From 169cd315cbd9f90af38bc1e68256b546ae75df03 Mon Sep 17 00:00:00 2001
From: CTO Agent <cto@basicstack.de>
Date: Sun, 5 Jul 2026 08:36:13 +0000
Subject: [PATCH] Fix OpenCloud user/group management for OIDC authentication

Problem: Users routed to /login page instead of OIDC redirect.
Root cause: ConfigMap still configured for LDAP-based user/group management.

Changes:
- Users service: Changed driver from 'ldap' to 'owncloudsql'
- Groups service: Changed driver from 'ldap' to 'owncloudsql'
- Graph service: Removed LDAP identity backend configuration
- Auth services: Removed auth_basic LDAP provider (OIDC only)
- Commented out IDP/IDM service configs (excluded services)

Result: OpenCloud will use owncloudsql driver for OIDC-based auto-provisioning.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
---
 apps/opencloud/opencloud-configmap.yaml | 41 +++++++++----------------
 1 file changed, 15 insertions(+), 26 deletions(-)

diff --git a/apps/opencloud/opencloud-configmap.yaml b/apps/opencloud/opencloud-configmap.yaml
index a21f3db..ad7e5a7 100644
--- a/apps/opencloud/opencloud-configmap.yaml
+++ b/apps/opencloud/opencloud-configmap.yaml
@@ -20,7 +20,7 @@ data:
     system_user_id: ${OC_SYSTEM_USER_ID}
     admin_user_id: ${OC_ADMIN_USER_ID}
 
-    # Graph service
+    # Graph service (using owncloudsql for OIDC-based user management)
     graph:
       application:
         id: ${OC_GRAPH_APPLICATION_ID:-025a50d1-5f8d-4309-a201-dd938e7b0b2f}
@@ -28,25 +28,21 @@ data:
         tls_insecure: true
       spaces:
         insecure: true
-      identity:
-        ldap:
-          bind_password: ${OC_GRAPH_LDAP_BIND_PASSWORD}
       service_account:
         service_account_id: ${OC_SERVICE_ACCOUNT_ID}
         service_account_secret: ${OC_SERVICE_ACCOUNT_SECRET}
 
-    # IDP service
-    idp:
-      ldap:
-        bind_password: ${OC_IDP_LDAP_BIND_PASSWORD}
+    # IDP and IDM services excluded (using external OIDC via Pocket ID)
+    # idp:
+    #   ldap:
+    #     bind_password: ${OC_IDP_LDAP_BIND_PASSWORD}
 
-    # IDM service
-    idm:
-      service_user_passwords:
-        admin_password: ${OC_IDM_ADMIN_PASSWORD}
-        idm_password: ${OC_IDM_IDM_PASSWORD}
-        reva_password: ${OC_IDM_REVA_PASSWORD}
-        idp_password: ${OC_IDM_IDP_PASSWORD}
+    # idm:
+    #   service_user_passwords:
+    #     admin_password: ${OC_IDM_ADMIN_PASSWORD}
+    #     idm_password: ${OC_IDM_IDM_PASSWORD}
+    #     reva_password: ${OC_IDM_REVA_PASSWORD}
+    #     idp_password: ${OC_IDM_IDP_PASSWORD}
 
     # Collaboration services
     collaboration:
@@ -77,27 +73,20 @@ data:
       ocdav:
         insecure: true
 
-    # Auth services
-    auth_basic:
-      auth_providers:
-        ldap:
-          bind_password: ${OC_AUTH_BASIC_LDAP_BIND_PASSWORD}
-
+    # Auth services (OIDC only, no basic auth)
     auth_bearer:
       auth_providers:
         oidc:
           insecure: false
 
-    # User/Group services
+    # User/Group services (using owncloudsql for OIDC-based provisioning)
     users:
       drivers:
-        ldap:
-          bind_password: ${OC_USERS_LDAP_BIND_PASSWORD}
+        owncloudsql: {}
 
     groups:
       drivers:
-        ldap:
-          bind_password: ${OC_GROUPS_LDAP_BIND_PASSWORD}
+        owncloudsql: {}
 
     # OCM (Open Cloud Mesh)
     ocm: