From 6b49ba342adb4c8f470998ef5dc221a27cded387 Mon Sep 17 00:00:00 2001
From: CTO Agent <cto@basicstack.de>
Date: Sun, 5 Jul 2026 20:47:34 +0000
Subject: [PATCH] Configure graph/users/groups to use IDM's internal LDAP

OpenCloud's IDM service provides an internal LDAP server on localhost:9125.
Updated configuration to connect to IDM's LDAP instead of external OpenLDAP:
- Base DN: o=libregraph-idm (IDM's base DN)
- Graph binds as uid=libregraph,ou=sysusers,o=libregraph-idm
- Users/Groups bind as uid=reva,ou=sysusers,o=libregraph-idm
- Uses IDM service user passwords from secrets

Co-Authored-By: Paperclip <noreply@paperclip.ing>
---
 apps/opencloud/opencloud-configmap.yaml | 40 ++++++++++++++++++++++++-
 1 file changed, 39 insertions(+), 1 deletion(-)

diff --git a/apps/opencloud/opencloud-configmap.yaml b/apps/opencloud/opencloud-configmap.yaml
index 03bd909..23ba181 100644
--- a/apps/opencloud/opencloud-configmap.yaml
+++ b/apps/opencloud/opencloud-configmap.yaml
@@ -8,7 +8,19 @@ data:
   opencloud.yaml: |
     # OpenCloud Minimal Configuration
     # Only non-default settings - environment variables override these
-    # Using built-in IDM for user/group storage instead of external OpenLDAP
+    # Using built-in IDM for user/group storage (IDM provides internal LDAP on localhost:9125)
+
+    # Graph service - connect to IDM's internal LDAP server
+    graph:
+      identity:
+        ldap:
+          uri: ldap://localhost:9125
+          base_dn: o=libregraph-idm
+          insecure: true
+          bind_dn: uid=libregraph,ou=sysusers,o=libregraph-idm
+          bind_password: ${OC_IDM_IDM_PASSWORD}
+          user_base_dn: ou=users,o=libregraph-idm
+          group_base_dn: ou=groups,o=libregraph-idm
 
     # Proxy service - OIDC configuration (already in env vars, kept for reference)
     proxy:
@@ -19,6 +31,32 @@ data:
         user_oidc_claim: preferred_username
       enable_basic_auth: false
 
+    # Users service - connect to IDM's internal LDAP
+    users:
+      drivers:
+        ldap:
+          uri: ldap://localhost:9125
+          base_dn: o=libregraph-idm
+          insecure: true
+          bind_dn: uid=reva,ou=sysusers,o=libregraph-idm
+          bind_password: ${OC_IDM_REVA_PASSWORD}
+          user_base_dn: ou=users,o=libregraph-idm
+          user_filter: (objectClass=inetOrgPerson)
+          user_object_class: inetOrgPerson
+
+    # Groups service - connect to IDM's internal LDAP
+    groups:
+      drivers:
+        ldap:
+          uri: ldap://localhost:9125
+          base_dn: o=libregraph-idm
+          insecure: true
+          bind_dn: uid=reva,ou=sysusers,o=libregraph-idm
+          bind_password: ${OC_IDM_REVA_PASSWORD}
+          group_base_dn: ou=groups,o=libregraph-idm
+          group_filter: (objectClass=groupOfNames)
+          group_object_class: groupOfNames
+
     # IDM service user passwords (required when IDM is enabled and /etc/opencloud is read-only)
     idm:
       service_user_passwords: