Fix OpenCloud architecture - Keep IDM for user storage

Problem: Login still showing local page instead of OIDC redirect.
Root cause: Excluded both IDP and IDM, but IDM is needed for user storage.

Architecture Fix:
- IDP (Identity Provider) = EXCLUDED (auth handled by Pocket ID OIDC)
- IDM (Identity Management) = KEPT (provides LDAP storage for users/groups)
- Proxy auto-provisioning = creates users in IDM LDAP on first OIDC login

Changes:
- deployment: OC_EXCLUDE_RUN_SERVICES changed from "search,idp,idm" to "search,idp"
- configmap: Re-enabled IDM service configuration
- configmap: Restored graph.identity.ldap (points to internal IDM)
- configmap: Restored users/groups LDAP drivers (connect to internal IDM)

Flow: User → OIDC (Pocket ID) → Proxy auto-provision → IDM LDAP → User created

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/opencloud/opencloud-configmap.yaml

@@ -20,7 +20,7 @@ data:
     system_user_id: ${OC_SYSTEM_USER_ID}
     admin_user_id: ${OC_ADMIN_USER_ID}
 
-    # Graph service (using owncloudsql for OIDC-based user management)
+    # Graph service (using internal IDM LDAP for user storage)
     graph:
       application:
         id: ${OC_GRAPH_APPLICATION_ID:-025a50d1-5f8d-4309-a201-dd938e7b0b2f}
@@ -28,21 +28,25 @@ data:
         tls_insecure: true
       spaces:
         insecure: true
+      identity:
+        ldap:
+          bind_password: ${OC_GRAPH_LDAP_BIND_PASSWORD}
       service_account:
         service_account_id: ${OC_SERVICE_ACCOUNT_ID}
         service_account_secret: ${OC_SERVICE_ACCOUNT_SECRET}
 
-    # IDP and IDM services excluded (using external OIDC via Pocket ID)
+    # IDP service excluded (using external OIDC via Pocket ID for authentication)
     # idp:
     #   ldap:
     #     bind_password: ${OC_IDP_LDAP_BIND_PASSWORD}
 
-    # idm:
-    #   service_user_passwords:
-    #     admin_password: ${OC_IDM_ADMIN_PASSWORD}
-    #     idm_password: ${OC_IDM_IDM_PASSWORD}
-    #     reva_password: ${OC_IDM_REVA_PASSWORD}
-    #     idp_password: ${OC_IDM_IDP_PASSWORD}
+    # IDM service (needed for user storage even with external OIDC)
+    idm:
+      service_user_passwords:
+        admin_password: ${OC_IDM_ADMIN_PASSWORD}
+        idm_password: ${OC_IDM_IDM_PASSWORD}
+        reva_password: ${OC_IDM_REVA_PASSWORD}
+        idp_password: ${OC_IDM_IDP_PASSWORD}
 
     # Collaboration services
     collaboration:
@@ -95,14 +99,16 @@ data:
         oidc:
           insecure: false
 
-    # User/Group services (using owncloudsql for OIDC-based provisioning)
+    # User/Group services (using LDAP driver connected to internal IDM)
     users:
       drivers:
-        owncloudsql: {}
+        ldap:
+          bind_password: ${OC_USERS_LDAP_BIND_PASSWORD}
 
     groups:
       drivers:
-        owncloudsql: {}
+        ldap:
+          bind_password: ${OC_GROUPS_LDAP_BIND_PASSWORD}
 
     # OCM (Open Cloud Mesh)
     ocm:

apps/opencloud/opencloud-deployment.yaml

@@ -91,9 +91,9 @@ spec:
         - name: PROXY_TLS
           value: "false"
 
-        # Exclude broken search service and internal IDP/IDM (using external OIDC via Pocket ID)
+        # Exclude broken search service and internal IDP only (IDM needed for user storage, using external OIDC via Pocket ID for auth)
         - name: OC_EXCLUDE_RUN_SERVICES
-          value: "search,idp,idm"
+          value: "search,idp"
 
         # Data paths
         - name: OPENCLOUD_BASE_DATA_PATH