Repository: owncloud/ocis
Pull request #3668 (2022-05-04 08:17:25)

[full-ci] Fix searching shares
<!--
Thanks for submitting a change to ownCloud!

This is the bug tracker for the oCIS component. Find other components at https://github.com/owncloud/core/blob/master/.github/CONTRIBUTING.md#guidelines

For fixing potential security issues please see https://owncloud.org/security/

To make it possible for us to get your change reviewed and merged please carefully fill out the requested information below.

Please note that any kind of change needs first be submitted to the master branch which holds the next version of oCIS.

Please set the following labels:

- Set label "Status:Needs-Review" for review or "Status:In-Progress" if the PR still has open tasks.
- Assignment: assign to self
- Reviewers: pick at least one
-->

## Description

This PR fixes searching files in shares.

## Types of changes
<!--- What types of changes does your code introduce? Put an `x` in all the boxes that apply: -->
- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing functionality to change)
- [ ] Technical debt
- [ ] Tests only (no source changes)

## Checklist:
<!-- Tick the checkboxes when done. -->
<!-- Raise documentation ticket in owncloud.github.io/ -->
- [x] Code changes
- [x] Unit tests added
- [ ] Acceptance tests added
- [ ] Documentation ticket raised: <link> 


update-docs[bot]: Thanks for opening this pull request! The maintainers of this repository would appreciate it if you would create a [changelog](https://github.com/owncloud/ocis/blob/master/changelog/README.md) item based on your changes.

sonarcloud[bot]: Kudos, SonarCloud Quality Gate passed!&nbsp; &nbsp; [![Quality Gate passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/passed-16px.png 'Quality Gate passed')](https://sonarcloud.io/dashboard?id=owncloud_ocis&pullRequest=3668)

[![Bug](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/bug-16px.png 'Bug')](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=3668&resolved=false&types=BUG) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=3668&resolved=false&types=BUG) [0 Bugs](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=3668&resolved=false&types=BUG)  
[![Vulnerability](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/vulnerability-16px.png 'Vulnerability')](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=3668&resolved=false&types=VULNERABILITY) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=3668&resolved=false&types=VULNERABILITY) [0 Vulnerabilities](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=3668&resolved=false&types=VULNERABILITY)  
[![Security Hotspot](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/security_hotspot-16px.png 'Security Hotspot')](https://sonarcloud.io/project/security_hotspots?id=owncloud_ocis&pullRequest=3668&resolved=false&types=SECURITY_HOTSPOT) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/security_hotspots?id=owncloud_ocis&pullRequest=3668&resolved=false&types=SECURITY_HOTSPOT) [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=owncloud_ocis&pullRequest=3668&resolved=false&types=SECURITY_HOTSPOT)  
[![Code Smell](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/code_smell-16px.png 'Code Smell')](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=3668&resolved=false&types=CODE_SMELL) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=3668&resolved=false&types=CODE_SMELL) [4 Code Smells](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=3668&resolved=false&types=CODE_SMELL)

[![0.0%](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/CoverageChart/0-16px.png '0.0%')](https://sonarcloud.io/component_measures?id=owncloud_ocis&pullRequest=3668&metric=new_coverage&view=list) [0.0% Coverage](https://sonarcloud.io/component_measures?id=owncloud_ocis&pullRequest=3668&metric=new_coverage&view=list)  
[![0.0%](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/Duplications/3-16px.png '0.0%')](https://sonarcloud.io/component_measures?id=owncloud_ocis&pullRequest=3668&metric=new_duplicated_lines_density&view=list) [0.0% Duplication](https://sonarcloud.io/component_measures?id=owncloud_ocis&pullRequest=3668&metric=new_duplicated_lines_density&view=list)



Patch:
diff --git a/.drone.star b/.drone.star
index 5781862821e..13366709172 100644
--- a/.drone.star
+++ b/.drone.star
@@ -1660,7 +1660,7 @@ def ocisServer(storage, accounts_hash_difficulty = 4, volumes = [], depends_on =
             "name": "wait-for-ocis-server",
             "image": OC_CI_ALPINE,
             "commands": [
-                "curl -k -u admin:admin --fail --retry-connrefused --retry 10 --retry-all-errors 'https://ocis-server:9200/graph/v1.0/users/ddc2004c-0977-11eb-9d3f-a793888cd0f8'",
+                "curl -k -u admin:admin --fail --retry-connrefused --retry 10 --retry-all-errors 'https://ocis-server:9200/graph/v1.0/users/admin'",
             ],
             "depends_on": depends_on,
         }
diff --git a/.vscode/launch.json b/.vscode/launch.json
index ede7b3f5c49..4d181ce3a0b 100644
--- a/.vscode/launch.json
+++ b/.vscode/launch.json
@@ -15,14 +15,16 @@
                 "OCIS_LOG_LEVEL": "debug",
                 "OCIS_LOG_PRETTY": "true",
                 "OCIS_LOG_COLOR": "true",
-                // enable basic auth for dev setup so that we can use curl for testing
-                "PROXY_ENABLE_BASIC_AUTH": "true",
+                // user id of "admin", for user creation and admin role assignement
+                "OCIS_ADMIN_USER_ID": "admin-user-id",
                 // set insecure options because we don't have valid certificates in dev environments
                 "OCIS_INSECURE": "true",
                 // set some hardcoded secrets
                 "OCIS_JWT_SECRET": "some-ocis-jwt-secret",
-                "STORAGE_TRANSFER_SECRET": "some-ocis-transfer-secret",
                 "OCIS_MACHINE_AUTH_API_KEY": "some-ocis-machine-auth-api-key",
+                "STORAGE_TRANSFER_SECRET": "some-ocis-transfer-secret",
+                // enable basic auth for dev setup so that we can use curl for testing
+                "PROXY_ENABLE_BASIC_AUTH": "true",
                 // idm ldap
                 "IDM_SVC_PASSWORD": "some-ldap-idm-password",
                 "GRAPH_LDAP_BIND_PASSWORD": "some-ldap-idm-password",
diff --git a/CHANGELOG.md b/CHANGELOG.md
index ba9a9714577..cb8ecab443c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -74,13 +74,15 @@ The following sections list the changes for unreleased.
 
 * Change - Introduce `ocis init` and remove all default secrets: [#3551](https://github.com/owncloud/ocis/pull/3551)
 
-   We've removed all default secrets. This means you can't start oCIS any longer without setting
-   these via environment variable or configuration file.
+   We've removed all default secrets and the hardcoded UUID of the user `admin`. This means you
+   can't start oCIS any longer without setting these via environment variable or configuration
+   file.
 
    In order to make this easy for you, we introduced a new command: `ocis init`. You can run this
    command before starting oCIS with `ocis server` and it will bootstrap you a configuration file
    for a secure oCIS instance.
 
+   https://github.com/owncloud/ocis/issues/3524
    https://github.com/owncloud/ocis/pull/3551
 
 * Change - Reduce drives in graph /me/drives API: [#3629](https://github.com/owncloud/ocis/pull/3629)
diff --git a/changelog/unreleased/change-ocis-init.md b/changelog/unreleased/change-ocis-init.md
index a4a81eb3854..9c029b1f623 100644
--- a/changelog/unreleased/change-ocis-init.md
+++ b/changelog/unreleased/change-ocis-init.md
@@ -1,10 +1,12 @@
 Change: Introduce `ocis init` and remove all default secrets
 
-We've removed all default secrets. This means you can't start oCIS any longer
-without setting these via environment variable or configuration file.
+We've removed all default secrets and the hardcoded UUID of the user `admin`.
+This means you can't start oCIS any longer without setting these via
+environment variable or configuration file.
 
 In order to make this easy for you, we introduced a new command: `ocis init`.
 You can run this command before starting oCIS with `ocis server` and it will
 bootstrap you a configuration file for a secure oCIS instance.
 
 https://github.com/owncloud/ocis/pull/3551
+https://github.com/owncloud/ocis/issues/3524
diff --git a/extensions/idm/ldif/base.ldif.tmpl b/extensions/idm/ldif/base.ldif.tmpl
index e29221c62f8..6e1b9c2059b 100644
--- a/extensions/idm/ldif/base.ldif.tmpl
+++ b/extensions/idm/ldif/base.ldif.tmpl
@@ -29,7 +29,7 @@ cn: admin
 displayName: Admin
 description: An admin for this oCIS instance.
 mail: admin@example.org
-ownCloudUUID: ddc2004c-0977-11eb-9d3f-a793888cd0f8
+ownCloudUUID: {{ .ID }}
 {{ else -}}
 dn: uid={{ .Name }},ou=sysusers,o=libregraph-idm
 objectClass: account
diff --git a/extensions/idm/pkg/command/server.go b/extensions/idm/pkg/command/server.go
index 90f399dfa93..6286cd1f128 100644
--- a/extensions/idm/pkg/command/server.go
+++ b/extensions/idm/pkg/command/server.go
@@ -90,12 +90,14 @@ func bootstrap(logger log.Logger, cfg *config.Config, srvcfg server.Config) erro
 	type svcUser struct {
 		Name     string
 		Password string
+		ID       string
 	}
 
 	serviceUsers := []svcUser{
 		{
 			Name:     "admin",
 			Password: cfg.ServiceUserPasswords.OcisAdmin,
+			ID:       cfg.Commons.AdminUserID,
 		},
 		{
 			Name:     "libregraph",
diff --git a/extensions/idm/pkg/config/parser/parse.go b/extensions/idm/pkg/config/parser/parse.go
index 7d04c55ad4d..9fe4a856657 100644
--- a/extensions/idm/pkg/config/parser/parse.go
+++ b/extensions/idm/pkg/config/parser/parse.go
@@ -33,6 +33,10 @@ func ParseConfig(cfg *config.Config) error {
 }
 
 func Validate(cfg *config.Config) error {
+	if cfg.AdminUserID == "" {
+		return shared.MissingAdminUserID(cfg.Service.Name)
+	}
+
 	if cfg.ServiceUserPasswords.Idm == "" {
 		return shared.MissingServiceUserPassword(cfg.Service.Name, "IDM")
 	}
@@ -44,6 +48,7 @@ func Validate(cfg *config.Config) error {
 	if cfg.ServiceUserPasswords.Idp == "" {
 		return shared.MissingServiceUserPassword(cfg.Service.Name, "IDP")
 	}
+
 	if cfg.ServiceUserPasswords.Reva == "" {
 		return shared.MissingServiceUserPassword(cfg.Service.Name, "REVA")
 	}
diff --git a/extensions/proxy/pkg/config/config.go b/extensions/proxy/pkg/config/config.go
index f6264f413d6..032e81efa9b 100644
--- a/extensions/proxy/pkg/config/config.go
+++ b/extensions/proxy/pkg/config/config.go
@@ -53,7 +53,7 @@ type Route struct {
 	Backend string `yaml:"backend"`
 	// Service name to look up in the registry
 	Service     string `yaml:"service"`
-	ApacheVHost bool   `yaml:"apache-vhost"`
+	ApacheVHost bool   `yaml:"apache_vhost"`
 }
 
 // RouteType defines the type of a route
diff --git a/extensions/search/pkg/config/defaults/defaultconfig.go b/extensions/search/pkg/config/defaults/defaultconfig.go
index c3c40a7fea4..62aadc787f8 100644
--- a/extensions/search/pkg/config/defaults/defaultconfig.go
+++ b/extensions/search/pkg/config/defaults/defaultconfig.go
@@ -37,7 +37,7 @@ func DefaultConfig() *config.Config {
 			Cluster:       "ocis-cluster",
 			ConsumerGroup: "search",
 		},
-		MachineAuthAPIKey: "change-me-please",
+		MachineAuthAPIKey: "",
 	}
 }
 
diff --git a/extensions/search/pkg/search/index/index.go b/extensions/search/pkg/search/index/index.go
index 8cba7f7a6ca..6d828844277 100644
--- a/extensions/search/pkg/search/index/index.go
+++ b/extensions/search/pkg/search/index/index.go
@@ -207,7 +207,7 @@ func (i *Index) Search(ctx context.Context, req *searchsvc.SearchIndexRequest) (
 		bleve.NewQueryStringQuery("Name:"+req.Query),
 		deletedQuery, // Skip documents that have been marked as deleted
 		bleve.NewQueryStringQuery("RootID:"+req.Ref.ResourceId.StorageId+"!"+req.Ref.ResourceId.OpaqueId), // Limit search to the space
-		bleve.NewQueryStringQuery("Path:"+req.Ref.Path+"*"),                                               // Limit search to this directory in the space
+		bleve.NewQueryStringQuery("Path:"+utils.MakeRelativePath(path.Join(req.Ref.Path, "/"))+"*"),       // Limit search to this directory in the space
 	)
 	bleveReq := bleve.NewSearchRequest(query)
 	bleveReq.Size = 200
diff --git a/extensions/search/pkg/search/provider/events.go b/extensions/search/pkg/search/provider/events.go
new file mode 100644
index 00000000000..90606760706
--- /dev/null
+++ b/extensions/search/pkg/search/provider/events.go
@@ -0,0 +1,128 @@
+package provider
+
+import (
+	"context"
+
+	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
+	user "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1"
+	rpc "github.com/cs3org/go-cs3apis/cs3/rpc/v1beta1"
+	provider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
+	ctxpkg "github.com/cs3org/reva/v2/pkg/ctx"
+	"github.com/cs3org/reva/v2/pkg/events"
+	"google.golang.org/grpc/metadata"
+)
+
+func (p *Provider) handleEvent(ev interface{}) {
+	var ref *provider.Reference
+	var owner *user.User
+	switch e := ev.(type) {
+	case events.ItemTrashed:
+		p.logger.Debug().Interface("event", ev).Msg("marking document as deleted")
+		err := p.indexClient.Delete(e.ID)
+		if err != nil {
+			p.logger.Error().Err(err).Interface("Id", e.ID).Msg("failed to remove item from index")
+		}
+		return
+	case events.ItemRestored:
+		p.logger.Debug().Interface("event", ev).Msg("marking document as restored")
+		ref = e.Ref
+		owner = &user.User{
+			Id: e.Executant,
+		}
+
+		statRes, err := p.statResource(ref, owner)
+		if err != nil {
+			p.logger.Error().Err(err).Msg("failed to stat the changed resource")
+			return
+		}
+
+		switch statRes.Status.Code {
+		case rpc.Code_CODE_OK:
+			err = p.indexClient.Restore(statRes.Info.Id)
+			if err != nil {
+				p.logger.Error().Err(err).Msg("failed to restore the changed resource in the index")
+			}
+		default:
+			p.logger.Error().Interface("statRes", statRes).Msg("failed to stat the changed resource")
+		}
+
+		return
+	case events.ItemMoved:
+		p.logger.Debug().Interface("event", ev).Msg("resource has been moved, updating the document")
+		ref = e.Ref
+		owner = &user.User{
+			Id: e.Executant,
+		}
+
+		statRes, err := p.statResource(ref, owner)
+		if err != nil {
+			p.logger.Error().Err(err).Msg("failed to stat the changed resource")
+			return
+		}
+
+		switch statRes.Status.Code {
+		case rpc.Code_CODE_OK:
+			err = p.indexClient.Move(statRes.Info)
+			if err != nil {
+				p.logger.Error().Err(err).Msg("failed to restore the changed resource in the index")
+			}
+		default:
+			p.logger.Error().Interface("statRes", statRes).Msg("failed to stat the changed resource")
+		}
+
+		return
+	case events.ContainerCreated:
+		ref = e.Ref
+		owner = &user.User{
+			Id: e.Executant,
+		}
+	case events.FileUploaded:
+		ref = e.Ref
+		owner = &user.User{
+			Id: e.Executant,
+		}
+	case events.FileVersionRestored:
+		ref = e.Ref
+		owner = &user.User{
+			Id: e.Executant,
+		}
+	default:
+		// Not sure what to do here. Skip.
+		return
+	}
+	p.logger.Debug().Interface("event", ev).Msg("resource has been changed, updating the document")
+
+	statRes, err := p.statResource(ref, owner)
+	if err != nil {
+		p.logger.Error().Err(err).Msg("failed to stat the changed resource")
+		return
+	}
+	if statRes.Status.Code != rpc.Code_CODE_OK {
+		p.logger.Error().Interface("statRes", statRes).Msg("failed to stat the changed resource")
+		return
+	}
+
+	err = p.indexClient.Add(ref, statRes.Info)
+	if err != nil {
+		p.logger.Error().Err(err).Msg("error adding updating the resource in the index")
+	} else {
+		p.logDocCount()
+	}
+}
+
+func (p *Provider) statResource(ref *provider.Reference, owner *user.User) (*provider.StatResponse, error) {
+	// Get auth
+	ownerCtx := ctxpkg.ContextSetUser(context.Background(), owner)
+	authRes, err := p.gwClient.Authenticate(ownerCtx, &gateway.AuthenticateRequest{
+		Type:         "machine",
+		ClientId:     "userid:" + owner.Id.OpaqueId,
+		ClientSecret: p.machineAuthAPIKey,
+	})
+	if err != nil || authRes.GetStatus().GetCode() != rpc.Code_CODE_OK {
+		p.logger.Error().Err(err).Interface("authRes", authRes).Msg("error using machine auth")
+	}
+	ownerCtx = metadata.AppendToOutgoingContext(ownerCtx, ctxpkg.TokenHeader, authRes.Token)
+
+	// Stat changed resource resource
+	return p.gwClient.Stat(ownerCtx, &provider.StatRequest{Ref: ref})
+}
diff --git a/extensions/search/pkg/search/provider/searchprovider.go b/extensions/search/pkg/search/provider/searchprovider.go
index 3aa2f6cda1f..58865f4c0ad 100644
--- a/extensions/search/pkg/search/provider/searchprovider.go
+++ b/extensions/search/pkg/search/provider/searchprovider.go
@@ -5,17 +5,17 @@ import (
 	"fmt"
 	"path/filepath"
 	"strings"
+	"time"
 
 	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
 	user "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1"
 	rpc "github.com/cs3org/go-cs3apis/cs3/rpc/v1beta1"
 	rpcv1beta1 "github.com/cs3org/go-cs3apis/cs3/rpc/v1beta1"
 	provider "github.com/cs3org/go-cs3apis/cs3/storage/provider/v1beta1"
-	typesv1beta1 "github.com/cs3org/go-cs3apis/cs3/types/v1beta1"
 	ctxpkg "github.com/cs3org/reva/v2/pkg/ctx"
 	"github.com/cs3org/reva/v2/pkg/errtypes"
-	"github.com/cs3org/reva/v2/pkg/events"
 	"github.com/cs3org/reva/v2/pkg/storage/utils/walker"
+	"github.com/cs3org/reva/v2/pkg/storagespace"
 	"github.com/cs3org/reva/v2/pkg/utils"
 	"github.com/owncloud/ocis/extensions/search/pkg/search"
 	"github.com/owncloud/ocis/ocis-pkg/log"
@@ -43,138 +43,28 @@ func New(gwClient gateway.GatewayAPIClient, indexClient search.IndexClient, mach
 	go func() {
 		for {
 			ev := <-eventsChan
-			var ref *provider.Reference
-			var owner *user.User
-			switch e := ev.(type) {
-			case events.ItemTrashed:
-				err := p.indexClient.Delete(e.ID)
-				if err != nil {
-					p.logger.Error().Err(err).Interface("Id", e.ID).Msg("failed to remove item from index")
-				}
-				continue
-			case events.ItemRestored:
-				ref = e.Ref
-				owner = &user.User{
-					Id: e.Executant,
-				}
-
-				statRes, err := p.statResource(ref, owner)
-				if err != nil {
-					p.logger.Error().Err(err).Msg("failed to stat the changed resource")
-				}
-
-				switch statRes.Status.Code {
-				case rpc.Code_CODE_OK:
-					err = p.indexClient.Restore(statRes.Info.Id)
-					if err != nil {
-						p.logger.Error().Err(err).Msg("failed to restore the changed resource in the index")
-					}
-				default:
-					p.logger.Error().Interface("statRes", statRes).Msg("failed to stat the changed resource")
-				}
-
-				continue
-			case events.ItemMoved:
-				ref = e.Ref
-				owner = &user.User{
-					Id: e.Executant,
-				}
-
-				statRes, err := p.statResource(ref, owner)
-				if err != nil {
-					p.logger.Error().Err(err).Msg("failed to stat the changed resource")
-				}
-
-				switch statRes.Status.Code {
-				case rpc.Code_CODE_OK:
-					err = p.indexClient.Move(statRes.Info)
-					if err != nil {
-						p.logger.Error().Err(err).Msg("failed to restore the changed resource in the index")
-					}
-				default:
-					p.logger.Error().Interface("statRes", statRes).Msg("failed to stat the changed resource")
-				}
-
-				continue
-			case events.ContainerCreated:
-				ref = e.Ref
-				owner = &user.User{
-					Id: e.Executant,
-				}
-			case events.FileUploaded:
-				ref = e.Ref
-				owner = &user.User{
-					Id: e.Executant,
-				}
-			case events.FileVersionRestored:
-				ref = e.Ref
-				owner = &user.User{
-					Id: e.Executant,
-				}
-			default:
-				// Not sure what to do here. Skip.
-				continue
-			}
-
-			statRes, err := p.statResource(ref, owner)
-			if err != nil {
-				p.logger.Error().Err(err).Msg("failed to stat the changed resource")
-			}
-
-			switch statRes.Status.Code {
-			case rpc.Code_CODE_OK:
-				err = p.indexClient.Add(ref, statRes.Info)
-				if err != nil {
-					p.logger.Error().Err(err).Msg("error adding updating the resource in the index")
-				} else {
-					p.logDocCount()
-				}
-			default:
-				p.logger.Error().Interface("statRes", statRes).Msg("failed to stat the changed resource")
-			}
+			go func() {
+				time.Sleep(1 * time.Second) // Give some time to let everything settle down before trying to access it when indexing
+				p.handleEvent(ev)
+			}()
 		}
 	}()
 
 	return p
 }
 
-func (p *Provider) statResource(ref *provider.Reference, owner *user.User) (*provider.StatResponse, error) {
-	// Get auth
-	ownerCtx := ctxpkg.ContextSetUser(context.Background(), owner)
-	authRes, err := p.gwClient.Authenticate(ownerCtx, &gateway.AuthenticateRequest{
-		Type:         "machine",
-		ClientId:     "userid:" + owner.Id.OpaqueId,
-		ClientSecret: p.machineAuthAPIKey,
-	})
-	if err != nil || authRes.GetStatus().GetCode() != rpc.Code_CODE_OK {
-		p.logger.Error().Err(err).Interface("authRes", authRes).Msg("error using machine auth")
-	}
-	ownerCtx = metadata.AppendToOutgoingContext(ownerCtx, ctxpkg.TokenHeader, authRes.Token)
-
-	// Stat changed resource resource
-	return p.gwClient.Stat(ownerCtx, &provider.StatRequest{Ref: ref})
-}
-
-func (p *Provider) logDocCount() {
-	c, err := p.indexClient.DocCount()
-	if err != nil {
-		p.logger.Error().Err(err).Msg("error getting document count from the index")
-	}
-	p.logger.Debug().Interface("count", c).Msg("new document count")
-}
-
 func (p *Provider) Search(ctx context.Context, req *searchsvc.SearchRequest) (*searchsvc.SearchResponse, error) {
 	if req.Query == "" {
 		return nil, errtypes.PreconditionFailed("empty query provided")
 	}
 
 	listSpacesRes, err := p.gwClient.ListStorageSpaces(ctx, &provider.ListStorageSpacesRequest{
-		Opaque: &typesv1beta1.Opaque{Map: map[string]*typesv1beta1.OpaqueEntry{
-			"path": {
-				Decoder: "plain",
-				Value:   []byte("/"),
+		Filters: []*provider.ListStorageSpacesRequest_Filter{
+			{
+				Type: provider.ListStorageSpacesRequest_Filter_TYPE_SPACE_TYPE,
+				Term: &provider.ListStorageSpacesRequest_Filter_SpaceType{SpaceType: "+grant"},
 			},
-		}},
+		},
 	})
 	if err != nil {
 		return nil, err
@@ -196,12 +86,14 @@ func (p *Provider) Search(ctx context.Context, req *searchsvc.SearchRequest) (*s
 			pathPrefix = utils.MakeRelativePath(gpRes.Path)
 		}
 
+		_, rootStorageID := storagespace.SplitStorageID(space.Root.StorageId)
+
 		res, err := p.indexClient.Search(ctx, &searchsvc.SearchIndexRequest{
 			Query: req.Query,
 			Ref: &searchmsg.Reference{
 				ResourceId: &searchmsg.ResourceID{
 					StorageId: space.Root.StorageId,
-					OpaqueId:  space.Root.OpaqueId,
+					OpaqueId:  rootStorageID,
 				},
 				Path: pathPrefix,
 			},
@@ -276,3 +168,11 @@ func (p *Provider) IndexSpace(ctx context.Context, req *searchsvc.IndexSpaceRequ
 	p.logDocCount()
 	return &searchsvc.IndexSpaceResponse{}, nil
 }
+
+func (p *Provider) logDocCount() {
+	c, err := p.indexClient.DocCount()
+	if err != nil {
+		p.logger.Error().Err(err).Msg("error getting document count from the index")
+	}
+	p.logger.Debug().Interface("count", c).Msg("new document count")
+}
diff --git a/extensions/settings/pkg/config/parser/parse.go b/extensions/settings/pkg/config/parser/parse.go
index b59d8ee9fd1..5fa45bac680 100644
--- a/extensions/settings/pkg/config/parser/parse.go
+++ b/extensions/settings/pkg/config/parser/parse.go
@@ -41,5 +41,9 @@ func Validate(cfg *config.Config) error {
 		return shared.MissingMachineAuthApiKeyError(cfg.Service.Name)
 	}
 
+	if cfg.AdminUserID == "" {
+		return shared.MissingAdminUserID(cfg.Service.Name)
+	}
+
 	return nil
 }
diff --git a/extensions/settings/pkg/service/v0/service.go b/extensions/settings/pkg/service/v0/service.go
index 213151e9d74..ee3ced9b4e5 100644
--- a/extensions/settings/pkg/service/v0/service.go
+++ b/extensions/settings/pkg/service/v0/service.go
@@ -126,7 +126,7 @@ func (g Service) RegisterDefaultRoles() {
 		}
 	}
 
-	for _, req := range defaultRoleAssignments() {
+	for _, req := range g.defaultRoleAssignments() {
 		if _, err := g.manager.WriteRoleAssignment(req.AccountUuid, req.RoleId); err != nil {
 			g.logger.Error().Err(err).Msg("failed to register role assignment")
 		}
diff --git a/extensions/settings/pkg/service/v0/settings.go b/extensions/settings/pkg/service/v0/settings.go
index 404845e51c7..04b481c782f 100644
--- a/extensions/settings/pkg/service/v0/settings.go
+++ b/extensions/settings/pkg/service/v0/settings.go
@@ -532,20 +532,14 @@ func generatePermissionRequests() []*settingssvc.AddSettingToBundleRequest {
 	}
 }
 
-func defaultRoleAssignments() []*settingsmsg.UserRoleAssignment {
+func (g Service) defaultRoleAssignments() []*settingsmsg.UserRoleAssignment {
 	return []*settingsmsg.UserRoleAssignment{
 		// default admin users
 		{
-			AccountUuid: "058bff95-6708-4fe5-91e4-9ea3d377588b",
+			AccountUuid: "058bff95-6708-4fe5-91e4-9ea3d377588b", // demo user "moss"
 			RoleId:      BundleUUIDRoleAdmin,
 		}, {
-			AccountUuid: "ddc2004c-0977-11eb-9d3f-a793888cd0f8",
-			RoleId:      BundleUUIDRoleAdmin,
-		}, {
-			AccountUuid: "820ba2a1-3f54-4538-80a4-2d73007e30bf",
-			RoleId:      BundleUUIDRoleAdmin,
-		}, {
-			AccountUuid: "bc596f3c-c955-4328-80a0-60d018b4ad57",
+			AccountUuid: g.config.Commons.AdminUserID,
 			RoleId:      BundleUUIDRoleAdmin,
 		},
 		// default users with role "user"
diff --git a/extensions/settings/pkg/store/defaults/defaults.go b/extensions/settings/pkg/store/defaults/defaults.go
index 27f3d43f9f1..2b3e94435fb 100644
--- a/extensions/settings/pkg/store/defaults/defaults.go
+++ b/extensions/settings/pkg/store/defaults/defaults.go
@@ -1,6 +1,7 @@
 package defaults
 
 import (
+	"github.com/owncloud/ocis/extensions/settings/pkg/config"
 	settingsmsg "github.com/owncloud/ocis/protogen/gen/ocis/messages/settings/v0"
 )
 
@@ -496,20 +497,14 @@ var languageSetting = settingsmsg.Setting_SingleChoiceValue{
 }
 
 // DefaultRoleAssignments returns (as one might guess) the default role assignments
-func DefaultRoleAssignments() []*settingsmsg.UserRoleAssignment {
+func DefaultRoleAssignments(cfg *config.Config) []*settingsmsg.UserRoleAssignment {
 	return []*settingsmsg.UserRoleAssignment{
 		// default admin users
 		{
-			AccountUuid: "058bff95-6708-4fe5-91e4-9ea3d377588b",
+			AccountUuid: "058bff95-6708-4fe5-91e4-9ea3d377588b", // demo user "moss"
 			RoleId:      BundleUUIDRoleAdmin,
 		}, {
-			AccountUuid: "ddc2004c-0977-11eb-9d3f-a793888cd0f8",
-			RoleId:      BundleUUIDRoleAdmin,
-		}, {
-			AccountUuid: "820ba2a1-3f54-4538-80a4-2d73007e30bf",
-			RoleId:      BundleUUIDRoleAdmin,
-		}, {
-			AccountUuid: "bc596f3c-c955-4328-80a0-60d018b4ad57",
+			AccountUuid: cfg.Commons.AdminUserID,
 			RoleId:      BundleUUIDRoleAdmin,
 		},
 		// default users with role "user"
diff --git a/extensions/settings/pkg/store/metadata/assignments.go b/extensions/settings/pkg/store/metadata/assignments.go
index 88ce7e1c18b..63c7b31121e 100644
--- a/extensions/settings/pkg/store/metadata/assignments.go
+++ b/extensions/settings/pkg/store/metadata/assignments.go
@@ -14,7 +14,7 @@ import (
 // ListRoleAssignments loads and returns all role assignments matching the given assignment identifier.
 func (s *Store) ListRoleAssignments(accountUUID string) ([]*settingsmsg.UserRoleAssignment, error) {
 	if s.mdc == nil {
-		return defaultRoleAssignments(accountUUID), nil
+		return s.defaultRoleAssignments(accountUUID), nil
 	}
 	s.Init()
 	ctx := context.TODO()
@@ -92,9 +92,9 @@ func (s *Store) RemoveRoleAssignment(assignmentID string) error {
 	return fmt.Errorf("assignmentID '%s' not found", assignmentID)
 }
 
