Skip to content

fix(identity): add opencloud.ldap.keepIdm for external OIDC without OpenLDAP - #167

Closed
HttpRafa wants to merge 2 commits into
Tim-herbie:mainfrom
HttpRafa:feat/improve-chart
Closed

fix(identity): add opencloud.ldap.keepIdm for external OIDC without OpenLDAP#167
HttpRafa wants to merge 2 commits into
Tim-herbie:mainfrom
HttpRafa:feat/improve-chart

Conversation

@HttpRafa

@HttpRafa HttpRafa commented Sep 6, 2026

Copy link
Copy Markdown

OpenCloud splits login and the user directory:

  • IDP is login (bundled OIDC, or Authentik / Keycloak / Authelia)
  • IDM is the user database (bundled LibreIDM, or a real OpenLDAP)

The chart currently treats those as one switch. Setting excludeServices: [idp] to use Authentik also rewires every LDAP setting to ldaps://openldap.openldap.svc.cluster.local. If you did not deploy OpenLDAP, the users service fails DNS, /graph/v1.0/me returns 500, and accounts never get created.

That coupling is only right for one of the two official layouts:

  1. External OIDC + OpenLDAP (idm/external-idp.yml): exclude idm and idp, run OpenLDAP.
  2. External OIDC + bundled IDM (Authelia / the official external-IDP docs): exclude idp only. Users autoprovision into IDM. No LDAP server.

I first tried to make layout 2 the default. That would silently break existing OpenLDAP installs: OC_LDAP_* would disappear unless they set a new flag. So this PR does not change 3.0.0 behaviour.

opencloud.ldap.keepIdm defaults to false. Excluding idp still points LDAP at OpenLDAP, same as today.

Set it to true when you want layout 2:

oidc:
  issuerUrl: https://auth.example.com/application/o/opencloud/
opencloud:
  ldap:
    keepIdm: true
  excludeServices:
    - idp

Do not exclude idm on that path.


I used AI to understand the inner workings of this chart, and for suggestions and help implementing the required changes.

@HttpRafa HttpRafa changed the title fix(identity): decouple external OIDC from external LDAP fix(identity): add useBundledLDAP for external OIDC without OpenLDAP Sep 8, 2026
@HttpRafa
HttpRafa marked this pull request as ready for review September 8, 2026 10:29
@HttpRafa HttpRafa changed the title fix(identity): add useBundledLDAP for external OIDC without OpenLDAP fix(identity): add ldap.keepIdm for external OIDC without OpenLDAP Sep 8, 2026
@HttpRafa HttpRafa changed the title fix(identity): add ldap.keepIdm for external OIDC without OpenLDAP fix(identity): add opencloud.ldap.keepIdm for external OIDC without OpenLDAP Sep 8, 2026
@Tim-herbie

Copy link
Copy Markdown
Owner

Thank you for the pr @HttpRafa. Let me check that

excludeServices: [idp] still points LDAP at OpenLDAP.
Set opencloud.ldap.keepIdm: true to keep the bundled IDM instead.
@HttpRafa

HttpRafa commented Sep 9, 2026

Copy link
Copy Markdown
Author

@Tim-herbie I saw there's a workflow to publish a chart for this PR. Could you trigger it? I've only tested this on a stripped-down cluster so far, so I'm not sure if that test is fully reliable. Testing unreleased Helm charts with ArgoCD is quite difficult, so having the published chart would let me test it properly on my actual cluster.

@Tim-herbie

Copy link
Copy Markdown
Owner

@HttpRafa That was exactly what I tried :) I added a workflow to publish a chart on every pr, but I noticed that this does not work when the source branch is from another repository.

Anyway, I did it manually locally and pushed this tag: 3.0.0-pr-ldap

@Tim-herbie

Copy link
Copy Markdown
Owner

I am using layout 2 in my environment with an external Keycloak, but no Openldap.

When I use the values that you provide with the pr helm chart tag I got following:

  • opencloud starts
  • I can login with already registered users
  • I can login with new users (I create users with keycloak and assign them the specific role)

From my point of view, everthything works, but I still get error logs:

{"level":"error","service":"graph","request-id":"opencloud-opencloud-59b8cb6795-7xm8l/LmnsDgHSP8-000155","error":"LDAP Result Code 68 \"Entry Already Exists\": ","time":"2026-09-09T10:54:16Z","message":"failed to add user"}
{"level":"error","service":"graph","request-id":"opencloud-opencloud-59b8cb6795-7xm8l/LmnsDgHSP8-000155","error":"nameAlreadyExists: a user with that name already exists","time":"2026-09-09T10:54:16Z","message":"could not create user: backend error"}
{"level":"warn","service":"proxy","OData Error":"a user with that name already exists","time":"2026-09-09T10:54:16Z","message":"Error Response"}
{"level":"error","service":"graph","request-id":"opencloud-opencloud-59b8cb6795-7xm8l/LmnsDgHSP8-000157","error":"LDAP Result Code 68 \"Entry Already Exists\": ","time":"2026-09-09T10:54:16Z","message":"failed to add user"}
{"level":"error","service":"graph","request-id":"opencloud-opencloud-59b8cb6795-7xm8l/LmnsDgHSP8-000157","error":"nameAlreadyExists: a user with that name already exists","time":"2026-09-09T10:54:16Z","message":"could not create user: backend error"}
{"level":"warn","service":"proxy","OData Error":"a user with that name already exists","time":"2026-09-09T10:54:16Z","message":"Error Response"}
{"level":"error","service":"graph","request-id":"opencloud-opencloud-59b8cb6795-7xm8l/LmnsDgHSP8-000159","error":"LDAP Result Code 68 \"Entry Already Exists\": ","time":"2026-09-09T10:54:17Z","message":"failed to add user"}
{"level":"error","service":"graph","request-id":"opencloud-opencloud-59b8cb6795-7xm8l/LmnsDgHSP8-000159","error":"nameAlreadyExists: a user with that name already exists","time":"2026-09-09T10:54:17Z","message":"could not create user: backend error"}
{"level":"warn","service":"proxy","OData Error":"a user with that name already exists","time":"2026-09-09T10:54:17Z","message":"Error Response"}
{"level":"error","service":"graph","request-id":"opencloud-opencloud-59b8cb6795-7xm8l/LmnsDgHSP8-000160","error":"LDAP Result Code 68 \"Entry Already Exists\": ","time":"2026-09-09T10:54:17Z","message":"failed to add user"}
{"level":"error","service":"graph","request-id":"opencloud-opencloud-59b8cb6795-7xm8l/LmnsDgHSP8-000160","error":"nameAlreadyExists: a user with that name already exists","time":"2026-09-09T10:54:17Z","message":"could not create user: backend error"}
{"level":"warn","service":"proxy","OData Error":"a user with that name already exists","time":"2026-09-09T10:54:17Z","message":"Error Response"}
{"level":"error","service":"graph","request-id":"opencloud-opencloud-59b8cb6795-7xm8l/LmnsDgHSP8-000163","error":"LDAP Result Code 68 \"Entry Already Exists\": ","time":"2026-09-09T10:54:17Z","message":"failed to add user"}
{"level":"error","service":"graph","request-id":"opencloud-opencloud-59b8cb6795-7xm8l/LmnsDgHSP8-000163","error":"nameAlreadyExists: a user with that name already exists","time":"2026-09-09T10:54:17Z","message":"could not create user: backend error"}
{"level":"warn","service":"proxy","OData Error":"a user with that name already exists","time":"2026-09-09T10:54:17Z","message":"Error Response"}
{"level":"error","service":"graph","request-id":"opencloud-opencloud-59b8cb6795-7xm8l/LmnsDgHSP8-000165","error":"LDAP Result Code 68 \"Entry Already Exists\": ","time":"2026-09-09T10:54:17Z","message":"failed to add user"}
{"level":"error","service":"graph","request-id":"opencloud-opencloud-59b8cb6795-7xm8l/LmnsDgHSP8-000165","error":"nameAlreadyExists: a user with that name already exists","time":"2026-09-09T10:54:17Z","message":"could not create user: backend error"}
