Repository: owncloud/ocis
Pull request #5590 (2023-02-16 15:27:28)

proxy: Fix provsioning new users with the default role
With 078698fdf4e7c684669172f82df6efa8c84ac0b1 the semantics of the ListRoleAssignments Call in the settings service change. It no no longer returns a "not found" error when there is not RoleAssignment for a user. We'll just get an empty list as the result.

This changes the behaviour of the default role assignment to work with the new semantics.



update-docs[bot]: Thanks for opening this pull request! The maintainers of this repository would appreciate it if you would create a [changelog](https://github.com/owncloud/ocis/blob/master/changelog/README.md) item based on your changes.

sonarcloud[bot]: Kudos, SonarCloud Quality Gate passed!&nbsp; &nbsp; [![Quality Gate passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/passed-16px.png 'Quality Gate passed')](https://sonarcloud.io/dashboard?id=owncloud_ocis&pullRequest=5590)

[![Bug](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/bug-16px.png 'Bug')](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=5590&resolved=false&types=BUG) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=5590&resolved=false&types=BUG) [0 Bugs](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=5590&resolved=false&types=BUG)  
[![Vulnerability](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/vulnerability-16px.png 'Vulnerability')](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=5590&resolved=false&types=VULNERABILITY) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=5590&resolved=false&types=VULNERABILITY) [0 Vulnerabilities](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=5590&resolved=false&types=VULNERABILITY)  
[![Security Hotspot](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/security_hotspot-16px.png 'Security Hotspot')](https://sonarcloud.io/project/security_hotspots?id=owncloud_ocis&pullRequest=5590&resolved=false&types=SECURITY_HOTSPOT) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/security_hotspots?id=owncloud_ocis&pullRequest=5590&resolved=false&types=SECURITY_HOTSPOT) [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=owncloud_ocis&pullRequest=5590&resolved=false&types=SECURITY_HOTSPOT)  
[![Code Smell](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/code_smell-16px.png 'Code Smell')](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=5590&resolved=false&types=CODE_SMELL) [![A](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/RatingBadge/A-16px.png 'A')](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=5590&resolved=false&types=CODE_SMELL) [0 Code Smells](https://sonarcloud.io/project/issues?id=owncloud_ocis&pullRequest=5590&resolved=false&types=CODE_SMELL)

[![0.0%](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/CoverageChart/0-16px.png '0.0%')](https://sonarcloud.io/component_measures?id=owncloud_ocis&pullRequest=5590&metric=new_coverage&view=list) [0.0% Coverage](https://sonarcloud.io/component_measures?id=owncloud_ocis&pullRequest=5590&metric=new_coverage&view=list)  
[![0.0%](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/Duplications/3-16px.png '0.0%')](https://sonarcloud.io/component_measures?id=owncloud_ocis&pullRequest=5590&metric=new_duplicated_lines_density&view=list) [0.0% Duplication](https://sonarcloud.io/component_measures?id=owncloud_ocis&pullRequest=5590&metric=new_duplicated_lines_density&view=list)



Patch:
diff --git a/.drone.env b/.drone.env
index 37e04a729a5..e8387fdae53 100644
--- a/.drone.env
+++ b/.drone.env
@@ -1,3 +1,3 @@
 # The test runner source for UI tests
-WEB_COMMITID=5f66ccb84634586a34a058cd104ff61f31e46004
+WEB_COMMITID=617940b0685bb7d1f18ec331dc7fc9db7a5d4b27
 WEB_BRANCH=master
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3c7a07daf42..9664c58efdc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -27,6 +27,7 @@ The following sections list the changes for unreleased.
 * Enhancement - Extended search: [#5221](https://github.com/owncloud/ocis/pull/5221)
 * Enhancement - Resource tags: [#5227](https://github.com/owncloud/ocis/pull/5227)
 * Enhancement - Expiration Notifications: [#5330](https://github.com/owncloud/ocis/pull/5330)
+* Enhancement - Add endpoint to list permissions: [#5594](https://github.com/owncloud/ocis/pull/5594)
 * Enhancement - Better config for postprocessing service: [#5457](https://github.com/owncloud/ocis/pull/5457)
 * Enhancement - Add expiration to user and group shares: [#5389](https://github.com/owncloud/ocis/pull/5389)
 * Enhancement - Space Management permissions: [#5441](https://github.com/owncloud/ocis/pull/5441)
diff --git a/changelog/unreleased/list-permissions.md b/changelog/unreleased/list-permissions.md
new file mode 100644
index 00000000000..791aa3e6914
--- /dev/null
+++ b/changelog/unreleased/list-permissions.md
@@ -0,0 +1,6 @@
+Enhancement: Add endpoint to list permissions
+
+We added 'https://cloud.ocis.test/api/v0/settings/permissions-list' to retrieve all permissions of the logged in user.
+
+https://github.com/owncloud/ocis/pull/5594
+https://github.com/owncloud/ocis/pull/5571
diff --git a/deployments/examples/ocis_ldap/docker-compose.yml b/deployments/examples/ocis_ldap/docker-compose.yml
index b5538240ee0..89d80ba4df2 100644
--- a/deployments/examples/ocis_ldap/docker-compose.yml
+++ b/deployments/examples/ocis_ldap/docker-compose.yml
@@ -57,17 +57,17 @@ services:
     # run ocis init to initialize a configuration file with random secrets
     # it will fail on subsequent runs, because the config file already exists
     # therefore we ignore the error and then start the ocis server
-    command: ["-c", "ocis init || true; ocis server"]
+    command: [ "-c", "ocis init || true; ocis server" ]
     environment:
       # users/gropups from ldap
       LDAP_URI: ldaps://ldap-server
       LDAP_INSECURE: "true"
       LDAP_BIND_DN: "cn=admin,dc=owncloud,dc=com"
       LDAP_BIND_PASSWORD: ${LDAP_ADMIN_PASSWORD:-admin}
-      LDAP_GROUP_BASE_DN: "dc=owncloud,dc=com"
+      LDAP_GROUP_BASE_DN: "ou=groups,dc=owncloud,dc=com"
       LDAP_GROUP_FILTER: "(objectclass=owncloud)"
       LDAP_GROUP_OBJECTCLASS: "groupOfNames"
-      LDAP_USER_BASE_DN: "dc=owncloud,dc=com"
+      LDAP_USER_BASE_DN: "ou=users,dc=owncloud,dc=com"
       LDAP_USER_FILTER: "(objectclass=owncloud)"
       LDAP_USER_OBJECTCLASS: "inetOrgPerson"
       LDAP_LOGIN_ATTRIBUTES: "uid"
@@ -76,7 +76,8 @@ services:
       IDP_LDAP_LOGIN_ATTRIBUTE: "uid"
       IDP_LDAP_UUID_ATTRIBUTE: "ownclouduuid"
       IDP_LDAP_UUID_ATTRIBUTE_TYPE: binary
-      GRAPH_LDAP_SERVER_WRITE_ENABLED: "false" # assuming the external ldap is readonly
+      GRAPH_LDAP_SERVER_WRITE_ENABLED: "true" # assuming the external ldap is writable
+      GRAPH_LDAP_REFINT_ENABLED: "true" # osixia has refint enabled.
       # OCIS_RUN_SERVICES specifies to start all services except glauth, idm and accounts. These are replaced by external services
       OCIS_RUN_SERVICES: app-registry,app-provider,audit,auth-basic,auth-machine,frontend,gateway,graph,groups,idp,nats,notifications,ocdav,ocs,proxy,search,settings,sharing,storage-system,storage-publiclink,storage-shares,storage-users,store,thumbnails,users,web,webdav
       # General oCIS config
@@ -147,5 +148,6 @@ volumes:
   ocis-config:
   ocis-data:
 
+
 networks:
   ocis-net:
diff --git a/protogen/gen/ocis/messages/settings/v0/settings.pb.go b/protogen/gen/ocis/messages/settings/v0/settings.pb.go
index ae11049bab7..bae3a9c8710 100644
--- a/protogen/gen/ocis/messages/settings/v0/settings.pb.go
+++ b/protogen/gen/ocis/messages/settings/v0/settings.pb.go
@@ -1190,7 +1190,7 @@ type Value struct {
 	Id       string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty" yaml:"id"`                             // @gotags: yaml:"id"
 	BundleId string `protobuf:"bytes,2,opt,name=bundle_id,json=bundleId,proto3" json:"bundle_id,omitempty" yaml:"bundle_id"` // @gotags: yaml:"bundle_id"
 	// setting_id is the id of the setting from within its bundle.
-	SettingId   string    `protobuf:"bytes,3,opt,name=setting_id,json=settingId,proto3" json:"setting_id,omitempty" yaml:"settings_id"`       // @gotags: yaml:"settings_id"
+	SettingId   string    `protobuf:"bytes,3,opt,name=setting_id,json=settingId,proto3" json:"setting_id,omitempty" yaml:"setting_id"`       // @gotags: yaml:"setting_id"
 	AccountUuid string    `protobuf:"bytes,4,opt,name=account_uuid,json=accountUuid,proto3" json:"account_uuid,omitempty" yaml:"account_uuid"` // @gotags: yaml:"account_uuid"
 	Resource    *Resource `protobuf:"bytes,5,opt,name=resource,proto3" json:"resource,omitempty" yaml:"resource"`                          // @gotags: yaml:"resource"
 	// Types that are assignable to Value:
diff --git a/protogen/gen/ocis/services/settings/v0/settings.swagger.json b/protogen/gen/ocis/services/settings/v0/settings.swagger.json
index c1ec15a0bd7..e55e5933db6 100644
--- a/protogen/gen/ocis/services/settings/v0/settings.swagger.json
+++ b/protogen/gen/ocis/services/settings/v0/settings.swagger.json
@@ -598,7 +598,8 @@
           "type": "array",
           "items": {
             "$ref": "#/definitions/v0ListOptionValue"
-          }
+          },
+          "title": "@gotags: yaml:\"values\""
         }
       }
     },
@@ -607,33 +608,40 @@
       "properties": {
         "id": {
           "type": "string",
-          "description": "id is the id of the Value. It is generated on saving it."
+          "description": "id is the id of the Value. It is generated on saving it.\n\n@gotags: yaml:\"id\""
         },
         "bundleId": {
-          "type": "string"
+          "type": "string",
+          "title": "@gotags: yaml:\"bundle_id\""
         },
         "settingId": {
           "type": "string",
-          "description": "setting_id is the id of the setting from within its bundle."
+          "description": "setting_id is the id of the setting from within its bundle.\n\n@gotags: yaml:\"setting_id\""
         },
         "accountUuid": {
-          "type": "string"
+          "type": "string",
+          "title": "@gotags: yaml:\"account_uuid\""
         },
         "resource": {
-          "$ref": "#/definitions/v0Resource"
+          "$ref": "#/definitions/v0Resource",
+          "title": "@gotags: yaml:\"resource\""
         },
         "boolValue": {
-          "type": "boolean"
+          "type": "boolean",
+          "title": "@gotags: yaml:\"bool_value\""
         },
         "intValue": {
           "type": "string",
-          "format": "int64"
+          "format": "int64",
+          "title": "@gotags: yaml:\"int_value\""
         },
         "stringValue": {
-          "type": "string"
+          "type": "string",
+          "title": "@gotags: yaml:\"string_value\""
         },
         "listValue": {
-          "$ref": "#/definitions/settingsv0ListValue"
+          "$ref": "#/definitions/settingsv0ListValue",
+          "title": "@gotags: yaml:\"list_value\""
         }
       }
     },
@@ -680,10 +688,12 @@
       "type": "object",
       "properties": {
         "default": {
-          "type": "boolean"
+          "type": "boolean",
+          "title": "@gotags: yaml:\"default\""
         },
         "label": {
-          "type": "string"
+          "type": "string",
+          "title": "@gotags: yaml:\"label\""
         }
       }
     },
@@ -691,28 +701,35 @@
       "type": "object",
       "properties": {
         "id": {
-          "type": "string"
+          "type": "string",
+          "title": "@gotags: yaml:\"id\""
         },
         "name": {
-          "type": "string"
+          "type": "string",
+          "title": "@gotags: yaml:\"name\""
         },
         "type": {
-          "$ref": "#/definitions/v0BundleType"
+          "$ref": "#/definitions/v0BundleType",
+          "title": "@gotags: yaml:\"type\""
         },
         "extension": {
-          "type": "string"
+          "type": "string",
+          "title": "@gotags: yaml:\"extension\""
         },
         "displayName": {
-          "type": "string"
+          "type": "string",
+          "title": "@gotags: yaml:\"display_name\""
         },
         "settings": {
           "type": "array",
           "items": {
             "$ref": "#/definitions/v0Setting"
-          }
+          },
+          "title": "@gotags: yaml:\"settings\""
         },
         "resource": {
-          "$ref": "#/definitions/v0Resource"
+          "$ref": "#/definitions/v0Resource",
+          "title": "@gotags: yaml:\"resource\""
         }
       }
     },
@@ -803,22 +820,27 @@
       "properties": {
         "default": {
           "type": "string",
-          "format": "int64"
+          "format": "int64",
+          "title": "@gotags: yaml:\"default\""
         },
         "min": {
           "type": "string",
-          "format": "int64"
+          "format": "int64",
+          "title": "@gotags: yaml:\"min\""
         },
         "max": {
           "type": "string",
-          "format": "int64"
+          "format": "int64",
+          "title": "@gotags: yaml:\"max\""
         },
         "step": {
           "type": "string",
-          "format": "int64"
+          "format": "int64",
+          "title": "@gotags: yaml:\"step\""
         },
         "placeholder": {
-          "type": "string"
+          "type": "string",
+          "title": "@gotags: yaml:\"placeholder\""
         }
       }
     },
@@ -848,13 +870,16 @@
       "type": "object",
       "properties": {
         "value": {
-          "$ref": "#/definitions/v0ListOptionValue"
+          "$ref": "#/definitions/v0ListOptionValue",
+          "title": "@gotags: yaml:\"value\""
         },
         "default": {
-          "type": "boolean"
+          "type": "boolean",
+          "title": "@gotags: yaml:\"default\""
         },
         "displayValue": {
-          "type": "string"
+          "type": "string",
+          "title": "@gotags: yaml:\"display_value\""
         }
       }
     },
@@ -862,11 +887,13 @@
       "type": "object",
       "properties": {
         "stringValue": {
-          "type": "string"
+          "type": "string",
+          "title": "@gotags: yaml:\"string_value\""
         },
         "intValue": {
           "type": "string",
-          "format": "int64"
+          "format": "int64",
+          "title": "@gotags: yaml:\"int_value\""
         }
       }
     },
@@ -956,7 +983,8 @@
           "type": "array",
           "items": {
             "$ref": "#/definitions/v0ListOption"
-          }
+          },
+          "title": "@gotags: yaml:\"options\""
         }
       }
     },
@@ -964,10 +992,12 @@
       "type": "object",
       "properties": {
         "operation": {
-          "$ref": "#/definitions/v0PermissionOperation"
+          "$ref": "#/definitions/v0PermissionOperation",
+          "title": "@gotags: yaml:\"operation\""
         },
         "constraint": {
-          "$ref": "#/definitions/PermissionConstraint"
+          "$ref": "#/definitions/PermissionConstraint",
+          "title": "@gotags: yaml:\"constraint\""
         }
       }
     },
@@ -1066,37 +1096,48 @@
       "type": "object",
       "properties": {
         "id": {
-          "type": "string"
+          "type": "string",
+          "title": "@gotags: yaml:\"id\""
         },
         "name": {
-          "type": "string"
+          "type": "string",
+          "title": "@gotags: yaml:\"name\""
         },
         "displayName": {
-          "type": "string"
+          "type": "string",
+          "title": "@gotags: yaml:\"display_name\""
         },
         "description": {
-          "type": "string"
+          "type": "string",
+          "title": "@gotags: yaml:\"description\""
         },
         "intValue": {
-          "$ref": "#/definitions/v0Int"
+          "$ref": "#/definitions/v0Int",
+          "title": "@gotags: yaml:\"int_value\""
         },
         "stringValue": {
-          "$ref": "#/definitions/v0String"
+          "$ref": "#/definitions/v0String",
+          "title": "@gotags: yaml:\"string_value\""
         },
         "boolValue": {
-          "$ref": "#/definitions/v0Bool"
+          "$ref": "#/definitions/v0Bool",
+          "title": "@gotags: yaml:\"bool_value\""
         },
         "singleChoiceValue": {
-          "$ref": "#/definitions/v0SingleChoiceList"
+          "$ref": "#/definitions/v0SingleChoiceList",
+          "title": "@gotags: yaml:\"single_choice_value\""
         },
         "multiChoiceValue": {
-          "$ref": "#/definitions/v0MultiChoiceList"
+          "$ref": "#/definitions/v0MultiChoiceList",
+          "title": "@gotags: yaml:\"multi_choice_value\""
         },
         "permissionValue": {
-          "$ref": "#/definitions/v0Permission"
+          "$ref": "#/definitions/v0Permission",
+          "title": "@gotags: yaml:\"permission_value\""
         },
         "resource": {
-          "$ref": "#/definitions/v0Resource"
+          "$ref": "#/definitions/v0Resource",
+          "title": "@gotags: yaml:\"resource\""
         }
       }
     },
@@ -1107,7 +1148,8 @@
           "type": "array",
           "items": {
             "$ref": "#/definitions/v0ListOption"
-          }
+          },
+          "title": "@gotags: yaml:\"options\""
         }
       }
     },
@@ -1115,21 +1157,26 @@
       "type": "object",
       "properties": {
         "default": {
-          "type": "string"
+          "type": "string",
+          "title": "@gotags: yaml:\"default\""
         },
         "required": {
-          "type": "boolean"
+          "type": "boolean",
+          "title": "@gotags: yaml:\"required\""
         },
         "minLength": {
           "type": "integer",
-          "format": "int32"
+          "format": "int32",
+          "title": "@gotags: yaml:\"min_length\""
         },
         "maxLength": {
           "type": "integer",
-          "format": "int32"
+          "format": "int32",
+          "title": "@gotags: yaml:\"max_length\""
         },
         "placeholder": {
-          "type": "string"
+          "type": "string",
+          "title": "@gotags: yaml:\"placeholder\""
         }
       }
     },
diff --git a/services/graph/pkg/config/config.go b/services/graph/pkg/config/config.go
index f140389ab25..cd2c8be5c75 100644
--- a/services/graph/pkg/config/config.go
+++ b/services/graph/pkg/config/config.go
@@ -51,6 +51,7 @@ type LDAP struct {
 	UseServerUUID      bool   `yaml:"use_server_uuid" env:"GRAPH_LDAP_SERVER_UUID" desc:"If set to true, rely on the LDAP Server to generate a unique ID for users and groups, like when using 'entryUUID' as the user ID attribute."`
 	UsePasswordModExOp bool   `yaml:"use_password_modify_exop" env:"GRAPH_LDAP_SERVER_USE_PASSWORD_MODIFY_EXOP" desc:"User the Password Modify Extended Operation for updating user passwords."`
 	WriteEnabled       bool   `yaml:"write_enabled" env:"GRAPH_LDAP_SERVER_WRITE_ENABLED" desc:"Allow to create, modify and delete LDAP users via GRAPH API. This is only works when the default Schema is used."`
+	RefintEnabled      bool   `yaml:"refint_enabled" env:"GRAPH_LDAP_REFINT_ENABLED" desc:"Signals that the server has the refint plugin enabled, which makes some actions not needed."`
 
 	UserBaseDN               string `yaml:"user_base_dn" env:"LDAP_USER_BASE_DN;GRAPH_LDAP_USER_BASE_DN" desc:"Search base DN for looking up LDAP users."`
 	UserSearchScope          string `yaml:"user_search_scope" env:"LDAP_USER_SCOPE;GRAPH_LDAP_USER_SCOPE" desc:"LDAP search scope to use when looking up users. Supported scopes are 'base', 'one' and 'sub'."`
@@ -60,6 +61,7 @@ type LDAP struct {
 	UserDisplayNameAttribute string `yaml:"user_displayname_attribute" env:"LDAP_USER_SCHEMA_DISPLAY_NAME;GRAPH_LDAP_USER_DISPLAYNAME_ATTRIBUTE" desc:"LDAP Attribute to use for the displayname of users."`
 	UserNameAttribute        string `yaml:"user_name_attribute" env:"LDAP_USER_SCHEMA_USERNAME;GRAPH_LDAP_USER_NAME_ATTRIBUTE" desc:"LDAP Attribute to use for username of users."`
 	UserIDAttribute          string `yaml:"user_id_attribute" env:"LDAP_USER_SCHEMA_ID;GRAPH_LDAP_USER_UID_ATTRIBUTE" desc:"LDAP Attribute to use as the unique ID for users. This should be a stable globally unique ID like a UUID."`
+	UserEnabledAttribute     string `yaml:"user_enabled_attribute" env:"LDAP_USER_ENABLED_ATTRIBUTE;GRAPH_USER_ENABLED_ATTRIBUTE" desc:"LDAP Attribute to use as a flag telling if the user is enabled or disabled."`
 
 	GroupBaseDN        string `yaml:"group_base_dn" env:"LDAP_GROUP_BASE_DN;GRAPH_LDAP_GROUP_BASE_DN" desc:"Search base DN for looking up LDAP groups."`
 	GroupSearchScope   string `yaml:"group_search_scope" env:"LDAP_GROUP_SCOPE;GRAPH_LDAP_GROUP_SEARCH_SCOPE" desc:"LDAP search scope to use when looking up groups. Supported scopes are 'base', 'one' and 'sub'."`
diff --git a/services/graph/pkg/config/defaults/defaultconfig.go b/services/graph/pkg/config/defaults/defaultconfig.go
index 1c494566ef1..0819334ebaf 100644
--- a/services/graph/pkg/config/defaults/defaultconfig.go
+++ b/services/graph/pkg/config/defaults/defaultconfig.go
@@ -68,6 +68,7 @@ func DefaultConfig() *config.Config {
 				// FIXME: switch this to some more widely available attribute by default
 				//        ideally this needs to	be constant for the lifetime of a users
 				UserIDAttribute:           "owncloudUUID",
+				UserEnabledAttribute:      "ownCloudUserEnabled",
 				GroupBaseDN:               "ou=groups,o=libregraph-idm",
 				GroupSearchScope:          "sub",
 				GroupFilter:               "",
diff --git a/services/graph/pkg/identity/ldap.go b/services/graph/pkg/identity/ldap.go
index e54a6034af4..b126204b5cb 100644
--- a/services/graph/pkg/identity/ldap.go
+++ b/services/graph/pkg/identity/ldap.go
@@ -4,6 +4,8 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"strconv"
+	"strings"
 
 	"github.com/CiscoM31/godata"
 	"github.com/go-ldap/ldap/v3"
@@ -25,6 +27,7 @@ const (
 type LDAP struct {
 	useServerUUID   bool
 	writeEnabled    bool
+	refintEnabled   bool
 	usePwModifyExOp bool
 
 	userBaseDN       string
@@ -46,12 +49,13 @@ type LDAP struct {
 }
 
 type userAttributeMap struct {
-	displayName string
-	id          string
-	mail        string
-	userName    string
-	givenName   string
-	surname     string
+	displayName    string
+	id             string
+	mail           string
+	userName       string
+	givenName      string
+	surname        string
+	accountEnabled string
 }
 
 type ldapAttributeValues map[string][]string
@@ -62,12 +66,13 @@ func NewLDAPBackend(lc ldap.Client, config config.LDAP, logger *log.Logger) (*LD
 		return nil, errors.New("invalid user attribute mappings")
 	}
 	uam := userAttributeMap{
-		displayName: config.UserDisplayNameAttribute,
-		id:          config.UserIDAttribute,
-		mail:        config.UserEmailAttribute,
-		userName:    config.UserNameAttribute,
-		givenName:   givenNameAttribute,
-		surname:     surNameAttribute,
+		displayName:    config.UserDisplayNameAttribute,
+		id:             config.UserIDAttribute,
+		mail:           config.UserEmailAttribute,
+		userName:       config.UserNameAttribute,
+		accountEnabled: config.UserEnabledAttribute,
+		givenName:      givenNameAttribute,
+		surname:        surNameAttribute,
 	}
 
 	if config.GroupNameAttribute == "" || config.GroupIDAttribute == "" {
@@ -112,6 +117,7 @@ func NewLDAPBackend(lc ldap.Client, config config.LDAP, logger *log.Logger) (*LD
 		logger:            logger,
 		conn:              lc,
 		writeEnabled:      config.WriteEnabled,
+		refintEnabled:     config.RefintEnabled,
 	}, nil
 }
 
@@ -172,19 +178,21 @@ func (i *LDAP) DeleteUser(ctx context.Context, nameOrID string) error {
 		return err
 	}
 
-	// Find all the groups that this user was a member of and remove it from there
-	groupEntries, err := i.getLDAPGroupsByFilter(fmt.Sprintf("(%s=%s)", i.groupAttributeMap.member, e.DN), true, false)
-	if err != nil {
-		return err
-	}
-	for _, group := range groupEntries {
-		logger.Debug().Str("group", group.DN).Str("user", e.DN).Msg("Cleaning up group membership")
-
-		if mr, err := i.removeEntryByDNAndAttributeFromEntry(group, e.DN, i.groupAttributeMap.member); err == nil {
-			if err = i.conn.Modify(mr); err != nil {
-				// Errors when deleting the memberships are only logged as warnings but not returned
-				// to the user as we already successfully deleted the users itself
-				logger.Warn().Str("group", group.DN).Str("user", e.DN).Err(err).Msg("failed to remove member")
+	if !i.refintEnabled {
+		// Find all the groups that this user was a member of and remove it from there
+		groupEntries, err := i.getLDAPGroupsByFilter(fmt.Sprintf("(%s=%s)", i.groupAttributeMap.member, e.DN), true, false)
+		if err != nil {
+			return err
+		}
+		for _, group := range groupEntries {
+			logger.Debug().Str("group", group.DN).Str("user", e.DN).Msg("Cleaning up group membership")
+
+			if mr, err := i.removeEntryByDNAndAttributeFromEntry(group, e.DN, i.groupAttributeMap.member); err == nil {
+				if err = i.conn.Modify(mr); err != nil {
+					// Errors when deleting the memberships are only logged as warnings but not returned
+					// to the user as we already successfully deleted the users itself
+					logger.Warn().Str("group", group.DN).Str("user", e.DN).Err(err).Msg("failed to remove member")
+				}
 			}
 		}
 	}
@@ -245,7 +253,17 @@ func (i *LDAP) UpdateUser(ctx context.Context, nameOrID string, user libregraph.
 			updateNeeded = true
 		}
 	}
-	// TODO implement account disabled/enabled
+
+	if user.AccountEnabled != nil {
+		boolString := strings.ToUpper(strconv.FormatBool(*user.AccountEnabled))
+		ldapValue := e.GetEqualFoldAttributeValue(i.userAttributeMap.accountEnabled)
+		updateNeeded = true
+		if ldapValue != "" {
+			mr.Replace(i.userAttributeMap.accountEnabled, []string{boolString})
+		} else {
+			mr.Add(i.userAttributeMap.accountEnabled, []string{boolString})
+		}
+	}
 
 	if updateNeeded {
 		if err := i.conn.Modify(&mr); err != nil {
@@ -269,6 +287,7 @@ func (i *LDAP) getUserByDN(dn string) (*ldap.Entry, error) {
 		i.userAttributeMap.userName,
 		i.userAttributeMap.surname,
 		i.userAttributeMap.givenName,
+		i.userAttributeMap.accountEnabled,
 	}
 
 	filter := fmt.Sprintf("(objectClass=%s)", i.userObjectClass)
@@ -365,6 +384,7 @@ func (i *LDAP) getLDAPUserByFilter(filter string) (*ldap.Entry, error) {
 		i.userAttributeMap.userName,
 		i.userAttributeMap.surname,
 		i.userAttributeMap.givenName,
+		i.userAttributeMap.accountEnabled,
 	}
 	return i.searchLDAPEntryByFilter(i.userBaseDN, attrs, filter)
 }
@@ -435,6 +455,7 @@ func (i *LDAP) GetUsers(ctx context.Context, oreq *godata.GoDataRequest) ([]*lib
 			i.userAttributeMap.userName,
 			i.userAttributeMap.surname,
 			i.userAttributeMap.givenName,
+			i.userAttributeMap.accountEnabled,
 		},
 		nil,
 	)
@@ -472,10 +493,6 @@ func (i *LDAP) GetUsers(ctx context.Context, oreq *godata.GoDataRequest) ([]*lib
 
 func (i *LDAP) changeUserName(ctx context.Context, dn, originalUserName, newUserName string) (*ldap.Entry, error) {
 	logger := i.logger.SubloggerWithRequestID(ctx)
-	groups, err := i.getGroupsForUser(dn)
-	if err != nil {
-		return nil, err
-	}
 
 	newDN := fmt.Sprintf("%s=%s", i.userAttributeMap.userName, newUserName)
 
@@ -508,14 +525,21 @@ func (i *LDAP) changeUserName(ctx context.Context, dn, originalUserName, newUser
 		return nil, err
 	}
 
-	for _, g := range groups {
-		err = i.renameMemberInGroup(ctx, g, dn, u.DN)
-		// This could leave the groups in an inconsistent state, might be a good idea to
-		// add a defer that changes everything back on error. Ideally, this entire function
-		// should be atomic, but LDAP doesn't support that.
+	if !i.refintEnabled {
+		groups, err := i.getGroupsForUser(dn)
 		if err != nil {
 			return nil, err
 		}
+		for _, g := range groups {
+			logger.Debug().Str("originalDN", dn).Str("newDN", u.DN).Str("group", g.DN).Msg("Changing member in group")
+			err = i.renameMemberInGroup(ctx, g, dn, u.DN)
+			// This could leave the groups in an inconsistent state, might be a good idea to
+			// add a defer that changes everything back on error. Ideally, this entire function
+			// should be atomic, but LDAP doesn't support that.
+			if err != nil {
+				return nil, err
+			}
+		}
 	}
 
 	return u, nil
@@ -531,8 +555,14 @@ func (i *LDAP) renameMemberInGroup(ctx context.Context, group *ldap.Entry, oldMe
 		var lerr *ldap.Error
 		if errors.As(err, &lerr) {
 			if lerr.ResultCode == ldap.LDAPResultNoSuchObject {
-				groupID := group.GetEqualFoldAttributeValue(i.groupAttributeMap.id)
-				logger.Warn().Str("group", groupID).Msg("Group no longer exists")
+				logger.Warn().Str("group", group.DN).Msg("Group no longer exists")
+				return nil
+			} else if lerr.ResultCode == ldap.LDAPResultNoSuchAttribute {
+				logger.Warn().
+					Str("oldMember", oldMember).
+					Str("newMember", newMember).
+					Str("groupDN", group.DN).
+					Msg("member attribute not found, this probably means that the server has refint enabled, please configure the OCIS to respect that.")
 				return nil
 			}
 		}
@@ -581,6 +611,7 @@ func (i *LDAP) createUserModelFromLDAP(e *ldap.Entry) *libregraph.User {
 			Id:                       &id,
 			GivenName:                &givenName,
 			Surname:                  &surname,
+			AccountEnabled:           booleanOrNil(e.GetEqualFoldAttributeValue(i.userAttributeMap.accountEnabled)),
 		}
 	}
 	i.logger.Warn().Str("dn", e.DN).Msg("Invalid User. Missing username or id attribute")
@@ -592,13 +623,18 @@ func (i *LDAP) userToLDAPAttrValues(user libregraph.User) (map[string][]string,
 		i.userAttributeMap.displayName: {user.GetDisplayName()},
 		i.userAttributeMap.userName:    {user.GetOnPremisesSamAccountName()},
 		i.userAttributeMap.mail:        {user.GetMail()},
-		"objectClass":                  {"inetOrgPerson", "organizationalPerson", "person", "top"},
+		"objectClass":                  {"inetOrgPerson", "organizationalPerson", "person", "top", "ownCloudUser"},
 		"cn":                           {user.GetOnPremisesSamAccountName()},
 	}
 
 	if !i.useServerUUID {
 		attrs["owncloudUUID"] = []string{uuid.Must(uuid.NewV4()).String()}
-		attrs["objectClass"] = append(attrs["objectClass"], "owncloud")
+	}
+
+	if user.AccountEnabled != nil {
+		attrs[i.userAttributeMap.accountEnabled] = []string{
+			strings.ToUpper(strconv.FormatBool(*user.AccountEnabled)),
+		}
 	}
 
 	// inetOrgPerson requires "sn" to be set. Set it to the Username if
@@ -636,6 +672,7 @@ func (i *LDAP) getUserAttrTypes() []string {
 		"cn",
 		"owncloudUUID",
 		"userPassword",
+		i.userAttributeMap.accountEnabled,
 	}
 }
 
@@ -666,6 +703,15 @@ func pointerOrNil(val string) *string {
 	return &val
 }
 
+func booleanOrNil(val string) *bool {
+	boolValue, err := strconv.ParseBool(val)
+	if err != nil {
+		return nil
+	}
+
+	return &boolValue
+}
+
 func stringToScope(scope string) (int, error) {
 	var s int
 	switch scope {
diff --git a/services/proxy/pkg/user/backend/cs3.go b/services/proxy/pkg/user/backend/cs3.go
index 13cb1bb4ed9..b37cd481336 100644
--- a/services/proxy/pkg/user/backend/cs3.go
+++ b/services/proxy/pkg/user/backend/cs3.go
@@ -3,7 +3,6 @@ package backend
 import (
 	"context"
 	"encoding/json"
-	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -23,7 +22,6 @@ import (
 	settingssvc "github.com/owncloud/ocis/v2/protogen/gen/ocis/services/settings/v0"
 	"github.com/owncloud/ocis/v2/services/graph/pkg/service/v0/errorcode"
 	settingsService "github.com/owncloud/ocis/v2/services/settings/pkg/service/v0"
-	merrors "go-micro.dev/v4/errors"
 	"go-micro.dev/v4/metadata"
 	"go-micro.dev/v4/selector"
 )
@@ -80,27 +78,26 @@ func (c *cs3backend) GetUserByClaims(ctx context.Context, claim, value string, w
 	if user.Id.Type != cs3.UserType_USER_TYPE_LIGHTWEIGHT {
 		roleIDs, err = loadRolesIDs(ctx, user.Id.OpaqueId, c.settingsRoleService)
 		if err != nil {
-			var merr *merrors.Error
-			if errors.As(err, &merr) && merr.Code == http.StatusNotFound {
-				// This user doesn't have a role assignment yet. Assign a
-				// default user role. At least until proper roles are provided. See
-				// https://github.com/owncloud/ocis/v2/issues/1825 for more context.
-				if user.Id.Type == cs3.UserType_USER_TYPE_PRIMARY {
-					c.logger.Info().Str("userid", user.Id.OpaqueId).Msg("user has no role assigned, assigning default user role")
-					ctx = metadata.Set(ctx, middleware.AccountID, user.Id.OpaqueId)
-					_, err := c.settingsRoleService.AssignRoleToUser(ctx, &settingssvc.AssignRoleToUserRequest{
-						AccountUuid: user.Id.OpaqueId,
-						RoleId:      settingsService.BundleUUIDRoleUser,
-					})
-					if err != nil {
-						c.logger.Error().Err(err).Msg("Could not add default role")
-						return nil, "", err
-					}
-					roleIDs = append(roleIDs, settingsService.BundleUUIDRoleUser)
+			c.logger.Error().Err(err).Msgf("Could not load roles")
+			return nil, "", err
+		}
+
+		if len(roleIDs) == 0 {
+			// This user doesn't have a role assignment yet. Assign a
+			// default user role. At least until proper roles are provided. See
+			// https://github.com/owncloud/ocis/v2/issues/1825 for more context.
+			if user.Id.Type == cs3.UserType_USER_TYPE_PRIMARY {
+				c.logger.Info().Str("userid", user.Id.OpaqueId).Msg("user has no role assigned, assigning default user role")
+				ctx = metadata.Set(ctx, middleware.AccountID, user.Id.OpaqueId)
+				_, err := c.settingsRoleService.AssignRoleToUser(ctx, &settingssvc.AssignRoleToUserRequest{
+					AccountUuid: user.Id.OpaqueId,
+					RoleId:      settingsService.BundleUUIDRoleUser,
+				})
+				if err != nil {
+					c.logger.Error().Err(err).Msg("Could not add default role")
+					return nil, "", err
 				}
-			} else {
-				c.logger.Error().Err(err).Msgf("Could not load roles")
-				return nil, "", err
+				roleIDs = append(roleIDs, settingsService.BundleUUIDRoleUser)
 			}
 		}
 	}
diff --git a/services/settings/pkg/config/defaults/defaultconfig.go b/services/settings/pkg/config/defaults/defaultconfig.go
index 6215963d4a9..7b0e91d70ad 100644
--- a/services/settings/pkg/config/defaults/defaultconfig.go
+++ b/services/settings/pkg/config/defaults/defaultconfig.go
@@ -6,6 +6,7 @@ import (
 
 	"github.com/owncloud/ocis/v2/ocis-pkg/config/defaults"
 	"github.com/owncloud/ocis/v2/ocis-pkg/shared"
+	v0 "github.com/owncloud/ocis/v2/protogen/gen/ocis/messages/settings/v0"
 	"github.com/owncloud/ocis/v2/services/settings/pkg/config"
 	rdefaults "github.com/owncloud/ocis/v2/services/settings/pkg/store/defaults"
 )
@@ -52,7 +53,7 @@ func DefaultConfig() *config.Config {
 			StorageAddress: "127.0.0.1:9215",
 			SystemUserIDP:  "internal",
 		},
-		Bundles: rdefaults.GenerateBundlesDefaultRoles(),
+		Bundles: []*v0.Bundle{},
 	}
 }
 
@@ -122,6 +123,10 @@ func EnsureDefaults(cfg *config.Config) {
 }
 
 func Sanitize(cfg *config.Config) {
+	if len(cfg.Bundles) == 0 {
+		cfg.Bundles = rdefaults.GenerateBundlesDefaultRoles()
+	}
+
 	// sanitize config
 	if cfg.HTTP.Root != "/" {
 		cfg.HTTP.Root = strings.TrimSuffix(cfg.HTTP.Root, "/")
diff --git a/services/settings/pkg/service/v0/service.go b/services/settings/pkg/service/v0/service.go
index ec2966cf2c4..40c6187dd3d 100644
--- a/services/settings/pkg/service/v0/service.go
+++ b/services/settings/pkg/service/v0/service.go
@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"strings"
 
 	cs3permissions "github.com/cs3org/go-cs3apis/cs3/permissions/v1beta1"
 	rpcv1beta1 "github.com/cs3org/go-cs3apis/cs3/rpc/v1beta1"
@@ -499,7 +500,7 @@ func (g Service) ListPermissions(ctx context.Context, req *settingssvc.ListPermi
 
 		if bundle != nil {
 			for _, setting := range bundle.GetSettings() {
-				permissionNames[setting.Name] = struct{}{}
+				permissionNames[formatPermissionName(setting)] = struct{}{}
 			}
 		}
 	}
@@ -667,3 +668,8 @@ func (g Service) isCurrentUser(ctx context.Context, accountID string) bool {
 func (g Service) canManageRoles(ctx context.Context) bool {
 	return g.hasStaticPermission(ctx, RoleManagementPermissionID)
 }
+
+func formatPermissionName(setting *settingsmsg.Setting) string {
+	constraint := strings.TrimPrefix(setting.GetPermissionValue().GetConstraint().String(), "CONSTRAINT_")
+	return setting.Name + "." + strings.ToLower(constraint)
+}
diff --git a/services/web/Makefile b/services/web/Makefile
index 9b87a615dfb..0793aef2a16 100644
--- a/services/web/Makefile
+++ b/services/web/Makefile
@@ -1,6 +1,6 @@
 SHELL := bash
 NAME := web
-WEB_ASSETS_VERSION = v7.0.0-rc.13
+WEB_ASSETS_VERSION = v7.0.0-rc.14
 
 include ../../.make/recursion.mk
 


Test patch:
diff --git a/services/graph/pkg/identity/ldap_education_class_test.go b/services/graph/pkg/identity/ldap_education_class_test.go
index df48c36e85d..682e4d907c9 100644
--- a/services/graph/pkg/identity/ldap_education_class_test.go
+++ b/services/graph/pkg/identity/ldap_education_class_test.go
@@ -275,7 +275,7 @@ func TestGetEducationClassMembers(t *testing.T) {
 			Scope:      0,
 			SizeLimit:  1,
 			Filter:     "(objectClass=inetOrgPerson)",
-			Attributes: []string{"displayname", "entryUUID", "mail", "uid", "sn", "givenname"},
+			Attributes: []string{"displayname", "entryUUID", "mail", "uid", "sn", "givenname", "userEnabledAttribute"},
 			Controls:   []ldap.Control(nil),
 		}
 		lm.On("Search", user_sr).Return(&ldap.SearchResult{Entries: []*ldap.Entry{userEntry}}, nil)
diff --git a/services/graph/pkg/identity/ldap_education_school_test.go b/services/graph/pkg/identity/ldap_education_school_test.go
index a26982e5185..a97d4804d83 100644
--- a/services/graph/pkg/identity/ldap_education_school_test.go
+++ b/services/graph/pkg/identity/ldap_education_school_test.go
@@ -21,6 +21,7 @@ var eduConfig = config.LDAP{
 	UserIDAttribute:          "entryUUID",
 	UserEmailAttribute:       "mail",
 	UserNameAttribute:        "uid",
+	UserEnabledAttribute:     "userEnabledAttribute",
 
 	GroupBaseDN:        "ou=groups,dc=test",
 	GroupObjectClass:   "groupOfNames",
diff --git a/services/graph/pkg/identity/ldap_group_test.go b/services/graph/pkg/identity/ldap_group_test.go
index da79a9772a0..511076b01c5 100644
--- a/services/graph/pkg/identity/ldap_group_test.go
+++ b/services/graph/pkg/identity/ldap_group_test.go
@@ -100,14 +100,14 @@ func TestGetGroup(t *testing.T) {
 		BaseDN:     "uid=user,ou=people,dc=test",
 		SizeLimit:  1,
 		Filter:     "(objectClass=inetOrgPerson)",
-		Attributes: []string{"displayname", "entryUUID", "mail", "uid", "sn", "givenname"},
+		Attributes: []string{"displayname", "entryUUID", "mail", "uid", "sn", "givenname", "userEnabledAttribute"},
 		Controls:   []ldap.Control(nil),
 	}
 	sr3 := &ldap.SearchRequest{
 		BaseDN:     "uid=invalid,ou=people,dc=test",
 		SizeLimit:  1,
 		Filter:     "(objectClass=inetOrgPerson)",
-		Attributes: []string{"displayname", "entryUUID", "mail", "uid", "sn", "givenname"},
+		Attributes: []string{"displayname", "entryUUID", "mail", "uid", "sn", "givenname", "userEnabledAttribute"},
 		Controls:   []ldap.Control(nil),
 	}
 
@@ -195,14 +195,14 @@ func TestGetGroups(t *testing.T) {
 		BaseDN:     "uid=user,ou=people,dc=test",
 		SizeLimit:  1,
 		Filter:     "(objectClass=inetOrgPerson)",
-		Attributes: []string{"displayname", "entryUUID", "mail", "uid", "sn", "givenname"},
+		Attributes: []string{"displayname", "entryUUID", "mail", "uid", "sn", "givenname", "userEnabledAttribute"},
 		Controls:   []ldap.Control(nil),
 	}
 	sr3 := &ldap.SearchRequest{
 		BaseDN:     "uid=invalid,ou=people,dc=test",
 		SizeLimit:  1,
 		Filter:     "(objectClass=inetOrgPerson)",
-		Attributes: []string{"displayname", "entryUUID", "mail", "uid", "sn", "givenname"},
+		Attributes: []string{"displayname", "entryUUID", "mail", "uid", "sn", "givenname", "userEnabledAttribute"},
 		Controls:   []ldap.Control(nil),
 	}
 
diff --git a/services/graph/pkg/identity/ldap_test.go b/services/graph/pkg/identity/ldap_test.go
index 93cfe52ad7d..04f5f479f23 100644
--- a/services/graph/pkg/identity/ldap_test.go
+++ b/services/graph/pkg/identity/ldap_test.go
@@ -30,6 +30,7 @@ var lconfig = config.LDAP{
 	UserIDAttribute:          "entryUUID",
 	UserEmailAttribute:       "mail",
 	UserNameAttribute:        "uid",
+	UserEnabledAttribute:     "userEnabledAttribute",
 
 	GroupBaseDN:        "ou=groups,dc=test",
 	GroupObjectClass:   "groupOfNames",
@@ -43,12 +44,13 @@ var lconfig = config.LDAP{
 
 var userEntry = ldap.NewEntry("uid=user",
 	map[string][]string{
-		"uid":         {"user"},
-		"displayname": {"DisplayName"},
-		"mail":        {"user@example"},
-		"entryuuid":   {"abcd-defg"},
-		"sn":          {"surname"},
-		"givenname":   {"givenName"},
+		"uid":                  {"user"},
+		"displayname":          {"DisplayName"},
+		"mail":                 {"user@example"},
+		"entryuuid":            {"abcd-defg"},
+		"sn":                   {"surname"},
+		"givenname":            {"givenName"},
+		"userenabledattribute": {"TRUE"},
 	})
 
 var invalidUserEntry = ldap.NewEntry("uid=user",
@@ -105,8 +107,9 @@ func TestCreateUser(t *testing.T) {
 	ar.Attribute(lconfig.UserEmailAttribute, []string{mail})
 	ar.Attribute("sn", []string{surname})
 	ar.Attribute("givenname", []string{givenName})
-	ar.Attribute("objectClass", []string{"inetOrgPerson", "organizationalPerson", "person", "top"})
+	ar.Attribute("objectClass", []string{"inetOrgPerson", "organizationalPerson", "person", "top", "ownCloudUser"})
 	ar.Attribute("cn", []string{userName})
+	ar.Attribute(lconfig.UserEnabledAttribute, []string{"TRUE"})
 
 	l := &mocks.Client{}
 	l.On("Search", mock.Anything).
@@ -124,6 +127,7 @@ func TestCreateUser(t *testing.T) {
 	user.SetOnPremisesSamAccountName(userName)
 	user.SetSurname(surname)
 	user.SetGivenName(givenName)
+	user.SetAccountEnabled(true)
 
 	c := lconfig
 	c.UseServerUUID = true
@@ -136,6 +140,7 @@ func TestCreateUser(t *testing.T) {
 	assert.Equal(t, userName, newUser.GetOnPremisesSamAccountName())
 	assert.Equal(t, givenName, newUser.GetGivenName())
 	assert.Equal(t, surname, newUser.GetSurname())
+	assert.True(t, newUser.GetAccountEnabled())
 }
 
 func TestCreateUserModelFromLDAP(t *testing.T) {
@@ -285,6 +290,7 @@ func TestUpdateUser(t *testing.T) {
 		mail                     string
 		displayName              string
 		onPremisesSamAccountName string
+		accountEnabled           bool
 	}
 	type args struct {
 		nameOrID  string
@@ -323,7 +329,7 @@ func TestUpdateUser(t *testing.T) {
 							ldap.ScopeWholeSubtree,
 							ldap.NeverDerefAliases, 1, 0, false,
 							"(&(objectClass=inetOrgPerson)(|(uid=testUser)(entryUUID=testUser)))",
-							[]string{"displayname", "entryUUID", "mail", "uid", "sn", "givenname"},
+							[]string{"displayname", "entryUUID", "mail", "uid", "sn", "givenname", "userEnabledAttribute"},
 							nil,
 						),
 					},
@@ -353,6 +359,7 @@ func TestUpdateUser(t *testing.T) {
 				mail:                     "testuser@example.org",
 				displayName:              "testUser",
 				onPremisesSamAccountName: "testUser",
+				accountEnabled:           true,
 			},
 			assertion: func(t assert.TestingT, err error, args ...interface{}) bool {
 				return assert.Nil(t, err, args...)
@@ -366,7 +373,7 @@ func TestUpdateUser(t *testing.T) {
 							ldap.ScopeWholeSubtree,
 							ldap.NeverDerefAliases, 1, 0, false,
 							"(&(objectClass=inetOrgPerson)(|(uid=testUser)(entryUUID=testUser)))",
-							[]string{"displayname", "entryUUID", "mail", "uid", "sn", "givenname"},
+							[]string{"displayname", "entryUUID", "mail", "uid", "sn", "givenname", "userEnabledAttribute"},
 							nil,
 						),
 					},
@@ -380,24 +387,18 @@ func TestUpdateUser(t *testing.T) {
 											Name:   "displayname",
 											Values: []string{"oldmail@example.org"},
 										},
-									},
-								},
-								{
-									DN: "uid=oldName",
-									Attributes: []*ldap.EntryAttribute{
 										{
 											Name:   "entryUUID",
 											Values: []string{"testUser"},
 										},
-									},
-								},
-								{
-									DN: "uid=oldName",
-									Attributes: []*ldap.EntryAttribute{
 										{
 											Name:   "mail",
 											Values: []string{"oldmail@example.org"},
 										},
+										{
+											Name:   lconfig.UserEnabledAttribute,
+											Values: []string{"TRUE"},
+										},
 									},
 								},
 							},
@@ -416,7 +417,7 @@ func TestUpdateUser(t *testing.T) {
 							TimeLimit:    0,
 							TypesOnly:    false,
 							Filter:       "(objectClass=inetOrgPerson)",
-							Attributes:   []string{"displayname", "entryUUID", "mail", "uid", "sn", "givenname"},
+							Attributes:   []string{"displayname", "entryUUID", "mail", "uid", "sn", "givenname", "userEnabledAttribute"},
 							Controls:     []ldap.Control(nil),
 						},
 					},
@@ -442,6 +443,10 @@ func TestUpdateUser(t *testing.T) {
 											Name:   lconfig.UserNameAttribute,
 											Values: []string{"testUser"},
 										},
+										{
+											Name:   lconfig.UserEnabledAttribute,
+											Values: []string{"TRUE"},
+										},
 									},
 								},
 							},
@@ -483,6 +488,7 @@ func TestUpdateUser(t *testing.T) {
 				mail:                     "testuser@example.org",
 				displayName:              "newName",
 				onPremisesSamAccountName: "testUser",
+				accountEnabled:           true,
 			},
 			assertion: func(t assert.TestingT, err error, args ...interface{}) bool {
 				return assert.Nil(t, err, args...)
@@ -496,7 +502,7 @@ func TestUpdateUser(t *testing.T) {
 							ldap.ScopeWholeSubtree,
 							ldap.NeverDerefAliases, 1, 0, false,
 							"(&(objectClass=inetOrgPerson)(|(uid=testUser)(entryUUID=testUser)))",
-							[]string{"displayname", "entryUUID", "mail", "uid", "sn", "givenname"},
+							[]string{"displayname", "entryUUID", "mail", "uid", "sn", "givenname", "userEnabledAttribute"},
 							nil,
 						),
 					},
@@ -510,24 +516,18 @@ func TestUpdateUser(t *testing.T) {
 											Name:   "displayname",
 											Values: []string{"testUser"},
 										},
-									},
-								},
-								{
-									DN: "uid=oldName",
-									Attributes: []*ldap.EntryAttribute{
 										{
 											Name:   "entryUUID",
 											Values: []string{"testUser"},
 										},
-									},
-								},
-								{
-									DN: "uid=oldName",
-									Attributes: []*ldap.EntryAttribute{
 										{
 											Name:   "mail",
 											Values: []string{"testuser@example.org"},
 										},
+										{
+											Name:   lconfig.UserEnabledAttribute,
+											Values: []string{"TRUE"},
+										},
 									},
 								},
 							},
@@ -546,7 +546,7 @@ func TestUpdateUser(t *testing.T) {
 							TimeLimit:    0,
 							TypesOnly:    false,
 							Filter:       "(objectClass=inetOrgPerson)",
-							Attributes:   []string{"displayname", "entryUUID", "mail", "uid", "sn", "givenname"},
+							Attributes:   []string{"displayname", "entryUUID", "mail", "uid", "sn", "givenname", "userEnabledAttribute"},
 							Controls:     []ldap.Control(nil),
 						},
 					},
@@ -572,6 +572,10 @@ func TestUpdateUser(t *testing.T) {
 											Name:   lconfig.UserNameAttribute,
 											Values: []string{"testUser"},
 										},
+										{
+											Name:   lconfig.UserEnabledAttribute,
+											Values: []string{"TRUE"},
+										},
 									},
 								},
 							},
@@ -613,6 +617,7 @@ func TestUpdateUser(t *testing.T) {
 				mail:                     "testuser@example.org",
 				displayName:              "newName",
 				onPremisesSamAccountName: "newName",
+				accountEnabled:           true,
 			},
 			assertion: func(t assert.TestingT, err error, args ...interface{}) bool {
 				return assert.Nil(t, err, args...)
@@ -626,7 +631,7 @@ func TestUpdateUser(t *testing.T) {
 							ldap.ScopeWholeSubtree,
 							ldap.NeverDerefAliases, 1, 0, false,
 							"(&(objectClass=inetOrgPerson)(|(uid=testUser)(entryUUID=testUser)))",
-							[]string{"displayname", "entryUUID", "mail", "uid", "sn", "givenname"},
+							[]string{"displayname", "entryUUID", "mail", "uid", "sn", "givenname", "userEnabledAttribute"},
 							nil,
 						),
 					},
@@ -652,6 +657,10 @@ func TestUpdateUser(t *testing.T) {
 											Name:   lconfig.UserNameAttribute,
 											Values: []string{"oldName"},
 										},
+										{
+											Name:   lconfig.UserEnabledAttribute,
+											Values: []string{"TRUE"},
+										},
 									},
 								},
 							},
@@ -718,7 +727,7 @@ func TestUpdateUser(t *testing.T) {
 							TimeLimit:    0,
 							TypesOnly:    false,
 							Filter:       "(objectClass=inetOrgPerson)",
-							Attributes:   []string{"displayname", "entryUUID", "mail", "uid", "sn", "givenname"},
+							Attributes:   []string{"displayname", "entryUUID", "mail", "uid", "sn", "givenname", "userEnabledAttribute"},
 							Controls:     []ldap.Control(nil),
 						},
 					},
@@ -744,6 +753,10 @@ func TestUpdateUser(t *testing.T) {
 											Name:   lconfig.UserNameAttribute,
 											Values: []string{"newName"},
 										},
+										{
+											Name:   lconfig.UserEnabledAttribute,
+											Values: []string{"TRUE"},
+										},
 									},
 								},
 							},
@@ -779,6 +792,135 @@ func TestUpdateUser(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "Test changing accountEnabled",
+			args: args{
+				nameOrID: "testUser",
+				userProps: userProps{
+					accountEnabled: false,
+				},
+			},
+			want: &userProps{
+				id:                       "testUser",
+				mail:                     "testuser@example.org",
+				displayName:              "testUser",
+				onPremisesSamAccountName: "testUser",
+				accountEnabled:           false,
+			},
+			assertion: func(t assert.TestingT, err error, args ...interface{}) bool {
+				return assert.Nil(t, err, args...)
+			},
+			ldapMocks: []mockInputs{
+				{
+					funcName: "Search",
+					args: []interface{}{
+						ldap.NewSearchRequest(
+							"ou=people,dc=test",
+							ldap.ScopeWholeSubtree,
+							ldap.NeverDerefAliases, 1, 0, false,
+							"(&(objectClass=inetOrgPerson)(|(uid=testUser)(entryUUID=testUser)))",
+							[]string{"displayname", "entryUUID", "mail", "uid", "sn", "givenname", "userEnabledAttribute"},
+							nil,
+						),
+					},
+					returns: []interface{}{
+						&ldap.SearchResult{
+							Entries: []*ldap.Entry{
+								{
+									DN: "uid=name",
+									Attributes: []*ldap.EntryAttribute{
+										{
+											Name:   "displayname",
+											Values: []string{"testuser@example.org"},
+										},
+										{
+											Name:   "entryUUID",
+											Values: []string{"testUser"},
+										},
+										{
+											Name:   "mail",
+											Values: []string{"testuser@example.org"},
+										},
+										{
+											Name:   lconfig.UserEnabledAttribute,
+											Values: []string{"TRUE"},
+										},
+									},
+								},
+							},
+						},
+						nil,
+					},
+				},
+				{
+					funcName: "Search",
+					args: []interface{}{
+						&ldap.SearchRequest{
+							BaseDN:       "uid=name",
+							Scope:        0,
+							DerefAliases: 0,
+							SizeLimit:    1,
+							TimeLimit:    0,
+							TypesOnly:    false,
+							Filter:       "(objectClass=inetOrgPerson)",
+							Attributes:   []string{"displayname", "entryUUID", "mail", "uid", "sn", "givenname", "userEnabledAttribute"},
+							Controls:     []ldap.Control(nil),
+						},
+					},
+					returns: []interface{}{
+						&ldap.SearchResult{
+							Entries: []*ldap.Entry{
+								{
+									DN: "uid=name",
+									Attributes: []*ldap.EntryAttribute{
+										{
+											Name:   lconfig.UserIDAttribute,
+											Values: []string{"testUser"},
+										},
+										{
+											Name:   lconfig.UserEmailAttribute,
+											Values: []string{"testuser@example.org"},
+										},
+										{
+											Name:   lconfig.UserDisplayNameAttribute,
+											Values: []string{"testUser"},
+										},
+										{
+											Name:   lconfig.UserNameAttribute,
+											Values: []string{"testUser"},
+										},
+										{
+											Name:   lconfig.UserEnabledAttribute,
+											Values: []string{"FALSE"},
+										},
+									},
+								},
+							},
+						},
+						nil,
+					},
+				},
+				{
+					funcName: "Modify",
+					args: []interface{}{
+						&ldap.ModifyRequest{
+							DN: "uid=name",
+							Changes: []ldap.Change{
+								{
+									Operation: 0x2,
+									Modification: ldap.PartialAttribute{
+										Type: lconfig.UserEnabledAttribute,
+										Vals: []string{"FALSE"},
+									},
+								},
+							},
+							Controls: []ldap.Control(nil),
+						},
+					},
+					returns: []interface{}{nil},
+				},
+			},
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -805,6 +947,7 @@ func TestUpdateUser(t *testing.T) {
 					OnPremisesSamAccountName: &tt.want.onPremisesSamAccountName,
 					Surname:                  &emptyString,
 					GivenName:                &emptyString,
+					AccountEnabled:           &tt.want.accountEnabled,
 				}
 			}
 
diff --git a/tests/TestHelpers/GraphHelper.php b/tests/TestHelpers/GraphHelper.php
index 388c36f5088..2f0902bdc69 100644
--- a/tests/TestHelpers/GraphHelper.php
+++ b/tests/TestHelpers/GraphHelper.php
@@ -1019,4 +1019,58 @@ class GraphHelper {
 			self::getRequestHeaders()
 		);
 	}
+
+	/**
+	 * @param string $baseUrl
+	 * @param string $xRequestId
+	 * @param string $user
+	 * @param string $password
+	 * @param string $groupId
+	 *
+	 * @return ResponseInterface
+	 * @throws GuzzleException
+	 */
+	public static function getUsersWithFilterMemberOf(
+		string $baseUrl,
+		string $xRequestId,
+		string $user,
+		string $password,
+		string $groupId
+	): ResponseInterface {
+		$url = self::getFullUrl($baseUrl, 'users' . '?$filter=memberOf/any(m:m/id ' . "eq '$groupId')");
+		return HttpRequestHelper::get(
+			$url,
+			$xRequestId,
+			$user,
+			$password,
+			self::getRequestHeaders()
+		);
+	}
+
+	/**
+	 * @param string $baseUrl
+	 * @param string $xRequestId
+	 * @param string $user
+	 * @param string $password
+	 * @param array $groupIdArray
+	 *
+	 * @return ResponseInterface
+	 * @throws GuzzleException
+	 */
+	public static function getUsersOfTwoGroups(
+		string $baseUrl,
+		string $xRequestId,
+		string $user,
+		string $password,
+		array $groupIdArray
+	): ResponseInterface {
+		$url = self::getFullUrl($baseUrl, 'users' . '?$filter=memberOf/any(m:m/id ' . "eq '$groupIdArray[0]') " . "and memberOf/any(m:m/id eq '$groupIdArray[1]')");
+		return HttpRequestHelper::get(
+			$url,
+			$xRequestId,
+			$user,
+			$password,
+			self::getRequestHeaders()
+		);
+	}
 }
diff --git a/tests/acceptance/config/behat.yml b/tests/acceptance/config/behat.yml
index 422e63d80a0..ed8924b4c3c 100644
--- a/tests/acceptance/config/behat.yml
+++ b/tests/acceptance/config/behat.yml
@@ -53,6 +53,7 @@ default:
         - WebDavPropertiesContext:
         - TUSContext:
         - SpacesTUSContext:
+        - GraphContext:
 
     apiSpacesShares:
       paths:
@@ -75,6 +76,7 @@ default:
         - TUSContext:
         - SpacesTUSContext:
         - ArchiverContext:
+        - GraphContext:
 
     apiContract:
       paths:
@@ -96,6 +98,7 @@ default:
         - WebDavPropertiesContext:
         - TUSContext:
         - SpacesTUSContext:
+        - GraphContext:
 
     apiArchiver:
       paths:
@@ -115,6 +118,7 @@ default:
         - FavoritesContext:
         - TrashbinContext:
         - WebDavPropertiesContext:
+        - GraphContext:
 
     apiGraph:
       paths:
@@ -152,6 +156,7 @@ default:
         - FilesVersionsContext:
         - OCSContext:
         - TrashbinContext:
+        - GraphContext:
 
     apiAsyncUpload:
       paths:
@@ -167,6 +172,7 @@ default:
         - FilesVersionsContext:
         - OCSContext:
         - TrashbinContext:
+        - GraphContext:
 
 
   extensions:
diff --git a/tests/acceptance/expected-failures-localAPI-on-OCIS-storage.md b/tests/acceptance/expected-failures-localAPI-on-OCIS-storage.md
index bfc0b285523..dee2060cd74 100644
--- a/tests/acceptance/expected-failures-localAPI-on-OCIS-storage.md
+++ b/tests/acceptance/expected-failures-localAPI-on-OCIS-storage.md
@@ -29,8 +29,8 @@ The expected failures in this file are from features in the owncloud/ocis repo.
 - [apiSpacesShares/changingFilesShare.feature:12](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiSpacesShares/changingFilesShare.feature#L12)
 
 ### [copy to overwrite (file and folder) from Personal to Shares Jail behaves differently](https://github.com/owncloud/ocis/issues/4393)
-- [apiSpacesShares/copySpaces.feature:487](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiSpacesShares/copySpaces.feature#L487)
-- [apiSpacesShares/copySpaces.feature:501](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiSpacesShares/copySpaces.feature#L501)
+- [apiSpacesShares/copySpaces.feature:529](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiSpacesShares/copySpaces.feature#L529)
+- [apiSpacesShares/copySpaces.feature:543](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiSpacesShares/copySpaces.feature#L543)
 
 #### [PATCH request for TUS upload with wrong checksum gives incorrect response](https://github.com/owncloud/ocis/issues/1755)
 - [apiSpacesShares/shareUploadTUS.feature:204](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiSpacesShares/shareUploadTUS.feature#L204)
@@ -38,9 +38,9 @@ The expected failures in this file are from features in the owncloud/ocis repo.
 - [apiSpacesShares/shareUploadTUS.feature:284](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiSpacesShares/shareUploadTUS.feature#L284)
 
 ### [Copy or move on an existing resource doesn't create a new version but deletes instead](https://github.com/owncloud/ocis/issues/4797)
-- [apiSpacesShares/moveSpaces.feature:306](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiSpacesShares/moveSpaces.feature#L306)
-- [apiSpacesShares/copySpaces.feature:710](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiSpacesShares/copySpaces.feature#L710)
-- [apiSpacesShares/copySpaces.feature:751](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiSpacesShares/copySpaces.feature#L751)
+- [apiSpacesShares/moveSpaces.feature:322](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiSpacesShares/moveSpaces.feature#L322)
+- [apiSpacesShares/copySpaces.feature:752](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiSpacesShares/copySpaces.feature#L752)
+- [apiSpacesShares/copySpaces.feature:793](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiSpacesShares/copySpaces.feature#L793)
 
 ### [Creating group with empty name returns status code 200](https://github.com/owncloud/ocis/issues/5050)
 - [apiGraph/createGroup.feature:40](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiGraph/createGroup.feature#L40)
@@ -79,10 +79,10 @@ The expected failures in this file are from features in the owncloud/ocis repo.
 - [apiSpacesShares/shareSubItemOfSpaceViaPublicLink.feature:62](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiSpacesShares/shareSubItemOfSpaceViaPublicLink.feature#L62)
 - [apiSpacesShares/shareSubItemOfSpaceViaPublicLink.feature:63](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiSpacesShares/shareSubItemOfSpaceViaPublicLink.feature#L63)
 - [apiSpacesShares/shareSubItemOfSpaceViaPublicLink.feature:64](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiSpacesShares/shareSubItemOfSpaceViaPublicLink.feature#L64)
-- [apiSpacesShares/shareSubItemOfSpaceViaPublicLink.feature:90](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiSpacesShares/shareSubItemOfSpaceViaPublicLink.feature#L90)
-- [apiSpacesShares/shareSubItemOfSpaceViaPublicLink.feature:160](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiSpacesShares/shareSubItemOfSpaceViaPublicLink.feature#L160)
-- [apiSpacesShares/shareSubItemOfSpaceViaPublicLink.feature:161](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiSpacesShares/shareSubItemOfSpaceViaPublicLink.feature#L161)
-- [apiSpacesShares/shareSubItemOfSpaceViaPublicLink.feature:162](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiSpacesShares/shareSubItemOfSpaceViaPublicLink.feature#L162)
+- [apiSpacesShares/shareSubItemOfSpaceViaPublicLink.feature:92](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiSpacesShares/shareSubItemOfSpaceViaPublicLink.feature#L92)
+- [apiSpacesShares/shareSubItemOfSpaceViaPublicLink.feature:166](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiSpacesShares/shareSubItemOfSpaceViaPublicLink.feature#L166)
+- [apiSpacesShares/shareSubItemOfSpaceViaPublicLink.feature:167](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiSpacesShares/shareSubItemOfSpaceViaPublicLink.feature#L167)
+- [apiSpacesShares/shareSubItemOfSpaceViaPublicLink.feature:168](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiSpacesShares/shareSubItemOfSpaceViaPublicLink.feature#L168)
 
 #### [Public cannot download folder via the public link of the folder inside the project space](https://github.com/owncloud/ocis/issues/5229)
 - [apiSpacesShares/publicLinkDownload.feature:30](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiSpacesShares/publicLinkDownload.feature#L30)
@@ -97,7 +97,7 @@ The expected failures in this file are from features in the owncloud/ocis repo.
 - [apiAsyncUpload/delayPostprocessing.feature:16](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiAsyncUpload/delayPostprocessing.feature#L16)
 
 #### [Sharing to a group with an expiration date does not work #5442](https://github.com/owncloud/ocis/issues/5442)
-- [apiSpacesShares/shareSubItemOfSpace.feature:99](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiSpacesShares/shareSubItemOfSpace.feature#L99)
+- [apiSpacesShares/shareSubItemOfSpace.feature:105](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiSpacesShares/shareSubItemOfSpace.feature#L105)
 
 #### [Space admin should not not be able to change the user quota](https://github.com/owncloud/ocis/issues/5475)
 - [apiSpaces/spaceManagement.feature:69](https://github.com/owncloud/ocis/blob/master/tests/acceptance/features/apiSpaces/spaceManagement.feature#L69)
diff --git a/tests/acceptance/features/apiContract/propfind.feature b/tests/acceptance/features/apiContract/propfind.feature
index 13cebf83fe1..f778ab51a72 100644
--- a/tests/acceptance/features/apiContract/propfind.feature
+++ b/tests/acceptance/features/apiContract/propfind.feature
@@ -27,7 +27,9 @@ Feature: Propfind test
 
   Scenario Outline: space member with a different role checks the PROPFIND request of a space
     Given user "Alice" has uploaded a file inside space "new-space" with content "some content" to "testfile.txt"
-    And user "Alice" has shared a space "new-space" to user "Brian" with role "<role>"
+    And user "Alice" has shared a space "new-space" with settings:
+      | shareWith | Brian  |
+      | role      | <role> |
     When user "Brian" sends PROPFIND request to space "new-space" using the WebDAV API
     Then the HTTP status code should be "207"
     And the "PROPFIND" response should contain a space "new-space" with these key and value pairs:
diff --git a/tests/acceptance/features/apiGraph/getUser.feature b/tests/acceptance/features/apiGraph/getUser.feature
index f98170a1de8..f5e92927a63 100644
--- a/tests/acceptance/features/apiGraph/getUser.feature
+++ b/tests/acceptance/features/apiGraph/getUser.feature
@@ -29,7 +29,7 @@ Feature: get users
   Scenario: admin user gets all users
     When user "Alice" gets all users using the Graph API
     Then the HTTP status code should be "200"
-    And the API response should contain all users with the following information:
+    And the API response should contain following users with the information:
       | displayName  | id        | mail              | onPremisesSamAccountName |
       | Alice Hansen | %uuid_v4% | alice@example.org | Alice                    |
       | Brian Murphy | %uuid_v4% | brian@example.org | Brian                    |
@@ -96,4 +96,30 @@ Feature: get users
     When the user "Carol" gets user "Brian" along with his group information using Graph API
     Then the HTTP status code should be "401"
     And the last response should be an unauthorized response
-    
\ No newline at end of file
+
+
+  Scenario: admin user gets all users of certain groups
+    Given user "Carol" has been created with default attributes and without skeleton files
+    And group "tea-lover" has been created
+    And group "coffee-lover" has been created
+    And user "Alice" has been added to group "tea-lover"
+    And user "Brian" has been added to group "tea-lover"
+    And user "Brian" has been added to group "coffee-lover"
+    When the user "Alice" gets all users of the group "tea-lover" using the Graph API
+    Then the HTTP status code should be "200"
+    And the API response should contain following users with the information:
+      | displayName  | id        | mail              | onPremisesSamAccountName |
+      | Alice Hansen | %uuid_v4% | alice@example.org | Alice                    |
+      | Brian Murphy | %uuid_v4% | brian@example.org | Brian                    |
+    But the API response should not contain following user with the information:
+      | displayName | id        | mail              | onPremisesSamAccountName |
+      | Carol King  | %uuid_v4% | carol@example.org | Carol                    |
+    When the user "Alice" gets all users of two groups "tea-lover,coffee-lover" using the Graph API
+    Then the HTTP status code should be "200"
+    And the API response should contain following user with the information:
+      | displayName  | id        | mail              | onPremisesSamAccountName |
+      | Brian Murphy | %uuid_v4% | brian@example.org | Brian                    |
+    But the API response should not contain following users with the information:
+      | displayName  | id        | mail              | onPremisesSamAccountName |
+      | Alice Hansen | %uuid_v4% | alice@example.org | Alice                    |
+      | Carol King   | %uuid_v4% | carol@example.org | Carol                    |
diff --git a/tests/acceptance/features/apiSpaces/changeSpaces.feature b/tests/acceptance/features/apiSpaces/changeSpaces.feature
index 93fafaa1c61..85be343617a 100644
--- a/tests/acceptance/features/apiSpaces/changeSpaces.feature
+++ b/tests/acceptance/features/apiSpaces/changeSpaces.feature
@@ -14,8 +14,12 @@ Feature: Change data of space
       | Bob      |
     And the administrator has given "Alice" the role "Space Admin" using the settings api
     And user "Alice" has created a space "Project Jupiter" of type "project" with quota "20"
-    And user "Alice" has shared a space "Project Jupiter" to user "Brian" with role "editor"
-    And user "Alice" has shared a space "Project Jupiter" to user "Bob" with role "viewer"
+    And user "Alice" has shared a space "Project Jupiter" with settings:
+      | shareWith | Brian    |
+      | role      | editor |
+    And user "Alice" has shared a space "Project Jupiter" with settings:
+      | shareWith | Bob    |
+      | role      | viewer |
     And using spaces DAV path
 
 
diff --git a/tests/acceptance/features/apiSpaces/deleteSpaces.feature b/tests/acceptance/features/apiSpaces/deleteSpaces.feature
index 4c387a468ba..b5c6a77a2fa 100644
--- a/tests/acceptance/features/apiSpaces/deleteSpaces.feature
+++ b/tests/acceptance/features/apiSpaces/deleteSpaces.feature
@@ -15,8 +15,12 @@ Feature: Disabling and deleting space
       | Bob      |
     And the administrator has given "Alice" the role "Space Admin" using the settings api
     And user "Alice" has created a space "Project Moon" with the default quota using the GraphApi
-    And user "Alice" has shared a space "Project Moon" to user "Brian" with role "editor"
-    And user "Alice" has shared a space "Project Moon" to user "Bob" with role "viewer"
+    And user "Alice" has shared a space "Project Moon" with settings:
+      | shareWith | Brian  |
+      | role      | editor |
+    And user "Alice" has shared a space "Project Moon" with settings:
+      | shareWith | Bob    |
+      | role      | viewer |
 
 
   Scenario Outline: A space admin user can disable a Space via the Graph API
diff --git a/tests/acceptance/features/apiSpaces/download.feature b/tests/acceptance/features/apiSpaces/download.feature
index af74af5841b..80f70c043dd 100644
--- a/tests/acceptance/features/apiSpaces/download.feature
+++ b/tests/acceptance/features/apiSpaces/download.feature
@@ -1,52 +1,56 @@
 @api @skipOnOcV10
 Feature: Download file in project space
-    As a user with different role, I want to be able to download files
+  As a user with different role, I want to be able to download files
 
-    Note - this feature is run in CI with ACCOUNTS_HASH_DIFFICULTY set to the default for production
-    See https://github.com/owncloud/ocis/issues/1542 and https://github.com/owncloud/ocis/pull/839
+  Note - this feature is run in CI with ACCOUNTS_HASH_DIFFICULTY set to the default for production
+  See https://github.com/owncloud/ocis/issues/1542 and https://github.com/owncloud/ocis/pull/839
 
-    Background:
-        Given these users have been created with default attributes and without skeleton files:
-            | username |
-            | Alice    |
-            | Brian    |
-            | Bob    |
-        And using spaces DAV path
-        And the administrator has given "Alice" the role "Space Admin" using the settings api
-        And user "Alice" has created a space "download file" with the default quota using the GraphApi
-        And user "Alice" has uploaded a file inside space "download file" with content "some content" to "file.txt"
-        And user "Alice" has shared a space "download file" to user "Brian" with role "editor"
-        And user "Alice" has shared a space "download file" to user "Bob" with role "viewer"
+  Background:
+    Given these users have been created with default attributes and without skeleton files:
+      | username |
+      | Alice    |
+      | Brian    |
+      | Bob      |
+    And using spaces DAV path
+    And the administrator has given "Alice" the role "Space Admin" using the settings api
+    And user "Alice" has created a space "download file" with the default quota using the GraphApi
+    And user "Alice" has uploaded a file inside space "download file" with content "some content" to "file.txt"
+    And user "Alice" has shared a space "download file" with settings:
+      | shareWith | Brian  |
+      | role      | editor |
+    And user "Alice" has shared a space "download file" with settings:
+      | shareWith | Bob    |
+      | role      | viewer |
 
 
-    Scenario Outline: An user downloads a file in the project space
-        When user "<user>" downloads the file "file.txt" of the space "download file" using the WebDAV API
-        Then the HTTP status code should be "200"
-        And the following headers should be set
-            | header         | value |
-            | Content-Length | 12    |
-        Examples:
-            | user  |
-            | Alice |
-            | Brian |
-            | Bob   |
+  Scenario Outline: An user downloads a file in the project space
+    When user "<user>" downloads the file "file.txt" of the space "download file" using the WebDAV API
+    Then the HTTP status code should be "200"
+    And the following headers should be set
+      | header         | value |
+      | Content-Length | 12    |
+    Examples:
+      | user  |
+      | Alice |
+      | Brian |
+      | Bob   |
 
 
-    Scenario Outline: An user downloads an old version of the file in the project space
-        Given user "Alice" has uploaded a file inside space "download file" with content "new content" to "file.txt"
-        And user "Alice" has uploaded a file inside space "download file" with content "newest content" to "file.txt"
-        When user "<user>" downloads version of the file "file.txt" with the index "1" of the space "download file" using the WebDAV API
-        Then the HTTP status code should be "200"
-        And the following headers should be set
-            | header         | value |
-            | Content-Length | 11    |
-        When user "<user>" downloads version of the file "file.txt" with the index "2" of the space "download file" using the WebDAV API
-        Then the HTTP status code should be "200"
-        And the following headers should be set
-            | header         | value |
-            | Content-Length | 12    |
-        Examples:
-            | user  |
-            | Alice |
-            | Brian |
-            | Bob   |
+  Scenario Outline: An user downloads an old version of the file in the project space
+    Given user "Alice" has uploaded a file inside space "download file" with content "new content" to "file.txt"
+    And user "Alice" has uploaded a file inside space "download file" with content "newest content" to "file.txt"
+    When user "<user>" downloads version of the file "file.txt" with the index "1" of the space "download file" using the WebDAV API
+    Then the HTTP status code should be "200"
+    And the following headers should be set
+      | header         | value |
+      | Content-Length | 11    |
+    When user "<user>" downloads version of the file "file.txt" with the index "2" of the space "download file" using the WebDAV API
+    Then the HTTP status code should be "200"
+    And the following headers should be set
+      | header         | value |
+      | Content-Length | 12    |
+    Examples:
+      | user  |
+      | Alice |
+      | Brian |
+      | Bob   |
diff --git a/tests/acceptance/features/apiSpaces/editPublicLinkOfSpace.feature b/tests/acceptance/features/apiSpaces/editPublicLinkOfSpace.feature
index e3e6f63f4a9..9f3e825b7ac 100644
--- a/tests/acceptance/features/apiSpaces/editPublicLinkOfSpace.feature
+++ b/tests/acceptance/features/apiSpaces/editPublicLinkOfSpace.feature
@@ -53,7 +53,9 @@ Feature: A manager of the space can edit public link
 
   Scenario Outline: All members can see a created public link
     Given using OCS API version "2"
-    When user "Alice" shares a space "edit space" to user "Brian" with role "<role>"
+    When user "Alice" shares a space "edit space" with settings:
+      | shareWith | Brian  |
+      | role      | <role> |
     Then the HTTP status code should be "200"
     And the OCS status code should be "200"
     And for user "Alice" the space "edit space" should contain the last created public link
@@ -67,7 +69,9 @@ Feature: A manager of the space can edit public link
 
   Scenario Outline: Members of the space try to edit a public link
     Given using OCS API version "2"
-    And user "Alice" has shared a space "edit space" to user "Brian" with role "<role>"
+    And user "Alice" has shared a space "edit space" with settings:
+      | shareWith | Brian  |
+      | role      | <role> |
     When user "Brian" updates the last public link share using the sharing API with
       | permissions | 15 |
     Then the HTTP status code should be "<code>"
diff --git a/tests/acceptance/features/apiSpaces/removeSpaceObjects.feature b/tests/acceptance/features/apiSpaces/removeSpaceObjects.feature
index 3a679d4ecc3..90eecbaf3c1 100644
--- a/tests/acceptance/features/apiSpaces/removeSpaceObjects.feature
+++ b/tests/acceptance/features/apiSpaces/removeSpaceObjects.feature
@@ -21,7 +21,9 @@ Feature: Remove files, folder
 
 
   Scenario Outline: An user deletes a folder with some subfolders in a Space via the webDav API
-    Given user "Alice" has shared a space "delete objects" to user "Brian" with role "<role>"
+    Given user "Alice" has shared a space "delete objects" with settings:
+      | shareWith | Brian  |
+      | role      | <role> |
     When user "<user>" removes the folder "folderForDeleting" from space "delete objects"
     Then the HTTP status code should be "<code>"
     And for user "<user>" the space "delete objects" <shouldOrNotBeInSpace> contain these entries:
@@ -36,7 +38,9 @@ Feature: Remove files, folder
 
 
   Scenario Outline: An user deletes a subfolder in a Space via the webDav API
-    Given user "Alice" has shared a space "delete objects" to user "Brian" with role "<role>"
+    Given user "Alice" has shared a space "delete objects" with settings:
+      | shareWith | Brian  |
+      | role      | <role> |
     When user "<user>" removes the folder "folderForDeleting/sub1" from space "delete objects"
     Then the HTTP status code should be "<code>"
     And for user "<user>" the space "delete objects" should contain these entries:
@@ -53,7 +57,9 @@ Feature: Remove files, folder
 
 
   Scenario Outline: An user deletes a file in a Space via the webDav API
-    Given user "Alice" has shared a space "delete objects" to user "Brian" with role "<role>"
+    Given user "Alice" has shared a space "delete objects" with settings:
+      | shareWith | Brian  |
+      | role      | <role> |
     When user "<user>" removes the file "text.txt" from space "delete objects"
     Then the HTTP status code should be "<code>"
     And for user "<user>" the space "delete objects" <shouldOrNotBeInSpace> contain these entries:
diff --git a/tests/acceptance/features/apiSpaces/restoreSpaceObjects.feature b/tests/acceptance/features/apiSpaces/restoreSpaceObjects.feature
index 32671a337c7..52cbdf99cb6 100644
--- a/tests/acceptance/features/apiSpaces/restoreSpaceObjects.feature
+++ b/tests/acceptance/features/apiSpaces/restoreSpaceObjects.feature
@@ -22,7 +22,9 @@ Feature: Restore files, folder
 
 
   Scenario Outline: The user with different role can see deleted objects in trash bin of the space via the webDav API
-    Given user "Alice" has shared a space "restore objects" to user "Brian" with role "<role>"
+    Given user "Alice" has shared a space "restore objects" with settings:
+      | shareWith | Brian  |
+      | role      | <role> |
     And user "Alice" has removed the file "newFolder/file.txt" from space "restore objects"
     And user "Alice" has removed the folder "newFolder" from space "restore objects"
     When user "<user>" lists all deleted files in the trash bin of the space "restore objects"
@@ -37,7 +39,9 @@ Feature: Restore files, folder
 
 
   Scenario Outline: The user can restore a folder with some objects from the trash via the webDav API
-    Given user "Alice" has shared a space "restore objects" to user "Brian" with role "<role>"
+    Given user "Alice" has shared a space "restore objects" with settings:
+      | shareWith | Brian  |
+      | role      | <role> |
     And user "Alice" has removed the folder "newFolder" from space "restore objects"
     When user "<user>" restores the folder "newFolder" from the trash of the space "restore objects" to "/newFolder"
     Then the HTTP status code should be "<code>"
@@ -53,7 +57,9 @@ Feature: Restore files, folder
 
 
   Scenario Outline: The user can restore a file from the trash via the webDav API
-    Given user "Alice" has shared a space "restore objects" to user "Brian" with role "<role>"
+    Given user "Alice" has shared a space "restore objects" with settings:
+      | shareWith | Brian  |
+      | role      | <role> |
     And user "Alice" has removed the file "newFolder/file.txt" from space "restore objects"
     When user "<user>" restores the file "file.txt" from the trash of the space "restore objects" to "newFolder/file.txt"
     Then the HTTP status code should be "<code>"
diff --git a/tests/acceptance/features/apiSpaces/restoreSpaces.feature b/tests/acceptance/features/apiSpaces/restoreSpaces.feature
index 893f46dadb8..c7ab87e5c3e 100644
--- a/tests/acceptance/features/apiSpaces/restoreSpaces.feature
+++ b/tests/acceptance/features/apiSpaces/restoreSpaces.feature
@@ -28,8 +28,12 @@ Feature: Restoring space
   Scenario: Participants can see the data after the space is restored
     Given user "Alice" has created a folder "mainFolder" in space "restore a space"
     And user "Alice" has uploaded a file inside space "restore a space" with content "example" to "test.txt"
-    And user "Alice" has shared a space "restore a space" to user "Brian" with role "editor"
-    And user "Alice" has shared a space "restore a space" to user "Bob" with role "viewer"
+    And user "Alice" has shared a space "restore a space" with settings:
+      | shareWith | Brian  |
+      | role      | editor |
+    And user "Alice" has shared a space "restore a space" with settings:
+      | shareWith | Bob    |
+      | role      | viewer |
     And user "Alice" has disabled a space "restore a space"
     When user "Alice" restores a disabled space "restore a space"
     Then for user "Alice" the space "restore a space" should contain these entries:
@@ -44,7 +48,9 @@ Feature: Restoring space
 
 
   Scenario: Participant can create data in the space after restoring
-    Given user "Alice" has shared a space "restore a space" to user "Brian" with role "editor"
+    Given user "Alice" has shared a space "restore a space" with settings:
+      | shareWith | Brian  |
+      | role      | editor |
     And user "Alice" has disabled a space "restore a space"
     And user "Alice" has restored a disabled space "restore a space"
     When user "Brian" creates a folder "mainFolder" in space "restore a space" using the WebDav Api
@@ -55,7 +61,9 @@ Feature: Restoring space
 
 
   Scenario Outline: User without space manager role cannot restore space
-    Given user "Alice" has shared a space "restore a space" to user "Brian" with role "<role>"
+    Given user "Alice" has shared a space "restore a space" with settings:
+      | shareWith | Brian  |
+      | role      | <role> |
     And user "Alice" has disabled a space "restore a space"
     When user "Brian" restores a disabled space "restore a space" owned by user "Alice"
     Then the HTTP status code should be "404"
diff --git a/tests/acceptance/features/apiSpaces/tag.feature b/tests/acceptance/features/apiSpaces/tag.feature
index 26f382004c2..e9ddd4da242 100644
--- a/tests/acceptance/features/apiSpaces/tag.feature
+++ b/tests/acceptance/features/apiSpaces/tag.feature
@@ -18,7 +18,9 @@ Feature: Tag
 
 
   Scenario: Alice creates tags for resources in the project space
-    Given user "Alice" has shared a space "use-tag" to user "Brian" with role "viewer"
+    Given user "Alice" has shared a space "use-tag" with settings:
+      | shareWith | Brian  |
+      | role      | viewer |
     When user "Alice" creates the following tags for folder "folderMain" of space "use-tag":
       | tag level#1                    |
       | tag with symbols @^$#^%$@%!_+) |
@@ -81,7 +83,9 @@ Feature: Tag
 
 
   Scenario Outline: Member of the space tries to create tag
-    Given user "Alice" has shared a space "use-tag" to user "Brian" with role "<role>"
+    Given user "Alice" has shared a space "use-tag" with settings:
+      | shareWith | Brian  |
+      | role      | <role> |
     When user "Brian" creates the following tags for folder "folderMain/insideTheFolder.txt" of space "use-tag":
       | tag level#1                    |
       | tag with symbols @^$#^%$@%!_+) |
diff --git a/tests/acceptance/features/apiSpaces/uploadSpaces.feature b/tests/acceptance/features/apiSpaces/uploadSpaces.feature
index c987c688d25..b328b7c2d49 100644
--- a/tests/acceptance/features/apiSpaces/uploadSpaces.feature
+++ b/tests/acceptance/features/apiSpaces/uploadSpaces.feature
@@ -18,7 +18,9 @@ Feature: Upload files into a space
 
 
   Scenario Outline: An user creates a folder in the Space via the Graph API
-    And user "Alice" has shared a space "Project Ceres" to user "Brian" with role "<role>"
+    Given user "Alice" has shared a space "Project Ceres" with settings:
+      | shareWith | Brian  |
+      | role      | <role> |
     When user "Brian" creates a folder "mainFolder" in space "Project Ceres" using the WebDav Api
     Then the HTTP status code should be "<code>"
     And for user "Brian" the space "Project Ceres" <shouldOrNot> contain these entries:
@@ -31,7 +33,9 @@ Feature: Upload files into a space
 
 
   Scenario Outline: An user uploads a file in shared Space via the Graph API
-    And user "Alice" has shared a space "Project Ceres" to user "Brian" with role "<role>"
+    Given user "Alice" has shared a space "Project Ceres" with settings:
+      | shareWith | Brian  |
+      | role      | <role> |
     When user "Brian" uploads a file inside space "Project Ceres" with content "Test" to "test.txt" using the WebDAV API
     Then the HTTP status code should be "<code>"
     And for user "Brian" the space "Project Ceres" <shouldOrNot> contain these entries:
diff --git a/tests/acceptance/features/apiSpacesShares/copySpaces.feature b/tests/acceptance/features/apiSpacesShares/copySpaces.feature
index ef78faa1134..33a12f8289b 100644
--- a/tests/acceptance/features/apiSpacesShares/copySpaces.feature
+++ b/tests/acceptance/features/apiSpacesShares/copySpaces.feature
@@ -17,7 +17,9 @@ Feature: copy file
     And user "Alice" has created a space "Project" with the default quota using the GraphApi
     And user "Alice" has created a folder "/newfolder" in space "Project"
     And user "Alice" has uploaded a file inside space "Project" with content "some content" to "/insideSpace.txt"
-    And user "Alice" has shared a space "Project" to user "Brian" with role "<role>"
+    And user "Alice" has shared a space "Project" with settings:
+      | shareWith | Brian  |
+      | role      | <role> |
     When user "Brian" copies file "/insideSpace.txt" to "/newfolder/insideSpace.txt" inside space "Project" using the WebDAV API
     Then the HTTP status code should be "201"
     And for user "Brian" the space "Project" should contain these entries:
@@ -34,7 +36,9 @@ Feature: copy file
     And user "Alice" has created a space "Project" with the default quota using the GraphApi
     And user "Alice" has created a folder "/newfolder" in space "Project"
     And user "Alice" has uploaded a file inside space "Project" with content "some content" to "insideSpace.txt"
-    And user "Alice" has shared a space "Project" to user "Brian" with role "viewer"
+    And user "Alice" has shared a space "Project" with settings:
+      | shareWith | Brian  |
+      | role      | viewer |
     When user "Brian" copies file "/insideSpace.txt" to "/newfolder/insideSpace.txt" inside space "Project" using the WebDAV API
     Then the HTTP status code should be "403"
     And for user "Brian" the space "Project" should not contain these entries:
@@ -46,8 +50,12 @@ Feature: copy file
     And user "Brian" has created a space "Project1" with the default quota using the GraphApi
     And user "Brian" has created a space "Project2" with the default quota using the GraphApi
     And user "Brian" has uploaded a file inside space "Project1" with content "Project1 content" to "/project1.txt"
-    And user "Brian" has shared a space "Project2" to user "Alice" with role "<to_role>"
-    And user "Brian" has shared a space "Project1" to user "Alice" with role "<from_role>"
+    And user "Brian" has shared a space "Project2" with settings:
+      | shareWith | Alice     |
+      | role      | <to_role> |
+    And user "Brian" has shared a space "Project1" with settings:
+      | shareWith | Alice       |
+      | role      | <from_role> |
     When user "Alice" copies file "/project1.txt" from space "Project1" to "/project1.txt" inside space "Project2" using the WebDAV API
     Then the HTTP status code should be "201"
     And for user "Alice" the space "Project2" should contain these entries:
@@ -66,8 +74,12 @@ Feature: copy file
     And user "Brian" has created a space "Project1" with the default quota using the GraphApi
     And user "Brian" has created a space "Project2" with the default quota using the GraphApi
     And user "Brian" has uploaded a file inside space "Project1" with content "Project1 content" to "/project1.txt"
-    And user "Brian" has shared a space "Project2" to user "Alice" with role "viewer"
-    And user "Brian" has shared a space "Project1" to user "Alice" with role "<role>"
+    And user "Brian" has shared a space "Project2" with settings:
+      | shareWith | Alice  |
+      | role      | viewer |
+    And user "Brian" has shared a space "Project1" with settings:
+      | shareWith | Alice  |
+      | role      | <role> |
     When user "Alice" copies file "/project1.txt" from space "Project1" to "/project1.txt" inside space "Project2" using the WebDAV API
     Then the HTTP status code should be "403"
     And for user "Alice" the space "Project2" should not contain these entries:
@@ -82,7 +94,9 @@ Feature: copy file
     Given the administrator has given "Brian" the role "Space Admin" using the settings api
     And user "Brian" has created a space "Project" with the default quota using the GraphApi
     And user "Brian" has uploaded a file inside space "Project" with content "Project content" to "/project.txt"
-    And user "Brian" has shared a space "Project" to user "Alice" with role "<role>"
+    And user "Brian" has shared a space "Project" with settings:
+      | shareWith | Alice  |
+      | role      | <role> |
     When user "Alice" copies file "/project.txt" from space "Project" to "/project.txt" inside space "Personal" using the WebDAV API
     Then the HTTP status code should be "201"
     And for user "Alice" the space "Personal" should contain these entries:
@@ -100,7 +114,9 @@ Feature: copy file
     And user "Brian" has created a space "Project" with the default quota using the GraphApi
     And user "Brian" has created folder "/testshare"
     And user "Brian" has uploaded a file inside space "Project" with content "Project content" to "/project.txt"
-    And user "Brian" has shared a space "Project" to user "Alice" with role "<role>"
+    And user "Brian" has shared a space "Project" with settings:
+      | shareWith | Alice  |
+      | role      | <role> |
     And user "Brian" has shared folder "/testshare" with user "Alice" with permissions "31"
     And user "Alice" has accepted share "/testshare" offered by user "Brian"
     When user "Alice" copies file "/project.txt" from space "Project" to "/testshare/project.txt" inside space "Shares" using the WebDAV API
@@ -120,7 +136,9 @@ Feature: copy file
     And user "Brian" has created a space "Project" with the default quota using the GraphApi
     And user "Brian" has created folder "/testshare"
     And user "Brian" has uploaded a file inside space "Project" with content "Project content" to "/project.txt"
-    And user "Brian" has shared a space "Project" to user "Alice" with role "<role>"
+    And user "Brian" has shared a space "Project" with settings:
+      | shareWith | Alice  |
+      | role      | <role> |
     And user "Brian" has shared folder "/testshare" with user "Alice" with permissions "17"
     And user "Alice" has accepted share "/testshare" offered by user "Brian"
     When user "Alice" copies file "/project.txt" from space "Project" to "/testshare/project.txt" inside space "Shares" using the WebDAV API
@@ -137,7 +155,9 @@ Feature: copy file
   Scenario Outline: User copies a file from space personal to space project with different role
     Given the administrator has given "Brian" the role "Space Admin" using the settings api
     And user "Brian" has created a space "Project" with the default quota using the GraphApi
-    And user "Brian" has shared a space "Project" to user "Alice" with role "<role>"
+    And user "Brian" has shared a space "Project" with settings:
+      | shareWith | Alice  |
+      | role      | <role> |
     And user "Alice" has uploaded file with content "personal space content" to "/personal.txt"
     When user "Alice" copies file "/personal.txt" from space "Personal" to "/personal.txt" inside space "Project" using the WebDAV API
     Then the HTTP status code should be "201"
@@ -153,7 +173,9 @@ Feature: copy file
   Scenario: User copies a file from space personal to space project with role viewer
     Given the administrator has given "Brian" the role "Space Admin" using the settings api
     And user "Brian" has created a space "Project" with the default quota using the GraphApi
-    And user "Brian" has shared a space "Project" to user "Alice" with role "viewer"
+    And user "Brian" has shared a space "Project" with settings:
+      | shareWith | Alice  |
+      | role      | viewer |
     And user "Alice" has uploaded file with content "personal space content" to "/personal.txt"
     When user "Alice" copies file "/personal.txt" from space "Personal" to "/personal.txt" inside space "Project" using the WebDAV API
     Then the HTTP status code should be "403"
@@ -204,7 +226,9 @@ Feature: copy file
   Scenario Outline: User copies a file from space Shares with different role to space project with different role
     Given the administrator has given "Brian" the role "Space Admin" using the settings api
     And user "Brian" has created a space "Project" with the default quota using the GraphApi
-    And user "Brian" has shared a space "Project" to user "Alice" with role "<role>"
+    And user "Brian" has shared a space "Project" with settings:
+      | shareWith | Alice  |
+      | role      | <role> |
     And user "Brian" has created folder "/testshare"
     And user "Brian" has uploaded file with content "testshare content" to "/testshare/testshare.txt"
     And user "Brian" has shared folder "/testshare" with user "Alice" with permissions "<permissions>"
@@ -225,7 +249,9 @@ Feature: copy file
   Scenario Outline: User copies a file from space Shares with different role to space project with role viewer
     Given the administrator has given "Brian" the role "Space Admin" using the settings api
     And user "Brian" has created a space "Project" with the default quota using the GraphApi
-    And user "Brian" has shared a space "Project" to user "Alice" with role "viewer"
+    And user "Brian" has shared a space "Project" with settings:
+      | shareWith | Alice  |
+      | role      | viewer |
     And user "Brian" has created folder "/testshare"
     And user "Brian" has uploaded file with content "testshare content" to "/testshare/testshare.txt"
     And user "Brian" has shared folder "/testshare" with user "Alice" with permissions "<permissions>"
@@ -288,7 +314,9 @@ Feature: copy file
     And user "Alice" has created a folder "/folder1" in space "Project"
     And user "Alice" has created a folder "/folder2" in space "Project"
     And user "Alice" has uploaded a file inside space "Project" with content "some content" to "/folder2/demo.txt"
-    And user "Alice" has shared a space "Project" to user "Brian" with role "<role>"
+    And user "Alice" has shared a space "Project" with settings:
+      | shareWith | Brian  |
+      | role      | <role> |
     When user "Brian" copies folder "/folder2" to "/folder1/folder2" inside space "Project" using the WebDAV API
     Then the HTTP status code should be "<status-code>"
     And for user "Brian" the space "Project" <shouldOrNot> contain these entries:
@@ -306,8 +334,12 @@ Feature: copy file
     And user "Brian" has created a space "Project2" with the default quota using the GraphApi
     And user "Brian" has created a folder "/folder1" in space "Project1"
     And user "Brian" has uploaded a file inside space "Project1" with content "some content" to "/folder1/demo.txt"
-    And user "Brian" has shared a space "Project2" to user "Alice" with role "<to_role>"
-    And user "Brian" has shared a space "Project1" to user "Alice" with role "<from_role>"
+    And user "Brian" has shared a space "Project2" with settings:
+      | shareWith | Alice     |
+      | role      | <to_role> |
+    And user "Brian" has shared a space "Project1" with settings:
+      | shareWith | Alice       |
+      | role      | <from_role> |
     When user "Alice" copies folder "/folder1" from space "Project1" to "/folder1" inside space "Project2" using the WebDAV API
     Then the HTTP status code should be "<status-code>"
     And for user "Alice" the space "Project2" <shouldOrNot> contain these entries:
@@ -328,7 +360,9 @@ Feature: copy file
     And user "Brian" has created a space "Project" with the default quota using the GraphApi
     And user "Brian" has created a folder "/folder1" in space "Project"
     And user "Brian" has uploaded a file inside space "Project" with content "some content" to "/folder1/demo.txt"
-    And user "Brian" has shared a space "Project" to user "Alice" with role "<role>"
+    And user "Brian" has shared a space "Project" with settings:
+      | shareWith | Alice  |
+      | role      | <role> |
     When user "Alice" copies file "/folder1" from space "Project" to "/folder1" inside space "Personal" using the WebDAV API
     Then the HTTP status code should be "201"
     And for user "Alice" the space "Personal" should contain these entries:
@@ -346,7 +380,9 @@ Feature: copy file
     And user "Brian" has created folder "/testshare"
     And user "Brian" has created a folder "/folder1" in space "Project"
     And user "Brian" has uploaded a file inside space "Project" with content "some content" to "/folder1/demo.txt"
-    And user "Brian" has shared a space "Project" to user "Alice" with role "<role>"
+    And user "Brian" has shared a space "Project" with settings:
+      | shareWith | Alice  |
+      | role      | <role> |
     And user "Brian" has shared folder "/testshare" with user "Alice" with permissions "<permissions>"
     And user "Alice" has accepted share "/testshare" offered by user "Brian"
     When user "Alice" copies folder "/folder1" from space "Project" to "/testshare/folder1" inside space "Shares" using the WebDAV API
@@ -366,7 +402,9 @@ Feature: copy file
   Scenario Outline: User copies a folder from space personal to space project with different role
     Given the administrator has given "Brian" the role "Space Admin" using the settings api
     And user "Brian" has created a space "Project" with the default quota using the GraphApi
-    And user "Brian" has shared a space "Project" to user "Alice" with role "<role>"
+    And user "Brian" has shared a space "Project" with settings:
+      | shareWith | Alice  |
+      | role      | <role> |
     And user "Alice" has created folder "/folder1"
     And user "Alice" has uploaded file with content "some content" to "folder1/demo.txt"
     When user "Alice" copies folder "/folder1" from space "Personal" to "/folder1" inside space "Project" using the WebDAV API
@@ -416,7 +454,9 @@ Feature: copy file
   Scenario Outline: User copies a folder from space Shares with different role to space project with different role
     Given the administrator has given "Brian" the role "Space Admin" using the settings api
     And user "Brian" has created a space "Project" with the default quota using the GraphApi
-    And user "Brian" has shared a space "Project" to user "Alice" with role "<role>"
+    And user "Brian" has shared a space "Project" with settings:
+      | shareWith | Alice  |
+      | role      | <role> |
     And user "Brian" has created folder "/testshare"
     And user "Brian" has created folder "/testshare/folder1"
     And user "Brian" has uploaded file with content "testshare content" to "/testshare/folder1/testshare.txt"
@@ -437,7 +477,9 @@ Feature: copy file
   Scenario Outline: User copies a folder from space Shares with different role to space project with role viewer
     Given the administrator has given "Brian" the role "Space Admin" using the settings api
     And user "Brian" has created a space "Project" with the default quota using the GraphApi
-    And user "Brian" has shared a space "Project" to user "Alice" with role "viewer"
+    And user "Brian" has shared a space "Project" with settings:
+      | shareWith | Alice  |
+      | role      | viewer |
     And user "Brian" has created folder "/testshare"
     And user "Brian" has created folder "/testshare/folder1"
     And user "Brian" has uploaded file with content "testshare content" to "/testshare/folder1/testshare.txt"
diff --git a/tests/acceptance/features/apiSpacesShares/moveSpaces.feature b/tests/acceptance/features/apiSpacesShares/moveSpaces.feature
index 04b0f44bd9e..c56af234a4a 100644
--- a/tests/acceptance/features/apiSpacesShares/moveSpaces.feature
+++ b/tests/acceptance/features/apiSpacesShares/moveSpaces.feature
@@ -17,7 +17,9 @@ Feature: move (rename) file
     And user "Brian" has created a space "Project" with the default quota using the GraphApi
     And user "Brian" has created a folder "newfolder" in space "Project"
     And user "Brian" has uploaded a file inside space "Project" with content "some content" to "insideSpace.txt"
-    And user "Brian" has shared a space "Project" to user "Alice" with role "<role>"
+    And user "Brian" has shared a space "Project" with settings:
+      | shareWith | Alice  |
+      | role      | <role> |
     When user "Alice" moves file "insideSpace.txt" to "newfolder/insideSpace.txt" in space "Project" using the WebDAV API
     Then the HTTP status code should be "201"
     And for user "Alice" the space "Project" should contain these entries:
@@ -35,7 +37,9 @@ Feature: move (rename) file
     And user "Brian" has created a space "Project" with the default quota using the GraphApi
     And user "Brian" has created a folder "newfolder" in space "Project"
     And user "Brian" has uploaded a file inside space "Project" with content "some content" to "insideSpace.txt"
-    And user "Brian" has shared a space "Project" to user "Alice" with role "viewer"
+    And user "Brian" has shared a space "Project" with settings:
+      | shareWith | Alice  |
+      | role      | viewer |
     When user "Alice" moves file "insideSpace.txt" to "newfolder/insideSpace.txt" in space "Project" using the WebDAV API
     Then the HTTP status code should be "403"
     And for user "Alice" the space "Project" should not contain these entries:
@@ -49,8 +53,12 @@ Feature: move (rename) file
     And user "Brian" has created a space "Project1" with the default quota using the GraphApi
     And user "Brian" has created a space "Project2" with the default quota using the GraphApi
     And user "Brian" has uploaded a file inside space "Project1" with content "Project1 content" to "project1.txt"
-    And user "Brian" has shared a space "Project2" to user "Alice" with role "<to_role>"
-    And user "Brian" has shared a space "Project1" to user "Alice" with role "<from_role>"
+    And user "Brian" has shared a space "Project2" with settings:
+      | shareWith | Alice     |
+      | role      | <to_role> |
+    And user "Brian" has shared a space "Project1" with settings:
+      | shareWith | Alice       |
+      | role      | <from_role> |
     When user "Alice" moves file "project1.txt" from space "Project1" to "project1.txt" inside space "Project2" using the WebDAV API
     Then the HTTP status code should be "<https_status_code>"
     And for user "Alice" the space "Project1" should contain these entries:
@@ -74,7 +82,9 @@ Feature: move (rename) file
     Given the administrator has given "Brian" the role "Space Admin" using the settings api
     And user "Brian" has created a space "Project" with the default quota using the GraphApi
     And user "Brian" has uploaded a file inside space "Project" with content "Project content" to "project.txt"
-    And user "Brian" has shared a space "Project" to user "Alice" with role "<role>"
+    And user "Brian" has shared a space "Project" with settings:
+      | shareWith | Alice  |
+      | role      | <role> |
     When user "Alice" moves file "project.txt" from space "Project" to "project.txt" inside space "Personal" using the WebDAV API
     Then the HTTP status code should be "<https_status_code>"
     And for user "Alice" the space "Project" should contain these entries:
@@ -93,7 +103,9 @@ Feature: move (rename) file
     And user "Brian" has created a space "Project" with the default quota using the GraphApi
     And user "Brian" has created folder "/testshare"
     And user "Brian" has uploaded a file inside space "Project" with content "Project content" to "project.txt"
-    And user "Brian" has shared a space "Project" to user "Alice" with role "<role>"
+    And user "Brian" has shared a space "Project" with settings:
+      | shareWith | Alice  |
+      | role      | <role> |
     And user "Brian" has shared folder "/testshare" with user "Alice" with permissions "<permissions>"
     And user "Alice" has accepted share "/testshare" offered by user "Brian"
     When user "Alice" moves file "project.txt" from space "Project" to "/testshare/project.txt" inside space "Shares" using the WebDAV API
@@ -115,7 +127,9 @@ Feature: move (rename) file
   Scenario Outline: User moves a file from space personal to space project with different role
     Given the administrator has given "Brian" the role "Space Admin" using the settings api
     And user "Brian" has created a space "Project" with the default quota using the GraphApi
-    And user "Brian" has shared a space "Project" to user "Alice" with role "<role>"
+    And user "Brian" has shared a space "Project" with settings:
+      | shareWith | Alice  |
+      | role      | <role> |
     And user "Alice" has uploaded file with content "personal space content" to "/personal.txt"
     When user "Alice" moves file "personal.txt" from space "Personal" to "personal.txt" inside space "Project" using the WebDAV API
     Then the HTTP status code should be "<https_status_code>"
@@ -169,7 +183,9 @@ Feature: move (rename) file
   Scenario Outline: User moves a file from space Shares with different role (permissions) to space project with different role
     Given the administrator has given "Brian" the role "Space Admin" using the settings api
     And user "Brian" has created a space "Project" with the default quota using the GraphApi
-    And user "Brian" has shared a space "Project" to user "Alice" with role "<role>"
+    And user "Brian" has shared a space "Project" with settings:
+      | shareWith | Alice  |
+      | role      | <role> |
     And user "Brian" has created folder "/testshare"
     And user "Brian" has uploaded file with content "testshare content" to "/testshare/testshare.txt"
     And user "Brian" has shared folder "/testshare" with user "Alice" with permissions "<permissions>"
diff --git a/tests/acceptance/features/apiSpacesShares/shareSpaces.feature b/tests/acceptance/features/apiSpacesShares/shareSpaces.feature
index 239105cf9b1..3ce7b96bd3e 100644
--- a/tests/acceptance/features/apiSpacesShares/shareSpaces.feature
+++ b/tests/acceptance/features/apiSpacesShares/shareSpaces.feature
@@ -18,7 +18,9 @@ Feature: Share spaces
 
 
   Scenario Outline: A Space Admin can share a space to another user
-    When user "Alice" shares a space "share space" to user "Brian" with role "<role>"
+    When user "Alice" shares a space "share space" with settings:
+      | shareWith | Brian  |
+      | role      | <role> |
     Then the HTTP status code should be "200"
     And the OCS status code should be "200"
     And the OCS status message should be "OK"
@@ -35,29 +37,38 @@ Feature: Share spaces
 
 
   Scenario: A user can see who has been granted access
-    When user "Alice" shares a space "share space" to user "Brian" with role "viewer"
+    When user "Alice" shares a space "share space" with settings:
+      | shareWith | Brian  |
+      | role      | viewer |
     Then the user "Alice" should have a space called "share space" granted to user "Brian" with role "viewer"
 
 
   Scenario: A user can see that the group has been granted access
     Given group "sales" has been created
-    When user "Alice" shares a space "share space" to group "sales" with role "viewer"
+    When user "Alice" shares a space "share space" with settings:
+      | shareWith | sales  |
+      | shareType | 8      |
+      | role      | viewer |
     Then the HTTP status code should be "200"
     And the OCS status code should be "200"
     And the user "Alice" should have a space called "share space" granted to group "sales" with role "viewer"
-   
-   
+
+
   Scenario: A user can see a file in a received shared space
     Given user "Alice" has uploaded a file inside space "share space" with content "Test" to "test.txt"
     And user "Alice" has created a folder "Folder Main" in space "share space"
-    When user "Alice" shares a space "share space" to user "Brian" with role "viewer"
+    When user "Alice" shares a space "share space" with settings:
+      | shareWith | Brian  |
+      | role      | viewer |
     Then for user "Brian" the space "share space" should contain these entries:
       | test.txt    |
       | Folder Main |
 
 
   Scenario: When a user unshares a space, the space becomes unavailable to the receiver
-    Given user "Alice" has shared a space "share space" to user "Brian" with role "viewer"
+    Given user "Alice" has shared a space "share space" with settings:
+      | shareWith | Brian  |
+      | role      | viewer |
     And the user "Brian" should have a space called "share space" with these key and value pairs:
       | key       | value       |
       | driveType | project     |
@@ -69,7 +80,9 @@ Feature: Share spaces
 
 
   Scenario Outline: Owner of a space cannot see the space after removing his access to the space
-    Given user "Alice" has shared a space "share space" to user "Brian" with role "manager"
+    Given user "Alice" has shared a space "share space" with settings:
+      | shareWith | Brian   |
+      | role      | manager |
     When user "<user>" unshares a space "share space" to user "Alice"
     Then the HTTP status code should be "200"
     And the user "Brian" should have a space called "share space" owned by "Alice" with these key and value pairs:
@@ -86,9 +99,13 @@ Feature: Share spaces
 
   Scenario: A user can add another user to the space managers to enable him
     Given user "Alice" has uploaded a file inside space "share space" with content "Test" to "test.txt"
-    When user "Alice" shares a space "share space" to user "Brian" with role "manager"
+    When user "Alice" shares a space "share space" with settings:
+      | shareWith | Brian   |
+      | role      | manager |
     Then the user "Brian" should have a space called "share space" granted to "Brian" with role "manager"
-    When user "Brian" shares a space "share space" to user "Bob" with role "viewer"
+    When user "Brian" shares a space "share space" with settings:
+      | shareWith | Bob    |
+      | role      | viewer |
     Then the user "Bob" should have a space called "share space" granted to "Bob" with role "viewer"
     And for user "Bob" the space "share space" should contain these entries:
       | test.txt |
@@ -96,7 +113,9 @@ Feature: Share spaces
 
   Scenario Outline: A user cannot share a disabled space to another user
     Given user "Alice" has disabled a space "share space"
-    When user "Alice" shares a space "share space" to user "Brian" with role "<role>"
+    When user "Alice" shares a space "share space" with settings:
+      | shareWith | Brian  |
+      | role      | <role> |
     Then the HTTP status code should be "404"
     And the OCS status code should be "404"
     And the OCS status message should be "Wrong path, file/folder doesn't exist"
@@ -109,8 +128,12 @@ Feature: Share spaces
 
 
   Scenario Outline: A user with manager role can share a space to another user
-    Given user "Alice" has shared a space "share space" to user "Brian" with role "manager"
-    When user "Brian" shares a space "share space" to user "Bob" with role "<role>"
+    Given user "Alice" has shared a space "share space" with settings:
+      | shareWith | Brian   |
+      | role      | manager |
+    When user "Brian" shares a space "share space" with settings:
+      | shareWith | Bob    |
+      | role      | <role> |
     Then the HTTP status code should be "200"
     And the OCS status code should be "200"
     And the OCS status message should be "OK"
@@ -127,8 +150,12 @@ Feature: Share spaces
 
 
   Scenario Outline: A user with editor or viewer role cannot share a space to another user
-    Given user "Alice" has shared a space "share space" to user "Brian" with role "<role>"
-    When user "Brian" shares a space "share space" to user "Bob" with role "<new_role>"
+    Given user "Alice" has shared a space "share space" with settings:
+      | shareWith | Brian  |
+      | role      | <role> |
+    When user "Brian" shares a space "share space" with settings:
+      | shareWith | Bob        |
+      | role      | <new_role> |
     Then the HTTP status code should be "404"
     And the OCS status code should be "404"
     And the OCS status message should be "No share permission"
@@ -144,8 +171,12 @@ Feature: Share spaces
 
 
   Scenario Outline: space manager can change the role of space members
-    Given user "Alice" has shared a space "share space" to user "Brian" with role "<role>"
-    When user "Alice" updates the space "share space" for user "Brian" changing the role to "<new_role>"
+    Given user "Alice" has shared a space "share space" with settings:
+      | shareWith | Brian  |
+      | role      | <role> |
+    When user "Alice" shares a space "share space" with settings:
+      | shareWith | Brian      |
+      | role      | <new_role> |
     Then the HTTP status code should be "200"
     And the OCS status code should be "200"
     And the user "Alice" should have a space called "share space" granted to "Brian" with role "<new_role>"
@@ -160,9 +191,15 @@ Feature: Share spaces
 
 
   Scenario Outline: user without manager role cannot change the role of space members
-    Given user "Alice" has shared a space "share space" to user "Brian" with role "<role>"
-    And user "Alice" has shared a space "share space" to user "Bob" with role "viewer"
-    When user "Brian" updates the space "share space" for user "Bob" changing the role to "<new_role>"
+    Given user "Alice" has shared a space "share space" with settings:
+      | shareWith | Brian  |
+      | role      | <role> |
+    And user "Alice" has shared a space "share space" with settings:
+      | shareWith | Bob    |
+      | role      | viewer |
+    When user "Brian" updates the space "share space" with settings:
+      | shareWith | Bob        |
+      | role      | <new_role> |
     Then the HTTP status code should be "404"
     And the OCS status code should be "404"
     And the user "Alice" should have a space called "share space" granted to "Bob" with role "viewer"
@@ -178,7 +215,10 @@ Feature: Share spaces
     Given group "group2" has been created
     And the administrator has added a user "Brian" to the group "group2" using GraphApi
     And the administrator has added a user "Bob" to the group "group2" using GraphApi
-    When user "Alice" shares a space "share space" to group "group2" with role "<role>"
+    When user "Alice" shares a space "share space" with settings:
+      | shareWith | group2 |
+      | shareType | 8      |
+      | role      | <role> |
     Then the HTTP status code should be "200"
     And the user "Brian" should have a space called "share space" with these key and value pairs:
       | key       | value       |
@@ -198,7 +238,10 @@ Feature: Share spaces
   Scenario Outline: The user has no access to the space if access for the group has been removed
     Given group "group2" has been created
     And the administrator has added a user "Brian" to the group "group2" using GraphApi
-    And user "Alice" has shared a space "share space" to group "group2" with role "<role>"
+    And user "Alice" has shared a space "share space" with settings:
+      | shareWith | group2 |
+      | shareType | 8      |
+      | role      | <role> |
     When user "Alice" unshares a space "share space" to group "group2"
     Then the HTTP status code should be "200"
     And the user "Brian" should not have a space called "share space"
@@ -213,7 +256,10 @@ Feature: Share spaces
     Given group "group2" has been created
     And the administrator has added a user "Brian" to the group "group2" using GraphApi
     And the administrator has added a user "Bob" to the group "group2" using GraphApi
-    And user "Alice" has shared a space "share space" to group "group2" with role "editor"
+    And user "Alice" has shared a space "share space" with settings:
+      | shareWith | group2 |
+      | shareType | 8      |
+      | role      | editor |
     When the administrator removes the following users from the following groups using the Graph API
       | username | groupname |
       | Brian    | group2    |
@@ -229,24 +275,76 @@ Feature: Share spaces
     Given group "group2" has been created
     And the administrator has added a user "Brian" to the group "group2" using GraphApi
     And the administrator has added a user "Bob" to the group "group2" using GraphApi
-    And user "Alice" has shared a space "share space" to group "group2" with role "editor"
+    And user "Alice" has shared a space "share space" with settings:
+      | shareWith | group2 |
+      | shareType | 8      |
+      | role      | editor |
     When the administrator deletes group "group2" using the Graph API
     Then the HTTP status code should be "204"
     And the user "Brian" should not have a space called "share space"
     And the user "Bob" should not have a space called "share space"
 
 
-  Scenario Outline: User increases permissions for one member of the group or for the entire group
+  Scenario: User increases permissions for one member of the group or for the entire group
+    Given group "sales" has been created
+    And the administrator has added a user "Brian" to the group "sales" using GraphApi
+    And user "Alice" has shared a space "share space" with settings:
+      | shareWith | sales  |
+      | shareType | 8      |
+      | role      | viewer |
+    When user "Brian" uploads a file inside space "share space" with content "Test" to "test.txt" using the WebDAV API
+    Then the HTTP status code should be "403"
+    When user "Alice" has shared a space "share space" with settings:
+      | shareWith | Brian  |
+      | role      | editor |
+    Then the HTTP status code should be "200"
+    When user "Brian" uploads a file inside space "share space" with content "Test" to "test.txt" using the WebDAV API
+    Then the HTTP status code should be "201"
+
+
+  Scenario: User increases permissions for the group, so the user's permissions are increased
     Given group "sales" has been created
     And the administrator has added a user "Brian" to the group "sales" using GraphApi
-    And user "Alice" has shared a space "share space" to <firstRecipient> with role "viewer"
+    And user "Alice" has shared a space "share space" with settings:
+      | shareWith | Brian  |
+      | role      | viewer |
     When user "Brian" uploads a file inside space "share space" with content "Test" to "test.txt" using the WebDAV API
     Then the HTTP status code should be "403"
-    When user "Alice" shares a space "share space" to <secondRecipient> with role "editor"
+    When user "Alice" has shared a space "share space" with settings:
+      | shareWith | sales  |
+      | shareType | 8      |
+      | role      | editor |
     Then the HTTP status code should be "200"
     When user "Brian" uploads a file inside space "share space" with content "Test" to "test.txt" using the WebDAV API
     Then the HTTP status code should be "201"
+
+
+  Scenario Outline: A Space Admin can share a space to the user with an expiration date
+    When user "Alice" shares a space "share space" with settings:
+      | shareWith  | Brian                    |
+      | role       | <role>                   |
+      | expireDate | 2042-03-25T23:59:59+0100 |
+    Then the HTTP status code should be "200"
+    And the user "Brian" should have a space called "share space" granted to user "Brian" with role "<role>" and expiration date "2042-03-25"
     Examples:
-      | firstRecipient | secondRecipient |
-      | group "sales"  | user "Brian"    |
-      | user "Brian"   | group "sales"   |
+      | role    |
+      | manager |
+      | editor  |
+      | viewer  |
+
+
+  Scenario Outline: A Space Admin can share a space to the group with an expiration date
+    Given group "sales" has been created
+    And the administrator has added a user "Brian" to the group "sales" using GraphApi
+    When user "Alice" shares a space "share space" with settings:
+      | shareWith  | sales                    |
+      | shareType  | 8                        |
+      | role       | <role>                   |
+      | expireDate | 2042-03-25T23:59:59+0100 |
+    Then the HTTP status code should be "200"
+    And the user "Brian" should have a space called "share space" granted to group "sales" with role "<role>" and expiration date "2042-03-25"
+    Examples:
+      | role    |
+      | manager |
+      | editor  |
+      | viewer  |
\ No newline at end of file
diff --git a/tests/acceptance/features/apiSpacesShares/shareSpacesViaLink.feature b/tests/acceptance/features/apiSpacesShares/shareSpacesViaLink.feature
index 7104ba45c11..68f18792132 100644
--- a/tests/acceptance/features/apiSpacesShares/shareSpacesViaLink.feature
+++ b/tests/acceptance/features/apiSpacesShares/shareSpacesViaLink.feature
@@ -71,7 +71,9 @@ Feature: Share spaces via link
 
 
   Scenario Outline: An user without manager role cannot share a space to public via link
-    Given user "Alice" has shared a space "share space" to user "Brian" with role "<role>"
+    Given user "Alice" has shared a space "share space" with settings:
+      | shareWith | Brian  |
+      | role      | <role> |
     When user "Brian" creates a public link share of the space "share space" with settings:
       | permissions | 1 |
     Then the HTTP status code should be "404"
@@ -85,7 +87,9 @@ Feature: Share spaces via link
 
 
   Scenario: An user with manager role can share a space to public via link
-    Given user "Alice" has shared a space "share space" to user "Brian" with role "manager"
+    Given user "Alice" has shared a space "share space" with settings:
+      | shareWith | Brian   |
+      | role      | manager |
     When user "Brian" creates a public link share of the space "share space" with settings:
       | permissions | 1 |
     Then the HTTP status code should be "200"
diff --git a/tests/acceptance/features/apiSpacesShares/shareSubItemOfSpace.feature b/tests/acceptance/features/apiSpacesShares/shareSubItemOfSpace.feature
index e1b25aa6579..f7f189b578c 100644
--- a/tests/acceptance/features/apiSpacesShares/shareSubItemOfSpace.feature
+++ b/tests/acceptance/features/apiSpacesShares/shareSubItemOfSpace.feature
@@ -43,7 +43,9 @@ Feature: Share a file or folder that is inside a space
 
 
   Scenario Outline: A user participant of the project space with manager role can share an entity to another user
-    Given user "Alice" has shared a space "share sub-item" to user "Brian" with role "manager"
+    Given user "Alice" has shared a space "share sub-item" with settings:
+      | shareWith | Brian   |
+      | role      | manager |
     When user "Brian" creates a share inside of space "share sub-item" with settings:
       | path       | <entity>     |
       | shareWith  | Bob          |
@@ -65,7 +67,9 @@ Feature: Share a file or folder that is inside a space
 
 
   Scenario Outline: A user participant of the project space without space manager role cannot share an entity to another user
-    Given user "Alice" has shared a space "share sub-item" to user "Brian" with role "<spaceRole>"
+    Given user "Alice" has shared a space "share sub-item" with settings:
+      | shareWith | Brian       |
+      | role      | <spaceRole> |
     When user "Brian" creates a share inside of space "share sub-item" with settings:
       | path      | <entity> |
       | shareWith | Bob      |
@@ -82,7 +86,9 @@ Feature: Share a file or folder that is inside a space
 
 
   Scenario Outline: A user participant of the project space can see the created resources share
-    Given user "Alice" has shared a space "share sub-item" to user "Brian" with role "<spaceRole>"
+    Given user "Alice" has shared a space "share sub-item" with settings:
+      | shareWith | Brian       |
+      | role      | <spaceRole> |
     When user "Alice" creates a share inside of space "share sub-item" with settings:
       | path      | file.txt |
       | shareWith | Bob      |
diff --git a/tests/acceptance/features/apiSpacesShares/shareSubItemOfSpaceViaPublicLink.feature b/tests/acceptance/features/apiSpacesShares/shareSubItemOfSpaceViaPublicLink.feature
index cc62dcc820b..0f4000e8323 100644
--- a/tests/acceptance/features/apiSpacesShares/shareSubItemOfSpaceViaPublicLink.feature
+++ b/tests/acceptance/features/apiSpacesShares/shareSubItemOfSpaceViaPublicLink.feature
@@ -1,21 +1,21 @@
 @api @skipOnOcV10
 Feature: Share a file or folder that is inside a space via public link
-  As an user with manager space role
-  I want to be able to share the data inside the space via public link
+      As an user with manager space role
+      I want to be able to share the data inside the space via public link
 
-  folder permissions:
-  | role        | permissions |
-  | internal    | 0           |
-  | viewer      | 1           |
-  | uploader    | 4           |
-  | contributor | 5           |
-  | editor      | 15          |
+      folder permissions:
+      | role        | permissions |
+      | internal    | 0           |
+      | viewer      | 1           |
+      | uploader    | 4           |
+      | contributor | 5           |
+      | editor      | 15          |
 
-  file permissions:
-  | role     | permissions |
-  | internal | 0           |
-  | viewer   | 1           |
-  | editor   | 3           |
+      file permissions:
+      | role     | permissions |
+      | internal | 0           |
+      | viewer   | 1           |
+      | editor   | 3           |
 
   Note - this feature is run in CI with ACCOUNTS_HASH_DIFFICULTY set to the default for production
   See https://github.com/owncloud/ocis/issues/1542 and https://github.com/owncloud/ocis/pull/839
@@ -65,7 +65,9 @@ Feature: Share a file or folder that is inside a space via public link
 
 
   Scenario Outline: An user participant of the project space with space manager role can share an entity inside project space via public link
-    Given user "Alice" has shared a space "share sub-item" to user "Brian" with role "manager"
+    Given user "Alice" has shared a space "share sub-item" with settings:
+      | shareWith | Brian   |
+      | role      | manager |
     When user "Brian" creates a public link share inside of space "share sub-item" with settings:
       | path        | <entity>                 |
       | shareType   | 3                        |
@@ -91,7 +93,9 @@ Feature: Share a file or folder that is inside a space via public link
 
 
   Scenario Outline: An user participant of the project space without space manager role cannot share an entity inside project space via public link
-    Given user "Alice" has shared a space "share sub-item" to user "Brian" with role "<spaceRole>"
+    Given user "Alice" has shared a space "share sub-item" with settings:
+      | shareWith | Brian       |
+      | role      | <spaceRole> |
     When user "Brian" creates a public link share inside of space "share sub-item" with settings:
       | path        | <entity>                 |
       | shareType   | 3                        |
@@ -138,7 +142,9 @@ Feature: Share a file or folder that is inside a space via public link
 
 
   Scenario Outline: An user participant of the project space can see the created public resources link
-    Given user "Alice" has shared a space "share sub-item" to user "Brian" with role "<spaceRole>"
+    Given user "Alice" has shared a space "share sub-item" with settings:
+      | shareWith | Brian       |
+      | role      | <spaceRole> |
     When user "Alice" creates a public link share inside of space "share sub-item" with settings:
       | path        | folder/file.txt |
       | shareType   | 3               |
diff --git a/tests/acceptance/features/bootstrap/FeatureContext.php b/tests/acceptance/features/bootstrap/FeatureContext.php
index b989863198a..78be6159bd3 100644
--- a/tests/acceptance/features/bootstrap/FeatureContext.php
+++ b/tests/acceptance/features/bootstrap/FeatureContext.php
@@ -39,6 +39,7 @@ use TestHelpers\HttpRequestHelper;
 use TestHelpers\UploadHelper;
 use TestHelpers\OcisHelper;
 use Laminas\Ldap\Ldap;
+use TestHelpers\GraphHelper;
 use TestHelpers\WebDavHelper;
 
 require_once 'bootstrap.php';
@@ -3104,6 +3105,8 @@ class FeatureContext extends BehatVariablesContext {
 	 *                               "parameter" => []
 	 *                             ],
 	 *                           ]
+	 * @param string|null $group
+	 * @param string|null $userName
 	 *
 	 * @return string
 	 */
@@ -3111,7 +3114,9 @@ class FeatureContext extends BehatVariablesContext {
 		?string $value,
 		?string $user = null,
 		?array  $functions = [],
-		?array  $additionalSubstitutions = []
+		?array  $additionalSubstitutions = [],
+		?string $group = null,
+		?string $userName = null
 	): ?string {
 		$substitutions = [
 			[
@@ -3249,6 +3254,18 @@ class FeatureContext extends BehatVariablesContext {
 					"getLastPublicShareToken"
 				],
 				"parameter" => []
+			],
+			[
+			"code" => "%user_id%",
+			"function" =>
+			[$this, "getUserIdByUserName"],
+			"parameter" => [$userName]
+			],
+			[
+			"code" => "%group_id%",
+			"function" =>
+			[$this, "getGroupIdByGroupName"],
+			"parameter" => [$group]
 			]
 		];
 		if ($user !== null) {
@@ -3293,6 +3310,18 @@ class FeatureContext extends BehatVariablesContext {
 						"getPersonalSpaceIdForUser",
 					],
 					"parameter" => [$user, true]
+				],
+				[
+				"code" => "%user_id%",
+				"function" =>
+				[$this, "getUserIdByUserName"],
+				"parameter" => [$userName]
+				],
+				[
+				"code" => "%group_id%",
+				"function" =>
+				[$this, "getGroupIdByGroupName"],
+				"parameter" => [$group]
 				]
 			);
 		}
@@ -4485,4 +4514,58 @@ class FeatureContext extends BehatVariablesContext {
 			$this->getBaseUrl()
 		);
 	}
+
+	/**
+	 * The method returns userId
+	 *
+	 * @param string $userName
+	 *
+	 * @return string
+	 * @throws Exception|GuzzleException
+	 */
+	public function getUserIdByUserName(string $userName): string {
+		$response = GraphHelper::getUser(
+			$this->getBaseUrl(),
+			$this->getStepLineRef(),
+			$this->getAdminUsername(),
+			$this->getAdminPassword(),
+			$userName
+		);
+		if ($response) {
+			$data = \json_decode($response->getBody()->getContents(), true, 512, JSON_THROW_ON_ERROR);
+			if (isset($data["id"])) {
+				return $data["id"];
+			} else {
+				throw new Exception(__METHOD__ . " accounts-list is empty");
+			}
+		}
+		throw new Exception(__METHOD__ . " user with name $userName not found");
+	}
+
+	/**
+	 * The method returns groupId
+	 *
+	 * @param string $groupName
+	 *
+	 * @return string
+	 * @throws Exception|GuzzleException
+	 */
+	public function getGroupIdByGroupName(string $groupName): string {
+		$response = GraphHelper::getGroup(
+			$this->getBaseUrl(),
+			$this->getStepLineRef(),
+			$this->getAdminUsername(),
+			$this->getAdminPassword(),
+			$groupName
+		);
+		if ($response) {
+			$data = $this->getJsonDecodedResponse($response);
+			if (isset($data["id"])) {
+				return $data["id"];
+			} else {
+				throw new Exception(__METHOD__ . " accounts-list is empty");
+			}
+		}
+		throw new Exception(__METHOD__ . " Group with name $groupName not found");
+	}
 }
diff --git a/tests/acceptance/features/bootstrap/GraphContext.php b/tests/acceptance/features/bootstrap/GraphContext.php
index b4cf8009217..0b084b4430f 100644
--- a/tests/acceptance/features/bootstrap/GraphContext.php
+++ b/tests/acceptance/features/bootstrap/GraphContext.php
@@ -28,11 +28,6 @@ class GraphContext implements Context {
 	 */
 	private FeatureContext $featureContext;
 
-	/**
-	 * @var SpacesContext
-	 */
-	private SpacesContext $spacesContext;
-
 	/**
 	 * This will run before EVERY scenario.
 	 * It will set the properties for this object.
@@ -1284,14 +1279,15 @@ class GraphContext implements Context {
 	}
 
 	/**
-	 * @Then the API response should contain all users with the following information:
+	 * @Then /^the API response should (not|)\s?contain following (user|users) with the information:$/
 	 *
+	 * @param string    $shouldOrNot   (not|)
 	 * @param TableNode $table
 	 *
 	 * @throws Exception
 	 * @return void
 	 */
-	public function theApiResponseShouldContainAllUserWithFollowingInformation(TableNode $table): void {
+	public function theApiResponseShouldContainAllUserWithFollowingInformation(string $shouldOrNot, TableNode $table): void {
 		$values = $table->getHash();
 		$apiResponse = $this->featureContext->getJsonDecodedResponse($this->featureContext->getResponse())['value'];
 		foreach ($values as $expectedValue) {
@@ -1304,8 +1300,10 @@ class GraphContext implements Context {
 					break;
 				}
 			}
-			if (!$found) {
-				throw new Exception('User ' . $expectedValue["displayName"] . ' could not be found in the response.');
+			if ($shouldOrNot === 'not') {
+				Assert::assertFalse($found, $expectedValue["displayName"] . ' has been found in the response, but should not be.');
+			} else {
+				Assert::assertTrue($found, $expectedValue["displayName"] . ' could not be found in the response.');
 			}
 		}
 	}
@@ -1520,4 +1518,49 @@ class GraphContext implements Context {
 			Assert::assertTrue($foundRoleInResponse, "the response does not contain the role $row[0]");
 		}
 	}
+
+	/**
+	 * @When the user :user gets all users of the group :group using the Graph API
+	 *
+	 * @param string $user
+	 * @param string $group
+	 *
+	 * @return void
+	 * @throws GuzzleException
+	 */
+	public function userGetsAllUsersOfTheGroupUsingTheGraphApi(string $user, string $group) {
+		$groupId = $this->featureContext->getGroupIdByGroupName($group);
+		$response = GraphHelper::getUsersWithFilterMemberOf(
+			$this->featureContext->getBaseUrl(),
+			$this->featureContext->getStepLineRef(),
+			$user,
+			$this->featureContext->getPasswordForUser($user),
+			$groupId
+		);
+		$this->featureContext->setResponse($response);
+	}
+
+	/**
+	 * @When the user :user gets all users of two groups :groups using the Graph API
+	 *
+	 * @param string $user
+	 * @param string $groups
+	 *
+	 * @return void
+	 * @throws GuzzleException
+	 */
+	public function userGetsAllUsersOfTwoGroupsUsingTheGraphApi(string $user, string $groups) {
+		$groupsIdArray = [];
+		foreach (explode(',', $groups) as $group) {
+			array_push($groupsIdArray, $this->featureContext->getGroupIdByGroupName($group));
+		}
+		$response = GraphHelper::getUsersOfTwoGroups(
+			$this->featureContext->getBaseUrl(),
+			$this->featureContext->getStepLineRef(),
+			$user,
+			$this->featureContext->getPasswordForUser($user),
+			$groupsIdArray
+		);
+		$this->featureContext->setResponse($response);
+	}
 }
diff --git a/tests/acceptance/features/bootstrap/SpacesContext.php b/tests/acceptance/features/bootstrap/SpacesContext.php
index 3221397ab2e..1d02a421781 100644
--- a/tests/acceptance/features/bootstrap/SpacesContext.php
+++ b/tests/acceptance/features/bootstrap/SpacesContext.php
@@ -69,11 +69,17 @@ class SpacesContext implements Context {
 	 * @var ChecksumContext
 	 */
 	private ChecksumContext $checksumContext;
+	
 	/**
 	 * @var FilesVersionsContext
 	 */
 	private FilesVersionsContext $filesVersionsContext;
 
+	/**
+	 * @var GraphContext
+	 */
+	private GraphContext $graphContext;
+
 	/**
 	 * @var string
 	 */
@@ -397,60 +403,6 @@ class SpacesContext implements Context {
 		return $fileData["Etag"][0];
 	}
 
-	/**
-	 * The method returns userId
-	 *
-	 * @param string $userName
-	 *
-	 * @return string
-	 * @throws Exception|GuzzleException
-	 */
-	public function getUserIdByUserName(string $userName): string {
-		$response = GraphHelper::getUser(
-			$this->featureContext->getBaseUrl(),
-			$this->featureContext->getStepLineRef(),
-			$this->featureContext->getAdminUsername(),
-			$this->featureContext->getAdminPassword(),
-			$userName
-		);
-		if ($response) {
-			$data = \json_decode($response->getBody()->getContents(), true, 512, JSON_THROW_ON_ERROR);
-			if (isset($data["id"])) {
-				return $data["id"];
-			} else {
-				throw new Exception(__METHOD__ . " accounts-list is empty");
-			}
-		}
-		throw new Exception(__METHOD__ . " user with name $userName not found");
-	}
-
-	/**
-	 * The method returns groupId
-	 *
-	 * @param string $groupName
-	 *
-	 * @return string
-	 * @throws Exception|GuzzleException
-	 */
-	public function getGroupIdByGroupName(string $groupName): string {
-		$response = GraphHelper::getGroup(
-			$this->featureContext->getBaseUrl(),
-			$this->featureContext->getStepLineRef(),
-			$this->featureContext->getAdminUsername(),
-			$this->featureContext->getAdminPassword(),
-			$groupName
-		);
-		if ($response) {
-			$data = $this->featureContext->getJsonDecodedResponse($response);
-			if (isset($data["id"])) {
-				return $data["id"];
-			} else {
-				throw new Exception(__METHOD__ . " accounts-list is empty");
-			}
-		}
-		throw new Exception(__METHOD__ . " Group with name $groupName not found");
-	}
-
 	/**
 	 * using method from core to set share data
 	 *
@@ -485,6 +437,7 @@ class SpacesContext implements Context {
 		$this->favoritesContext = $environment->getContext('FavoritesContext');
 		$this->checksumContext = $environment->getContext('ChecksumContext');
 		$this->filesVersionsContext = $environment->getContext('FilesVersionsContext');
+		$this->graphContext = $environment->getContext('GraphContext');
 		// Run the BeforeScenario function in OCSContext to set it up correctly
 		$this->ocsContext->before($scope);
 		$this->baseUrl = \trim($this->featureContext->getBaseUrl(), "/");
@@ -990,12 +943,6 @@ class SpacesContext implements Context {
 						[$this, "getSpaceIdByNameFromResponse"],
 						"parameter" => [$spaceName]
 					],
-					[
-						"code" => "%user_id%",
-						"function" =>
-						[$this, "getUserIdByUserName"],
-						"parameter" => [$userName]
-					],
 					[
 						"code" => "%file_id%",
 						"function" =>
@@ -1007,14 +954,10 @@ class SpacesContext implements Context {
 						"function" =>
 						[$this, "getETag"],
 						"parameter" => [$userName, $spaceName, $fileName]
-					],
-					[
-						"code" => "%group_id%",
-						"function" =>
-						[$this, "getGroupIdByGroupName"],
-						"parameter" => [$groupName]
 					]
-				]
+				],
+				$groupName,
+				$userName
 			);
 			$segments = explode("@@@", $row["key"]);
 			// traverse down in the array
@@ -1111,7 +1054,7 @@ class SpacesContext implements Context {
 		);
 		Assert::assertIsArray($spaceAsArray = $this->getSpaceByNameFromResponse($spaceName), "No space with name $spaceName found");
 		$permissions = $spaceAsArray["root"]["permissions"];
-		$userId = $this->getUserIdByUserName($grantedUser);
+		$userId = $this->featureContext->getUserIdByUserName($grantedUser);
 
 		$userRole = "";
 		foreach ($permissions as $permission) {
@@ -1945,14 +1888,12 @@ class SpacesContext implements Context {
 	}
 
 	/**
-	 * @When /^user "([^"]*)" shares a space "([^"]*)" to user "([^"]*)" with role "([^"]*)"$/
-	 * @When /^user "([^"]*)" shares a space "([^"]*)" to group "([^"]*)" with role "([^"]*)"$/
-	 * @When /^user "([^"]*)" updates the space "([^"]*)" for user "([^"]*)" changing the role to "([^"]*)"$/
+	 * @When /^user "([^"]*)" shares a space "([^"]*)" with settings:$/
+	 * @When /^user "([^"]*)" updates the space "([^"]*)" with settings:$/
 	 *
 	 * @param  string $user
 	 * @param  string $spaceName
-	 * @param  string $recipient
-	 * @param  string $role
+	 * @param  TableNode $table
 	 *
 	 * @return void
 	 * @throws GuzzleException
@@ -1960,19 +1901,23 @@ class SpacesContext implements Context {
 	public function sendShareSpaceRequest(
 		string $user,
 		string $spaceName,
-		string $recipient,
-		string $role
+		TableNode $table
 	): void {
 		$space = $this->getSpaceByName($user, $spaceName);
 		$availableRoleToAssignToShareSpace = ['manager', 'editor', 'viewer'];
-		if (!\in_array(\strtolower($role), $availableRoleToAssignToShareSpace)) {
-			throw new Error("The Selected " . $role . " Cannot be Found");
+		$rows = $table->getRowsHash();
+		if (!\in_array(\strtolower($rows['role']), $availableRoleToAssignToShareSpace)) {
+			throw new Error("The Selected " . $rows['role'] . " Cannot be Found");
 		}
+		$rows["shareType"] = \array_key_exists("shareType", $rows) ? $rows["shareType"] : 7;
+		$rows["expireDate"] = \array_key_exists("expireDate", $rows) ? $rows["expireDate"] : null;
+
 		$body = [
-			"space_ref" => $space['id'],
-			"shareType" => 7,
-			"shareWith" => $recipient,
-			"role" => $role // role overrides the permissions parameter
+			"space_ref" => $space["id"],
+			"shareType" => $rows["shareType"],
+			"shareWith" => $rows["shareWith"],
+			"role" => $rows["role"],
+			"expireDate" => $rows["expireDate"]
 		];
 
 		$fullUrl = $this->baseUrl . $this->ocsApiUrl;
@@ -2159,12 +2104,11 @@ class SpacesContext implements Context {
 	}
 
 	/**
-	 * @Given /^user "([^"]*)" has shared a space "([^"]*)" to (?:user|group) "([^"]*)" with role "([^"]*)"$/
+	 * @Given /^user "([^"]*)" has shared a space "([^"]*)" with settings:$/
 	 *
 	 * @param  string $user
 	 * @param  string $spaceName
-	 * @param  string $recipient
-	 * @param  string $role
+	 * @param  TableNode $tableNode
 	 *
 	 * @return void
 	 * @throws GuzzleException
@@ -2172,10 +2116,9 @@ class SpacesContext implements Context {
 	public function userHasSharedSpace(
 		string $user,
 		string $spaceName,
-		string $recipient,
-		string $role
+		TableNode $tableNode
 	): void {
-		$this->sendShareSpaceRequest($user, $spaceName, $recipient, $role);
+		$this->sendShareSpaceRequest($user, $spaceName, $tableNode);
 		$expectedHTTPStatus = "200";
 		$this->featureContext->theHTTPStatusCodeShouldBe(
 			$expectedHTTPStatus,
@@ -3252,12 +3195,14 @@ class SpacesContext implements Context {
 
 	/**
 	 * @Then /^the user "([^"]*)" should have a space called "([^"]*)" granted to (user|group)\s? "([^"]*)" with role "([^"]*)"$/
+	 * @Then /^the user "([^"]*)" should have a space called "([^"]*)" granted to (user|group)\s? "([^"]*)" with role "([^"]*)" and expiration date "([^"]*)"$/
 	 *
 	 * @param string $user
 	 * @param string $spaceName
 	 * @param string $recipientType
 	 * @param string $recipient
 	 * @param string $role
+	 * @param string $expirationDate
 	 *
 	 * @return void
 	 *
@@ -3269,7 +3214,8 @@ class SpacesContext implements Context {
 		string $spaceName,
 		string $recipientType,
 		string $recipient,
-		string $role
+		string $role,
+		string $expirationDate = null
 	): void {
 		$this->theUserListsAllHisAvailableSpacesUsingTheGraphApi($user);
 		$this->featureContext->theHTTPStatusCodeShouldBe(
@@ -3277,11 +3223,15 @@ class SpacesContext implements Context {
 			"Expected response status code should be 200"
 		);
 		Assert::assertIsArray($spaceAsArray = $this->getSpaceByNameFromResponse($spaceName), "No space with name $spaceName found");
-		$recipientType === 'user' ? $recipientId = $this->getUserIdByUserName($recipient) : $recipientId = $this->getGroupIdByGroupName($recipient);
+		$recipientType === 'user' ? $recipientId = $this->featureContext->getUserIdByUserName($recipient) : $recipientId = $this->featureContext->getGroupIdByGroupName($recipient);
 		$foundRoleInResponse = false;
 		foreach ($spaceAsArray['root']['permissions'] as $permission) {
 			if (isset($permission['grantedToIdentities'][0][$recipientType]) && $permission['roles'][0] === $role && $permission['grantedToIdentities'][0][$recipientType]['id'] === $recipientId) {
 				$foundRoleInResponse = true;
+				if ($expirationDate !== null) {
+					Assert::assertArrayHasKey('expirationDateTime', $permission, 'expirationDateTime key not found in response');
+					Assert::assertEquals($expirationDate, (preg_split("/[\sT]+/", $permission['expirationDateTime']))[0], "$expirationDate is different in the response");
+				}
 				break;
 			}
 		}
diff --git a/tests/acceptance/lint-expected-failures.sh b/tests/acceptance/lint-expected-failures.sh
index a1f31ce4da0..c17be505956 100755
--- a/tests/acceptance/lint-expected-failures.sh
+++ b/tests/acceptance/lint-expected-failures.sh
@@ -1,15 +1,30 @@
 #!/usr/bin/env bash
 
 log_error() {
-	echo -e "\e[31m$1\e[0m"
+	if [ -n "${PLAIN_OUTPUT}" ]
+	then
+		echo -e "$1"
+	else
+		echo -e "\e[31m$1\e[0m"
+	fi
 }
 
 log_info() {
-	echo -e "\e[34m$1\e[0m"
+	if [ -n "${PLAIN_OUTPUT}" ]
+	then
+		echo -e "$1"
+	else
+		echo -e "\e[34m$1\e[0m"
+	fi
 }
 
 log_success() {
-	echo -e "\e[32m$1\e[0m"
+	if [ -n "${PLAIN_OUTPUT}" ]
+	then
+		echo -e "$1"
+	else
+		echo -e "\e[32m$1\e[0m"
+	fi
 }
 
 declare -A scenarioLines
diff --git a/tests/acceptance/run.sh b/tests/acceptance/run.sh
index 5d1af389686..45fa70b6d9a 100755
--- a/tests/acceptance/run.sh
+++ b/tests/acceptance/run.sh
@@ -22,6 +22,21 @@ then
 	STEP_THROUGH_OPTION="--step-through"
 fi
 
+if [ -n "${PLAIN_OUTPUT}" ]
+then
+	# explicitly tell Behat to not do colored output
+	COLORS_OPTION="--no-colors"
+	# Use the Bash "null" command to do nothing, rather than use tput to set a color
+	RED_COLOR = ":"
+	GREEN_COLOR = ":"
+	YELLOW_COLOR = ":"
+else
+	COLORS_OPTION="--colors"
+	RED_COLOR = "tput setaf 1"
+	GREEN_COLOR = "tput setaf 2"
+	YELLOW_COLOR = "tput setaf 3"
+fi
+
 # The following environment variables can be specified:
 #
 # ACCEPTANCE_TEST_TYPE - see "--type" description
@@ -180,7 +195,7 @@ function run_behat_tests() {
 	fi
 
 	echo "Using behat config '${BEHAT_YML}'"
-	${BEHAT} --colors --strict ${STEP_THROUGH_OPTION} -c ${BEHAT_YML} -f pretty ${BEHAT_SUITE_OPTION} --tags ${BEHAT_FILTER_TAGS} ${BEHAT_FEATURE} -v 2>&1 | tee -a ${TEST_LOG_FILE}
+	${BEHAT} ${COLORS_OPTION} --strict ${STEP_THROUGH_OPTION} -c ${BEHAT_YML} -f pretty ${BEHAT_SUITE_OPTION} --tags ${BEHAT_FILTER_TAGS} ${BEHAT_FEATURE} -v 2>&1 | tee -a ${TEST_LOG_FILE}
 
 	BEHAT_EXIT_STATUS=${PIPESTATUS[0]}
 
@@ -207,7 +222,7 @@ function run_behat_tests() {
 		# So exit the tests and do not lint expected failures when undefined steps exist.
 		if [[ ${SCENARIO_RESULTS} == *"undefined"* ]]
 		then
-			echo -e "\033[31m Undefined steps: There were some undefined steps found."
+			${RED_COLOR}; echo -e "Undefined steps: There were some undefined steps found."
 			exit 1
 		fi
 		# If there were no scenarios in the requested suite or feature that match
@@ -348,7 +363,7 @@ function run_behat_tests() {
 		# Big red error output is displayed if there are no matching scenarios - send it to null
 		DRY_RUN_FILE=$(mktemp)
 		SKIP_TAGS="${TEST_TYPE_TAG}&&@skip"
-		${BEHAT} --dry-run --colors -c ${BEHAT_YML} -f pretty ${BEHAT_SUITE_OPTION} --tags "${SKIP_TAGS}" ${BEHAT_FEATURE} 1>${DRY_RUN_FILE} 2>/dev/null
+		${BEHAT} --dry-run {$COLORS_OPTION} -c ${BEHAT_YML} -f pretty ${BEHAT_SUITE_OPTION} --tags "${SKIP_TAGS}" ${BEHAT_FEATURE} 1>${DRY_RUN_FILE} 2>/dev/null
 		if grep -q -m 1 'No scenarios' "${DRY_RUN_FILE}"
 		then
 			# If there are no skip scenarios, then no need to report that
@@ -636,24 +651,24 @@ fi
 
 if [ "${UNEXPECTED_FAILURE}" = true ]
 then
-	tput setaf 3; echo "runsh: Total unexpected failed scenarios throughout the test run:"
-	tput setaf 1; printf "%s\n" "${UNEXPECTED_FAILED_SCENARIOS[@]}"
+	${YELLOW_COLOR}; echo "runsh: Total unexpected failed scenarios throughout the test run:"
+	${RED_COLOR}; printf "%s\n" "${UNEXPECTED_FAILED_SCENARIOS[@]}"
 else
-	tput setaf 2; echo "runsh: There were no unexpected failures."
+	${GREEN_COLOR}; echo "runsh: There were no unexpected failures."
 fi
 
 if [ "${UNEXPECTED_SUCCESS}" = true ]
 then
-	tput setaf 3; echo "runsh: Total unexpected passed scenarios throughout the test run:"
-	tput setaf 1; printf "%s\n" "${ACTUAL_UNEXPECTED_PASS[@]}"
+	${YELLOW_COLOR}; echo "runsh: Total unexpected passed scenarios throughout the test run:"
+	${RED_COLOR}; printf "%s\n" "${ACTUAL_UNEXPECTED_PASS[@]}"
 else
-	tput setaf 2; echo "runsh: There were no unexpected success."
+	${GREEN_COLOR}; echo "runsh: There were no unexpected success."
 fi
 
 if [ "${UNEXPECTED_BEHAT_EXIT_STATUS}" = true ]
 then
-	tput setaf 3; echo "runsh: The following Behat test runs exited with non-zero status:"
-	tput setaf 1; printf "%s\n" "${UNEXPECTED_BEHAT_EXIT_STATUSES[@]}"
+	${YELLOW_COLOR}; echo "runsh: The following Behat test runs exited with non-zero status:"
+	${RED_COLOR}; printf "%s\n" "${UNEXPECTED_BEHAT_EXIT_STATUSES[@]}"
 fi
 
 # sync the file-system so all output will be flushed to storage.