-func defaultRoleAssignments(accID string) []*settingsmsg.UserRoleAssignment {
+func (s *Store) defaultRoleAssignments(accID string) []*settingsmsg.UserRoleAssignment {
 	var assmnts []*settingsmsg.UserRoleAssignment
-	for _, r := range defaults.DefaultRoleAssignments() {
+	for _, r := range defaults.DefaultRoleAssignments(s.cfg) {
 		if r.AccountUuid == accID {
 			assmnts = append(assmnts, r)
 		}
diff --git a/extensions/settings/pkg/store/metadata/store.go b/extensions/settings/pkg/store/metadata/store.go
index c98615559a7..e9d8739dd35 100644
--- a/extensions/settings/pkg/store/metadata/store.go
+++ b/extensions/settings/pkg/store/metadata/store.go
@@ -123,7 +123,7 @@ func (s *Store) initMetadataClient(mdc MetadataClient) error {
 		}
 	}
 
-	for _, p := range defaults.DefaultRoleAssignments() {
+	for _, p := range defaults.DefaultRoleAssignments(s.cfg) {
 		accountUUID := p.AccountUuid
 		roleID := p.RoleId
 		err = mdc.MakeDirIfNotExist(ctx, accountPath(accountUUID))
diff --git a/ocis-pkg/config/config.go b/ocis-pkg/config/config.go
index 9b2a7b6e376..2d5474e4b82 100644
--- a/ocis-pkg/config/config.go
+++ b/ocis-pkg/config/config.go
@@ -70,20 +70,21 @@ type Config struct {
 	MachineAuthAPIKey string               `yaml:"machine_auth_api_key" env:"OCIS_MACHINE_AUTH_API_KEY"`
 	TransferSecret    string               `yaml:"transfer_secret" env:"STORAGE_TRANSFER_SECRET"`
 	SystemUserID      string               `yaml:"system_user_id" env:"OCIS_SYSTEM_USER_ID"`
+	AdminUserID       string               `yaml:"admin_user_id" env:"OCIS_ADMIN_USER_ID"`
 	Runtime           Runtime              `yaml:"runtime"`
 
 	Accounts          *accounts.Config      `yaml:"accounts"`
-	AppProvider       *appProvider.Config   `yaml:"app-provider"`
-	AppRegistry       *appRegistry.Config   `yaml:"app-registry"`
+	AppProvider       *appProvider.Config   `yaml:"app_provider"`
+	AppRegistry       *appRegistry.Config   `yaml:"app_registry"`
 	Audit             *audit.Config         `yaml:"audit"`
-	AuthBasic         *authbasic.Config     `yaml:"auth-basic"`
-	AuthBearer        *authbearer.Config    `yaml:"auth-bearer"`
-	AuthMachine       *authmachine.Config   `yaml:"auth-machine"`
+	AuthBasic         *authbasic.Config     `yaml:"auth_basic"`
+	AuthBearer        *authbearer.Config    `yaml:"auth_bearer"`
+	AuthMachine       *authmachine.Config   `yaml:"auth_machine"`
 	Frontend          *frontend.Config      `yaml:"frontend"`
 	Gateway           *gateway.Config       `yaml:"gateway"`
 	GLAuth            *glauth.Config        `yaml:"glauth"`
 	Graph             *graph.Config         `yaml:"graph"`
-	GraphExplorer     *graphExplorer.Config `yaml:"graph-explorer"`
+	GraphExplorer     *graphExplorer.Config `yaml:"graph_explorer"`
 	Group             *group.Config         `yaml:"group"`
 	IDM               *idm.Config           `yaml:"idm"`
 	IDP               *idp.Config           `yaml:"idp"`
@@ -94,10 +95,10 @@ type Config struct {
 	Proxy             *proxy.Config         `yaml:"proxy"`
 	Settings          *settings.Config      `yaml:"settings"`
 	Sharing           *sharing.Config       `yaml:"sharing"`
-	StorageSystem     *storagesystem.Config `yaml:"storage-system"`
-	StoragePublicLink *storagepublic.Config `yaml:"storage-public"`
-	StorageShares     *storageshares.Config `yaml:"storage-shares"`
-	StorageUsers      *storageusers.Config  `yaml:"storage-users"`
+	StorageSystem     *storagesystem.Config `yaml:"storage_system"`
+	StoragePublicLink *storagepublic.Config `yaml:"storage_public"`
+	StorageShares     *storageshares.Config `yaml:"storage_shares"`
+	StorageUsers      *storageusers.Config  `yaml:"storage_users"`
 	Store             *store.Config         `yaml:"store"`
 	Thumbnails        *thumbnails.Config    `yaml:"thumbnails"`
 	User              *user.Config          `yaml:"user"`
diff --git a/ocis-pkg/config/parser/parse.go b/ocis-pkg/config/parser/parse.go
index 9df81ab3890..b5381afc563 100644
--- a/ocis-pkg/config/parser/parse.go
+++ b/ocis-pkg/config/parser/parse.go
@@ -98,6 +98,11 @@ func EnsureCommons(cfg *config.Config) {
 	if cfg.SystemUserID != "" {
 		cfg.Commons.SystemUserID = cfg.SystemUserID
 	}
+
+	// copy admin user id to the commons part if set
+	if cfg.AdminUserID != "" {
+		cfg.Commons.AdminUserID = cfg.AdminUserID
+	}
 }
 
 func Validate(cfg *config.Config) error {
@@ -117,5 +122,9 @@ func Validate(cfg *config.Config) error {
 		return shared.MissingSystemUserID("ocis")
 	}
 
+	if cfg.AdminUserID == "" {
+		return shared.MissingAdminUserID("ocis")
+	}
+
 	return nil
 }
diff --git a/ocis-pkg/shared/errors.go b/ocis-pkg/shared/errors.go
index c0815c35cc4..394407bba40 100644
--- a/ocis-pkg/shared/errors.go
+++ b/ocis-pkg/shared/errors.go
@@ -53,3 +53,11 @@ func MissingSystemUserID(service string) error {
 		"the config/corresponding environment variable).",
 		service, defaults.BaseConfigPath())
 }
+
+func MissingAdminUserID(service string) error {
+	return fmt.Errorf("The admin user ID has not been configured for %s. "+
+		"Make sure your %s config contains the proper values "+
+		"(e.g. by running ocis init or setting it manually in "+
+		"the config/corresponding environment variable).",
+		service, defaults.BaseConfigPath())
+}
diff --git a/ocis-pkg/shared/shared_types.go b/ocis-pkg/shared/shared_types.go
index a92f0f4c9af..33aa70b9e3e 100644
--- a/ocis-pkg/shared/shared_types.go
+++ b/ocis-pkg/shared/shared_types.go
@@ -45,4 +45,5 @@ type Commons struct {
 	MachineAuthAPIKey string        `yaml:"machine_auth_api_key" env:"OCIS_MACHINE_AUTH_API_KEY"`
 	TransferSecret    string        `yaml:"transfer_secret,omitempty" env:"REVA_TRANSFER_SECRET"`
 	SystemUserID      string        `yaml:"system_user_id" env:"OCIS_SYSTEM_USER_ID"`
+	AdminUserID       string        `yaml:"admin_user_id" env:"OCIS_ADMIN_USER_ID"`
 }
diff --git a/ocis/pkg/init/init.go b/ocis/pkg/init/init.go
index de71b69daaa..b88acc580dc 100644
--- a/ocis/pkg/init/init.go
+++ b/ocis/pkg/init/init.go
@@ -100,17 +100,18 @@ type OcisConfig struct {
 	MachineAuthApiKey string       `yaml:"machine_auth_api_key"`
 	TransferSecret    string       `yaml:"transfer_secret"`
 	SystemUserID      string       `yaml:"system_user_id"`
+	AdminUserID       string       `yaml:"admin_user_id"`
 	Graph             GraphExtension
 	Idp               LdapBasedExtension
 	Idm               IdmExtension
 	Proxy             InsecureProxyExtension
 	Frontend          FrontendExtension
-	AuthBasic         AuthbasicExtension  `yaml:"auth-basic"`
-	AuthBearer        AuthbearerExtension `yaml:"auth-bearer"`
+	AuthBasic         AuthbasicExtension  `yaml:"auth_basic"`
+	AuthBearer        AuthbearerExtension `yaml:"auth_bearer"`
 	User              UserAndGroupExtension
 	Group             UserAndGroupExtension
-	StorageMetadata   DataProviderInsecureSettings `yaml:"storage-system"`
-	StorageUsers      DataProviderInsecureSettings `yaml:"storage-users"`
+	StorageMetadata   DataProviderInsecureSettings `yaml:"storage_system"`
+	StorageUsers      DataProviderInsecureSettings `yaml:"storage_users"`
 	Ocdav             InsecureExtension
 	Thumbnails        ThumbNailExtension
 }
@@ -162,6 +163,7 @@ func CreateConfig(insecure, forceOverwrite bool, configPath, adminPassword strin
 	}
 
 	systemUserID := uuid.Must(uuid.NewV4()).String()
+	adminUserID := uuid.Must(uuid.NewV4()).String()
 
 	idmServicePassword, err := generators.GenerateRandomPassword(passwordLength)
 	if err != nil {
@@ -203,6 +205,7 @@ func CreateConfig(insecure, forceOverwrite bool, configPath, adminPassword strin
 		MachineAuthApiKey: machineAuthApiKey,
 		TransferSecret:    revaTransferSecret,
 		SystemUserID:      systemUserID,
+		AdminUserID:       adminUserID,
 		Idm: IdmExtension{
 			ServiceUserPasswords: ServiceUserPasswordsSettings{
 				AdminPassword: ocisAdminServicePassword,


Test patch:
diff --git a/extensions/search/pkg/search/provider/searchprovider_test.go b/extensions/search/pkg/search/provider/searchprovider_test.go
index f6ea0de3952..183501e5e45 100644
--- a/extensions/search/pkg/search/provider/searchprovider_test.go
+++ b/extensions/search/pkg/search/provider/searchprovider_test.go
@@ -51,7 +51,7 @@ var _ = Describe("Searchprovider", func() {
 				},
 			},
 			Id:   &sprovider.StorageSpaceId{OpaqueId: "personalspace"},
-			Root: &sprovider.ResourceId{OpaqueId: "personalspaceroot"},
+			Root: &sprovider.ResourceId{StorageId: "storageid", OpaqueId: "storageid"},
 			Name: "personalspace",
 		}
 
@@ -113,7 +113,7 @@ var _ = Describe("Searchprovider", func() {
 
 			Eventually(func() bool {
 				return called
-			}).Should(BeTrue())
+			}, "2s").Should(BeTrue())
 		})
 
 		It("removes an entry from the index when the file has been deleted", func() {
@@ -135,7 +135,7 @@ var _ = Describe("Searchprovider", func() {
 
 			Eventually(func() bool {
 				return called
-			}).Should(BeTrue())
+			}, "2s").Should(BeTrue())
 		})
 
 		It("indexes items when they are being restored", func() {
@@ -152,7 +152,7 @@ var _ = Describe("Searchprovider", func() {
 
 			Eventually(func() bool {
 				return called
-			}).Should(BeTrue())
+			}, "2s").Should(BeTrue())
 		})
 
 		It("indexes items when a version has been restored", func() {
@@ -169,12 +169,12 @@ var _ = Describe("Searchprovider", func() {
 
 			Eventually(func() bool {
 				return called
-			}).Should(BeTrue())
+			}, "2s").Should(BeTrue())
 		})
 
 		It("indexes items when they are being moved", func() {
 			called := false
-			indexClient.On("Move", mock.Anything, mock.MatchedBy(func(riToIndex *sprovider.ResourceInfo) bool {
+			indexClient.On("Move", mock.MatchedBy(func(riToIndex *sprovider.ResourceInfo) bool {
 				return riToIndex.Id.OpaqueId == ri.Id.OpaqueId
 			})).Return(nil).Run(func(args mock.Arguments) {
 				called = true
@@ -186,7 +186,7 @@ var _ = Describe("Searchprovider", func() {
 
 			Eventually(func() bool {
 				return called
-			}).Should(BeTrue())
+			}, "2s").Should(BeTrue())
 		})
 	})
 
@@ -220,10 +220,7 @@ var _ = Describe("Searchprovider", func() {
 
 		Context("with a personal space", func() {
 			BeforeEach(func() {
-				gwClient.On("ListStorageSpaces", mock.Anything, mock.MatchedBy(func(req *sprovider.ListStorageSpacesRequest) bool {
-					p := string(req.Opaque.Map["path"].Value)
-					return p == "/"
-				})).Return(&sprovider.ListStorageSpacesResponse{
+				gwClient.On("ListStorageSpaces", mock.Anything, mock.Anything).Return(&sprovider.ListStorageSpacesResponse{
 					Status:        status.NewOK(ctx),
 					StorageSpaces: []*sprovider.StorageSpace{personalSpace},
 				}, nil)
@@ -278,7 +275,7 @@ var _ = Describe("Searchprovider", func() {
 					SpaceType: "grant",
 					Owner:     otherUser,
 					Id:        &sprovider.StorageSpaceId{OpaqueId: "otherspaceroot!otherspacegrant"},
-					Root:      &sprovider.ResourceId{StorageId: "otherspaceroot", OpaqueId: "otherspacegrant"},
+					Root:      &sprovider.ResourceId{StorageId: "otherspaceroot", OpaqueId: "otherspaceroot"},
 					Name:      "grantspace",
 				}
 				gwClient.On("GetPath", mock.Anything, mock.Anything).Return(&sprovider.GetPathResponse{
@@ -288,10 +285,7 @@ var _ = Describe("Searchprovider", func() {
 			})
 
 			It("searches the received spaces (grants)", func() {
-				gwClient.On("ListStorageSpaces", mock.Anything, mock.MatchedBy(func(req *sprovider.ListStorageSpacesRequest) bool {
-					p := string(req.Opaque.Map["path"].Value)
-					return p == "/"
-				})).Return(&sprovider.ListStorageSpacesResponse{
+				gwClient.On("ListStorageSpaces", mock.Anything, mock.Anything).Return(&sprovider.ListStorageSpacesResponse{
 					Status:        status.NewOK(ctx),
 					StorageSpaces: []*sprovider.StorageSpace{grantSpace},
 				}, nil)
@@ -329,20 +323,17 @@ var _ = Describe("Searchprovider", func() {
 				Expect(match.Entity.Ref.Path).To(Equal("./to/Shared.pdf"))
 
 				indexClient.AssertCalled(GinkgoT(), "Search", mock.Anything, mock.MatchedBy(func(req *searchsvc.SearchIndexRequest) bool {
-					return req.Query == "foo" && req.Ref.ResourceId.OpaqueId == grantSpace.Root.OpaqueId && req.Ref.Path == "./grant/path"
+					return req.Query == "foo" && req.Ref.ResourceId.StorageId == grantSpace.Root.StorageId && req.Ref.Path == "./grant/path"
 				}))
 			})
 
 			It("finds matches in both the personal space AND the grant", func() {
-				gwClient.On("ListStorageSpaces", mock.Anything, mock.MatchedBy(func(req *sprovider.ListStorageSpacesRequest) bool {
-					p := string(req.Opaque.Map["path"].Value)
-					return p == "/"
-				})).Return(&sprovider.ListStorageSpacesResponse{
+				gwClient.On("ListStorageSpaces", mock.Anything, mock.Anything).Return(&sprovider.ListStorageSpacesResponse{
 					Status:        status.NewOK(ctx),
 					StorageSpaces: []*sprovider.StorageSpace{personalSpace, grantSpace},
 				}, nil)
 				indexClient.On("Search", mock.Anything, mock.MatchedBy(func(req *searchsvc.SearchIndexRequest) bool {
-					return req.Ref.ResourceId.OpaqueId == grantSpace.Root.OpaqueId
+					return req.Ref.ResourceId.StorageId == grantSpace.Root.StorageId
 				})).Return(&searchsvc.SearchIndexResponse{
 					Matches: []*searchmsg.Match{
 						{
@@ -364,7 +355,7 @@ var _ = Describe("Searchprovider", func() {
 					},
 				}, nil)
 				indexClient.On("Search", mock.Anything, mock.MatchedBy(func(req *searchsvc.SearchIndexRequest) bool {
-					return req.Ref.ResourceId.OpaqueId == personalSpace.Root.OpaqueId
+					return req.Ref.ResourceId.StorageId == personalSpace.Root.StorageId
 				})).Return(&searchsvc.SearchIndexResponse{
 					Matches: []*searchmsg.Match{
 						{
diff --git a/extensions/settings/pkg/store/metadata/assignments_test.go b/extensions/settings/pkg/store/metadata/assignments_test.go
index 2111366e31f..62b0b43682c 100644
--- a/extensions/settings/pkg/store/metadata/assignments_test.go
+++ b/extensions/settings/pkg/store/metadata/assignments_test.go
@@ -5,8 +5,10 @@ import (
 	"sync"
 	"testing"
 
+	"github.com/gofrs/uuid"
 	"github.com/owncloud/ocis/extensions/settings/pkg/config/defaults"
 	olog "github.com/owncloud/ocis/ocis-pkg/log"
+	"github.com/owncloud/ocis/ocis-pkg/shared"
 	settingsmsg "github.com/owncloud/ocis/protogen/gen/ocis/messages/settings/v0"
 	"github.com/stretchr/testify/require"
 )
@@ -18,7 +20,6 @@ var (
 	s = &Store{
 		Logger: logger,
 		l:      &sync.Mutex{},
-		cfg:    defaults.DefaultConfig(),
 	}
 
 	logger = olog.NewLogger(
@@ -89,6 +90,11 @@ var (
 )
 
 func init() {
+	s.cfg = defaults.DefaultConfig()
+	s.cfg.Commons = &shared.Commons{
+		AdminUserID: uuid.Must(uuid.NewV4()).String(),
+	}
+
 	_ = NewMDC(s)
 	setupRoles()
 }