basicstack/stack.basicstack.de
2
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

fix(opencloud): remove external LDAP config, use IDM for user storage

Browse source 
Graph service was routing auto-provisioning to external OpenLDAP which lacks
the OpenCloud schema (openCloudUUID: attribute type undefined). The explicit
graph.identity.ldap, users.drivers.ldap, and groups.drivers.ldap sections in
opencloud.yaml overrode the default IDM LDAP, causing user creation to fail.

Remove all external LDAP sections so Graph/Users/Groups default to IDM's
internal LDAP, which has the full OpenCloud schema. IDM is already running.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
This commit is contained in:
CTO Agent 2026-07-05 15:37:46 +00:00
parent 4a674dba6e
commit 5adc38c4d8
1 changed files with 3 additions and 42 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

45
apps/opencloud/opencloud-configmap.yaml
View file

@ -6,22 +6,9 @@ metadata:
namespace: opencloud
data:
opencloud.yaml: |
# OpenCloud Minimal Configuration
# Only non-default settings - environment variables override these
# OpenCloud Configuration - Pocket ID OIDC auth, IDM for internal user storage
# Graph service - external OpenLDAP configuration
graph:
identity:
ldap:
uri: ldap://openldap.opencloud.svc.cluster.local:389
base_dn: dc=basicstack,dc=de
bind_dn: cn=admin,dc=basicstack,dc=de
bind_password: ${OPENLDAP_ADMIN_PASSWORD|}
user_base_dn: ou=users,dc=basicstack,dc=de
group_base_dn: ou=groups,dc=basicstack,dc=de
insecure: true
# Proxy service - OIDC configuration (already in env vars, kept for reference)
# Proxy service - OIDC via Pocket ID
proxy:
oidc:
issuer: https://auth.basicstack.de
@ -30,33 +17,7 @@ data:
user_oidc_claim: preferred_username
enable_basic_auth: false
# Users service - external LDAP
users:
drivers:
ldap:
uri: ldap://openldap.opencloud.svc.cluster.local:389
base_dn: dc=basicstack,dc=de
bind_dn: cn=admin,dc=basicstack,dc=de
bind_password: ${OPENLDAP_ADMIN_PASSWORD|}
user_base_dn: ou=users,dc=basicstack,dc=de
user_filter: (objectClass=inetOrgPerson)
user_object_class: inetOrgPerson
insecure: true
# Groups service - external LDAP
groups:
drivers:
ldap:
uri: ldap://openldap.opencloud.svc.cluster.local:389
base_dn: dc=basicstack,dc=de
bind_dn: cn=admin,dc=basicstack,dc=de
bind_password: ${OPENLDAP_ADMIN_PASSWORD|}
group_base_dn: ou=groups,dc=basicstack,dc=de
group_filter: (objectClass=groupOfNames)
group_object_class: groupOfNames
insecure: true
# IDM service user passwords (required when IDM is enabled and /etc/opencloud is read-only)
# IDM service user passwords (required when /etc/opencloud is read-only - init cannot write here)
idm:
service_user_passwords:
admin_password: ${OC_IDM_ADMIN_PASSWORD}