . '@' . $m[2];
                 }
                 foreach (array_keys($acl) as $key) {
                     if ($owner && $key === $owner) {
                         // Don't even try to remove the folder's owner entry
                         continue;
                     }
                     if (!in_array($key, $idents)) {
                         if ($dry_run) {
                             echo "{$folder} {$key} {$acl[$key]}\n";
                         } else {
                             \Log::info("Cleanup: Removing {$key} from ACL on {$folder}");
                             $imap->deleteACL($folder, $key);
                         }
                     }
                 }
             }
         };
 
         $folders = $imap->listMailboxes('', "user/*@{$domain}");
 
         if (!is_array($folders)) {
             $imap->closeConnection();
             throw new \Exception("Failed to get IMAP folders");
         }
 
         array_walk($folders, $callback);
 
         $folders = $imap->listMailboxes('', "shared/*@{$domain}");
 
         if (!is_array($folders)) {
             $imap->closeConnection();
             throw new \Exception("Failed to get IMAP folders");
         }
 
         array_walk($folders, $callback);
 
         $imap->closeConnection();
     }
 
     /**
      * Create a folder and set some default properties
      *
      * @param \rcube_imap_generic $imap The imap instance
      * @param string $mailbox Mailbox name
      * @param bool $subscribe Subscribe to the folder
      * @param array $metadata Metadata to set on the folder
      * @param array $acl Acl to set on the folder
      *
      * @return bool True when having a folder created, False if it already existed.
      * @throws \Exception
      */
     private static function createFolder($imap, string $mailbox, $subscribe = false, $metadata = null, $acl = null)
     {
         if (self::folderExists($imap, $mailbox)) {
             return false;
         }
 
         if (!$imap->createFolder($mailbox)) {
             throw new \Exception("Failed to create mailbox {$mailbox}");
         }
 
-        if ($acl) {
+        if (!empty($acl)) {
             self::aclUpdate($imap, $mailbox, $acl, true);
         }
 
         if ($subscribe) {
             $imap->subscribe($mailbox);
         }
 
         foreach ($metadata as $key => $value) {
             $imap->setMetadata($mailbox, [$key => $value]);
         }
 
         return true;
     }
 
     /**
      * Convert Kolab ACL into IMAP user->rights array
      */
     private static function aclToImap($acl): array
     {
         if (empty($acl)) {
             return [];
         }
 
         return \collect($acl)
             ->mapWithKeys(function ($item, $key) {
                 list($user, $rights) = explode(',', $item, 2);
-                return [trim($user) => self::ACL_MAP[trim($rights)]];
+                $rights = trim($rights);
+                return [trim($user) => self::ACL_MAP[$rights] ?? $rights];
             })
             ->all();
     }
 
     /**
      * Update folder ACL
      */
     private static function aclUpdate($imap, $mailbox, $acl, bool $isNew = false)
     {
         $imapAcl = $isNew ? [] : $imap->getACL($mailbox);
 
         if (is_array($imapAcl)) {
             foreach (self::aclToImap($acl) as $user => $rights) {
                 if (empty($imapAcl[$user]) || implode('', $imapAcl[$user]) !== $rights) {
                     $imap->setACL($mailbox, $user, $rights);
                 }
 
                 unset($imapAcl[$user]);
             }
 
             foreach ($imapAcl as $user => $rights) {
                 $imap->deleteACL($mailbox, $user);
             }
         }
     }
 
     /**
      * Check if an IMAP folder exists
      */
     private static function folderExists($imap, string $folder): bool
     {
         $folders = $imap->listMailboxes('', $folder);
 
         if (!is_array($folders)) {
             $imap->closeConnection();
             throw new \Exception("Failed to get IMAP folders");
         }
 
         return count($folders) > 0;
     }
 
     /**
      * Initialize connection to IMAP
      */
     private static function initIMAP(array $config, string $login_as = null)
     {
         $imap = new \rcube_imap_generic();
 
         if (\config('app.debug')) {
             $imap->setDebug(true, 'App\Backends\IMAP::logDebug');
         }
 
         if ($login_as) {
             $config['options']['auth_cid'] = $config['user'];
             $config['options']['auth_pw'] = $config['password'];
             $config['options']['auth_type'] = 'PLAIN';
             $config['user'] = $login_as;
         }
 
         $imap->connect($config['host'], $config['user'], $config['password'], $config['options']);
 
         if (!$imap->connected()) {
             $message = sprintf("Login failed for %s against %s. %s", $config['user'], $config['host'], $imap->error);
 
             \Log::error($message);
 
             throw new \Exception("Connection to IMAP failed");
         }
 
         return $imap;
     }
 
     /**
      * Get LDAP configuration for specified access level
      */
     private static function getConfig()
     {
         $uri = \parse_url(\config('imap.uri'));
         $default_port = 143;
         $ssl_mode = null;
 
         if (isset($uri['scheme'])) {
             if (preg_match('/^(ssl|imaps)/', $uri['scheme'])) {
                 $default_port = 993;
                 $ssl_mode = 'ssl';
             } elseif ($uri['scheme'] === 'tls') {
                 $ssl_mode = 'tls';
             }
         }
 
         $config = [
             'host' => $uri['host'],
             'user' => \config('imap.admin_login'),
             'password' => \config('imap.admin_password'),
             'options' => [
                 'port' => !empty($uri['port']) ? $uri['port'] : $default_port,
                 'ssl_mode' => $ssl_mode,
                 'socket_options' => [
                     'ssl' => [
                         'verify_peer' => \config('imap.verify_peer'),
                         'verify_peer_name' => \config('imap.verify_peer'),
                         'verify_host' => \config('imap.verify_host')
                     ],
                 ],
             ],
         ];
 
         return $config;
     }
 
     /**
      * Debug logging callback
      */
     public static function logDebug($conn, $msg): void
     {
         $msg = '[IMAP] ' . $msg;
 
         \Log::debug($msg);
     }
 }
diff --git a/src/app/Backends/LDAP.php b/src/app/Backends/LDAP.php
index b6fbd532..a0b89834 100644
--- a/src/app/Backends/LDAP.php
+++ b/src/app/Backends/LDAP.php
@@ -1,1417 +1,1422 @@
 <?php
 
 namespace App\Backends;
 
 use App\Domain;
 use App\Group;
 use App\Resource;
 use App\SharedFolder;
 use App\User;
+use App\Utils;
 
 class LDAP
 {
     /** @const array Group settings used by the backend */
     public const GROUP_SETTINGS = [
         'sender_policy',
     ];
 
     /** @const array Resource settings used by the backend */
     public const RESOURCE_SETTINGS = [
         'folder',
         'invitation_policy',
     ];
 
     /** @const array Shared folder settings used by the backend */
     public const SHARED_FOLDER_SETTINGS = [
         'folder',
         'acl',
     ];
 
     /** @const array User settings used by the backend */
     public const USER_SETTINGS = [
         'first_name',
         'last_name',
         'organization',
     ];
 
     /** @var ?\Net_LDAP3 LDAP connection object */
     protected static $ldap;
 
 
     /**
      * Starts a new LDAP connection that will be used by all methods
      * until you call self::disconnect() explicitely. Normally every
      * method uses a separate connection.
      *
      * @throws \Exception
      */
     public static function connect(): void
     {
         if (empty(self::$ldap)) {
             $config = self::getConfig('admin');
             self::$ldap = self::initLDAP($config);
         }
     }
 
     /**
      * Close the connection created by self::connect()
      */
     public static function disconnect(): void
     {
         if (!empty(self::$ldap)) {
             self::$ldap->close();
             self::$ldap = null;
         }
     }
 
     /**
      * Validates that ldap is available as configured.
      *
      * @throws \Exception
      */
     public static function healthcheck(): void
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         $mgmtRootDN = \config('ldap.admin.root_dn');
         $hostedRootDN = \config('ldap.hosted.root_dn');
 
         $result = $ldap->search($mgmtRootDN, '', 'base');
         if (!$result || $result->count() != 1) {
             self::throwException($ldap, "Failed to find the configured management domain $mgmtRootDN");
         }
 
         $result = $ldap->search($hostedRootDN, '', 'base');
         if (!$result || $result->count() != 1) {
             self::throwException($ldap, "Failed to find the configured hosted domain $hostedRootDN");
         }
     }
 
     /**
      * Create a domain in LDAP.
      *
      * @param \App\Domain $domain The domain to create.
      *
      * @throws \Exception
      */
     public static function createDomain(Domain $domain): void
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         $mgmtRootDN = \config('ldap.admin.root_dn');
         $hostedRootDN = \config('ldap.hosted.root_dn');
 
         $domainBaseDN = "ou={$domain->namespace},{$hostedRootDN}";
 
         $aci = [
             '(targetattr = "*")'
             . '(version 3.0; acl "Deny Unauthorized"; deny (all)'
             . '(userdn != "ldap:///uid=kolab-service,ou=Special Users,' . $mgmtRootDN
             . ' || ldap:///ou=People,' . $domainBaseDN . '??sub?(objectclass=inetorgperson)") '
             . 'AND NOT roledn = "ldap:///cn=kolab-admin,' . $mgmtRootDN . '";)',
 
             '(targetattr != "userPassword")'
             . '(version 3.0;acl "Search Access";allow (read,compare,search)'
             . '(userdn = "ldap:///uid=kolab-service,ou=Special Users,' . $mgmtRootDN
             . ' || ldap:///ou=People,' . $domainBaseDN . '??sub?(objectclass=inetorgperson)");)',
 
             '(targetattr = "*")'
             . '(version 3.0;acl "Kolab Administrators";allow (all)'
             . '(roledn = "ldap:///cn=kolab-admin,' . $domainBaseDN
             . ' || ldap:///cn=kolab-admin,' . $mgmtRootDN . '");)'
         ];
 
         $entry = [
             'aci' => $aci,
             'associateddomain' => $domain->namespace,
             'inetdomainbasedn' => $domainBaseDN,
             'objectclass' => [
                 'top',
                 'domainrelatedobject',
                 'inetdomain'
             ],
         ];
 
         $dn = "associateddomain={$domain->namespace},{$config['domain_base_dn']}";
 
         self::setDomainAttributes($domain, $entry);
 
         if (!$ldap->get_entry($dn)) {
             self::addEntry(
                 $ldap,
                 $dn,
                 $entry,
                 "Failed to create domain {$domain->namespace} in LDAP (" . __LINE__ . ")"
             );
         }
 
         // create ou, roles, ous
         $entry = [
             'description' => $domain->namespace,
             'objectclass' => [
                 'top',
                 'organizationalunit'
             ],
             'ou' => $domain->namespace,
         ];
 
         $entry['aci'] = array(
             '(targetattr = "*")'
             . '(version 3.0;acl "Deny Unauthorized"; deny (all)'
             . '(userdn != "ldap:///uid=kolab-service,ou=Special Users,' . $mgmtRootDN
             . ' || ldap:///ou=People,' . $domainBaseDN . '??sub?(objectclass=inetorgperson)") '
             . 'AND NOT roledn = "ldap:///cn=kolab-admin,' . $mgmtRootDN . '";)',
 
             '(targetattr != "userPassword")'
             . '(version 3.0;acl "Search Access";allow (read,compare,search,write)'
             . '(userdn = "ldap:///uid=kolab-service,ou=Special Users,' . $mgmtRootDN
             . ' || ldap:///ou=People,' . $domainBaseDN . '??sub?(objectclass=inetorgperson)");)',
 
             '(targetattr = "*")'
             . '(version 3.0;acl "Kolab Administrators";allow (all)'
             . '(roledn = "ldap:///cn=kolab-admin,' . $domainBaseDN
             . ' || ldap:///cn=kolab-admin,' . $mgmtRootDN . '");)',
 
             '(target = "ldap:///ou=*,' . $domainBaseDN . '")'
             . '(targetattr="objectclass || aci || ou")'
             . '(version 3.0;acl "Allow Domain sub-OU Registration"; allow (add)'
             . '(userdn = "ldap:///uid=kolab-service,ou=Special Users,' . $mgmtRootDN . '");)',
 
             '(target = "ldap:///uid=*,ou=People,' . $domainBaseDN . '")(targetattr="*")'
             . '(version 3.0;acl "Allow Domain First User Registration"; allow (add)'
             . '(userdn = "ldap:///uid=kolab-service,ou=Special Users,' . $mgmtRootDN . '");)',
 
