fix(identity): add opencloud.ldap.keepIdm for external OIDC without OpenLDAP

CHANGELOG.md

@@ -4,6 +4,15 @@ All notable changes to this project will be documented in this file.
 
 <!-- release-bot:start -->
 
+## [Unreleased]
+
+### Fixes
+- Add `opencloud.ldap.keepIdm` so external OIDC can keep the bundled IDM (LibreIDM) instead of OpenLDAP. Default is unchanged: `excludeServices: [idp]` still points `OC_LDAP_*` at `openldap.openldap.svc`.
+
+### Upgrade notes
+- None. Existing OpenLDAP installs that exclude `idp` keep working with no new values. The supported external-LDAP layout excludes both `idp` and `idm`.
+- Authentik / Authelia (external OIDC, no OpenLDAP): set `oidc.issuerUrl`, `excludeServices: [idp]`, and `opencloud.ldap.keepIdm: true`. Do **not** exclude `idm`.
+
 ## [3.0.0] - 2026-08-30
 
 ### Breaking Changes

CONTRIBUTING.md

@@ -31,7 +31,35 @@ git checkout -b feature/your-feature-name
 When making changes, please ensure you:
 - Follow Helm best practices
 - Include proper documentation
-- Test your changes with `helm lint` and installation tests
+- Run the required chart validation commands below
+
+#### Required Helm validation
+
+From the repository root, run both commands before opening or updating a PR:
+
+```bash
+helm lint charts/opencloud --strict
+helm unittest charts/opencloud
+```
+
+`helm-unittest` is a Helm plugin. Install it once if it is not available:
+
+```bash
+# The plugin repository does not publish Helm provenance metadata.
+helm plugin install --verify=false https://github.com/helm-unittest/helm-unittest.git
+```
+
+Also render the chart for a basic syntax check:
+
+```bash
+helm template test charts/opencloud >/dev/null
+```
+
+For changes affecting a deployed release, run the Helm integration tests as well:
+
+```bash
+helm test <release-name> --namespace <namespace>
+```
 
 ### 4. Submit a Pull Request
 
@@ -48,4 +76,4 @@ This project follows the [Contributor Covenant Code of Conduct](https://www.cont
 Contributors who make multiple high-quality PRs may be invited to become Reviewers.
 Reviewers who are consistently active and provide valuable reviews may be invited to become Maintainers.
 
-If you're interested in becoming a maintainer or reviewer, please continue contributing and engaging with the project.
+If you're interested in becoming a maintainer or reviewer, please continue contributing and engaging with the project.

charts/opencloud/README.md

@@ -289,7 +289,9 @@ This will prepend `my-registry.com/` to all image references in the chart. For e
 | `opencloud.adminPassword` | Admin password | `admin` |
 | `opencloud.createDemoUsers` | Create demo users (default `true` for integrated IDM) | `true` |
 | `opencloud.asyncUploads` | Keep upload sessions available during postprocessing | `true` |
-| `opencloud.excludeServices` | Services to exclude from starting (set `["idp"]` when using external OIDC). The external LDAP env vars (`OC_LDAP_*`, `GRAPH_LDAP_*`, `FRONTEND_LDAP_SERVER_WRITE_ENABLED`) and the external LDAP bind secret (`opencloud.ldap.secretRef`, default `<release-name>-opencloud-ldap`, chart-generated from `opencloud.ldap.adminPassword`) are only used when `idp` is excluded; with the built-in IDP running they are omitted and the bind passwords come from the generated init secret. | `[]` |
+| `opencloud.excludeServices` | Services to exclude from starting. Set `["idp"]` for external OIDC with bundled IDM. For external OIDC with external LDAP, set `["idp", "idm"]`. | `[]` |
+| `opencloud.ldap.keepIdm` | Keep the bundled IDM as the user directory when `idp` is excluded. `false`: `OC_LDAP_*` points at `opencloud.ldap.uri`. `true`: accounts stay in IDM. | `false` |
+| `opencloud.ldap.secretRef` | Existing Secret with `reva-ldap-bind-password` / `graph-ldap-bind-password` (used when `idp` is excluded and `ldap.keepIdm` is false) | `""` |
 | `opencloud.theme.urls.imprint` | Imprint URL shown in the web UI footer (empty = hidden) | `https://opencloud.eu/en/legal-notice` |
 | `opencloud.theme.urls.privacy` | Privacy policy URL shown in the web UI footer (empty = hidden) | `https://opencloud.eu/en/data-protection-notice` |
 | `opencloud.theme.urls.accessibility` | Accessibility statement URL shown in the web UI footer (empty = hidden) | `https://opencloud.eu/en/accessibility-statement` |
@@ -463,13 +465,22 @@ opencloud:
 
 
 
-The chart uses the **integrated IDM** by default. To use an external OIDC provider, set `oidc.issuerUrl` and exclude the `idp` service.
+The chart uses the **bundled IDP** (LibreGraph Connect) and **bundled IDM** (LibreIDM LDAP) by default. Those are two different services:
+
+| Piece | What it is | Bundled process | External replacement |
+| ----- | ---------- | --------------- | -------------------- |
+| **IDP** | Login (OIDC) | `idp` | Authentik, Keycloak, Authelia, Auth0, … (`oidc.issuerUrl` + `excludeServices: [idp]`) |
+| **IDM** | User directory (LDAP) | `idm` | OpenLDAP / AD (`OC_LDAP_*` + `excludeServices: [idp, idm]`) |
+
+When `excludeServices` contains `idp` and `ldap.keepIdm` is `false`, the chart sets `OC_LDAP_*` from `opencloud.ldap` (default `ldaps://openldap.openldap.svc.cluster.local:636`). For the supported external-LDAP layout, also exclude `idm`. Set `opencloud.ldap.keepIdm: true` to keep accounts in the bundled IDM instead.
+
+`keepIdm` selects the directory; it does not migrate users. Do not toggle it on an existing installation without migrating the user directory and checking user IDs, ownership, and shares.
 
 ### OIDC Settings
 
 | Parameter | Description | Default |
 | --------- | ----------- | ------- |
-| `oidc.issuerUrl` | OIDC Issuer URL (leave empty for integrated IDM) | `""` |
+| `oidc.issuerUrl` | OIDC Issuer URL (leave empty for the bundled IDP) | `""` |
 | `oidc.clientId` | OIDC Client ID | `"web"` |
 | `oidc.accountUrl` | Account management URL (optional; derived from `issuerUrl` if empty) | `""` |
 | `oidc.oidcIdpInsecure` | Disable TLS certificate validation for OIDC provider | `false` |
@@ -483,7 +494,33 @@ The chart uses the **integrated IDM** by default. To use an external OIDC provid
 | `oidc.cors.allowCredentials` | Allow credentials | `"true"` |
 | `oidc.cors.maxAge` | Max age in seconds | `"3600"` |
 
-#### Example: Using External OIDC Provider
+#### Example: External OIDC + bundled IDM
+
+Login goes to the external OIDC provider. Users autoprovision into IDM.
+
+```yaml
+oidc:
+  issuerUrl: "https://auth.example.com/application/o/opencloud/"
+  clientId: "web"
+  accountUrl: "https://auth.example.com/if/user/#/settings"
+  scope: "openid profile email groups"
+
+opencloud:
+  createDemoUsers: false
+  ldap:
+    keepIdm: true
+  excludeServices:
+    - idp
+  proxyOidcAccessTokenVerifyMethod: "none"
+  proxyRoleAssignmentOidcClaim: "groups"
+  proxyAutoprovisionClaimUsername: "preferred_username"
+  oidc:
+    scope: "openid profile email groups"
+```
+
+#### Example: External OIDC + OpenLDAP
+
+Excluding `idp` with `ldap.keepIdm: false` points LDAP at `opencloud.ldap.uri`. Deploy OpenLDAP yourself (the chart does not ship it).
 
 ```yaml
 oidc:
@@ -494,7 +531,12 @@ oidc:
 opencloud:
   createDemoUsers: false
   excludeServices:
-    - "idp"
+    - idp
+    - idm
+  ldap:
+    uri: "ldaps://openldap.openldap.svc.cluster.local:636"
+    bindDN: "cn=admin,dc=opencloud,dc=eu"
+    adminPassword: "changeme"
 ```
 
 ### Collabora Settings

charts/opencloud/deployments/flux/opencloud/opencloud.yaml

@@ -134,11 +134,12 @@ spec:
         enabled: false
       # Keep TUS uploads available until policy and antivirus postprocessing completes.
       asyncUploads: true
-      # Using external Keycloak OIDC + external OpenLDAP: the bundled IDM/idp
-      # service must NOT run, so exclude it. Demo users are also disabled.
+      # Using external Keycloak OIDC + external OpenLDAP: the bundled idm/idp
+      # services must NOT run, so exclude them. Demo users are also disabled.
       createDemoUsers: false
       excludeServices:
         - "idp"
+        - "idm"
       persistence:
         data:
           accessMode: ReadWriteMany  
@@ -373,11 +374,12 @@ spec:
 #       logLevel: info
 #       migration:
 #         enabled: false
-#       # Using external Keycloak OIDC + external OpenLDAP: the bundled IDM/idp
-#       # service must NOT run, so exclude it. Demo users are also disabled.
+#       # Using external Keycloak OIDC + external OpenLDAP: the bundled idm/idp
+#       # services must NOT run, so exclude them. Demo users are also disabled.
 #       createDemoUsers: false
 #       excludeServices:
 #         - "idp"
+#         - "idm"
 #       persistence:
 #         data:
 #           accessMode: ReadWriteOnce  # RWO: only one pod can mount at a time; the chart auto-switches the Deployment strategy to Recreate

charts/opencloud/templates/opencloud/deployment.yaml

@@ -1,4 +1,11 @@
 {{- if .Values.opencloud.enabled }}
+{{- /* LDAP directory selection: external OpenLDAP vs bundled IDM (LibreIDM). */}}
+{{- $excludeServices := .Values.opencloud.excludeServices | default (list) }}
+{{- $keepIdm := .Values.opencloud.ldap.keepIdm | default false }}
+{{- $useExternalLdap := and (has "idp" $excludeServices) (not $keepIdm) }}
+{{- if and $keepIdm (has "idm" $excludeServices) }}
+{{- fail "opencloud.ldap.keepIdm=true requires the bundled IDM to run: remove \"idm\" from opencloud.excludeServices" }}
+{{- end }}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -410,8 +417,8 @@ spec:
               value: {{ printf "%s/.well-known/openid-configuration" (include "opencloud.oidc.issuer" .) | quote }}
             - name: WEB_OIDC_SCOPE
               value: {{ .Values.opencloud.oidc.scope | quote }}
-            {{- /* External LDAP settings are only needed when the built-in IDP is excluded (external OIDC/LDAP setup) */}}
-            {{- if has "idp" (.Values.opencloud.excludeServices | default (list)) }}
+            {{- /* OC_LDAP_* against opencloud.ldap.uri when idp is excluded and opencloud.ldap.keepIdm is false. */}}
+            {{- if $useExternalLdap }}
             - name: OC_LDAP_SERVER_WRITE_ENABLED
               value: {{ .Values.opencloud.ldapServerWriteEnabled | quote }}
             - name: GRAPH_LDAP_SERVER_WRITE_ENABLED
@@ -541,10 +548,8 @@ spec:
                   name: {{ $initSecretName }}
                   key: serviceAccountID
             # Per-service LDAP bind passwords
-            {{- if has "idp" (.Values.opencloud.excludeServices | default (list)) }}
-            # External LDAP (built-in IDP excluded): bind against the external
-            # directory using the shared bind secret (opencloud.ldap.secretRef,
-            # or the chart-generated <release-name>-opencloud-ldap).
+            {{- if $useExternalLdap }}
+            # Bind against the external LDAP secret (opencloud.ldap.secretRef, or <release>-opencloud-ldap).
             - name: USERS_LDAP_BIND_PASSWORD
               valueFrom:
                 secretKeyRef:
@@ -571,9 +576,7 @@ spec:
                   name: {{ .Values.opencloud.ldap.secretRef | default (printf "%s-ldap" (include "opencloud.opencloud.fullname" .)) }}
                   key: graph-ldap-bind-password
             {{- else }}
-            # Built-in IDP (default): bind against the internal IDM LDAP using the
-            # generated service user passwords from the init secret — no external
-            # LDAP secret needed.
+            # Bind against the bundled IDM using passwords from the init secret.
             - name: USERS_LDAP_BIND_PASSWORD
               valueFrom:
                 secretKeyRef:

charts/opencloud/templates/opencloud/secrets.yaml

@@ -30,8 +30,8 @@ stringData:
   secretKey: {{ .Values.opencloud.storage.s3.external.secretKey }}
 {{- end }}
 ---
-{{- /* External LDAP bind secret — only needed when the built-in IDP is excluded (external OIDC/LDAP setup) */}}
-{{- if and .Values.opencloud.enabled (has "idp" (.Values.opencloud.excludeServices | default (list))) (not .Values.opencloud.ldap.secretRef) }}
+{{- /* External LDAP bind secret when idp is excluded and opencloud.ldap.keepIdm is false. */}}
+{{- if and .Values.opencloud.enabled (has "idp" (.Values.opencloud.excludeServices | default (list))) (not (.Values.opencloud.ldap.keepIdm | default false)) (not .Values.opencloud.ldap.secretRef) }}
 apiVersion: v1
 kind: Secret
 metadata: