fix(identity): add opencloud.ldap.keepIdm for external OIDC without OpenLDAP - #167
fix(identity): add opencloud.ldap.keepIdm for external OIDC without OpenLDAP#167HttpRafa wants to merge 2 commits into
Conversation
8339b90 to
c95eb36
Compare
704d391 to
cb4bdce
Compare
cb4bdce to
0fcf855
Compare
|
Thank you for the pr @HttpRafa. Let me check that |
excludeServices: [idp] still points LDAP at OpenLDAP. Set opencloud.ldap.keepIdm: true to keep the bundled IDM instead.
63c1d0e to
db4a1dd
Compare
|
@Tim-herbie I saw there's a workflow to publish a chart for this PR. Could you trigger it? I've only tested this on a stripped-down cluster so far, so I'm not sure if that test is fully reliable. Testing unreleased Helm charts with ArgoCD is quite difficult, so having the published chart would let me test it properly on my actual cluster. |
|
@HttpRafa That was exactly what I tried :) I added a workflow to publish a chart on every pr, but I noticed that this does not work when the source branch is from another repository. Anyway, I did it manually locally and pushed this tag: 3.0.0-pr-ldap |
|
I am using layout 2 in my environment with an external Keycloak, but no Openldap. When I use the values that you provide with the pr helm chart tag I got following:
From my point of view, everthything works, but I still get error logs: |
I use Authentik with OpenCloud and Layout 2 as well, but I don't get any of these errors. Since these come from the integrated IDM, it might be a different issue. Are these errors specific to my chart version? I've never seen this happen. I'd expect logins to break, but that seems to work fine. |
|
@HttpRafa Okay. For me it´s verifizied that Layout2 works. Do you have an openldap-server and can test the Layout with an external oidc and external openldap? If not, maybe @suse-coder can test this. I know, that he use both external services as well. |
I sadly don't have the setup for that. |
|
Checked and it works — I tested the approach from this PR on a real cluster (external Keycloak via Flux) and made some smaller changes on top: schema placed under |
Thanks 👍 |
OpenCloud splits login and the user directory:
The chart currently treats those as one switch. Setting
excludeServices: [idp]to use Authentik also rewires every LDAP setting toldaps://openldap.openldap.svc.cluster.local. If you did not deploy OpenLDAP, the users service fails DNS,/graph/v1.0/mereturns 500, and accounts never get created.That coupling is only right for one of the two official layouts:
idm/external-idp.yml): excludeidmandidp, run OpenLDAP.idponly. Users autoprovision into IDM. No LDAP server.I first tried to make layout 2 the default. That would silently break existing OpenLDAP installs:
OC_LDAP_*would disappear unless they set a new flag. So this PR does not change 3.0.0 behaviour.opencloud.ldap.keepIdmdefaults tofalse. Excludingidpstill points LDAP at OpenLDAP, same as today.Set it to
truewhen you want layout 2:Do not exclude
idmon that path.I used AI to understand the inner workings of this chart, and for suggestions and help implementing the required changes.