             '(target = "ldap:///cn=*,' . $domainBaseDN . '")(targetattr="objectclass || cn")'
             . '(version 3.0;acl "Allow Domain Role Registration"; allow (add)'
             . '(userdn = "ldap:///uid=kolab-service,ou=Special Users,' . $mgmtRootDN . '");)',
         );
 
         if (!$ldap->get_entry($domainBaseDN)) {
             self::addEntry(
                 $ldap,
                 $domainBaseDN,
                 $entry,
                 "Failed to create domain {$domain->namespace} in LDAP (" . __LINE__ . ")"
             );
         }
 
         foreach (['Groups', 'People', 'Resources', 'Shared Folders'] as $item) {
             $itemDN = "ou={$item},{$domainBaseDN}";
             if (!$ldap->get_entry($itemDN)) {
                 $itemEntry = [
                     'ou' => $item,
                     'description' => $item,
                     'objectclass' => [
                         'top',
                         'organizationalunit'
                     ]
                 ];
 
                 self::addEntry(
                     $ldap,
                     $itemDN,
                     $itemEntry,
                     "Failed to create domain {$domain->namespace} in LDAP (" . __LINE__ . ")"
                 );
             }
         }
 
         foreach (['kolab-admin'] as $item) {
             $itemDN = "cn={$item},{$domainBaseDN}";
             if (!$ldap->get_entry($itemDN)) {
                 $itemEntry = [
                     'cn' => $item,
                     'description' => "{$item} role",
                     'objectclass' => [
                         'top',
                         'ldapsubentry',
                         'nsmanagedroledefinition',
                         'nsroledefinition',
                         'nssimpleroledefinition'
                     ]
                 ];
 
                 self::addEntry(
                     $ldap,
                     $itemDN,
                     $itemEntry,
                     "Failed to create domain {$domain->namespace} in LDAP (" . __LINE__ . ")"
                 );
             }
         }
 
         // TODO: Assign kolab-admin role to the owner?
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
     }
 
     /**
      * Create a group in LDAP.
      *
      * @param \App\Group $group The group to create.
      *
      * @throws \Exception
      */
     public static function createGroup(Group $group): void
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         $domainName = explode('@', $group->email, 2)[1];
         $cn = $ldap->quote_string($group->name);
         $dn = "cn={$cn}," . self::baseDN($ldap, $domainName, 'Groups');
 
         $entry = [
             'mail' => $group->email,
             'objectclass' => [
                 'top',
                 'groupofuniquenames',
                 'kolabgroupofuniquenames'
             ],
         ];
 
         if (!self::getGroupEntry($ldap, $group->email)) {
             self::setGroupAttributes($ldap, $group, $entry);
 
             self::addEntry(
                 $ldap,
                 $dn,
                 $entry,
                 "Failed to create group {$group->email} in LDAP (" . __LINE__ . ")"
             );
         }
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
     }
 
     /**
      * Create a resource in LDAP.
      *
      * @param \App\Resource $resource The resource to create.
      *
      * @throws \Exception
      */
     public static function createResource(Resource $resource): void
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         $domainName = explode('@', $resource->email, 2)[1];
         $cn = $ldap->quote_string($resource->name);
         $dn = "cn={$cn}," . self::baseDN($ldap, $domainName, 'Resources');
 
         $entry = [
             'mail' => $resource->email,
             'objectclass' => [
                 'top',
                 'kolabresource',
                 'kolabsharedfolder',
                 'mailrecipient',
             ],
             'kolabfoldertype' => 'event',
         ];
 
         if (!self::getResourceEntry($ldap, $resource->email)) {
             self::setResourceAttributes($ldap, $resource, $entry);
 
             self::addEntry(
                 $ldap,
                 $dn,
                 $entry,
                 "Failed to create resource {$resource->email} in LDAP (" . __LINE__ . ")"
             );
         }
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
     }
 
     /**
      * Create a shared folder in LDAP.
      *
      * @param \App\SharedFolder $folder The shared folder to create.
      *
      * @throws \Exception
      */
     public static function createSharedFolder(SharedFolder $folder): void
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         $domainName = explode('@', $folder->email, 2)[1];
         $cn = $ldap->quote_string($folder->name);
         $dn = "cn={$cn}," . self::baseDN($ldap, $domainName, 'Shared Folders');
 
         $entry = [
             'mail' => $folder->email,
             'objectclass' => [
                 'top',
                 'kolabsharedfolder',
                 'mailrecipient',
             ],
         ];
 
         if (!self::getSharedFolderEntry($ldap, $folder->email)) {
             self::setSharedFolderAttributes($ldap, $folder, $entry);
 
             self::addEntry(
                 $ldap,
                 $dn,
                 $entry,
                 "Failed to create shared folder {$folder->id} in LDAP (" . __LINE__ . ")"
             );
         }
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
     }
 
     /**
      * Create a user in LDAP.
      *
      * Only need to add user if in any of the local domains? Figure that out here for now. Should
      * have Context-Based Access Controls before the job is queued though, probably.
      *
      * Use one of three modes;
      *
      * 1) The authenticated user account.
      *
      *    * Only valid if the authenticated user is a domain admin.
      *    * We don't know the originating user here.
      *    * We certainly don't have its password anymore.
      *
      * 2) The hosted kolab account.
      *
      * 3) The Directory Manager account.
      *
      * @param \App\User $user The user account to create.
      *
      * @throws \Exception
      */
     public static function createUser(User $user): void
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         $entry = [
             'objectclass' => [
                 'top',
                 'inetorgperson',
                 'inetuser',
                 'kolabinetorgperson',
                 'mailrecipient',
                 'person'
             ],
             'mail' => $user->email,
             'uid' => $user->email,
             'nsroledn' => []
         ];
 
         if (!self::getUserEntry($ldap, $user->email, $dn)) {
             if (empty($dn)) {
                 self::throwException($ldap, "Failed to create user {$user->email} in LDAP (" . __LINE__ . ")");
             }
 
             self::setUserAttributes($user, $entry);
 
             self::addEntry(
                 $ldap,
                 $dn,
                 $entry,
                 "Failed to create user {$user->email} in LDAP (" . __LINE__ . ")"
             );
         }
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
     }
 
     /**
      * Delete a domain from LDAP.
      *
      * @param \App\Domain $domain The domain to delete
      *
      * @throws \Exception
      */
     public static function deleteDomain(Domain $domain): void
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         $domainBaseDN = self::baseDN($ldap, $domain->namespace);
 
         if ($ldap->get_entry($domainBaseDN)) {
             $result = $ldap->delete_entry_recursive($domainBaseDN);
 
             if (!$result) {
                 self::throwException(
                     $ldap,
                     "Failed to delete domain {$domain->namespace} from LDAP (" . __LINE__ . ")"
                 );
             }
         }
 
         if ($ldap_domain = $ldap->find_domain($domain->namespace)) {
             if ($ldap->get_entry($ldap_domain['dn'])) {
                 $result = $ldap->delete_entry($ldap_domain['dn']);
 
                 if (!$result) {
                     self::throwException(
                         $ldap,
                         "Failed to delete domain {$domain->namespace} from LDAP (" . __LINE__ . ")"
                     );
                 }
             }
         }
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
     }
 
     /**
      * Delete a group from LDAP.
      *
      * @param \App\Group $group The group to delete.
      *
      * @throws \Exception
      */
     public static function deleteGroup(Group $group): void
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         if (self::getGroupEntry($ldap, $group->email, $dn)) {
             $result = $ldap->delete_entry($dn);
 
             if (!$result) {
                 self::throwException(
                     $ldap,
                     "Failed to delete group {$group->email} from LDAP (" . __LINE__ . ")"
                 );
             }
         }
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
     }
 
     /**
      * Delete a resource from LDAP.
      *
      * @param \App\Resource $resource The resource to delete.
      *
      * @throws \Exception
      */
     public static function deleteResource(Resource $resource): void
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         if (self::getResourceEntry($ldap, $resource->email, $dn)) {
             $result = $ldap->delete_entry($dn);
 
             if (!$result) {
                 self::throwException(
                     $ldap,
                     "Failed to delete resource {$resource->email} from LDAP (" . __LINE__ . ")"
                 );
             }
         }
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
     }
 
     /**
      * Delete a shared folder from LDAP.
      *
      * @param \App\SharedFolder $folder The shared folder to delete.
      *
      * @throws \Exception
      */
     public static function deleteSharedFolder(SharedFolder $folder): void
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         if (self::getSharedFolderEntry($ldap, $folder->email, $dn)) {
             $result = $ldap->delete_entry($dn);
 
             if (!$result) {
                 self::throwException(
                     $ldap,
                     "Failed to delete shared folder {$folder->id} from LDAP (" . __LINE__ . ")"
                 );
             }
         }
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
     }
 
     /**
      * Delete a user from LDAP.
      *
      * @param \App\User $user The user account to delete.
      *
      * @throws \Exception
      */
     public static function deleteUser(User $user): void
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         if (self::getUserEntry($ldap, $user->email, $dn)) {
             $result = $ldap->delete_entry($dn);
 
             if (!$result) {
                 self::throwException(
                     $ldap,
                     "Failed to delete user {$user->email} from LDAP (" . __LINE__ . ")"
                 );
             }
         }
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
     }
 
     /**
      * Get a domain data from LDAP.
      *
      * @param string $namespace The domain name
      *
      * @return array|false|null
      * @throws \Exception
      */
     public static function getDomain(string $namespace)
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         $ldapDomain = $ldap->find_domain($namespace);
 
         if ($ldapDomain) {
             $domain = $ldap->get_entry($ldapDomain['dn']);
         }
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
 
         return $domain ?? null;
     }
 
     /**
      * Get a group data from LDAP.
      *
      * @param string $email The group email.
      *
      * @return array|false|null
      * @throws \Exception
      */
     public static function getGroup(string $email)
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         $group = self::getGroupEntry($ldap, $email, $dn);
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
 
         return $group;
     }
 
     /**
      * Get a resource data from LDAP.
      *
      * @param string $email The resource email.
      *
      * @return array|false|null
      * @throws \Exception
      */
     public static function getResource(string $email)
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         $resource = self::getResourceEntry($ldap, $email, $dn);
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
 
         return $resource;
     }
 
     /**
      * Get a shared folder data from LDAP.
      *
      * @param string $email The resource email.
      *
      * @return array|false|null
      * @throws \Exception
      */
     public static function getSharedFolder(string $email)
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         $folder = self::getSharedFolderEntry($ldap, $email, $dn);
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
 
         return $folder;
     }
 
     /**
      * Get a user data from LDAP.
      *
      * @param string $email The user email.
      *
      * @return array|false|null
      * @throws \Exception
      */
     public static function getUser(string $email)
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         $user = self::getUserEntry($ldap, $email, $dn, true);
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
 
         return $user;
     }
 
     /**
      * Update a domain in LDAP.
      *
      * @param \App\Domain $domain The domain to update.
      *
      * @throws \Exception
      */
     public static function updateDomain(Domain $domain): void
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         $ldapDomain = $ldap->find_domain($domain->namespace);
 
         if (!$ldapDomain) {
             self::throwException(
                 $ldap,
                 "Failed to update domain {$domain->namespace} in LDAP (domain not found)"
             );
         }
 
         $oldEntry = $ldap->get_entry($ldapDomain['dn']);
         $newEntry = $oldEntry;
 
         self::setDomainAttributes($domain, $newEntry);
 
         if (array_key_exists('inetdomainstatus', $newEntry)) {
             $newEntry['inetdomainstatus'] = (string) $newEntry['inetdomainstatus'];
         }
 
         $result = $ldap->modify_entry($ldapDomain['dn'], $oldEntry, $newEntry);
 
         if (!is_array($result)) {
             self::throwException(
                 $ldap,
                 "Failed to update domain {$domain->namespace} in LDAP (" . __LINE__ . ")"
             );
         }
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
     }
 
     /**
      * Update a group in LDAP.
      *
      * @param \App\Group $group The group to update
      *
      * @throws \Exception
      */
     public static function updateGroup(Group $group): void
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         $newEntry = $oldEntry = self::getGroupEntry($ldap, $group->email, $dn);
 
         if (empty($oldEntry)) {
             self::throwException(
                 $ldap,
                 "Failed to update group {$group->email} in LDAP (group not found)"
             );
         }
 
         self::setGroupAttributes($ldap, $group, $newEntry);
 
         $result = $ldap->modify_entry($dn, $oldEntry, $newEntry);
 
         if (!is_array($result)) {
             self::throwException(
                 $ldap,
                 "Failed to update group {$group->email} in LDAP (" . __LINE__ . ")"
             );
         }
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
     }
 
     /**
      * Update a resource in LDAP.
      *
      * @param \App\Resource $resource The resource to update
      *
      * @throws \Exception
      */
     public static function updateResource(Resource $resource): void
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         $newEntry = $oldEntry = self::getResourceEntry($ldap, $resource->email, $dn);
 
         if (empty($oldEntry)) {
             self::throwException(
                 $ldap,
                 "Failed to update resource {$resource->email} in LDAP (resource not found)"
             );
         }
 
         self::setResourceAttributes($ldap, $resource, $newEntry);
 
         $result = $ldap->modify_entry($dn, $oldEntry, $newEntry);
 
         if (!is_array($result)) {
             self::throwException(
                 $ldap,
                 "Failed to update resource {$resource->email} in LDAP (" . __LINE__ . ")"
             );
         }
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
     }
 
     /**
      * Update a shared folder in LDAP.
      *
      * @param \App\SharedFolder $folder The shared folder to update
      *
      * @throws \Exception
      */
     public static function updateSharedFolder(SharedFolder $folder): void
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         $newEntry = $oldEntry = self::getSharedFolderEntry($ldap, $folder->email, $dn);
 
         if (empty($oldEntry)) {
             self::throwException(
                 $ldap,
                 "Failed to update shared folder {$folder->id} in LDAP (folder not found)"
             );
         }
 
         self::setSharedFolderAttributes($ldap, $folder, $newEntry);
 
