switch default config to idm

- The accounts and glauth service are turned off by default - proxy is switch from "accounts" to "cs3" for the account backend - The LDAP configuration (graph, idp, storage) of all services now points to idm instead of glauth
2026-07-20 04:24:25 -04:00 · 2022-03-09 11:42:51 +01:00
parent 5100465464
commit 1a38f3623c
15 changed files with 86 additions and 60 deletions
--- a/extensions/auth-basic/pkg/command/command.go
+++ b/extensions/auth-basic/pkg/command/command.go
@@ -193,6 +193,8 @@ func ldapConfigFromString(cfg config.LDAPProvider) map[string]interface{} {
 		"group_base_dn":     cfg.GroupBaseDN,
 		"user_filter":       cfg.UserFilter,
 		"group_filter":      cfg.GroupFilter,
+		"user_scope":        cfg.UserScope,
+		"group_scope":       cfg.GroupScope,
 		"user_objectclass":  cfg.UserObjectClass,
 		"group_objectclass": cfg.GroupObjectClass,
 		"login_attributes":  cfg.LoginAttributes,
--- a/extensions/auth-basic/pkg/config/config.go
+++ b/extensions/auth-basic/pkg/config/config.go
@@ -66,6 +66,8 @@ type LDAPProvider struct {
 	BindPassword     string   `env:"LDAP_BIND_PASSWORD;AUTH_BASIC_LDAP_BIND_PASSWORD"`
 	UserBaseDN       string   `env:"LDAP_USER_BASE_DN;AUTH_BASIC_LDAP_USER_BASE_DN"`
 	GroupBaseDN      string   `env:"LDAP_GROUP_BASE_DN;AUTH_BASIC_LDAP_GROUP_BASE_DN"`
+	UserScope        string   `env:"LDAP_USER_SCOPE;AUTH_BASIC_LDAP_USER_SCOPE"`
+	GroupScope       string   `env:"LDAP_GROUP_SCOPE;AUTH_BASIC_LDAP_GROUP_SCOPE"`
 	UserFilter       string   `env:"LDAP_USERFILTER;AUTH_BASIC_LDAP_USERFILTER"`
 	GroupFilter      string   `env:"LDAP_GROUPFILTER;AUTH_BASIC_LDAP_USERFILTER"`
 	UserObjectClass  string   `env:"LDAP_USER_OBJECTCLASS;AUTH_BASIC_LDAP_USER_OBJECTCLASS"`
--- a/extensions/auth-basic/pkg/config/defaults/defaultconfig.go
+++ b/extensions/auth-basic/pkg/config/defaults/defaultconfig.go
@@ -35,31 +35,33 @@ func DefaultConfig() *config.Config {
 		AuthProvider:    "ldap",
 		AuthProviders: config.AuthProviders{
 			LDAP: config.LDAPProvider{
-				URI:              "ldaps://localhost:9126",
-				CACert:           filepath.Join(defaults.BaseDataPath(), "ldap", "ldap.crt"),
+				URI:              "ldaps://localhost:9235",
+				CACert:           filepath.Join(defaults.BaseDataPath(), "idm", "ldap.crt"),
 				Insecure:         false,
-				UserBaseDN:       "dc=ocis,dc=test",
-				GroupBaseDN:      "dc=ocis,dc=test",
-				LoginAttributes:  []string{"cn", "mail"},
+				UserBaseDN:       "ou=users,o=libregraph-idm",
+				GroupBaseDN:      "ou=groups,o=libregraph-idm",
+				UserScope:        "sub",
+				GroupScope:       "sub",
+				LoginAttributes:  []string{"uid", "mail"},
 				UserFilter:       "",
 				GroupFilter:      "",
-				UserObjectClass:  "posixAccount",
-				GroupObjectClass: "posixGroup",
-				BindDN:           "cn=reva,ou=sysusers,dc=ocis,dc=test",
+				UserObjectClass:  "inetOrgPerson",
+				GroupObjectClass: "groupOfNames",
+				BindDN:           "uid=reva,ou=sysusers,o=libregraph-idm",
 				BindPassword:     "reva",
 				IDP:              "https://localhost:9200",
 				UserSchema: config.LDAPUserSchema{
 					ID:          "ownclouduuid",
