From 4c89d5d159edc847dbcc487ee8c2d74cfb996615 Mon Sep 17 00:00:00 2001
From: CTO Agent <cto@basicstack.de>
Date: Sun, 5 Jul 2026 08:51:26 +0000
Subject: [PATCH] Fix OpenCloud architecture - Keep IDM for user storage
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Problem: Login still showing local page instead of OIDC redirect.
Root cause: Excluded both IDP and IDM, but IDM is needed for user storage.

Architecture Fix:
- IDP (Identity Provider) = EXCLUDED (auth handled by Pocket ID OIDC)
- IDM (Identity Management) = KEPT (provides LDAP storage for users/groups)
- Proxy auto-provisioning = creates users in IDM LDAP on first OIDC login

Changes:
- deployment: OC_EXCLUDE_RUN_SERVICES changed from "search,idp,idm" to "search,idp"
- configmap: Re-enabled IDM service configuration
- configmap: Restored graph.identity.ldap (points to internal IDM)
- configmap: Restored users/groups LDAP drivers (connect to internal IDM)

Flow: User → OIDC (Pocket ID) → Proxy auto-provision → IDM LDAP → User created

Co-Authored-By: Paperclip <noreply@paperclip.ing>
---
 apps/opencloud/opencloud-configmap.yaml  | 28 ++++++++++++++----------
 apps/opencloud/opencloud-deployment.yaml |  4 ++--
 2 files changed, 19 insertions(+), 13 deletions(-)

diff --git a/apps/opencloud/opencloud-configmap.yaml b/apps/opencloud/opencloud-configmap.yaml
index eb820e3..3b8888f 100644
--- a/apps/opencloud/opencloud-configmap.yaml
+++ b/apps/opencloud/opencloud-configmap.yaml
@@ -20,7 +20,7 @@ data:
     system_user_id: ${OC_SYSTEM_USER_ID}
     admin_user_id: ${OC_ADMIN_USER_ID}
 
-    # Graph service (using owncloudsql for OIDC-based user management)
+    # Graph service (using internal IDM LDAP for user storage)
     graph:
       application:
         id: ${OC_GRAPH_APPLICATION_ID:-025a50d1-5f8d-4309-a201-dd938e7b0b2f}
@@ -28,21 +28,25 @@ data:
         tls_insecure: true
       spaces:
         insecure: true
+      identity:
+        ldap:
+          bind_password: ${OC_GRAPH_LDAP_BIND_PASSWORD}
       service_account:
         service_account_id: ${OC_SERVICE_ACCOUNT_ID}
         service_account_secret: ${OC_SERVICE_ACCOUNT_SECRET}
 
-    # IDP and IDM services excluded (using external OIDC via Pocket ID)
+    # IDP service excluded (using external OIDC via Pocket ID for authentication)
     # idp:
     #   ldap:
     #     bind_password: ${OC_IDP_LDAP_BIND_PASSWORD}
 
-    # idm:
-    #   service_user_passwords:
-    #     admin_password: ${OC_IDM_ADMIN_PASSWORD}
-    #     idm_password: ${OC_IDM_IDM_PASSWORD}
-    #     reva_password: ${OC_IDM_REVA_PASSWORD}
-    #     idp_password: ${OC_IDM_IDP_PASSWORD}
+    # IDM service (needed for user storage even with external OIDC)
+    idm:
+      service_user_passwords:
+        admin_password: ${OC_IDM_ADMIN_PASSWORD}
+        idm_password: ${OC_IDM_IDM_PASSWORD}
+        reva_password: ${OC_IDM_REVA_PASSWORD}
+        idp_password: ${OC_IDM_IDP_PASSWORD}
 
     # Collaboration services
     collaboration:
@@ -95,14 +99,16 @@ data:
         oidc:
           insecure: false
 
-    # User/Group services (using owncloudsql for OIDC-based provisioning)
+    # User/Group services (using LDAP driver connected to internal IDM)
     users:
       drivers:
-        owncloudsql: {}
+        ldap:
+          bind_password: ${OC_USERS_LDAP_BIND_PASSWORD}
 
     groups:
       drivers:
-        owncloudsql: {}
+        ldap:
+          bind_password: ${OC_GROUPS_LDAP_BIND_PASSWORD}
 
     # OCM (Open Cloud Mesh)
     ocm:
diff --git a/apps/opencloud/opencloud-deployment.yaml b/apps/opencloud/opencloud-deployment.yaml
index a6053e9..d45bd3e 100644
--- a/apps/opencloud/opencloud-deployment.yaml
+++ b/apps/opencloud/opencloud-deployment.yaml
@@ -91,9 +91,9 @@ spec:
         - name: PROXY_TLS
           value: "false"
 
-        # Exclude broken search service and internal IDP/IDM (using external OIDC via Pocket ID)
+        # Exclude broken search service and internal IDP only (IDM needed for user storage, using external OIDC via Pocket ID for auth)
         - name: OC_EXCLUDE_RUN_SERVICES
-          value: "search,idp,idm"
+          value: "search,idp"
 
         # Data paths
         - name: OPENCLOUD_BASE_DATA_PATH