On PHP >= 7.3 we're not using the cli tool at all now. So, this shouldn't be a problem with recent installations.

it could be useful too to allow to add Kolab Distribution Group in another group

LGTM.

Fixed.

Hi Daniel, Good catch. The 3rd option looks good to me. parse_input_attributes() should probably accept base_dn input for all kind of objects, not only 'ou' (except domain objects). https://git.kolab.org/diffusion/WAP/browse/master/lib/kolab_api_service.php$419

We're taking about this call:
https://git.kolab.org/diffusion/WAP/browse/master/lib/api/kolab_api_service_domain.php$413-418

Folders should generally not have a trailing space, so this should be fixed at the input / form level.

"is not equal to" implemented in e55bc13e33af3 [kolab-webadmin master].

Right, the complete fix might be very complicated because:

• we need different filters to list all roles, just non-managed roles or managed roles.

the alternative filters could be:
'(&(objectclass=ldapsubentry)(objectclass=nsComplexRoleDefinition))' - list all non-managed roles
'(&(objectclass=ldapsubentry)(objectclass=nsSimpleRoleDefinition))' - list all manged roles
'(&(objectclass=ldapsubentry)(objectclass=nsRoleDefinition))' - list all roles

• we need a separate code to implement user's roles listing (including editing managed roles). Currently, by default, Kolab User has a nsroledn attribute defined in WAP Settings. That implies that LDAP roles manaement follows logic of getting and changing regular multivalue LDAP attributes, but roles does not work like that. To set a role you need to add or remove nsroledn attribute, but checking role membership nsrole attribute should be used.

I guess, we could change the roles filter to fix the immediate issue, but if we want to display non-managed roles we'll need possibility to list both types of roles, i.e. the filter would depend on what we want to achieve at the moment.

Yes, I agree it's not a software bug, but I propose to add some documentation about delegation to
https://docs.kolab.org/administrator-guide/using-the-kolab-web-administration-panel.html#users-administration
[which is empty right now]. Something like:

you've to seperate 2 things

Try to add use_tls = true to the [ldap] section to fix the web admin.

That chunk of the config wasn't the culprit here. It's there to make sure resource names are unique - by automatically generating an unique name if already entered name exists.

I did a quick test again, and realized that I can login with a passwort "Test<1234" on Roundcube, but not on Kolab Webadmin. Therefore it must be possible to fix it in wap.

I tried it with a simple php script, and came to the conclusion that the _POST does not work with < character.

No further enhancements to the #HKCCP.

D24 has been updated after review from @machniak.

Reassigning for review of D27

D24 has been updated.