Adding the same user as multiple members in a single request results in listing the same user twice in the group #3354

Describe the bug

When adding users to a group using the Graph API, and referencing the same user ID multiple times in the member list, that user ends up being in that group twice.

Steps to reproduce

Setting a few environment variables to make copy-pasting the snippets below more portable:

groupname="test"
api="https://localhost:9200"
auth="admin:admin"

The snippets below require having curl and jq, optionally shuf to automate picking a random user, as well as basic authentication support (PROXY_ENABLE_BASIC_AUTH=true) to simplify the code below.

1. Optionally create a new group

curl -sSk -u "$auth" -X POST "$api/graph/v1.0/groups" -d '{"displayName": "'"$groupname"'"}'

Expected output:

{"displayName":"test","groupTypes":[],"id":"..."}

2. Pick an existing user at random

id=$(curl -ksS -u "$auth" -X GET "$api/graph/v1.0/users" | jq -r '.value.[] | select(.accountEnabled == true and .onPremisesSamAccountName != "admin") | .id' | shuf -n 1)

3. Add that user twice to a group

gid=$(curl -ksS -u "$auth" -X GET "$api/graph/v1.0/groups" | jq -r '.value.[] | select(.displayName == "test") | .id')

curl -ksS -u "$auth" -X PATCH "$api/graph/v1.0/groups/$gid" -d '{"members@odata.bind": ['"\"/graph/v1.0/users/$id\""','"\"/graph/v1.0/users/$id\""']}'

4. Check the members of that group:

curl -ksS -u "$auth" -X GET "$api/graph/v1.0/groups/$gid/members" | jq -r '.[].id'

Expected (buggy) output being the same user ID twice, for example:

801abee4-dd7f-11ef-a324-83f55a754b62
801abee4-dd7f-11ef-a324-83f55a754b62

Expected behavior

Normalize the list of member IDs to skip duplicates, as it makes no sense to have the same user being a member of a group twice. Ideally, this should also be caught on the IDM side of things, but as part of data sanitization, the Graph API should catch that as well.

When using the snippets above, the user should only show up once in the list of members of the group, instead of twice.

Actual behavior

The user is listed twice, and is thus stored twice as a member of that group.

With the snippets above, the expected output of the group member listing code (point 4) would be the user being referenced once, not twice, for example

801abee4-dd7f-11ef-a324-83f55a754b62

Setup

No particular setup is necessary (except allowing basic authentication to simplify the code snippets above to reproduce the issue).

Additional context

Currently a known issue that is covered by apiGraphUserGroup/addUserToGroup.feature:429 and marked as a known-to-fail test.

Also a known issue in the oci repo: owncloud/ocis#5855