idp: Use the UUID attribute for computing the "sub" claim

This avoids that recreating the user with the same name will create the
same "sub" claim. Even though it gets a new UUID

Fixes: #904

changelog/unreleased/fix-idp-sub-recreation.md

@@ -0,0 +1,10 @@
+Bugfix: Use UUID attribute for computing "sub" claim in lico idp
+
+By default the LDAP backend for lico uses the User DN for computing the "sub"
+claim of a user. This caused the "sub" claim to stay the same even if a user
+was deleted and recreated (and go a new UUID assgined with that). We now
+use the user's unique id (`owncloudUUID` by default) for computing the `sub`
+claim. So that user's recreated with the same name will be treated as different
+users by the IDP.
+
+https://github.com/owncloud/ocis/issues/904

services/idp/pkg/config/defaults/defaultconfig.go

@@ -122,7 +122,7 @@ func DefaultConfig() *config.Config {
 			LoginAttribute:       "uid",
 			EmailAttribute:       "mail",
 			NameAttribute:        "displayName",
-			UUIDAttribute:        "uid",
+			UUIDAttribute:        "ownCloudUUID",
 			UUIDAttributeType:    "text",
 			Filter:               "",
 			ObjectClass:          "inetOrgPerson",

services/idp/pkg/service/v0/service.go

@@ -197,6 +197,7 @@ func initLicoInternalLDAPEnvVars(ldap *config.Ldap) error {
 		"LDAP_EMAIL_ATTRIBUTE":     ldap.EmailAttribute,
 		"LDAP_NAME_ATTRIBUTE":      ldap.NameAttribute,
 		"LDAP_UUID_ATTRIBUTE":      ldap.UUIDAttribute,
+		"LDAP_SUB_ATTRIBUTES":      ldap.UUIDAttribute,
 		"LDAP_UUID_ATTRIBUTE_TYPE": ldap.UUIDAttributeType,
 		"LDAP_FILTER":              filter,
 	}