From 5adc38c4d8562800f1fbd8928448812f84558ea9 Mon Sep 17 00:00:00 2001
From: CTO Agent <cto@basicstack.de>
Date: Sun, 5 Jul 2026 15:37:46 +0000
Subject: [PATCH] fix(opencloud): remove external LDAP config, use IDM for user
 storage

Graph service was routing auto-provisioning to external OpenLDAP which lacks
the OpenCloud schema (openCloudUUID: attribute type undefined). The explicit
graph.identity.ldap, users.drivers.ldap, and groups.drivers.ldap sections in
opencloud.yaml overrode the default IDM LDAP, causing user creation to fail.

Remove all external LDAP sections so Graph/Users/Groups default to IDM's
internal LDAP, which has the full OpenCloud schema. IDM is already running.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
---
 apps/opencloud/opencloud-configmap.yaml | 45 ++-----------------------
 1 file changed, 3 insertions(+), 42 deletions(-)

diff --git a/apps/opencloud/opencloud-configmap.yaml b/apps/opencloud/opencloud-configmap.yaml
index 48b0883..7a7e244 100644
--- a/apps/opencloud/opencloud-configmap.yaml
+++ b/apps/opencloud/opencloud-configmap.yaml
@@ -6,22 +6,9 @@ metadata:
   namespace: opencloud
 data:
   opencloud.yaml: |
-    # OpenCloud Minimal Configuration
-    # Only non-default settings - environment variables override these
+    # OpenCloud Configuration - Pocket ID OIDC auth, IDM for internal user storage
 
-    # Graph service - external OpenLDAP configuration
-    graph:
-      identity:
-        ldap:
-          uri: ldap://openldap.opencloud.svc.cluster.local:389
-          base_dn: dc=basicstack,dc=de
-          bind_dn: cn=admin,dc=basicstack,dc=de
-          bind_password: ${OPENLDAP_ADMIN_PASSWORD|}
-          user_base_dn: ou=users,dc=basicstack,dc=de
-          group_base_dn: ou=groups,dc=basicstack,dc=de
-          insecure: true
-
-    # Proxy service - OIDC configuration (already in env vars, kept for reference)
+    # Proxy service - OIDC via Pocket ID
     proxy:
       oidc:
         issuer: https://auth.basicstack.de
@@ -30,33 +17,7 @@ data:
         user_oidc_claim: preferred_username
       enable_basic_auth: false
 
-    # Users service - external LDAP
-    users:
-      drivers:
-        ldap:
-          uri: ldap://openldap.opencloud.svc.cluster.local:389
-          base_dn: dc=basicstack,dc=de
-          bind_dn: cn=admin,dc=basicstack,dc=de
-          bind_password: ${OPENLDAP_ADMIN_PASSWORD|}
-          user_base_dn: ou=users,dc=basicstack,dc=de
-          user_filter: (objectClass=inetOrgPerson)
-          user_object_class: inetOrgPerson
-          insecure: true
-
-    # Groups service - external LDAP
-    groups:
-      drivers:
-        ldap:
-          uri: ldap://openldap.opencloud.svc.cluster.local:389
-          base_dn: dc=basicstack,dc=de
-          bind_dn: cn=admin,dc=basicstack,dc=de
-          bind_password: ${OPENLDAP_ADMIN_PASSWORD|}
-          group_base_dn: ou=groups,dc=basicstack,dc=de
-          group_filter: (objectClass=groupOfNames)
-          group_object_class: groupOfNames
-          insecure: true
-
-    # IDM service user passwords (required when IDM is enabled and /etc/opencloud is read-only)
+    # IDM service user passwords (required when /etc/opencloud is read-only - init cannot write here)
     idm:
       service_user_passwords:
         admin_password: ${OC_IDM_ADMIN_PASSWORD}