         $result = $ldap->modify_entry($dn, $oldEntry, $newEntry);
 
         if (!is_array($result)) {
             self::throwException(
                 $ldap,
                 "Failed to update shared folder {$folder->id} in LDAP (" . __LINE__ . ")"
             );
         }
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
     }
 
     /**
      * Update a user in LDAP.
      *
      * @param \App\User $user The user account to update.
      *
      * @throws \Exception
      */
     public static function updateUser(User $user): void
     {
         $config = self::getConfig('admin');
         $ldap = self::initLDAP($config);
 
         $newEntry = $oldEntry = self::getUserEntry($ldap, $user->email, $dn, true);
 
         if (!$oldEntry) {
             self::throwException(
                 $ldap,
                 "Failed to update user {$user->email} in LDAP (user not found)"
             );
         }
 
         self::setUserAttributes($user, $newEntry);
 
         if (array_key_exists('objectclass', $newEntry)) {
             if (!in_array('inetuser', $newEntry['objectclass'])) {
                 $newEntry['objectclass'][] = 'inetuser';
             }
         }
 
         if (array_key_exists('inetuserstatus', $newEntry)) {
             $newEntry['inetuserstatus'] = (string) $newEntry['inetuserstatus'];
         }
 
         if (array_key_exists('mailquota', $newEntry)) {
             $newEntry['mailquota'] = (string) $newEntry['mailquota'];
         }
 
         $result = $ldap->modify_entry($dn, $oldEntry, $newEntry);
 
         if (!is_array($result)) {
             self::throwException(
                 $ldap,
                 "Failed to update user {$user->email} in LDAP (" . __LINE__ . ")"
             );
         }
 
         if (empty(self::$ldap)) {
             $ldap->close();
         }
     }
 
     /**
      * Initialize connection to LDAP
      */
     private static function initLDAP(array $config, string $privilege = 'admin')
     {
         if (self::$ldap) {
             return self::$ldap;
         }
 
         $ldap = new \Net_LDAP3($config);
 
         $connected = $ldap->connect();
 
         if (!$connected) {
             throw new \Exception("Failed to connect to LDAP");
         }
 
         $bound = $ldap->bind(
             \config("ldap.{$privilege}.bind_dn"),
             \config("ldap.{$privilege}.bind_pw")
         );
 
         if (!$bound) {
             throw new \Exception("Failed to bind to LDAP");
         }
 
         return $ldap;
     }
 
     /**
      * Set domain attributes
      */
     private static function setDomainAttributes(Domain $domain, array &$entry)
     {
         $entry['inetdomainstatus'] = $domain->status;
     }
 
     /**
      * Convert group member addresses in to valid entries.
      */
     private static function setGroupAttributes($ldap, Group $group, &$entry)
     {
         $settings = $group->getSettings(['sender_policy']);
 
         // Make sure the policy does not contain duplicates, they aren't allowed
         // by the ldap definition of kolabAllowSMTPSender attribute
         $sender_policy = json_decode($settings['sender_policy'] ?: '[]', true);
         $sender_policy = array_values(array_unique(array_map('strtolower', $sender_policy)));
 
         $entry['kolaballowsmtpsender'] = $sender_policy;
         $entry['cn'] = $group->name;
         $entry['uniquemember'] = [];
 
         $groupDomain = explode('@', $group->email, 2)[1];
         $domainBaseDN = self::baseDN($ldap, $groupDomain);
         $validMembers = [];
 
         foreach ($group->members as $member) {
             list($local, $domainName) = explode('@', $member);
 
             $memberDN = "uid={$member},ou=People,{$domainBaseDN}";
             $memberEntry = $ldap->get_entry($memberDN);
 
             // if the member is in the local domain but doesn't exist, drop it
             if ($domainName == $groupDomain && !$memberEntry) {
                 continue;
             }
 
             // add the member if not in the local domain
             if (!$memberEntry) {
                 $memberEntry = [
                     'cn' => $member,
                     'mail' => $member,
                     'objectclass' => [
                         'top',
                         'inetorgperson',
                         'organizationalperson',
                         'person'
                     ],
                     'sn' => 'unknown'
                 ];
 
                 $ldap->add_entry($memberDN, $memberEntry);
             }
 
             $entry['uniquemember'][] = $memberDN;
             $validMembers[] = $member;
         }
 
         // Update members in sql (some might have been removed),
         // skip model events to not invoke another update job
         if ($group->members !== $validMembers) {
             $group->members = $validMembers;
             $group->saveQuietly();
         }
     }
 
     /**
      * Set common resource attributes
      */
     private static function setResourceAttributes($ldap, Resource $resource, &$entry)
     {
         $entry['cn'] = $resource->name;
         $entry['owner'] = null;
         $entry['kolabinvitationpolicy'] = null;
-        $entry['acl'] = '';
+        $entry['acl'] = [];
 
         $settings = $resource->getSettings(['invitation_policy', 'folder']);
 
         $entry['kolabtargetfolder'] = $settings['folder'] ?? '';
 
         // Here's how Wallace's resources module works:
         // - if policy is ACT_MANUAL and owner mail specified: a tentative response is sent, event saved,
         //   and mail sent to the owner to accept/decline the request.
         // - if policy is ACT_ACCEPT_AND_NOTIFY and owner mail specified: an accept response is sent,
         //   event saved, and notification (not confirmation) mail sent to the owner.
         // - if there's no owner (policy irrelevant): an accept response is sent, event saved.
         // - if policy is ACT_REJECT: a decline response is sent
         // - note that the notification email is being send if COND_NOTIFY policy is set or saving failed.
         // - all above assume there's no conflict, if there's a conflict the decline response is sent automatically
         //   (notification is sent if policy = ACT_ACCEPT_AND_NOTIFY).
         // - the only supported policies are: 'ACT_MANUAL', 'ACT_ACCEPT' (defined but not used anywhere),
         //   'ACT_REJECT', 'ACT_ACCEPT_AND_NOTIFY'.
 
         // For now we ignore the notifications feature
 
         if (!empty($settings['invitation_policy'])) {
             if ($settings['invitation_policy'] === 'accept') {
                 $entry['kolabinvitationpolicy'] = 'ACT_ACCEPT';
             } elseif ($settings['invitation_policy'] === 'reject') {
                 $entry['kolabinvitationpolicy'] = 'ACT_REJECT';
             } elseif (preg_match('/^manual:(\S+@\S+)$/', $settings['invitation_policy'], $m)) {
                 if (self::getUserEntry($ldap, $m[1], $userDN)) {
                     $entry['owner'] = $userDN;
-                    $entry['acl'] = $m[1] . ', full';
+                    $entry['acl'] = [$m[1] . ', full'];
                     $entry['kolabinvitationpolicy'] = 'ACT_MANUAL';
                 } else {
                     $entry['kolabinvitationpolicy'] = 'ACT_ACCEPT';
                 }
             }
         }
+
+        $entry['acl'] = Utils::ensureAclPostPermission($entry['acl']);
     }
 
     /**
      * Set common shared folder attributes
      */
     private static function setSharedFolderAttributes($ldap, SharedFolder $folder, &$entry)
     {
         $settings = $folder->getSettings(['acl', 'folder']);
 
+        $acl = !empty($settings['acl']) ? json_decode($settings['acl'], true) : [];
+
         $entry['cn'] = $folder->name;
         $entry['kolabfoldertype'] = $folder->type;
         $entry['kolabtargetfolder'] = $settings['folder'] ?? '';
-        $entry['acl'] = !empty($settings['acl']) ? json_decode($settings['acl'], true) : '';
+        $entry['acl'] = Utils::ensureAclPostPermission($acl);
         $entry['alias'] = $folder->aliases()->pluck('alias')->all();
     }
 
     /**
      * Set common user attributes
      */
     private static function setUserAttributes(User $user, array &$entry)
     {
         $isDegraded = $user->isDegraded(true);
         $settings = $user->getSettings(['first_name', 'last_name', 'organization']);
 
         $firstName = $settings['first_name'];
         $lastName = $settings['last_name'];
         $cn = "unknown";
         $displayname = "";
 
         if ($firstName) {
             if ($lastName) {
                 $cn = "{$firstName} {$lastName}";
                 $displayname = "{$lastName}, {$firstName}";
             } else {
                 $lastName = "unknown";
                 $cn = "{$firstName}";
                 $displayname = "{$firstName}";
             }
         } else {
             $firstName = "";
             if ($lastName) {
                 $cn = "{$lastName}";
                 $displayname = "{$lastName}";
             } else {
                 $lastName = "unknown";
             }
         }
 
         $entry['cn'] = $cn;
         $entry['displayname'] = $displayname;
         $entry['givenname'] = $firstName;
         $entry['sn'] = $lastName;
         $entry['userpassword'] = $user->password_ldap;
         $entry['inetuserstatus'] = $user->status;
         $entry['o'] = $settings['organization'];
         $entry['mailquota'] = 0;
         $entry['alias'] = $user->aliases()->pluck('alias')->all();
 
         $roles = [];
 
         foreach ($user->entitlements as $entitlement) {
             switch ($entitlement->sku->title) {
                 case "mailbox":
                     break;
 
                 case "storage":
                     $entry['mailquota'] += 1048576;
                     break;
 
                 default:
                     $roles[] = $entitlement->sku->title;
                     break;
             }
         }
 
         $hostedRootDN = \config('ldap.hosted.root_dn');
 
         $entry['nsroledn'] = [];
 
         if (in_array("2fa", $roles)) {
             $entry['nsroledn'][] = "cn=2fa-user,{$hostedRootDN}";
         }
 
         if ($isDegraded) {
             $entry['nsroledn'][] = "cn=degraded-user,{$hostedRootDN}";
             $entry['mailquota'] = \config('app.storage.min_qty') * 1048576;
         } else {
             if (in_array("activesync", $roles)) {
                 $entry['nsroledn'][] = "cn=activesync-user,{$hostedRootDN}";
             }
 
             if (!in_array("groupware", $roles)) {
                 $entry['nsroledn'][] = "cn=imap-user,{$hostedRootDN}";
             }
         }
     }
 
     /**
      * Get LDAP configuration for specified access level
      */
     private static function getConfig(string $privilege)
     {
         $config = [
             'domain_base_dn' => \config('ldap.domain_base_dn'),
             'domain_filter' => \config('ldap.domain_filter'),
             'domain_name_attribute' => \config('ldap.domain_name_attribute'),
             'hosts' => \config('ldap.hosts'),
             'sort' => false,
             'vlv' => false,
             'log_hook' => 'App\Backends\LDAP::logHook',
         ];
 
         return $config;
     }
 
     /**
      * Get group entry from LDAP.
      *
      * @param \Net_LDAP3 $ldap  Ldap connection
      * @param string     $email Group email (mail)
      * @param string     $dn    Reference to group DN
      *
      * @return null|array Group entry, NULL if not found
      */
     private static function getGroupEntry($ldap, $email, &$dn = null)
     {
         $domainName = explode('@', $email, 2)[1];
         $base_dn = self::baseDN($ldap, $domainName, 'Groups');
 
         $attrs = ['dn', 'cn', 'mail', 'uniquemember', 'objectclass', 'kolaballowsmtpsender'];
 
         // For groups we're using search() instead of get_entry() because
         // a group name is not constant, so e.g. on update we might have
         // the new name, but not the old one. Email address is constant.
         return self::searchEntry($ldap, $base_dn, "(mail=$email)", $attrs, $dn);
     }
 
     /**
      * Get a resource entry from LDAP.
      *
      * @param \Net_LDAP3 $ldap  Ldap connection
      * @param string     $email Resource email (mail)
      * @param string     $dn    Reference to the resource DN
      *
      * @return null|array Resource entry, NULL if not found
      */
     private static function getResourceEntry($ldap, $email, &$dn = null)
     {
         $domainName = explode('@', $email, 2)[1];
         $base_dn = self::baseDN($ldap, $domainName, 'Resources');
 
         $attrs = ['dn', 'cn', 'mail', 'objectclass', 'kolabtargetfolder',
             'kolabfoldertype', 'kolabinvitationpolicy', 'owner', 'acl'];
 
         // For resources we're using search() instead of get_entry() because
         // a resource name is not constant, so e.g. on update we might have
         // the new name, but not the old one. Email address is constant.
         return self::searchEntry($ldap, $base_dn, "(mail=$email)", $attrs, $dn);
     }
 
     /**
      * Get a shared folder entry from LDAP.
      *
      * @param \Net_LDAP3 $ldap  Ldap connection
      * @param string     $email Resource email (mail)
      * @param string     $dn    Reference to the shared folder DN
      *
      * @return null|array Shared folder entry, NULL if not found
      */
     private static function getSharedFolderEntry($ldap, $email, &$dn = null)
     {
         $domainName = explode('@', $email, 2)[1];
         $base_dn = self::baseDN($ldap, $domainName, 'Shared Folders');
 
         $attrs = ['dn', 'cn', 'mail', 'objectclass', 'kolabtargetfolder', 'kolabfoldertype', 'acl', 'alias'];
 
         // For shared folders we're using search() instead of get_entry() because
         // a folder name is not constant, so e.g. on update we might have
         // the new name, but not the old one. Email address is constant.
         return self::searchEntry($ldap, $base_dn, "(mail=$email)", $attrs, $dn);
     }
 
     /**
      * Get user entry from LDAP.
      *
      * @param \Net_LDAP3 $ldap  Ldap connection
      * @param string     $email User email (uid)
      * @param string     $dn    Reference to user DN
      * @param bool       $full  Get extra attributes, e.g. nsroledn
      *
      * @return null|array User entry, NULL if not found
      */
     private static function getUserEntry($ldap, $email, &$dn = null, $full = false)
     {
         $domainName = explode('@', $email, 2)[1];
 
         $dn = "uid={$email}," . self::baseDN($ldap, $domainName, 'People');
 
         $entry = $ldap->get_entry($dn);
 
         if ($entry && $full) {
             if (!array_key_exists('nsroledn', $entry)) {
                 $roles = $ldap->get_entry_attributes($dn, ['nsroledn']);
                 if (!empty($roles)) {
                     $entry['nsroledn'] = (array) $roles['nsroledn'];
                 }
             }
         }
 
         return $entry ?: null;
     }
 
     /**
      * Logging callback
      */
     public static function logHook($level, $msg): void
     {
         if (
             (
                 $level == LOG_INFO
                 || $level == LOG_DEBUG
                 || $level == LOG_NOTICE
             )
             && !\config('app.debug')
         ) {
             return;
         }
 
         switch ($level) {
             case LOG_CRIT:
                 $function = 'critical';
                 break;
             case LOG_EMERG:
                 $function = 'emergency';
                 break;
             case LOG_ERR:
                 $function = 'error';
                 break;
             case LOG_ALERT:
                 $function = 'alert';
                 break;
             case LOG_WARNING:
                 $function = 'warning';
                 break;
             case LOG_INFO:
                 $function = 'info';
                 break;
             case LOG_DEBUG:
                 $function = 'debug';
                 break;
             case LOG_NOTICE:
                 $function = 'notice';
                 break;
             default:
                 $function = 'info';
         }
 
         if (is_array($msg)) {
             $msg = implode("\n", $msg);
         }
 
         $msg = '[LDAP] ' . $msg;
 
         \Log::{$function}($msg);
     }
 
     /**
      * A wrapper for Net_LDAP3::add_entry() with error handler
      *
      * @param \Net_LDAP3 $ldap     Ldap connection
      * @param string     $dn       Entry DN
      * @param array      $entry    Entry attributes
      * @param ?string    $errorMsg A message to throw as an exception on error
      *
      * @throws \Exception
      */
     private static function addEntry($ldap, string $dn, array $entry, $errorMsg = null)
     {
         // try/catch because Laravel converts warnings into exceptions
         // and we want more human-friendly error message than that
         try {
             $result = $ldap->add_entry($dn, $entry);
         } catch (\Exception $e) {
             $result = false;
         }
 
         if (!$result) {
             if (!$errorMsg) {
                 $errorMsg = "LDAP Error (" . __LINE__ . ")";
             }
 
             if (isset($e)) {
                 $errorMsg .= ": " . $e->getMessage();
             }
 
             self::throwException($ldap, $errorMsg);
         }
     }
 
     /**
      * Find a single entry in LDAP by using search.
      *
      * @param \Net_LDAP3 $ldap    Ldap connection
      * @param string     $base_dn Base DN
      * @param string     $filter  Search filter
      * @param array      $attrs   Result attributes
      * @param string     $dn      Reference to a DN of the found entry
      *
      * @return null|array LDAP entry, NULL if not found
      */
     private static function searchEntry($ldap, $base_dn, $filter, $attrs, &$dn = null)
     {
         $result = $ldap->search($base_dn, $filter, 'sub', $attrs);
 
         if ($result && $result->count() == 1) {
             $entries = $result->entries(true);
             $dn = key($entries);
             $entry = $entries[$dn];
             $entry['dn'] = $dn;
 
             return $entry;
         }
 
         return null;
     }
 
     /**
      * Throw exception and close the connection when needed
      *
      * @param \Net_LDAP3 $ldap    Ldap connection
      * @param string     $message Exception message
      *
      * @throws \Exception
      */
     private static function throwException($ldap, string $message): void
     {
         if (empty(self::$ldap)) {
             $ldap->close();
         }
 
         throw new \Exception($message);
     }
 
     /**
      * Create a base DN string for a specified object.
      * Note: It makes sense with an existing domain only.
      *
      * @param \Net_LDAP3 $ldap       Ldap connection
      * @param string     $domainName Domain namespace
      * @param ?string    $ouName     Optional name of the sub-tree (OU)
      *
      * @return string Full base DN
      */
     private static function baseDN($ldap, string $domainName, string $ouName = null): string
     {
         $dn = $ldap->domain_root_dn($domainName);
 
         if ($ouName) {
             $dn = "ou={$ouName},{$dn}";
         }
 
         return $dn;
     }
 }
diff --git a/src/app/Utils.php b/src/app/Utils.php
index 29cb0283..632dc0d0 100644
--- a/src/app/Utils.php
+++ b/src/app/Utils.php
@@ -1,579 +1,605 @@
 <?php
 
 namespace App;
 
 use Carbon\Carbon;
 use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Str;
 
 /**
  * Small utility functions for App.
  */
 class Utils
 {
     // Note: Removed '0', 'O', '1', 'I' as problematic with some fonts
     public const CHARS = '23456789ABCDEFGHJKLMNPQRSTUVWXYZ';
 
     /**
      * Exchange rates for unit tests
      */
     private static $testRates;
 
     /**
      * Count the number of lines in a file.
      *
      * Useful for progress bars.
      *
      * @param string $file The filepath to count the lines of.
      *
      * @return int
      */
     public static function countLines($file)
     {
         $fh = fopen($file, 'rb');
         $numLines = 0;
 
         while (!feof($fh)) {
             $numLines += substr_count(fread($fh, 8192), "\n");
         }
 
         fclose($fh);
 
         return $numLines;
     }
 
     /**
      * Return the country ISO code for an IP address.
      *
      * @param string $ip       IP address
      * @param string $fallback Fallback country code
      *
      * @return string
      */
     public static function countryForIP($ip, $fallback = 'CH')
     {
         if (strpos($ip, ':') === false) {
             $net = \App\IP4Net::getNet($ip);
         } else {
             $net = \App\IP6Net::getNet($ip);
         }
 
         return $net && $net->country ? $net->country : $fallback;
     }
 
     /**
      * Return the country ISO code for the current request.
      */
     public static function countryForRequest()
     {
         $request = \request();
         $ip = $request->ip();
 
         return self::countryForIP($ip);
     }
 
     /**
      * Return the number of days in the month prior to this one.
      *
      * @return int
      */
     public static function daysInLastMonth()
     {
         $start = new Carbon('first day of last month');
         $end = new Carbon('last day of last month');
 
         return $start->diffInDays($end) + 1;
     }
 
     /**
      * Download a file from the interwebz and store it locally.
      *
      * @param string $source The source location
      * @param string $target The target location
      * @param bool $force    Force the download (and overwrite target)
      *
      * @return void
      */
     public static function downloadFile($source, $target, $force = false)
     {
         if (is_file($target) && !$force) {
             return;
         }
 
         \Log::info("Retrieving {$source}");
 
         $fp = fopen($target, 'w');
 
         $curl = curl_init();
         curl_setopt($curl, CURLOPT_URL, $source);
         curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
         curl_setopt($curl, CURLOPT_FILE, $fp);
         curl_exec($curl);
 
         if (curl_errno($curl)) {
             \Log::error("Request error on {$source}: " . curl_error($curl));
 
             curl_close($curl);
             fclose($fp);
 
             unlink($target);
             return;
         }
 
         curl_close($curl);
         fclose($fp);
     }
 
     /**
      * Converts an email address to lower case. Keeps the LMTP shared folder
      * addresses character case intact.
      *
      * @param string $email Email address
      *
      * @return string Email address
      */
     public static function emailToLower(string $email): string
     {
         // For LMTP shared folder address lower case the domain part only
         if (str_starts_with($email, 'shared+shared/')) {
             $pos = strrpos($email, '@');
             $domain = substr($email, $pos + 1);
             $local = substr($email, 0, strlen($email) - strlen($domain) - 1);
 
             return $local . '@' . strtolower($domain);
         }
 
         return strtolower($email);
     }
 
+    /**
+     * Make sure that IMAP folder access rights contains "anyone: p" permission
+     *
+     * @param array $acl ACL (in form of "user, permission" records)
+     *
+     * @return array ACL list
+     */
+    public static function ensureAclPostPermission(array $acl): array
+    {
+        foreach ($acl as $idx => $entry) {
+            if (str_starts_with($entry, 'anyone,')) {
+                if (strpos($entry, 'read-only')) {
+                    $acl[$idx] = 'anyone, lrsp';
+                } elseif (strpos($entry, 'read-write')) {
+                    $acl[$idx] = 'anyone, lrswitednp';
+                }
+
+                return $acl;
+            }
+        }
+
+        $acl[] = 'anyone, p';
+
+        return $acl;
+    }
+
     /**
      * Generate a passphrase. Not intended for use in production, so limited to environments that are not production.
      *
      * @return string
      */
     public static function generatePassphrase()
     {
         if (\config('app.env') == 'production') {
             throw new \Exception("Thou shall not pass!");
         }
 
         if (\config('app.passphrase')) {
             return \config('app.passphrase');
         }
 
         $alphaLow = 'abcdefghijklmnopqrstuvwxyz';
         $alphaUp = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ';
         $num = '0123456789';
         $stdSpecial = '~`!@#$%^&*()-_+=[{]}\\|\'";:/?.>,<';
 
         $source = $alphaLow . $alphaUp . $num . $stdSpecial;
 
         $result = '';
 
         for ($x = 0; $x < 16; $x++) {
             $result .= substr($source, rand(0, (strlen($source) - 1)), 1);
         }
 
         return $result;
     }
 
     /**
      * Find an object that is the recipient for the specified address.
      *
      * @param string $address
      *
      * @return array
      */
     public static function findObjectsByRecipientAddress($address)
     {
         $address = \App\Utils::normalizeAddress($address);
 
         list($local, $domainName) = explode('@', $address);
 
         $domain = \App\Domain::where('namespace', $domainName)->first();
 
         if (!$domain) {
             return [];
         }
 
         $user = \App\User::where('email', $address)->first();
 
         if ($user) {
             return [$user];
         }
 
         $userAliases = \App\UserAlias::where('alias', $address)->get();
 
         if (count($userAliases) > 0) {
             $users = [];
 
             foreach ($userAliases as $userAlias) {
                 $users[] = $userAlias->user;
             }
 
             return $users;
         }
 
         $userAliases = \App\UserAlias::where('alias', "catchall@{$domain->namespace}")->get();
 
         if (count($userAliases) > 0) {
             $users = [];
 
             foreach ($userAliases as $userAlias) {
                 $users[] = $userAlias->user;
             }
 
             return $users;
         }
 
         return [];
     }
 
     /**
      * Retrieve the network ID and Type from a client address
      *
      * @param string $clientAddress The IPv4 or IPv6 address.
      *
      * @return array An array of ID and class or null and null.
      */
     public static function getNetFromAddress($clientAddress)
     {
         if (strpos($clientAddress, ':') === false) {
             $net = \App\IP4Net::getNet($clientAddress);
 
             if ($net) {
                 return [$net->id, \App\IP4Net::class];
             }
         } else {
             $net = \App\IP6Net::getNet($clientAddress);
 
             if ($net) {
                 return [$net->id, \App\IP6Net::class];
             }
         }
 
         return [null, null];
     }
 
     /**
      * Calculate the broadcast address provided a net number and a prefix.
      *
      * @param string $net A valid IPv6 network number.
      * @param int $prefix The network prefix.
      *
      * @return string
      */
     public static function ip6Broadcast($net, $prefix)
     {
         $netHex = bin2hex(inet_pton($net));
 
         // Overwriting first address string to make sure notation is optimal
         $net = inet_ntop(hex2bin($netHex));
 
         // Calculate the number of 'flexible' bits
         $flexbits = 128 - $prefix;
 
         // Build the hexadecimal string of the last address
         $lastAddrHex = $netHex;
 
         // We start at the end of the string (which is always 32 characters long)
         $pos = 31;
         while ($flexbits > 0) {
             // Get the character at this position
             $orig = substr($lastAddrHex, $pos, 1);
 
             // Convert it to an integer
             $origval = hexdec($orig);
 
             // OR it with (2^flexbits)-1, with flexbits limited to 4 at a time
             $newval = $origval | (pow(2, min(4, $flexbits)) - 1);
 
             // Convert it back to a hexadecimal character
             $new = dechex($newval);
 
             // And put that character back in the string
             $lastAddrHex = substr_replace($lastAddrHex, $new, $pos, 1);
 
             // We processed one nibble, move to previous position
             $flexbits -= 4;
             $pos -= 1;
         }
 
         // Convert the hexadecimal string to a binary string
         $lastaddrbin = hex2bin($lastAddrHex);
 
