feat(LDAP): implement IIsAdmin interface

[blizzz]

• Resolves: Give admin rights to a specific LDAP group #6428

Summary

Promotes an LDAP group (per LDAP configuration) to an admin group.

A group can either be promoted via a dedicates occ call whres the group parameter can be a nextcloud group ID or a group name that will be search against – an exact match is required in that case.:

$ php occ ldap:promote-group  --help 2>/dev/null
Description:
  declares the specified group as admin group (only one is possible per LDAP configuration)

Usage:
  ldap:promote-group [options] [--] <group>

Arguments:
  group                 the group ID in Nextcloud or a group name

Options:
  -y, --yes             do not ask for confirmation
…

# Example
$ php occ ldap:promote-group  "Nextcloud Admins"
Promote Nextcloud Admins to the admin group (y|N)? y
Group Nextcloud Admins was promoted

$ php occ ldap:promote-group  "Paramount Court"
Promote Nextcloud Admins to the admin group and demote Nextcloud Admins (Group ID: nextcloud_admins) (y|N)? y
Group Paramount Court was promoted

$ php occ ldap:promote-group  "Paramount Court"
The specified group is already promoted

It is also possible to set the admin group mapping using occ ldap:set-config $configId ldapAdminGroup $groupId but as the Nextcloud group ID might not be known (yet) it is especially recommnded for automatized setups to use this command, that would also pull in the group and determine the group ID.

In order to demote or reset a promotion, an empty string should be set against to the targeted config's ldapAdminGroup:

# Reset an admin group mapping via set-config
occ ldap:set-config $configId ldapAdminGroup ""
# Example
occ ldap:set-config s01 ldapAdminGroup ""

Checklist

• Code is properly formatted
• Sign-off message is added to all commits
• Tests (unit, integration, api and/or acceptance) are included
• Screenshots before/after for front-end changes
• Documentation (manuals or wiki) has been updated or is not required
• Backports requested where applicable (ex: critical bugfixes)

[blizzz]

Apropos group deletion, this is something we could take into account as well and remove the promotion when a group disappears – although this is a bit atypical from what we usually do (like keeping users in place), but actually safer than keeping the entry. Questionable upon unassigned the group id (clearing the mappings), which should not be done in prod though (would keep it in that case).

An addition for later for we do not delete groups yet (i.e. there is not cleanup and nothing that dispatches the GroupDeletedEvent).

[blizzz]

Resetting by a group name or id could fail if the group is deleted, but we may try to guess by comparing stored config – not full proof. I tend to go with documenting how to do with with set-config instead (does not require another command).

Updated the description, that will go into documentation eventually.

[blizzz]

/backport to stable27

[blizzz]

addressed the php-cs test complaint.

[blizzz]

/backport to stable28