 					Mail:        "mail",
 					DisplayName: "displayname",
-					Username:    "cn",
+					Username:    "uid",
 				},
 				GroupSchema: config.LDAPGroupSchema{
-					ID:          "cn",
+					ID:          "ownclouduuid",
 					Mail:        "mail",
 					DisplayName: "cn",
 					Groupname:   "cn",
-					Member:      "cn",
+					Member:      "member",
 				},
 			},
 			JSON: config.JSONProvider{},
--- a/extensions/graph/pkg/config/defaults/defaultconfig.go
+++ b/extensions/graph/pkg/config/defaults/defaultconfig.go
@@ -33,15 +33,15 @@ func DefaultConfig() *config.Config {
 			Insecure:     false,
 		},
 		Identity: config.Identity{
-			Backend: "cs3",
+			Backend: "ldap",
 			LDAP: config.LDAP{
-				URI:                      "ldap://localhost:9125",
-				Insecure:                 false,
-				BindDN:                   "",
-				BindPassword:             "",
+				URI:                      "ldaps://localhost:9235",
+				Insecure:                 true,
+				BindDN:                   "uid=libregraph,ou=sysusers,o=libregraph-idm",
+				BindPassword:             "idm",
 				UseServerUUID:            false,
-				WriteEnabled:             false,
-				UserBaseDN:               "ou=users,dc=ocis,dc=test",
+				WriteEnabled:             true,
+				UserBaseDN:               "ou=users,o=libregraph-idm",
 				UserSearchScope:          "sub",
 				UserFilter:               "",
 				UserObjectClass:          "inetOrgPerson",
@@ -51,7 +51,7 @@ func DefaultConfig() *config.Config {
 				// FIXME: switch this to some more widely available attribute by default
 				//        ideally this needs to	be constant for the lifetime of a users
 				UserIDAttribute:    "owncloudUUID",
-				GroupBaseDN:        "ou=groups,dc=ocis,dc=test",
+				GroupBaseDN:        "ou=groups,o=libregraph-idm",
 				GroupSearchScope:   "sub",
 				GroupFilter:        "",
 				GroupObjectClass:   "groupOfNames",
--- a/extensions/group/pkg/command/command.go
+++ b/extensions/group/pkg/command/command.go
@@ -190,6 +190,8 @@ func ldapConfigFromString(cfg config.LDAPDriver) map[string]interface{} {
 		"bind_password":     cfg.BindPassword,
 		"user_base_dn":      cfg.UserBaseDN,
 		"group_base_dn":     cfg.GroupBaseDN,
+		"user_scope":        cfg.UserScope,
+		"group_scope":       cfg.GroupScope,
 		"user_filter":       cfg.UserFilter,
 		"group_filter":      cfg.GroupFilter,
 		"user_objectclass":  cfg.UserObjectClass,
--- a/extensions/group/pkg/config/config.go
+++ b/extensions/group/pkg/config/config.go
@@ -67,6 +67,8 @@ type LDAPDriver struct {
 	BindPassword     string   `env:"LDAP_BIND_PASSWORD;GROUPS_LDAP_BIND_PASSWORD"`
 	UserBaseDN       string   `env:"LDAP_USER_BASE_DN;GROUPS_LDAP_USER_BASE_DN"`
 	GroupBaseDN      string   `env:"LDAP_GROUP_BASE_DN;GROUPS_LDAP_GROUP_BASE_DN"`
+	UserScope        string   `env:"LDAP_USER_SCOPE;GROUPS_LDAP_USER_SCOPE"`
+	GroupScope       string   `env:"LDAP_GROUP_SCOPE;GROUPS_LDAP_GROUP_SCOPE"`
 	UserFilter       string   `env:"LDAP_USERFILTER;GROUPS_LDAP_USERFILTER"`
 	GroupFilter      string   `env:"LDAP_GROUPFILTER;GROUPS_LDAP_USERFILTER"`
 	UserObjectClass  string   `env:"LDAP_USER_OBJECTCLASS;GROUPS_LDAP_USER_OBJECTCLASS"`