         // And create an IPv6 address from the binary string
         $lastaddrstr = inet_ntop($lastaddrbin);
 
         return $lastaddrstr;
     }
 
     /**
      * Normalize an email address.
      *
      * This means to lowercase and strip components separated with recipient delimiters.
      *
      * @param ?string $address The address to normalize
      * @param bool    $asArray Return an array with local and domain part
      *
      * @return string|array Normalized email address as string or array
      */
     public static function normalizeAddress(?string $address, bool $asArray = false)
     {
         if ($address === null || $address === '') {
             return $asArray ? ['', ''] : '';
         }
 
         $address = self::emailToLower($address);
 
         if (strpos($address, '@') === false) {
             return $asArray ? [$address, ''] : $address;
         }
 
         list($local, $domain) = explode('@', $address);
 
         if (strpos($local, '+') !== false) {
             $local = explode('+', $local)[0];
         }
 
         return $asArray ? [$local, $domain] : "{$local}@{$domain}";
     }
 
     /**
      * Returns the current user's email address or null.
      *
      * @return string
      */
     public static function userEmailOrNull(): ?string
     {
         $user = Auth::user();
 
         if (!$user) {
             return null;
         }
 
         return $user->email;
     }
 
     /**
      * Returns a random string consisting of a quantity of segments of a certain length joined.
      *
      * Example:
      *
      * ```php
      * $roomName = strtolower(\App\Utils::randStr(3, 3, '-');
      * // $roomName == '3qb-7cs-cjj'
      * ```
      *
      * @param int $length  The length of each segment
      * @param int $qty     The quantity of segments
      * @param string $join The string to use to join the segments
      *
      * @return string
      */
     public static function randStr($length, $qty = 1, $join = '')
     {
         $chars = env('SHORTCODE_CHARS', self::CHARS);
 
         $randStrs = [];
 
         for ($x = 0; $x < $qty; $x++) {
             $randStrs[$x] = [];
 
             for ($y = 0; $y < $length; $y++) {
                 $randStrs[$x][] = $chars[rand(0, strlen($chars) - 1)];
             }
 
             shuffle($randStrs[$x]);
 
             $randStrs[$x] = implode('', $randStrs[$x]);
         }
 
         return implode($join, $randStrs);
     }
 
     /**
      * Returns a UUID in the form of an integer.
      *
      * @return int
      */
     public static function uuidInt(): int
     {
         $hex = self::uuidStr();
         $bin = pack('h*', str_replace('-', '', $hex));
         $ids = unpack('L', $bin);
         $id = array_shift($ids);
 
         return $id;
     }
 
     /**
      * Returns a UUID in the form of a string.
      *
      * @return string
      */
     public static function uuidStr(): string
     {
         return (string) Str::uuid();
     }
 
     /**
      * Create self URL
      *
      * @param string   $route    Route/Path/URL
      * @param int|null $tenantId Current tenant
      *
      * @todo Move this to App\Http\Controllers\Controller
      *
      * @return string Full URL
      */
     public static function serviceUrl(string $route, $tenantId = null): string
     {
         if (preg_match('|^https?://|i', $route)) {
             return $route;
         }
 
         $url = \App\Tenant::getConfig($tenantId, 'app.public_url');
 
         if (!$url) {
             $url = \App\Tenant::getConfig($tenantId, 'app.url');
         }
 
         return rtrim(trim($url, '/') . '/' . ltrim($route, '/'), '/');
     }
 
     /**
      * Create a configuration/environment data to be passed to
      * the UI
      *
      * @todo Move this to App\Http\Controllers\Controller
      *
      * @return array Configuration data
      */
     public static function uiEnv(): array
     {
         $countries = include resource_path('countries.php');
         $req_domain = preg_replace('/:[0-9]+$/', '', request()->getHttpHost());
         $sys_domain = \config('app.domain');
         $opts = [
             'app.name',
             'app.url',
             'app.domain',
             'app.theme',
             'app.webmail_url',
             'app.support_email',
             'app.company.copyright',
             'app.companion_download_link',
             'app.with_signup',
             'mail.from.address'
         ];
 
         $env = \app('config')->getMany($opts);
 
         $env['countries'] = $countries ?: [];
         $env['view'] = 'root';
         $env['jsapp'] = 'user.js';
 
         if ($req_domain == "admin.$sys_domain") {
             $env['jsapp'] = 'admin.js';
         } elseif ($req_domain == "reseller.$sys_domain") {
             $env['jsapp'] = 'reseller.js';
         }
 
         $env['paymentProvider'] = \config('services.payment_provider');
         $env['stripePK'] = \config('services.stripe.public_key');
 
         $env['languages'] = \App\Http\Controllers\ContentController::locales();
         $env['menu'] = \App\Http\Controllers\ContentController::menu();
 
         return $env;
     }
 
     /**
      * Set test exchange rates.
      *
      * @param array       $rates: Exchange rates
      */
     public static function setTestExchangeRates(array $rates): void
     {
         self::$testRates = $rates;
     }
 
     /**
      * Retrieve an exchange rate.
      *
      * @param string       $sourceCurrency: Currency from which to convert
      * @param string       $targetCurrency: Currency to convert to
      *
      * @return float Exchange rate
      */
     public static function exchangeRate(string $sourceCurrency, string $targetCurrency): float
     {
         if (strcasecmp($sourceCurrency, $targetCurrency) == 0) {
             return 1.0;
         }
 
         if (isset(self::$testRates[$targetCurrency])) {
             return floatval(self::$testRates[$targetCurrency]);
         }
 
         $currencyFile = resource_path("exchangerates-$sourceCurrency.php");
 
         //Attempt to find the reverse exchange rate, if we don't have the file for the source currency
         if (!file_exists($currencyFile)) {
             $rates = include resource_path("exchangerates-$targetCurrency.php");
             if (!isset($rates[$sourceCurrency])) {
                 throw new \Exception("Failed to find the reverse exchange rate for " . $sourceCurrency);
             }
             return 1.0 / floatval($rates[$sourceCurrency]);
         }
 
         $rates = include $currencyFile;
         if (!isset($rates[$targetCurrency])) {
             throw new \Exception("Failed to find exchange rate for " . $targetCurrency);
         }
 
         return floatval($rates[$targetCurrency]);
     }
 
     /**
      * A helper to display human-readable amount of money using
      * for specified currency and locale.
      *
      * @param int    $amount   Amount of money (in cents)
      * @param string $currency Currency code
      * @param string $locale   Output locale
      *
      * @return string String representation, e.g. "9.99 CHF"
      */
     public static function money(int $amount, $currency, $locale = 'de_DE'): string
     {
         $nf = new \NumberFormatter($locale, \NumberFormatter::CURRENCY);
         $result = $nf->formatCurrency(round($amount / 100, 2), $currency);
 
         // Replace non-breaking space
         return str_replace("\xC2\xA0", " ", $result);
     }
 
     /**
      * A helper to display human-readable percent value
      * for specified currency and locale.
      *
      * @param int|float $percent Percent value (0 to 100)
      * @param string    $locale  Output locale
      *
      * @return string String representation, e.g. "0 %", "7.7 %"
      */
     public static function percent(int|float $percent, $locale = 'de_DE'): string
     {
         $nf = new \NumberFormatter($locale, \NumberFormatter::PERCENT);
         $sep = $nf->getSymbol(\NumberFormatter::DECIMAL_SEPARATOR_SYMBOL);
 
         $result = sprintf('%.2F', $percent);
         $result = preg_replace('/\.00/', '', $result);
         $result = preg_replace('/(\.[0-9])0/', '\\1', $result);
         $result = str_replace('.', $sep, $result);
 
         return $result . ' %';
     }
 }
diff --git a/src/tests/Feature/Backends/IMAPTest.php b/src/tests/Feature/Backends/IMAPTest.php
index 0bb15a74..d8efb12d 100644
--- a/src/tests/Feature/Backends/IMAPTest.php
+++ b/src/tests/Feature/Backends/IMAPTest.php
@@ -1,346 +1,345 @@
 <?php
 
 namespace Tests\Feature\Backends;
 
 use App\Backends\IMAP;
 use App\Backends\LDAP;
 use Tests\TestCase;
 
 class IMAPTest extends TestCase
 {
     private $imap;
     private $user;
     private $group;
     private $resource;
     private $folder;
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         if ($this->imap) {
             $this->imap->closeConnection();
             $this->imap = null;
         }
 
         if ($this->user) {
             $this->deleteTestUser($this->user->email);
         }
         if ($this->group) {
             $this->deleteTestGroup($this->group->email);
         }
         if ($this->resource) {
             $this->deleteTestResource($this->resource->email);
         }
         if ($this->folder) {
             $this->deleteTestSharedFolder($this->folder->email);
         }
 
         parent::tearDown();
     }
 
     /**
      * Test aclCleanup()
      *
      * @group imap
      * @group ldap
      */
     public function testAclCleanup(): void
     {
         $this->user = $user = $this->getTestUser('test-' . time() . '@kolab.org');
         $this->group = $group = $this->getTestGroup('test-group-' . time() . '@kolab.org');
 
         // SETACL requires that the user/group exists in LDAP
         LDAP::createUser($user);
         // LDAP::createGroup($group);
 
         // First, set some ACLs that we'll expect to be removed later
         $imap = $this->getImap();
 
         $this->assertTrue($imap->setACL('user/john@kolab.org', $user->email, 'lrs'));
         $this->assertTrue($imap->setACL('shared/Resources/Conference Room #1@kolab.org', $user->email, 'lrs'));
 /*
         $this->assertTrue($imap->setACL('user/john@kolab.org', $group->name, 'lrs'));
         $this->assertTrue($imap->setACL('shared/Resources/Conference Room #1@kolab.org', $group->name, 'lrs'));
 */
         // Cleanup ACL of a user
         IMAP::aclCleanup($user->email);
 
         $acl = $imap->getACL('user/john@kolab.org');
         $this->assertTrue(is_array($acl) && !isset($acl[$user->email]));
         $acl = $imap->getACL('shared/Resources/Conference Room #1@kolab.org');
         $this->assertTrue(is_array($acl) && !isset($acl[$user->email]));
 
 /*
         // Cleanup ACL of a group
         IMAP::aclCleanup($group->name, 'kolab.org');
 
         $acl = $imap->getACL('user/john@kolab.org');
         $this->assertTrue(is_array($acl) && !isset($acl[$user->email]));
         $acl = $imap->getACL('shared/Resources/Conference Room #1@kolab.org');
         $this->assertTrue(is_array($acl) && !isset($acl[$user->email]));
 */
     }
 
     /**
      * Test aclCleanupDomain()
      *
      * @group imap
      * @group ldap
      */
     public function testAclCleanupDomain(): void
     {
         $this->user = $user = $this->getTestUser('test-' . time() . '@kolab.org');
         $this->group = $group = $this->getTestGroup('test-group-' . time() . '@kolab.org');
 
         // SETACL requires that the user/group exists in LDAP
         LDAP::createUser($user);
         // LDAP::createGroup($group);
 
         // First, set some ACLs that we'll expect to be removed later
         $imap = $this->getImap();
 
         $this->assertTrue($imap->setACL('user/john@kolab.org', 'anyone', 'lrs'));
         $this->assertTrue($imap->setACL('user/john@kolab.org', 'jack@kolab.org', 'lrs'));
         $this->assertTrue($imap->setACL('user/john@kolab.org', $user->email, 'lrs'));
         $this->assertTrue($imap->setACL('shared/Resources/Conference Room #1@kolab.org', 'anyone', 'lrs'));
         $this->assertTrue($imap->setACL('shared/Resources/Conference Room #1@kolab.org', 'jack@kolab.org', 'lrs'));
         $this->assertTrue($imap->setACL('shared/Resources/Conference Room #1@kolab.org', $user->email, 'lrs'));
 /*
         $this->assertTrue($imap->setACL('user/john@kolab.org', $group->name, 'lrs'));
         $this->assertTrue($imap->setACL('shared/Resources/Conference Room #1@kolab.org', $group->name, 'lrs'));
 
         $group->delete();
 */
         $user->delete();
 
         // Cleanup ACL for the domain
         IMAP::aclCleanupDomain('kolab.org');
 
         $acl = $imap->getACL('user/john@kolab.org');
         $this->assertTrue(is_array($acl) && !isset($acl[$user->email]));
         $this->assertTrue(is_array($acl) && isset($acl['jack@kolab.org']));
         $this->assertTrue(is_array($acl) && isset($acl['anyone']));
         $this->assertTrue(is_array($acl) && isset($acl['john@kolab.org']));
         // $this->assertTrue(is_array($acl) && !isset($acl[$group->name]));
 
         $acl = $imap->getACL('shared/Resources/Conference Room #1@kolab.org');
         $this->assertTrue(is_array($acl) && !isset($acl[$user->email]));
         $this->assertTrue(is_array($acl) && isset($acl['jack@kolab.org']));
         $this->assertTrue(is_array($acl) && isset($acl['anyone']));
         // $this->assertTrue(is_array($acl) && !isset($acl[$group->name]));
     }
 
     /**
      * Test creating/updating/deleting an IMAP account
      *
      * @group imap
      */
     public function testUsers(): void
     {
         $this->user = $user = $this->getTestUser('test-' . time() . '@' . \config('app.domain'));
         $storage = \App\Sku::withEnvTenantContext()->where('title', 'storage')->first();
         $user->assignSku($storage, 1, $user->wallets->first());
 
         // User must be in ldap, so imap auth works
         if (\config('app.with_ldap')) {
             LDAP::createUser($user);
         }
 
         $expectedQuota = [
             'user/' . $user->email => [
                 'storage' => [
                     'used' => 0,
                     'total' => 1048576
                 ]
             ]
         ];
 
         // Create the mailbox
         $result = IMAP::createUser($user);
         $this->assertTrue($result);
         $this->assertTrue(IMAP::verifyAccount($user->email));
         $this->assertTrue(IMAP::verifyDefaultFolders($user->email));
 
         $imap = $this->getImap();
         $quota = $imap->getQuota('user/' . $user->email);
         $this->assertSame($expectedQuota, $quota['all']);
 
         // Update the mailbox (increase quota)
         $user->assignSku($storage, 1, $user->wallets->first());
         $expectedQuota['user/' . $user->email]['storage']['total'] = 1048576 * 2;
 
         $result = IMAP::updateUser($user);
         $this->assertTrue($result);
 
         $quota = $imap->getQuota('user/' . $user->email);
         $this->assertSame($expectedQuota, $quota['all']);
 
         // Delete the mailbox
         $result = IMAP::deleteUser($user);
         $this->assertTrue($result);
 
         $result = IMAP::verifyAccount($user->email);
         $this->assertFalse($result);
         $this->assertFalse(IMAP::verifyDefaultFolders($user->email));
     }
 
     /**
      * Test creating/updating/deleting a resource
      *
      * @group imap
      */
     public function testResources(): void
     {
         $this->resource = $resource = $this->getTestResource(
             'test-resource-' . time() . '@kolab.org',
             ['name' => 'Resource ©' . time()]
         );
 
         $resource->setSetting('invitation_policy', 'manual:john@kolab.org');
 
         // Create the resource
         $this->assertTrue(IMAP::createResource($resource));
         $this->assertTrue(IMAP::verifySharedFolder($imapFolder = $resource->getSetting('folder')));
 
         $imap = $this->getImap();
-        $expectedAcl = ['john@kolab.org' => str_split('lrswipkxtecdn')];
+        $expectedAcl = ['anyone' => ['p'], 'john@kolab.org' => str_split('lrswipkxtecdn')];
         $acl = $imap->getACL(IMAP::toUTF7($imapFolder));
-        $this->assertTrue(is_array($acl) && isset($acl['john@kolab.org']));
-        $this->assertSame($expectedAcl['john@kolab.org'], $acl['john@kolab.org']);
+        $this->assertSame($expectedAcl, $acl);
 
         // Update the resource (rename)
         $resource->name = 'Resource1 ©' . time();
         $resource->save();
         $newImapFolder = $resource->getSetting('folder');
 
         $this->assertTrue(IMAP::updateResource($resource, ['folder' => $imapFolder]));
         $this->assertTrue($imapFolder != $newImapFolder);
         $this->assertTrue(IMAP::verifySharedFolder($newImapFolder));
         $acl = $imap->getACL(IMAP::toUTF7($newImapFolder));
-        $this->assertTrue(is_array($acl) && isset($acl['john@kolab.org']));
-        $this->assertSame($expectedAcl['john@kolab.org'], $acl['john@kolab.org']);
+        $this->assertSame($expectedAcl, $acl);
 
         // Update the resource (acl change)
         $resource->setSetting('invitation_policy', 'accept');
         $this->assertTrue(IMAP::updateResource($resource));
-        $this->assertSame([], $imap->getACL(IMAP::toUTF7($newImapFolder)));
+        $this->assertSame(['anyone' => ['p']], $imap->getACL(IMAP::toUTF7($newImapFolder)));
 
         // Delete the resource
         $this->assertTrue(IMAP::deleteResource($resource));
         $this->assertFalse(IMAP::verifySharedFolder($newImapFolder));
     }
 
     /**
      * Test creating/updating/deleting a shared folder
      *
      * @group imap
      */
     public function testSharedFolders(): void
     {
         $this->folder = $folder = $this->getTestSharedFolder(
             'test-folder-' . time() . '@kolab.org',
             ['name' => 'SharedFolder ©' . time()]
         );
 
         $folder->setSetting('acl', json_encode(['john@kolab.org, full', 'jack@kolab.org, read-only']));
 
         // Create the shared folder
         $this->assertTrue(IMAP::createSharedFolder($folder));
         $this->assertTrue(IMAP::verifySharedFolder($imapFolder = $folder->getSetting('folder')));
 
         $imap = $this->getImap();
         $expectedAcl = [
+            'anyone' => ['p'],
+            'jack@kolab.org' => str_split('lrs'),
             'john@kolab.org' => str_split('lrswipkxtecdn'),
-            'jack@kolab.org' => str_split('lrs')
         ];
 
         $acl = $imap->getACL(IMAP::toUTF7($imapFolder));
-        $this->assertTrue(is_array($acl) && isset($acl['john@kolab.org']));
-        $this->assertSame($expectedAcl['john@kolab.org'], $acl['john@kolab.org']);
-        $this->assertTrue(is_array($acl) && isset($acl['jack@kolab.org']));
-        $this->assertSame($expectedAcl['jack@kolab.org'], $acl['jack@kolab.org']);
+        ksort($acl);
+        $this->assertSame($expectedAcl, $acl);
 
         // Update shared folder (acl)
         $folder->setSetting('acl', json_encode(['jack@kolab.org, read-only']));
 
         $this->assertTrue(IMAP::updateSharedFolder($folder));
 
-        $expectedAcl = ['jack@kolab.org' => str_split('lrs')];
+        $expectedAcl = [
+            'anyone' => ['p'],
+            'jack@kolab.org' => str_split('lrs'),
+        ];
 
         $acl = $imap->getACL(IMAP::toUTF7($imapFolder));
-        $this->assertTrue(is_array($acl) && isset($acl['jack@kolab.org']));
-        $this->assertSame($expectedAcl['jack@kolab.org'], $acl['jack@kolab.org']);
-        $this->assertTrue(!isset($acl['john@kolab.org']));
+        ksort($acl);
+        $this->assertSame($expectedAcl, $acl);
 
         // Update the shared folder (rename)
         $folder->name = 'SharedFolder1 ©' . time();
         $folder->save();
         $newImapFolder = $folder->getSetting('folder');
 
         $this->assertTrue(IMAP::updateSharedFolder($folder, ['folder' => $imapFolder]));
         $this->assertTrue($imapFolder != $newImapFolder);
         $this->assertTrue(IMAP::verifySharedFolder($newImapFolder));
 
         $acl = $imap->getACL(IMAP::toUTF7($newImapFolder));
-        $this->assertTrue(is_array($acl) && isset($acl['jack@kolab.org']));
-        $this->assertSame($expectedAcl['jack@kolab.org'], $acl['jack@kolab.org']);
+        ksort($acl);
+        $this->assertSame($expectedAcl, $acl);
 
         // Delete the shared folder
         $this->assertTrue(IMAP::deleteSharedFolder($folder));
         $this->assertFalse(IMAP::verifySharedFolder($newImapFolder));
     }
 
     /**
      * Test verifying IMAP account existence (existing account)
      *
      * @group imap
      */
     public function testVerifyAccountExisting(): void
     {
         // existing user
         $result = IMAP::verifyAccount('john@kolab.org');
         $this->assertTrue($result);
 
         // non-existing user
         $result = IMAP::verifyAccount('non-existing@domain.tld');
         $this->assertFalse($result);
     }
 
     /**
      * Test verifying IMAP shared folder existence
      *
      * @group imap
      */
     public function testVerifySharedFolder(): void
     {
         // non-existing
         $result = IMAP::verifySharedFolder('shared/Resources/UnknownResource@kolab.org');
         $this->assertFalse($result);
 
         // existing
         $result = IMAP::verifySharedFolder('shared/Calendar@kolab.org');
         $this->assertTrue($result);
     }
 
     /**
      * Get configured/initialized rcube_imap_generic instance
      */
     private function getImap()
     {
         if ($this->imap) {
             return $this->imap;
         }
 
         $class = new \ReflectionClass(IMAP::class);
         $init = $class->getMethod('initIMAP');
         $config = $class->getMethod('getConfig');
         $init->setAccessible(true);
         $config->setAccessible(true);
 
         $config = $config->invoke(null);
 
         return $this->imap = $init->invokeArgs(null, [$config]);
     }
 }
diff --git a/src/tests/Feature/Backends/LDAPTest.php b/src/tests/Feature/Backends/LDAPTest.php
index a577ca1d..affaf90c 100644
--- a/src/tests/Feature/Backends/LDAPTest.php
+++ b/src/tests/Feature/Backends/LDAPTest.php
@@ -1,672 +1,672 @@
 <?php
 
 namespace Tests\Feature\Backends;
 
 use App\Backends\LDAP;
 use App\Domain;
 use App\Group;
 use App\Entitlement;
 use App\Resource;
 use App\SharedFolder;
 use App\User;
 use Illuminate\Support\Facades\Queue;
 use Tests\TestCase;
 
 class LDAPTest extends TestCase
 {
     private $ldap_config = [];
 
     /**
      * {@inheritDoc}
      */
     public function setUp(): void
     {
         parent::setUp();
 
         $this->ldap_config = [
             'ldap.hosts' => \config('ldap.hosts'),
         ];
 
         $this->deleteTestUser('user-ldap-test@' . \config('app.domain'));
         $this->deleteTestDomain('testldap.com');
         $this->deleteTestGroup('group@kolab.org');
         $this->deleteTestResource('test-resource@kolab.org');
         $this->deleteTestSharedFolder('test-folder@kolab.org');
         // TODO: Remove group members
     }
 
     /**
      * {@inheritDoc}
      */
     public function tearDown(): void
     {
         \config($this->ldap_config);
 
         $this->deleteTestUser('user-ldap-test@' . \config('app.domain'));
         $this->deleteTestDomain('testldap.com');
         $this->deleteTestGroup('group@kolab.org');
         $this->deleteTestResource('test-resource@kolab.org');
         $this->deleteTestSharedFolder('test-folder@kolab.org');
         // TODO: Remove group members
 
         parent::tearDown();
     }
 
     /**
      * Test handling connection errors
      *
      * @group ldap
      */
     public function testConnectException(): void
     {
         \config(['ldap.hosts' => 'non-existing.host']);
 
         $this->expectException(\Exception::class);
 
         LDAP::connect();
     }
 
     /**
      * Test creating/updating/deleting a domain record
      *
      * @group ldap
      */
     public function testDomain(): void
     {
         Queue::fake();
 
         $domain = $this->getTestDomain('testldap.com', [
                 'type' => Domain::TYPE_EXTERNAL,
                 'status' => Domain::STATUS_NEW | Domain::STATUS_ACTIVE,
         ]);
 
         // Create the domain
         LDAP::createDomain($domain);
 
         $ldap_domain = LDAP::getDomain($domain->namespace);
 
         $expected = [
             'associateddomain' => $domain->namespace,
             'inetdomainstatus' => $domain->status,
             'objectclass' => [
                 'top',
                 'domainrelatedobject',
                 'inetdomain'
             ],
         ];
 
         foreach ($expected as $attr => $value) {
             $this->assertEquals($value, isset($ldap_domain[$attr]) ? $ldap_domain[$attr] : null);
         }
 
         // TODO: Test other attributes, aci, roles/ous
 
         // Update the domain
         $domain->status |= User::STATUS_LDAP_READY;
 
         LDAP::updateDomain($domain);
 
         $expected['inetdomainstatus'] = $domain->status;
 
         $ldap_domain = LDAP::getDomain($domain->namespace);
 
         foreach ($expected as $attr => $value) {
             $this->assertEquals($value, isset($ldap_domain[$attr]) ? $ldap_domain[$attr] : null);
         }
 
         // Delete the domain
         LDAP::deleteDomain($domain);
 
         $this->assertSame(null, LDAP::getDomain($domain->namespace));
     }
 
     /**
      * Test creating/updating/deleting a group record
      *
      * @group ldap
      */
     public function testGroup(): void
     {
         Queue::fake();
 
         $root_dn = \config('ldap.hosted.root_dn');
         $group = $this->getTestGroup('group@kolab.org', [
                 'members' => ['member1@testldap.com', 'member2@testldap.com']
         ]);
         $group->setSetting('sender_policy', '["test.com"]');
 
         // Create the group
         LDAP::createGroup($group);
 
         $ldap_group = LDAP::getGroup($group->email);
 
         $expected = [
             'cn' => 'group',
             'dn' => 'cn=group,ou=Groups,ou=kolab.org,' . $root_dn,
             'mail' => $group->email,
             'objectclass' => [
                 'top',
                 'groupofuniquenames',
                 'kolabgroupofuniquenames'
             ],
             'kolaballowsmtpsender' => 'test.com',
             'uniquemember' => [
                 'uid=member1@testldap.com,ou=People,ou=kolab.org,' . $root_dn,
                 'uid=member2@testldap.com,ou=People,ou=kolab.org,' . $root_dn,
             ],
         ];
 
         foreach ($expected as $attr => $value) {
             $this->assertEquals($value, isset($ldap_group[$attr]) ? $ldap_group[$attr] : null, "Group $attr attribute");
         }
 
         // Update members
         $group->members = ['member3@testldap.com'];
         $group->save();
         $group->setSetting('sender_policy', '["test.com","Test.com","-"]');
 
         LDAP::updateGroup($group);
 
         // TODO: Should we force this to be always an array?
         $expected['uniquemember'] = 'uid=member3@testldap.com,ou=People,ou=kolab.org,' . $root_dn;
         $expected['kolaballowsmtpsender'] = ['test.com', '-']; // duplicates removed
 
         $ldap_group = LDAP::getGroup($group->email);
 
         foreach ($expected as $attr => $value) {
             $this->assertEquals($value, isset($ldap_group[$attr]) ? $ldap_group[$attr] : null, "Group $attr attribute");
         }
 
         $this->assertSame(['member3@testldap.com'], $group->fresh()->members);
 
         // Update members (add non-existing local member, expect it to be aot-removed from the group)
         // Update group name and sender_policy
         $group->members = ['member3@testldap.com', 'member-local@kolab.org'];
         $group->name = 'Te(=ść)1';
         $group->save();
         $group->setSetting('sender_policy', null);
 
         LDAP::updateGroup($group);
 
         // TODO: Should we force this to be always an array?
         $expected['uniquemember'] = 'uid=member3@testldap.com,ou=People,ou=kolab.org,' . $root_dn;
         $expected['kolaballowsmtpsender'] = null;
         $expected['dn'] = 'cn=Te(\\3dść)1,ou=Groups,ou=kolab.org,' . $root_dn;
         $expected['cn'] = 'Te(=ść)1';
 
         $ldap_group = LDAP::getGroup($group->email);
 
         foreach ($expected as $attr => $value) {
             $this->assertEquals($value, isset($ldap_group[$attr]) ? $ldap_group[$attr] : null, "Group $attr attribute");
         }
 
         $this->assertSame(['member3@testldap.com'], $group->fresh()->members);
 
         // We called save() twice, and setSettings() three times,
         // this is making sure that there's no job executed by the LDAP backend
         Queue::assertPushed(\App\Jobs\Group\UpdateJob::class, 5);
 
         // Delete the group
         LDAP::deleteGroup($group);
 
         $this->assertSame(null, LDAP::getGroup($group->email));
     }
 
     /**
      * Test creating/updating/deleting a resource record
      *
      * @group ldap
      */
     public function testResource(): void
     {
         Queue::fake();
 
         $root_dn = \config('ldap.hosted.root_dn');
         $resource = $this->getTestResource('test-resource@kolab.org', ['name' => 'Test1']);
         $resource->setSetting('invitation_policy', null);
 
         // Make sure the resource does not exist
         // LDAP::deleteResource($resource);
 
         // Create the resource
         LDAP::createResource($resource);
 
         $ldap_resource = LDAP::getResource($resource->email);
 
         $expected = [
             'cn' => 'Test1',
             'dn' => 'cn=Test1,ou=Resources,ou=kolab.org,' . $root_dn,
             'mail' => $resource->email,
             'objectclass' => [
                 'top',
                 'kolabresource',
                 'kolabsharedfolder',
                 'mailrecipient',
             ],
             'kolabfoldertype' => 'event',
             'kolabtargetfolder' => 'shared/Resources/Test1@kolab.org',
             'kolabinvitationpolicy' => null,
             'owner' => null,
-            'acl' => null,
+            'acl' => 'anyone, p',
         ];
 
         foreach ($expected as $attr => $value) {
             $ldap_value = isset($ldap_resource[$attr]) ? $ldap_resource[$attr] : null;
             $this->assertEquals($value, $ldap_value, "Resource $attr attribute");
         }
 
         // Update resource name and invitation_policy
         $resource->name = 'Te(=ść)1';
         $resource->save();
         $resource->setSetting('invitation_policy', 'manual:john@kolab.org');
 
         LDAP::updateResource($resource);
 
         $expected['kolabtargetfolder'] = 'shared/Resources/Te(=ść)1@kolab.org';
         $expected['kolabinvitationpolicy'] = 'ACT_MANUAL';
         $expected['owner'] = 'uid=john@kolab.org,ou=People,ou=kolab.org,' . $root_dn;
         $expected['dn'] = 'cn=Te(\\3dść)1,ou=Resources,ou=kolab.org,' . $root_dn;
         $expected['cn'] = 'Te(=ść)1';
-        $expected['acl'] = 'john@kolab.org, full';
+        $expected['acl'] = ['john@kolab.org, full', 'anyone, p'];
 
         $ldap_resource = LDAP::getResource($resource->email);
 
         foreach ($expected as $attr => $value) {
             $ldap_value = isset($ldap_resource[$attr]) ? $ldap_resource[$attr] : null;
             $this->assertEquals($value, $ldap_value, "Resource $attr attribute");
         }
 
         // Remove the invitation policy
         $resource->setSetting('invitation_policy', '[]');
 
         LDAP::updateResource($resource);
 
-        $expected['acl'] = null;
+        $expected['acl'] = 'anyone, p';
         $expected['kolabinvitationpolicy'] = null;
         $expected['owner'] = null;
 
         $ldap_resource = LDAP::getResource($resource->email);
 
         foreach ($expected as $attr => $value) {
             $ldap_value = isset($ldap_resource[$attr]) ? $ldap_resource[$attr] : null;
             $this->assertEquals($value, $ldap_value, "Resource $attr attribute");
         }
 
         // Delete the resource
         LDAP::deleteResource($resource);
 
         $this->assertSame(null, LDAP::getResource($resource->email));
     }
 
     /**
      * Test creating/updating/deleting a shared folder record
      *
      * @group ldap
      */
     public function testSharedFolder(): void
     {
         Queue::fake();
 
         $root_dn = \config('ldap.hosted.root_dn');
         $folder = $this->getTestSharedFolder('test-folder@kolab.org', ['type' => 'event']);
         $folder->setSetting('acl', null);
 
         // Make sure the shared folder does not exist
         // LDAP::deleteSharedFolder($folder);
 
         // Create the shared folder
         LDAP::createSharedFolder($folder);
 
         $ldap_folder = LDAP::getSharedFolder($folder->email);
 
         $expected = [
             'cn' => 'test-folder',
             'dn' => 'cn=test-folder,ou=Shared Folders,ou=kolab.org,' . $root_dn,
             'mail' => $folder->email,
             'objectclass' => [
                 'top',
                 'kolabsharedfolder',
                 'mailrecipient',
             ],
             'kolabfoldertype' => 'event',
             'kolabtargetfolder' => 'shared/test-folder@kolab.org',
-            'acl' => null,
+            'acl' => 'anyone, p',
             'alias' => null,
         ];
 
         foreach ($expected as $attr => $value) {
             $ldap_value = isset($ldap_folder[$attr]) ? $ldap_folder[$attr] : null;
             $this->assertEquals($value, $ldap_value, "Shared folder $attr attribute");
         }
 
         // Update folder name and acl
         $folder->name = 'Te(=ść)1';
         $folder->save();
         $folder->setSetting('acl', '["john@kolab.org, read-write","anyone, read-only"]');
         $aliases = ['t1-' . $folder->email, 't2-' . $folder->email];
         $folder->setAliases($aliases);
 
         LDAP::updateSharedFolder($folder);
 
         $expected['kolabtargetfolder'] = 'shared/Te(=ść)1@kolab.org';
-        $expected['acl'] = ['john@kolab.org, read-write', 'anyone, read-only'];
+        $expected['acl'] = ['john@kolab.org, read-write', 'anyone, lrsp'];
         $expected['dn'] = 'cn=Te(\\3dść)1,ou=Shared Folders,ou=kolab.org,' . $root_dn;
         $expected['cn'] = 'Te(=ść)1';
         $expected['alias'] = $aliases;
 
         $ldap_folder = LDAP::getSharedFolder($folder->email);
 
         foreach ($expected as $attr => $value) {
             $ldap_value = isset($ldap_folder[$attr]) ? $ldap_folder[$attr] : null;
             $this->assertEquals($value, $ldap_value, "Shared folder $attr attribute");
         }
 
         // Delete the resource
         LDAP::deleteSharedFolder($folder);
 
         $this->assertSame(null, LDAP::getSharedFolder($folder->email));
     }
 
     /**
      * Test creating/editing/deleting a user record
      *
      * @group ldap
      */
     public function testUser(): void
     {
         Queue::fake();
 
         $user = $this->getTestUser('user-ldap-test@' . \config('app.domain'));
 
         LDAP::createUser($user);
 
         $ldap_user = LDAP::getUser($user->email);
 
         $expected = [
             'objectclass' => [
                 'top',
                 'inetorgperson',
                 'inetuser',
                 'kolabinetorgperson',
                 'mailrecipient',
                 'person',
                 'organizationalPerson',
             ],
             'mail' => $user->email,
             'uid' => $user->email,
             'nsroledn' => [
                 'cn=imap-user,' . \config('ldap.hosted.root_dn')
             ],
             'cn' => 'unknown',
             'displayname' => '',
             'givenname' => '',
             'sn' => 'unknown',
             'inetuserstatus' => $user->status,
             'mailquota' => null,
             'o' => '',
             'alias' => null,
         ];
 
         foreach ($expected as $attr => $value) {
             $this->assertEquals($value, isset($ldap_user[$attr]) ? $ldap_user[$attr] : null);
         }
 
         // Add aliases, and change some user settings, and entitlements
         $user->setSettings([
             'first_name' => 'Firstname',
             'last_name' => 'Lastname',
             'organization' => 'Org',
             'country' => 'PL',
         ]);
         $user->status |= User::STATUS_IMAP_READY;
         $user->save();
         $aliases = ['t1-' . $user->email, 't2-' . $user->email];
         $user->setAliases($aliases);
         $package_kolab = \App\Package::withEnvTenantContext()->where('title', 'kolab')->first();
         $user->assignPackage($package_kolab);
 
         LDAP::updateUser($user->fresh());
 
         $expected['alias'] = $aliases;
         $expected['o'] = 'Org';
         $expected['displayname'] = 'Lastname, Firstname';
         $expected['givenname'] = 'Firstname';
         $expected['cn'] = 'Firstname Lastname';
         $expected['sn'] = 'Lastname';
         $expected['inetuserstatus'] = $user->status;
         $expected['mailquota'] = 5242880;
         $expected['nsroledn'] = null;
 
         $ldap_user = LDAP::getUser($user->email);
 
         foreach ($expected as $attr => $value) {
             $this->assertEquals($value, isset($ldap_user[$attr]) ? $ldap_user[$attr] : null);
         }
 
         // Update entitlements
         $sku_activesync = \App\Sku::withEnvTenantContext()->where('title', 'activesync')->first();
         $sku_groupware = \App\Sku::withEnvTenantContext()->where('title', 'groupware')->first();
         $user->assignSku($sku_activesync, 1);
         Entitlement::where(['sku_id' => $sku_groupware->id, 'entitleable_id' => $user->id])->delete();
 
         LDAP::updateUser($user->fresh());
 
         $expected_roles = [
             'activesync-user',
             'imap-user'
         ];
 
         $ldap_user = LDAP::getUser($user->email);
 
         $this->assertCount(2, $ldap_user['nsroledn']);
 
         $ldap_roles = array_map(
             function ($role) {
                 if (preg_match('/^cn=([a-z0-9-]+)/', $role, $m)) {
                     return $m[1];
                 } else {
                     return $role;
                 }
             },
             $ldap_user['nsroledn']
         );
 
         $this->assertSame($expected_roles, $ldap_roles);
 
         // Test degraded user
 
         $sku_storage = \App\Sku::withEnvTenantContext()->where('title', 'storage')->first();
         $sku_2fa = \App\Sku::withEnvTenantContext()->where('title', '2fa')->first();
         $user->status |= User::STATUS_DEGRADED;
         $user->update(['status' => $user->status]);
         $user->assignSku($sku_storage, 2);
         $user->assignSku($sku_2fa, 1);
 
         LDAP::updateUser($user->fresh());
 
         $expected['inetuserstatus'] = $user->status;
         $expected['mailquota'] = \config('app.storage.min_qty') * 1048576;
         $expected['nsroledn'] = [
             'cn=2fa-user,' . \config('ldap.hosted.root_dn'),
             'cn=degraded-user,' . \config('ldap.hosted.root_dn')
         ];
 
         $ldap_user = LDAP::getUser($user->email);
 
         foreach ($expected as $attr => $value) {
             $this->assertEquals($value, isset($ldap_user[$attr]) ? $ldap_user[$attr] : null);
         }
 
         // TODO: Test user who's owner is degraded
 
         // Delete the user
         LDAP::deleteUser($user);
 
         $this->assertSame(null, LDAP::getUser($user->email));
     }
 
     /**
      * Test handling errors on a resource creation
      *
      * @group ldap
      */
     public function testCreateResourceException(): void
     {
         $this->expectException(\Exception::class);
         $this->expectExceptionMessageMatches('/Failed to create resource/');
 
         $resource = new Resource([
                 'email' => 'test-non-existing-ldap@non-existing.org',
                 'name' => 'Test',
                 'status' => Resource::STATUS_ACTIVE,
         ]);
 
         LDAP::createResource($resource);
     }
 
     /**
      * Test handling errors on a group creation
      *
      * @group ldap
      */
     public function testCreateGroupException(): void
     {
         $this->expectException(\Exception::class);
         $this->expectExceptionMessageMatches('/Failed to create group/');
 
         $group = new Group([
                 'name' => 'test',
                 'email' => 'test@testldap.com',
                 'status' => Group::STATUS_NEW | Group::STATUS_ACTIVE,
         ]);
 
         LDAP::createGroup($group);
     }
 
     /**
      * Test handling errors on a shared folder creation
      *
      * @group ldap
      */
     public function testCreateSharedFolderException(): void
     {
         $this->expectException(\Exception::class);
         $this->expectExceptionMessageMatches('/Failed to create shared folder/');
 
         $folder = new SharedFolder([
                 'email' => 'test-non-existing-ldap@non-existing.org',
                 'name' => 'Test',
                 'status' => SharedFolder::STATUS_ACTIVE,
         ]);
 
         LDAP::createSharedFolder($folder);
     }
 
     /**
      * Test handling errors on user creation
      *
      * @group ldap
      */
     public function testCreateUserException(): void
     {
         $this->expectException(\Exception::class);
         $this->expectExceptionMessageMatches('/Failed to create user/');
 
         $user = new User([
                 'email' => 'test-non-existing-ldap@non-existing.org',
                 'status' => User::STATUS_ACTIVE,
         ]);
 
         LDAP::createUser($user);
     }
 
     /**
      * Test handling update of a non-existing domain
      *
      * @group ldap
      */
     public function testUpdateDomainException(): void
     {
         $this->expectException(\Exception::class);
         $this->expectExceptionMessageMatches('/domain not found/');
 
         $domain = new Domain([
                 'namespace' => 'testldap.com',
                 'type' => Domain::TYPE_EXTERNAL,
                 'status' => Domain::STATUS_NEW | Domain::STATUS_ACTIVE,
         ]);
 
         LDAP::updateDomain($domain);
     }
 
     /**
      * Test handling update of a non-existing group
      *
      * @group ldap
      */
     public function testUpdateGroupException(): void
     {
         $this->expectException(\Exception::class);
         $this->expectExceptionMessageMatches('/group not found/');
 
         $group = new Group([
                 'name' => 'test',
                 'email' => 'test@testldap.com',
                 'status' => Group::STATUS_NEW | Group::STATUS_ACTIVE,
         ]);
 
         LDAP::updateGroup($group);
     }
 
     /**
      * Test handling update of a non-existing resource
      *
      * @group ldap
      */
     public function testUpdateResourceException(): void
     {
         $this->expectException(\Exception::class);
         $this->expectExceptionMessageMatches('/resource not found/');
 
         $resource = new Resource([
                 'email' => 'test-resource@kolab.org',
         ]);
 
         LDAP::updateResource($resource);
     }
 
     /**
      * Test handling update of a non-existing shared folder
      *
      * @group ldap
      */
     public function testUpdateSharedFolderException(): void
     {
         $this->expectException(\Exception::class);
         $this->expectExceptionMessageMatches('/folder not found/');
 
         $folder = new SharedFolder([
                 'email' => 'test-folder-unknown@kolab.org',
         ]);
 
         LDAP::updateSharedFolder($folder);
     }
 
     /**
      * Test handling update of a non-existing user
      *
      * @group ldap
      */
     public function testUpdateUserException(): void
     {
         $this->expectException(\Exception::class);
         $this->expectExceptionMessageMatches('/user not found/');
 
         $user = new User([
                 'email' => 'test-non-existing-ldap@kolab.org',
                 'status' => User::STATUS_ACTIVE,
         ]);
 
         LDAP::updateUser($user);
     }
 }
diff --git a/src/tests/Unit/UtilsTest.php b/src/tests/Unit/UtilsTest.php
index bb164c01..c8adf3b1 100644
--- a/src/tests/Unit/UtilsTest.php
+++ b/src/tests/Unit/UtilsTest.php
@@ -1,216 +1,234 @@
 <?php
 
 namespace Tests\Unit;
 
 use App\Utils;
 use Tests\TestCase;
 
 class UtilsTest extends TestCase
 {
     /**
      * Test for Utils::countryForIP()
      */
     public function testCountryForIP(): void
     {
         // Create some network records, the tables might be empty
         \App\IP4Net::where('net_number', inet_pton('127.0.0.0'))->delete();
         \App\IP6Net::where('net_number', inet_pton('2001:db8::ff00:42:0'))->delete();
 
         $this->assertSame('', Utils::countryForIP('127.0.0.1', ''));
         $this->assertSame('CH', Utils::countryForIP('127.0.0.1'));
         $this->assertSame('', Utils::countryForIP('2001:db8::ff00:42:1', ''));
         $this->assertSame('CH', Utils::countryForIP('2001:db8::ff00:42:1'));
 
         \App\IP4Net::create([
                 'net_number' => '127.0.0.0',
                 'net_broadcast' => '127.255.255.255',
                 'net_mask' => 8,
                 'country' => 'US',
                 'rir_name' => 'test',
                 'serial' => 1,
         ]);
 
         \App\IP6Net::create([
                 'net_number' => '2001:db8::ff00:42:0',
                 'net_broadcast' => \App\Utils::ip6Broadcast('2001:db8::ff00:42:0', 8),
                 'net_mask' => 8,
                 'country' => 'PL',
                 'rir_name' => 'test',
                 'serial' => 1,
         ]);
 
         $this->assertSame('US', Utils::countryForIP('127.0.0.1', ''));
         $this->assertSame('US', Utils::countryForIP('127.0.0.1'));
         $this->assertSame('PL', Utils::countryForIP('2001:db8::ff00:42:1', ''));
         $this->assertSame('PL', Utils::countryForIP('2001:db8::ff00:42:1'));
 
         \App\IP4Net::where('net_number', inet_pton('127.0.0.0'))->delete();
         \App\IP6Net::where('net_number', inet_pton('2001:db8::ff00:42:0'))->delete();
     }
 
     /**
      * Test for Utils::emailToLower()
      */
     public function testEmailToLower(): void
     {
         $this->assertSame('test@test.tld', Utils::emailToLower('test@Test.Tld'));
         $this->assertSame('test@test.tld', Utils::emailToLower('Test@Test.Tld'));
         $this->assertSame('shared+shared/Test@test.tld', Utils::emailToLower('shared+shared/Test@Test.Tld'));
     }
 
+    /**
+     * Test for Utils::ensureAclPostPermission()
+     */
+    public function testEnsureAclPostPermission(): void
+    {
+        $acl = [];
+        $this->assertSame(['anyone, p'], Utils::ensureAclPostPermission($acl));
+
+        $acl = ['anyone, full'];
+        $this->assertSame(['anyone, full'], Utils::ensureAclPostPermission($acl));
+
+        $acl = ['anyone, read-only'];
+        $this->assertSame(['anyone, lrsp'], Utils::ensureAclPostPermission($acl));
+
+        $acl = ['anyone, read-write'];
+        $this->assertSame(['anyone, lrswitednp'], Utils::ensureAclPostPermission($acl));
+    }
+
     /**
      * Test for Utils::money()
      */
     public function testMoney(): void
     {
         $this->assertSame('-0,01 CHF', Utils::money(-1, 'CHF'));
         $this->assertSame('0,00 CHF', Utils::money(0, 'CHF'));
         $this->assertSame('1,11 €', Utils::money(111, 'EUR'));
         $this->assertSame('1,00 CHF', Utils::money(100, 'CHF'));
         $this->assertSame('€0.00', Utils::money(0, 'EUR', 'en_US'));
     }
 
     /**
      * Test for Utils::percent()
      */
     public function testPercent(): void
     {
         $this->assertSame('0 %', Utils::percent(0));
         $this->assertSame('10 %', Utils::percent(10.0));
         $this->assertSame('10,12 %', Utils::percent(10.12));
     }
 
     /**
      * Test for Utils::normalizeAddress()
      */
     public function testNormalizeAddress(): void
     {
         $this->assertSame('', Utils::normalizeAddress(''));
         $this->assertSame('', Utils::normalizeAddress(null));
         $this->assertSame('test', Utils::normalizeAddress('TEST'));
         $this->assertSame('test@domain.tld', Utils::normalizeAddress('Test@Domain.TLD'));
         $this->assertSame('test@domain.tld', Utils::normalizeAddress('Test+Trash@Domain.TLD'));
 
         $this->assertSame(['', ''], Utils::normalizeAddress('', true));
         $this->assertSame(['', ''], Utils::normalizeAddress(null, true));
         $this->assertSame(['test', ''], Utils::normalizeAddress('TEST', true));
         $this->assertSame(['test', 'domain.tld'], Utils::normalizeAddress('Test@Domain.TLD', true));
         $this->assertSame(['test', 'domain.tld'], Utils::normalizeAddress('Test+Trash@Domain.TLD', true));
     }
 
     /**
      * Test for Tests\Utils::powerSet()
      */
     public function testPowerSet(): void
     {
         $set = [];
 
         $result = \Tests\Utils::powerSet($set);
 
         $this->assertIsArray($result);
         $this->assertCount(0, $result);
 
         $set = ["a1"];
 
         $result = \Tests\Utils::powerSet($set);
 
         $this->assertIsArray($result);
         $this->assertCount(1, $result);
         $this->assertTrue(in_array(["a1"], $result));
 
         $set = ["a1", "a2"];
 
         $result = \Tests\Utils::powerSet($set);
 
         $this->assertIsArray($result);
         $this->assertCount(3, $result);
         $this->assertTrue(in_array(["a1"], $result));
         $this->assertTrue(in_array(["a2"], $result));
         $this->assertTrue(in_array(["a1", "a2"], $result));
 
         $set = ["a1", "a2", "a3"];
 
         $result = \Tests\Utils::powerSet($set);
 
         $this->assertIsArray($result);
         $this->assertCount(7, $result);
         $this->assertTrue(in_array(["a1"], $result));
         $this->assertTrue(in_array(["a2"], $result));
         $this->assertTrue(in_array(["a3"], $result));
         $this->assertTrue(in_array(["a1", "a2"], $result));
         $this->assertTrue(in_array(["a1", "a3"], $result));
         $this->assertTrue(in_array(["a2", "a3"], $result));
         $this->assertTrue(in_array(["a1", "a2", "a3"], $result));
     }
 
     /**
      * Test for Utils::serviceUrl()
      */
     public function testServiceUrl(): void
     {
         $public_href = 'https://public.url/cockpit';
         $local_href = 'https://local.url/cockpit';
 
         \config([
             'app.url' => $local_href,
             'app.public_url' => '',
         ]);
 
         $this->assertSame($local_href, Utils::serviceUrl(''));
         $this->assertSame($local_href . '/unknown', Utils::serviceUrl('unknown'));
         $this->assertSame($local_href . '/unknown', Utils::serviceUrl('/unknown'));
 
         \config([
             'app.url' => $local_href,
             'app.public_url' => $public_href,
         ]);
 
         $this->assertSame($public_href, Utils::serviceUrl(''));
         $this->assertSame($public_href . '/unknown', Utils::serviceUrl('unknown'));
         $this->assertSame($public_href . '/unknown', Utils::serviceUrl('/unknown'));
     }
 
     /**
      * Test for Utils::uuidInt()
      */
     public function testUuidInt(): void
     {
         $result = Utils::uuidInt();
 
         $this->assertTrue(is_int($result));
         $this->assertTrue($result > 0);
     }
 
     /**
      * Test for Utils::uuidStr()
      */
     public function testUuidStr(): void
     {
         $result = Utils::uuidStr();
 
         $this->assertTrue(is_string($result));
         $this->assertTrue(strlen($result) === 36);
         $this->assertTrue(preg_match('/[^a-f0-9-]/i', $result) === 0);
     }
 
     /**
      * Test for Utils::exchangeRate()
      */
     public function testExchangeRate(): void
     {
         $this->assertSame(1.0, Utils::exchangeRate("DUMMY", "dummy"));
 
         // Exchange rates are volatile, can't test with high accuracy.
 
         $this->assertTrue(Utils::exchangeRate("CHF", "EUR") >= 0.88);
         //$this->assertEqualsWithDelta(0.90503424978382, Utils::exchangeRate("CHF", "EUR"), PHP_FLOAT_EPSILON);
 
         $this->assertTrue(Utils::exchangeRate("EUR", "CHF") <= 1.12);
         //$this->assertEqualsWithDelta(1.1049305595217682, Utils::exchangeRate("EUR", "CHF"), PHP_FLOAT_EPSILON);
 
         $this->expectException(\Exception::class);
         $this->assertSame(1.0, Utils::exchangeRate("CHF", "FOO"));
         $this->expectException(\Exception::class);
         $this->assertSame(1.0, Utils::exchangeRate("FOO", "CHF"));
     }
 }