mirror of
https://github.com/opencloud-eu/opencloud.git
synced 2026-05-03 13:43:16 -04:00
c400949718
* re-implement the auth-api service to authenticate Reva tokens following the OIDC Userinfo endpoint specification * pass the context where necessary and add an authenticator interface to the JMAP HTTP driver, in order to select between master authentication (which is used when GROUPWARE_JMAP_MASTER_USERNAME and GROUPWARE_JMAP_MASTER_PASSWORD are both set) and OIDC token forwarding through bearer auth * add Stalwart directory configuration "idmoidc" which uses the OpenCloud auth-api service API (/auth/) to validate the token it received as bearer auth from the Groupware backend's JMAP client, using it as an OIDC Userinfo endpoint * implement optional additional shared secret to secure the Userinfo service, as an additional path parameter
Stalwart Configuration
The mechanics are currently to mount a different configuration file depending on the environment, as we support two scenarios that are described in services/groupware/DEVELOPER.md:
- «production» setup, with OpenLDAP and Keycloak containers
- «homelab» setup, with the built-in IDM (LDAP) and IDP that run as part of the
opencloudcontainer
The Docker Compose setup (in stalwart.yml) mounts either idmldap.toml or ldap.toml depending on how the variable STALWART_AUTH_DIRECTORY is set, which is either idmldap for the homelab setup, or ldap for the production setup.
This is thus all done automatically, but whenever changes are performed to Stalwart configuration files, they must be reflected across those two files, to keep them in sync, as the only entry that should differ is this one:
storage.directory = "ldap"
or this:
storage.directory = "idmldap"