--- a/extensions/group/pkg/config/defaults/defaultconfig.go
+++ b/extensions/group/pkg/config/defaults/defaultconfig.go
@@ -36,31 +36,33 @@ func DefaultConfig() *config.Config {
 		Driver:                      "ldap",
 		Drivers: config.Drivers{
 			LDAP: config.LDAPDriver{
-				URI:              "ldaps://localhost:9126",
-				CACert:           filepath.Join(defaults.BaseDataPath(), "ldap", "ldap.crt"),
+				URI:              "ldaps://localhost:9235",
+				CACert:           filepath.Join(defaults.BaseDataPath(), "idm", "ldap.crt"),
 				Insecure:         false,
-				UserBaseDN:       "dc=ocis,dc=test",
-				GroupBaseDN:      "dc=ocis,dc=test",
-				LoginAttributes:  []string{"cn", "mail"},
+				UserBaseDN:       "ou=users,o=libregraph-idm",
+				GroupBaseDN:      "ou=groups,o=libregraph-idm",
+				UserScope:        "sub",
+				GroupScope:       "sub",
+				LoginAttributes:  []string{"uid", "mail"},
 				UserFilter:       "",
 				GroupFilter:      "",
-				UserObjectClass:  "posixAccount",
-				GroupObjectClass: "posixGroup",
-				BindDN:           "cn=reva,ou=sysusers,dc=ocis,dc=test",
+				UserObjectClass:  "inetOrgPerson",
+				GroupObjectClass: "groupOfNames",
+				BindDN:           "uid=reva,ou=sysusers,o=libregraph-idm",
 				BindPassword:     "reva",
 				IDP:              "https://localhost:9200",
 				UserSchema: config.LDAPUserSchema{
 					ID:          "ownclouduuid",
 					Mail:        "mail",
 					DisplayName: "displayname",
-					Username:    "cn",
+					Username:    "uid",
 				},
 				GroupSchema: config.LDAPGroupSchema{
-					ID:          "cn",
+					ID:          "ownclouduuid",
 					Mail:        "mail",
 					DisplayName: "cn",
 					Groupname:   "cn",
-					Member:      "cn",
+					Member:      "member",
 				},
 			},
 			JSON: config.JSONDriver{},
--- a/extensions/idp/pkg/config/defaults/defaultconfig.go
+++ b/extensions/idp/pkg/config/defaults/defaultconfig.go
@@ -42,7 +42,7 @@ func DefaultConfig() *config.Config {
 			SignedOutURI:                      "",
 			AuthorizationEndpointURI:          "",
 			EndsessionEndpointURI:             "",
-			Insecure:                          false,
+			Insecure:                          true,
 			TrustedProxy:                      nil,
 			AllowScope:                        nil,
 			AllowClientGuests:                 false,
@@ -68,18 +68,18 @@ func DefaultConfig() *config.Config {
 			DyamicClientSecretDurationSeconds: 0,
 		},
 		Ldap: config.Ldap{
-			URI:               "ldap://localhost:9125",
-			BindDN:            "cn=idp,ou=sysusers,dc=ocis,dc=test",
+			URI:               "ldaps://localhost:9235",
+			BindDN:            "uid=idp,ou=sysusers,o=libregraph-idm",
 			BindPassword:      "idp",
-			BaseDN:            "ou=users,dc=ocis,dc=test",
+			BaseDN:            "ou=users,o=libregraph-idm",
 			Scope:             "sub",
-			LoginAttribute:    "cn",
+			LoginAttribute:    "uid",
 			EmailAttribute:    "mail",
 			NameAttribute:     "displayName",
 			UUIDAttribute:     "uid",
 			UUIDAttributeType: "text",
 			Filter:            "",
-			ObjectClass:       "posixAccount",
+			ObjectClass:       "inetOrgPerson",
 		},
 	}
 }
--- a/extensions/ocs/pkg/config/defaults/defaultconfig.go
+++ b/extensions/ocs/pkg/config/defaults/defaultconfig.go
@@ -41,7 +41,7 @@ func DefaultConfig() *config.Config {
 		TokenManager: config.TokenManager{
 			JWTSecret: "Pive-Fumkiu4",
 		},
-		AccountBackend: "accounts",
+		AccountBackend: "cs3",
 		Reva: config.Reva{
 			Address: "127.0.0.1:9142",
 		},
--- a/extensions/proxy/pkg/config/defaults/defaultconfig.go
+++ b/extensions/proxy/pkg/config/defaults/defaultconfig.go
@@ -45,7 +45,7 @@ func DefaultConfig() *config.Config {
 			AllowedHTTPMethods: []string{"GET"},
 			Enabled:            true,
 		},
-		AccountBackend:        "accounts",
+		AccountBackend:        "cs3",
 		UserOIDCClaim:         "email",
 		UserCS3Claim:          "mail",
 		MachineAuthAPIKey:     "change-me-please",
--- a/extensions/storage/pkg/config/defaults/defaultconfig.go
+++ b/extensions/storage/pkg/config/defaults/defaultconfig.go
@@ -44,35 +44,35 @@ func DefaultConfig() *config.Config {
 				IDClaim:  "preferred_username",
 			},
 			LDAP: config.LDAP{
-				URI:              "ldaps://localhost:9126",
-				CACert:           path.Join(defaults.BaseDataPath(), "ldap", "ldap.crt"),
+				URI:              "ldaps://localhost:9235",
+				CACert:           path.Join(defaults.BaseDataPath(), "idm", "ldap.crt"),
 				Insecure:         false,
-				UserBaseDN:       "dc=ocis,dc=test",
-				GroupBaseDN:      "dc=ocis,dc=test",
+				UserBaseDN:       "ou=users,o=libregraph-idm",
+				GroupBaseDN:      "ou=groups,o=libregraph-idm",
 				UserScope:        "sub",
 				GroupScope:       "sub",
-				LoginAttributes:  []string{"cn", "mail"},
+				LoginAttributes:  []string{"uid", "mail"},
 				UserFilter:       "",
 				GroupFilter:      "",
-				UserObjectClass:  "posixAccount",
-				GroupObjectClass: "posixGroup",
-				BindDN:           "cn=reva,ou=sysusers,dc=ocis,dc=test",
+				UserObjectClass:  "inetOrgPerson",
+				GroupObjectClass: "groupOfNames",
+				BindDN:           "uid=reva,ou=sysusers,o=libregraph-idm",
 				BindPassword:     "reva",
 				IDP:              defaultPublicURL,
 				UserSchema: config.LDAPUserSchema{
 					ID:          "ownclouduuid",
 					Mail:        "mail",
 					DisplayName: "displayname",
-					Username:    "cn",
+					Username:    "uid",
 					UIDNumber:   "uidnumber",
 					GIDNumber:   "gidnumber",
 				},
 				GroupSchema: config.LDAPGroupSchema{
-					ID:          "cn",
+					ID:          "ownclouduuid",
 					Mail:        "mail",
 					DisplayName: "cn",
 					Groupname:   "cn",
-					Member:      "cn",
+					Member:      "member",
 					GIDNumber:   "gidnumber",
 				},
 			},
--- a/extensions/user/pkg/command/command.go
+++ b/extensions/user/pkg/command/command.go
@@ -209,6 +209,8 @@ func ldapConfigFromString(cfg config.LDAPDriver) map[string]interface{} {
 		"bind_password":     cfg.BindPassword,
 		"user_base_dn":      cfg.UserBaseDN,
 		"group_base_dn":     cfg.GroupBaseDN,
+		"user_scope":        cfg.UserScope,
+		"group_scope":       cfg.GroupScope,
 		"user_filter":       cfg.UserFilter,
 		"group_filter":      cfg.GroupFilter,
 		"user_objectclass":  cfg.UserObjectClass,
--- a/extensions/user/pkg/config/config.go
+++ b/extensions/user/pkg/config/config.go
@@ -67,6 +67,8 @@ type LDAPDriver struct {
 	BindPassword     string   `env:"LDAP_BIND_PASSWORD;USERS_LDAP_BIND_PASSWORD"`
 	UserBaseDN       string   `env:"LDAP_USER_BASE_DN;USERS_LDAP_USER_BASE_DN"`
 	GroupBaseDN      string   `env:"LDAP_GROUP_BASE_DN;USERS_LDAP_GROUP_BASE_DN"`
+	UserScope        string   `env:"LDAP_USER_SCOPE;USERS_LDAP_USER_SCOPE"`
+	GroupScope       string   `env:"LDAP_GROUP_SCOPE;USERS_LDAP_GROUP_SCOPE"`
 	UserFilter       string   `env:"LDAP_USERFILTER;USERS_LDAP_USERFILTER"`
 	GroupFilter      string   `env:"LDAP_GROUPFILTER;USERS_LDAP_USERFILTER"`
 	UserObjectClass  string   `env:"LDAP_USER_OBJECTCLASS;USERS_LDAP_USER_OBJECTCLASS"`
--- a/extensions/user/pkg/config/defaults/defaultconfig.go
+++ b/extensions/user/pkg/config/defaults/defaultconfig.go
@@ -36,31 +36,33 @@ func DefaultConfig() *config.Config {
 		Driver:               "ldap",
 		Drivers: config.Drivers{
 			LDAP: config.LDAPDriver{
-				URI:              "ldaps://localhost:9126",
-				CACert:           filepath.Join(defaults.BaseDataPath(), "ldap", "ldap.crt"),
+				URI:              "ldaps://localhost:9235",
+				CACert:           filepath.Join(defaults.BaseDataPath(), "idm", "ldap.crt"),
 				Insecure:         false,
-				UserBaseDN:       "dc=ocis,dc=test",
-				GroupBaseDN:      "dc=ocis,dc=test",
-				LoginAttributes:  []string{"cn", "mail"},
+				UserBaseDN:       "ou=users,o=libregraph-idm",
+				GroupBaseDN:      "ou=groups,o=libregraph-idm",
+				UserScope:        "sub",
+				GroupScope:       "sub",
+				LoginAttributes:  []string{"uid", "mail"},
 				UserFilter:       "",
 				GroupFilter:      "",
-				UserObjectClass:  "posixAccount",
-				GroupObjectClass: "posixGroup",
-				BindDN:           "cn=reva,ou=sysusers,dc=ocis,dc=test",
+				UserObjectClass:  "inetOrgPerson",
+				GroupObjectClass: "groupOfNames",
+				BindDN:           "uid=reva,ou=sysusers,o=libregraph-idm",
 				BindPassword:     "reva",
 				IDP:              "https://localhost:9200",
 				UserSchema: config.LDAPUserSchema{
 					ID:          "ownclouduuid",
 					Mail:        "mail",
 					DisplayName: "displayname",
-					Username:    "cn",
+					Username:    "uid",
 				},
 				GroupSchema: config.LDAPGroupSchema{
-					ID:          "cn",
+					ID:          "ownclouduuid",
 					Mail:        "mail",
 					DisplayName: "cn",
 					Groupname:   "cn",
-					Member:      "cn",
+					Member:      "member",
 				},
 			},
 			JSON: config.JSONDriver{},
--- a/ocis/pkg/runtime/service/service.go
+++ b/ocis/pkg/runtime/service/service.go
@@ -254,10 +254,18 @@ func (s *Service) generateRunSet(cfg *ociscfg.Config) {
 	}

 	for name := range s.ServicesRegistry {
+		// don't run glauth by default but keep the possiblity to start it via cfg.Runtime.Extensions for now
+		if name == "glauth" {
+			continue
+		}
 		runset = append(runset, name)
 	}

 	for name := range s.Delayed {
+		// don't run accounts by default but keep the possiblity to start it via cfg.Runtime.Extensions for now
+		if name == "accounts" {
+			continue
+		}
 		runset = append(runset, name)
 	}
 }