{"level":"warn","service":"proxy","OData Error":"a user with that name already exists","time":"2026-09-09T10:54:17Z","message":"Error Response"}
{"level":"error","service":"graph","request-id":"opencloud-opencloud-59b8cb6795-7xm8l/LmnsDgHSP8-000167","error":"LDAP Result Code 68 \"Entry Already Exists\": ","time":"2026-09-09T10:54:17Z","message":"failed to add user"}
{"level":"error","service":"graph","request-id":"opencloud-opencloud-59b8cb6795-7xm8l/LmnsDgHSP8-000167","error":"nameAlreadyExists: a user with that name already exists","time":"2026-09-09T10:54:17Z","message":"could not create user: backend error"}
{"level":"warn","service":"proxy","OData Error":"a user with that name already exists","time":"2026-09-09T10:54:17Z","message":"Error Response"}
{"level":"error","service":"graph","request-id":"opencloud-opencloud-59b8cb6795-7xm8l/LmnsDgHSP8-000169","error":"LDAP Result Code 68 \"Entry Already Exists\": ","time":"2026-09-09T10:54:17Z","message":"failed to add user"}
{"level":"error","service":"graph","request-id":"opencloud-opencloud-59b8cb6795-7xm8l/LmnsDgHSP8-000169","error":"nameAlreadyExists: a user with that name already exists","time":"2026-09-09T10:54:17Z","message":"could not create user: backend error"}
{"level":"warn","service":"proxy","OData Error":"a user with that name already exists","time":"2026-09-09T10:54:17Z","message":"Error Response"}
{"level":"error","service":"graph","request-id":"opencloud-opencloud-59b8cb6795-7xm8l/LmnsDgHSP8-000171","error":"LDAP Result Code 68 \"Entry Already Exists\": ","time":"2026-09-09T10:54:17Z","message":"failed to add user"}
{"level":"error","service":"graph","request-id":"opencloud-opencloud-59b8cb6795-7xm8l/LmnsDgHSP8-000171","error":"nameAlreadyExists: a user with that name already exists","time":"2026-09-09T10:54:17Z","message":"could not create user: backend error"}
{"level":"error","service":"graph","request-id":"opencloud-opencloud-59b8cb6795-7xm8l/LmnsDgHSP8-000172","error":"LDAP Result Code 68 \"Entry Already Exists\": ","time":"2026-09-09T10:54:17Z","message":"failed to add user"}
{"level":"error","service":"graph","request-id":"opencloud-opencloud-59b8cb6795-7xm8l/LmnsDgHSP8-000172","error":"nameAlreadyExists: a user with that name already exists","time":"2026-09-09T10:54:17Z","message":"could not create user: backend error"}
{"level":"warn","service":"proxy","OData Error":"a user with that name already exists","time":"2026-09-09T10:54:17Z","message":"Error Response"}
{"level":"warn","service":"proxy","OData Error":"a user with that name already exists","time":"2026-09-09T10:54:17Z","message":"Error Response"}
{"level":"error","service":"graph","request-id":"opencloud-opencloud-59b8cb6795-7xm8l/LmnsDgHSP8-000175","error":"LDAP Result Code 68 \"Entry Already Exists\": ","time":"2026-09-09T10:54:17Z","message":"failed to add user"}
{"level":"error","service":"graph","request-id":"opencloud-opencloud-59b8cb6795-7xm8l/LmnsDgHSP8-000175","error":"nameAlreadyExists: a user with that name already exists","time":"2026-09-09T10:54:17Z","message":"could not create user: backend error"}
{"level":"warn","service":"proxy","OData Error":"a user with that name already exists","time":"2026-09-09T10:54:17Z","message":"Error Response"}
{"level":"warn","service":"storage-system","host.name":"opencloud-opencloud-59b8cb6795-7xm8l","pkg":"rhttp","traceid":"3c5ee3688958c849c7e6a8060631837b","host":"127.0.0.1","method":"GET","uri":"/data/spaces/f2bdd61a-da7c-49fc-8203-0558109d1b4f%21f2bdd61a-da7c-49fc-8203-0558109d1b4f/0f8dc888-1163-4e77-a898-3c2a7278d806","url":"/0f8dc888-1163-4e77-a898-3c2a7278d806","proto":"HTTP/1.1","status":404,"size":0,"start":"09/Sep/2026:10:54:17 +0000","end":"09/Sep/2026:10:54:17 +0000","time_ns":1053939,"time":"2026-09-09T10:54:17Z","message":"http"}

@HttpRafa

HttpRafa commented Sep 9, 2026

Copy link
Copy Markdown
Author

I am using layout 2 in my environment with an external Keycloak, but no Openldap.

When I use the values that you provide with the pr helm chart tag I got following:

  • opencloud starts
  • I can login with already registered users
  • I can login with new users (I create users with keycloak and assign them the specific role)

From my point of view, everthything works, but I still get error logs:

{"level":"error","service":"graph","request-id":"opencloud-opencloud-59b8cb6795-7xm8l/LmnsDgHSP8-000155","error":"LDAP Result Code 68 \"Entry Already Exists\": ","time":"2026-09-09T10:54:16Z","message":"failed to add user"}
{"level":"error","service":"graph","request-id":"opencloud-opencloud-59b8cb6795-7xm8l/LmnsDgHSP8-000155","error":"nameAlreadyExists: a user with that name already exists","time":"2026-09-09T10:54:16Z","message":"could not create user: backend error"}
{"level":"warn","service":"proxy","OData Error":"a user with that name already exists","time":"2026-09-09T10:54:16Z","message":"Error Response"}
{"level":"error","service":"graph","request-id":"opencloud-opencloud-59b8cb6795-7xm8l/LmnsDgHSP8-000157","error":"LDAP Result Code 68 \"Entry Already Exists\": ","time":"2026-09-09T10:54:16Z","message":"failed to add user"}
{"level":"error","service":"graph","request-id":"opencloud-opencloud-59b8cb6795-7xm8l/LmnsDgHSP8-000157","error":"nameAlreadyExists: a user with that name already exists","time":"2026-09-09T10:54:16Z","message":"could not create user: backend error"}
{"level":"warn","service":"proxy","OData Error":"a user with that name already exists","time":"2026-09-09T10:54:16Z","message":"Error Response"}
{"level":"error","service":"graph","request-id":"opencloud-opencloud-59b8cb6795-7xm8l/LmnsDgHSP8-000159","error":"LDAP Result Code 68 \"Entry Already Exists\": ","time":"2026-09-09T10:54:17Z","message":"failed to add user"}
{"level":"error","service":"graph","request-id":"opencloud-opencloud-59b8cb6795-7xm8l/LmnsDgHSP8-000159","error":"nameAlreadyExists: a user with that name already exists","time":"2026-09-09T10:54:17Z","message":"could not create user: backend error"}
{"level":"warn","service":"proxy","OData Error":"a user with that name already exists","time":"2026-09-09T10:54:17Z","message":"Error Response"}
{"level":"error","service":"graph","request-id":"opencloud-opencloud-59b8cb6795-7xm8l/LmnsDgHSP8-000160","error":"LDAP Result Code 68 \"Entry Already Exists\": ","time":"2026-09-09T10:54:17Z","message":"failed to add user"}
{"level":"error","service":"graph","request-id":"opencloud-opencloud-59b8cb6795-7xm8l/LmnsDgHSP8-000160","error":"nameAlreadyExists: a user with that name already exists","time":"2026-09-09T10:54:17Z","message":"could not create user: backend error"}
{"level":"warn","service":"proxy","OData Error":"a user with that name already exists","time":"2026-09-09T10:54:17Z","message":"Error Response"}
{"level":"error","service":"graph","request-id":"opencloud-opencloud-59b8cb6795-7xm8l/LmnsDgHSP8-000163","error":"LDAP Result Code 68 \"Entry Already Exists\": ","time":"2026-09-09T10:54:17Z","message":"failed to add user"}
{"level":"error","service":"graph","request-id":"opencloud-opencloud-59b8cb6795-7xm8l/LmnsDgHSP8-000163","error":"nameAlreadyExists: a user with that name already exists","time":"2026-09-09T10:54:17Z","message":"could not create user: backend error"}
{"level":"warn","service":"proxy","OData Error":"a user with that name already exists","time":"2026-09-09T10:54:17Z","message":"Error Response"}
{"level":"error","service":"graph","request-id":"opencloud-opencloud-59b8cb6795-7xm8l/LmnsDgHSP8-000165","error":"LDAP Result Code 68 \"Entry Already Exists\": ","time":"2026-09-09T10:54:17Z","message":"failed to add user"}
{"level":"error","service":"graph","request-id":"opencloud-opencloud-59b8cb6795-7xm8l/LmnsDgHSP8-000165","error":"nameAlreadyExists: a user with that name already exists","time":"2026-09-09T10:54:17Z","message":"could not create user: backend error"}
{"level":"warn","service":"proxy","OData Error":"a user with that name already exists","time":"2026-09-09T10:54:17Z","message":"Error Response"}
{"level":"error","service":"graph","request-id":"opencloud-opencloud-59b8cb6795-7xm8l/LmnsDgHSP8-000167","error":"LDAP Result Code 68 \"Entry Already Exists\": ","time":"2026-09-09T10:54:17Z","message":"failed to add user"}
{"level":"error","service":"graph","request-id":"opencloud-opencloud-59b8cb6795-7xm8l/LmnsDgHSP8-000167","error":"nameAlreadyExists: a user with that name already exists","time":"2026-09-09T10:54:17Z","message":"could not create user: backend error"}
{"level":"warn","service":"proxy","OData Error":"a user with that name already exists","time":"2026-09-09T10:54:17Z","message":"Error Response"}
{"level":"error","service":"graph","request-id":"opencloud-opencloud-59b8cb6795-7xm8l/LmnsDgHSP8-000169","error":"LDAP Result Code 68 \"Entry Already Exists\": ","time":"2026-09-09T10:54:17Z","message":"failed to add user"}
{"level":"error","service":"graph","request-id":"opencloud-opencloud-59b8cb6795-7xm8l/LmnsDgHSP8-000169","error":"nameAlreadyExists: a user with that name already exists","time":"2026-09-09T10:54:17Z","message":"could not create user: backend error"}
{"level":"warn","service":"proxy","OData Error":"a user with that name already exists","time":"2026-09-09T10:54:17Z","message":"Error Response"}
{"level":"error","service":"graph","request-id":"opencloud-opencloud-59b8cb6795-7xm8l/LmnsDgHSP8-000171","error":"LDAP Result Code 68 \"Entry Already Exists\": ","time":"2026-09-09T10:54:17Z","message":"failed to add user"}
{"level":"error","service":"graph","request-id":"opencloud-opencloud-59b8cb6795-7xm8l/LmnsDgHSP8-000171","error":"nameAlreadyExists: a user with that name already exists","time":"2026-09-09T10:54:17Z","message":"could not create user: backend error"}
{"level":"error","service":"graph","request-id":"opencloud-opencloud-59b8cb6795-7xm8l/LmnsDgHSP8-000172","error":"LDAP Result Code 68 \"Entry Already Exists\": ","time":"2026-09-09T10:54:17Z","message":"failed to add user"}
{"level":"error","service":"graph","request-id":"opencloud-opencloud-59b8cb6795-7xm8l/LmnsDgHSP8-000172","error":"nameAlreadyExists: a user with that name already exists","time":"2026-09-09T10:54:17Z","message":"could not create user: backend error"}
{"level":"warn","service":"proxy","OData Error":"a user with that name already exists","time":"2026-09-09T10:54:17Z","message":"Error Response"}
{"level":"warn","service":"proxy","OData Error":"a user with that name already exists","time":"2026-09-09T10:54:17Z","message":"Error Response"}
{"level":"error","service":"graph","request-id":"opencloud-opencloud-59b8cb6795-7xm8l/LmnsDgHSP8-000175","error":"LDAP Result Code 68 \"Entry Already Exists\": ","time":"2026-09-09T10:54:17Z","message":"failed to add user"}
{"level":"error","service":"graph","request-id":"opencloud-opencloud-59b8cb6795-7xm8l/LmnsDgHSP8-000175","error":"nameAlreadyExists: a user with that name already exists","time":"2026-09-09T10:54:17Z","message":"could not create user: backend error"}
{"level":"warn","service":"proxy","OData Error":"a user with that name already exists","time":"2026-09-09T10:54:17Z","message":"Error Response"}
{"level":"warn","service":"storage-system","host.name":"opencloud-opencloud-59b8cb6795-7xm8l","pkg":"rhttp","traceid":"3c5ee3688958c849c7e6a8060631837b","host":"127.0.0.1","method":"GET","uri":"/data/spaces/f2bdd61a-da7c-49fc-8203-0558109d1b4f%21f2bdd61a-da7c-49fc-8203-0558109d1b4f/0f8dc888-1163-4e77-a898-3c2a7278d806","url":"/0f8dc888-1163-4e77-a898-3c2a7278d806","proto":"HTTP/1.1","status":404,"size":0,"start":"09/Sep/2026:10:54:17 +0000","end":"09/Sep/2026:10:54:17 +0000","time_ns":1053939,"time":"2026-09-09T10:54:17Z","message":"http"}

I use Authentik with OpenCloud and Layout 2 as well, but I don't get any of these errors. Since these come from the integrated IDM, it might be a different issue. Are these errors specific to my chart version? I've never seen this happen. I'd expect logins to break, but that seems to work fine.

@Tim-herbie

Copy link
Copy Markdown
Owner

@HttpRafa Okay. For me it´s verifizied that Layout2 works. Do you have an openldap-server and can test the Layout with an external oidc and external openldap?

If not, maybe @suse-coder can test this. I know, that he use both external services as well.

@HttpRafa

HttpRafa commented Sep 9, 2026

Copy link
Copy Markdown
Author

@HttpRafa Okay. For me it´s verifizied that Layout2 works. Do you have an openldap-server and can test the Layout with an external oidc and external openldap?

If not, maybe @suse-coder can test this. I know, that he use both external services as well.

I sadly don't have the setup for that.

@suse-coder

Copy link
Copy Markdown

Checked and it works — I tested the approach from this PR on a real cluster (external Keycloak via Flux) and made some smaller changes on top: schema placed under opencloud.ldap, a fail guard for keepIdm: true + excluded idm, more tests, and doc updates. Opened as #169 which builds on and supersedes this one. Thanks for the original work!

@HttpRafa HttpRafa closed this Sep 9, 2026
@HttpRafa
HttpRafa deleted the feat/improve-chart branch September 9, 2026 15:19
@HttpRafa

HttpRafa commented Sep 9, 2026

Copy link
Copy Markdown
Author

Checked and it works — I tested the approach from this PR on a real cluster (external Keycloak via Flux) and made some smaller changes on top: schema placed under opencloud.ldap, a fail guard for keepIdm: true + excluded idm, more tests, and doc updates. Opened as #169 which builds on and supersedes this one. Thanks for the original work!

Thanks 👍

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants