basicstack/stack.basicstack.de
2
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

Fix OpenCloud architecture - Keep IDM for user storage

Browse source 
Problem: Login still showing local page instead of OIDC redirect.
Root cause: Excluded both IDP and IDM, but IDM is needed for user storage.

Architecture Fix:
- IDP (Identity Provider) = EXCLUDED (auth handled by Pocket ID OIDC)
- IDM (Identity Management) = KEPT (provides LDAP storage for users/groups)
- Proxy auto-provisioning = creates users in IDM LDAP on first OIDC login

Changes:
- deployment: OC_EXCLUDE_RUN_SERVICES changed from "search,idp,idm" to "search,idp"
- configmap: Re-enabled IDM service configuration
- configmap: Restored graph.identity.ldap (points to internal IDM)
- configmap: Restored users/groups LDAP drivers (connect to internal IDM)

Flow: User → OIDC (Pocket ID) → Proxy auto-provision → IDM LDAP → User created

Co-Authored-By: Paperclip <noreply@paperclip.ing>
This commit is contained in:
CTO Agent 2026-07-05 08:51:26 +00:00
parent c993aafd26
commit 4c89d5d159
2 changed files with 19 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

28
apps/opencloud/opencloud-configmap.yaml
View file

@ -20,7 +20,7 @@ data:
system_user_id: ${OC_SYSTEM_USER_ID} system_user_id: ${OC_SYSTEM_USER_ID}
admin_user_id: ${OC_ADMIN_USER_ID} admin_user_id: ${OC_ADMIN_USER_ID}
# Graph service (using owncloudsql for OIDC-based user management) # Graph service (using internal IDM LDAP for user storage)
graph: graph:
application: application:
id: ${OC_GRAPH_APPLICATION_ID:-025a50d1-5f8d-4309-a201-dd938e7b0b2f} id: ${OC_GRAPH_APPLICATION_ID:-025a50d1-5f8d-4309-a201-dd938e7b0b2f}
@ -28,21 +28,25 @@ data:
tls_insecure: true tls_insecure: true
spaces: spaces:
insecure: true insecure: true
identity:
ldap:
bind_password: ${OC_GRAPH_LDAP_BIND_PASSWORD}
service_account: service_account:
service_account_id: ${OC_SERVICE_ACCOUNT_ID} service_account_id: ${OC_SERVICE_ACCOUNT_ID}
service_account_secret: ${OC_SERVICE_ACCOUNT_SECRET} service_account_secret: ${OC_SERVICE_ACCOUNT_SECRET}
# IDP and IDM services excluded (using external OIDC via Pocket ID) # IDP service excluded (using external OIDC via Pocket ID for authentication)
# idp: # idp:
# ldap: # ldap:
# bind_password: ${OC_IDP_LDAP_BIND_PASSWORD} # bind_password: ${OC_IDP_LDAP_BIND_PASSWORD}
# idm: # IDM service (needed for user storage even with external OIDC)
# service_user_passwords: idm:
# admin_password: ${OC_IDM_ADMIN_PASSWORD} service_user_passwords:
# idm_password: ${OC_IDM_IDM_PASSWORD} admin_password: ${OC_IDM_ADMIN_PASSWORD}
# reva_password: ${OC_IDM_REVA_PASSWORD} idm_password: ${OC_IDM_IDM_PASSWORD}
# idp_password: ${OC_IDM_IDP_PASSWORD} reva_password: ${OC_IDM_REVA_PASSWORD}
idp_password: ${OC_IDM_IDP_PASSWORD}
# Collaboration services # Collaboration services
collaboration: collaboration:
@ -95,14 +99,16 @@ data:
oidc: oidc:
insecure: false insecure: false
# User/Group services (using owncloudsql for OIDC-based provisioning) # User/Group services (using LDAP driver connected to internal IDM)
users: users:
drivers: drivers:
owncloudsql: {} ldap:
bind_password: ${OC_USERS_LDAP_BIND_PASSWORD}
groups: groups:
drivers: drivers:
owncloudsql: {} ldap:
bind_password: ${OC_GROUPS_LDAP_BIND_PASSWORD}
# OCM (Open Cloud Mesh) # OCM (Open Cloud Mesh)
ocm: ocm:

4
apps/opencloud/opencloud-deployment.yaml
View file

@ -91,9 +91,9 @@ spec:
- name: PROXY_TLS - name: PROXY_TLS
value: "false" value: "false"
# Exclude broken search service and internal IDP/IDM (using external OIDC via Pocket ID) # Exclude broken search service and internal IDP only (IDM needed for user storage, using external OIDC via Pocket ID for auth)
- name: OC_EXCLUDE_RUN_SERVICES - name: OC_EXCLUDE_RUN_SERVICES
value: "search,idp,idm" value: "search,idp"
# Data paths # Data paths
- name: OPENCLOUD_BASE_DATA_PATH - name: OPENCLOUD_BASE_DATA_PATH