apps/opencloud/opencloud-configmap.yaml

@@ -6,22 +6,9 @@ metadata:
   namespace: opencloud
 data:
   opencloud.yaml: |
-    # OpenCloud Minimal Configuration
+    # OpenCloud Configuration - Pocket ID OIDC auth, IDM for internal user storage
-    # Only non-default settings - environment variables override these
 
-    # Graph service - external OpenLDAP configuration
+    # Proxy service - OIDC via Pocket ID
-    graph:
-      identity:
-        ldap:
-          uri: ldap://openldap.opencloud.svc.cluster.local:389
-          base_dn: dc=basicstack,dc=de
-          bind_dn: cn=admin,dc=basicstack,dc=de
-          bind_password: ${OPENLDAP_ADMIN_PASSWORD|}
-          user_base_dn: ou=users,dc=basicstack,dc=de
-          group_base_dn: ou=groups,dc=basicstack,dc=de
-          insecure: true
-
-    # Proxy service - OIDC configuration (already in env vars, kept for reference)
     proxy:
       oidc:
         issuer: https://auth.basicstack.de
@@ -30,33 +17,7 @@ data:
         user_oidc_claim: preferred_username
       enable_basic_auth: false
 
-    # Users service - external LDAP
+    # IDM service user passwords (required when /etc/opencloud is read-only - init cannot write here)
-    users:
-      drivers:
-        ldap:
-          uri: ldap://openldap.opencloud.svc.cluster.local:389
-          base_dn: dc=basicstack,dc=de
-          bind_dn: cn=admin,dc=basicstack,dc=de
-          bind_password: ${OPENLDAP_ADMIN_PASSWORD|}
-          user_base_dn: ou=users,dc=basicstack,dc=de
-          user_filter: (objectClass=inetOrgPerson)
-          user_object_class: inetOrgPerson
-          insecure: true
-
-    # Groups service - external LDAP
-    groups:
-      drivers:
-        ldap:
-          uri: ldap://openldap.opencloud.svc.cluster.local:389
-          base_dn: dc=basicstack,dc=de
-          bind_dn: cn=admin,dc=basicstack,dc=de
-          bind_password: ${OPENLDAP_ADMIN_PASSWORD|}
-          group_base_dn: ou=groups,dc=basicstack,dc=de
-          group_filter: (objectClass=groupOfNames)
-          group_object_class: groupOfNames
-          insecure: true
-
-    # IDM service user passwords (required when IDM is enabled and /etc/opencloud is read-only)
     idm:
       service_user_passwords:
         admin_password: ${OC_IDM_ADMIN_PASSWORD}

apps/opencloud/opencloud-deployment.yaml

@@ -99,9 +99,10 @@ spec:
         - name: PROXY_TLS
           value: "false"
 
-        # Exclude: search (broken), idp (using Pocket ID), idm (using external OpenLDAP), auth-basic (OIDC-only)
+        # Exclude broken search service, internal IDP, and auth-basic (OIDC-only auth via Pocket ID)
+        # IDM re-enabled: needed for auto-provisioning user storage when users log in via Pocket ID
         - name: OC_EXCLUDE_RUN_SERVICES
-          value: "search,idp,idm,auth-basic"
+          value: "search,idp,auth-basic"
 
         # Data paths
         - name: OPENCLOUD_BASE_DATA_PATH

apps/opencloud/opencloud-ldap-schema.yaml

@@ -1,58 +0,0 @@
----
-# OpenCloud LDAP schema ConfigMap
-# Defines openCloudUser objectClass and related attributes (OIDs under 1.3.6.1.4.1.63016)
-# Mounted into OpenLDAP pod and loaded via lifecycle postStart hook
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: opencloud-ldap-schema
-  namespace: opencloud
-data:
-  10_opencloud_schema.ldif: |
-    dn: cn=opencloud,cn=schema,cn=config
-    objectClass: olcSchemaConfig
-    cn: opencloud
-    olcAttributeTypes: ( 1.3.6.1.4.1.63016.1.1.1
-      NAME 'openCloudUUID'
-      DESC 'A non-reassignable and persistent account ID'
-      EQUALITY caseIgnoreMatch
-      SUBSTR caseIgnoreSubstringsMatch
-      SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256}
-      SINGLE-VALUE )
-    olcAttributeTypes: ( 1.3.6.1.4.1.63016.1.1.2
-      NAME 'openCloudExternalIdentity'
-      DESC 'Represents the objectIdentity resource type of the Graph API'
-      EQUALITY caseIgnoreMatch
-      SUBSTR caseIgnoreSubstringsMatch
-      SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
-    olcAttributeTypes: ( 1.3.6.1.4.1.63016.1.1.3
-      NAME 'openCloudUserEnabled'
-      DESC 'Indicates if the user account is enabled'
-      EQUALITY booleanMatch
-      SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
-      SINGLE-VALUE )
-    olcAttributeTypes: ( 1.3.6.1.4.1.63016.1.1.4
-      NAME 'openCloudUserType'
-      DESC 'Specifies the user type (Member or Guest)'
-      EQUALITY caseIgnoreMatch
-      SUBSTR caseIgnoreSubstringsMatch
-      SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
-      SINGLE-VALUE )
-    olcAttributeTypes: ( 1.3.6.1.4.1.63016.1.1.5
-      NAME 'openCloudLastSignInTimestamp'
-      DESC 'Timestamp of the most recent authentication event'
-      EQUALITY generalizedTimeMatch
-      ORDERING generalizedTimeOrderingMatch
-      SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
-      SINGLE-VALUE )
-    olcObjectClasses: ( 1.3.6.1.4.1.63016.1.2.1
-      NAME 'openCloudObject'
-      DESC 'Base auxiliary class for OpenCloud objects'
-      AUXILIARY
-      MAY ( openCloudUUID ) )
-    olcObjectClasses: ( 1.3.6.1.4.1.63016.1.2.2
-      NAME 'openCloudUser'
-      DESC 'Auxiliary class for OpenCloud user accounts'
-      AUXILIARY
-      SUP openCloudObject
-      MAY ( openCloudExternalIdentity $ openCloudUserEnabled $ openCloudUserType $ openCloudLastSignInTimestamp ) )

apps/opencloud/openldap-deployment.yaml

@@ -109,27 +109,6 @@ spec:
         - name: LDAP_REMOVE_CONFIG_AFTER_SETUP
           value: "false"
 
-        lifecycle:
-          postStart:
-            exec:
-              command:
-                - /bin/bash
-                - -c
-                - |
-                  # Wait for slapd to initialize
-                  sleep 10
-                  # Load OpenCloud schema if not already present
-                  if ! ldapsearch -Y EXTERNAL -H ldapi:/// \
-                    -b "cn=schema,cn=config" \
-                    "(cn={*}opencloud)" dn 2>/dev/null | grep -qi "opencloud"; then
-                    ldapadd -Y EXTERNAL -H ldapi:/// \
-                      -f /container/service/slapd/assets/config/bootstrap/schema/opencloud.ldif \
-                      2>&1 | tee /tmp/schema-load.log || true
-                    echo "OpenCloud schema load attempted"
-                  else
-                    echo "OpenCloud schema already present, skipping"
-                  fi
-
         ports:
         - containerPort: 389
           name: ldap
@@ -141,9 +120,6 @@ spec:
           mountPath: /var/lib/ldap
         - name: openldap-config
           mountPath: /etc/ldap/slapd.d
-        - name: opencloud-schema
-          mountPath: /container/service/slapd/assets/config/bootstrap/schema/opencloud.ldif
-          subPath: 10_opencloud_schema.ldif
 
         resources:
           requests:
@@ -174,6 +150,3 @@ spec:
       - name: openldap-config
         persistentVolumeClaim:
           claimName: openldap-config
-      - name: opencloud-schema
-        configMap:
-          name: opencloud-ldap-schema