we put in place an LDAP filter. Even if the users are well filtered for the Web interface, a directory is still created in /ownlcoud/data/. Furthermore, the filter does not apply to the desktop client. Users who do not need access can connect with this client while they do not have access to the web.
When a user who does not have the right to connect wants to have access, he is well rejected but a directory with his name is still created in …/owncloud/data.
rights-enabled users have an attribute in their LDAP form. The filter in “LDAP user and group backend” is then :
(&(objectclass=person)(AttributApplicationLocale=ECA*))
where ECA is name of our owncloud application.