---
# OpenCloud LDAP schema ConfigMap
# Defines openCloudUser objectClass and related attributes (OIDs under 1.3.6.1.4.1.63016)
# Mounted into OpenLDAP pod and loaded via lifecycle postStart hook
apiVersion: v1
kind: ConfigMap
metadata:
  name: opencloud-ldap-schema
  namespace: opencloud
data:
  10_opencloud_schema.ldif: |
    dn: cn=opencloud,cn=schema,cn=config
    objectClass: olcSchemaConfig
    cn: opencloud
    olcAttributeTypes: ( 1.3.6.1.4.1.63016.1.1.1
      NAME 'openCloudUUID'
      DESC 'A non-reassignable and persistent account ID'
      EQUALITY caseIgnoreMatch
      SUBSTR caseIgnoreSubstringsMatch
      SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256}
      SINGLE-VALUE )
    olcAttributeTypes: ( 1.3.6.1.4.1.63016.1.1.2
      NAME 'openCloudExternalIdentity'
      DESC 'Represents the objectIdentity resource type of the Graph API'
      EQUALITY caseIgnoreMatch
      SUBSTR caseIgnoreSubstringsMatch
      SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
    olcAttributeTypes: ( 1.3.6.1.4.1.63016.1.1.3
      NAME 'openCloudUserEnabled'
      DESC 'Indicates if the user account is enabled'
      EQUALITY booleanMatch
      SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
      SINGLE-VALUE )
    olcAttributeTypes: ( 1.3.6.1.4.1.63016.1.1.4
      NAME 'openCloudUserType'
      DESC 'Specifies the user type (Member or Guest)'
      EQUALITY caseIgnoreMatch
      SUBSTR caseIgnoreSubstringsMatch
      SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
      SINGLE-VALUE )
    olcAttributeTypes: ( 1.3.6.1.4.1.63016.1.1.5
      NAME 'openCloudLastSignInTimestamp'
      DESC 'Timestamp of the most recent authentication event'
      EQUALITY generalizedTimeMatch
      ORDERING generalizedTimeOrderingMatch
      SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
      SINGLE-VALUE )
    olcObjectClasses: ( 1.3.6.1.4.1.63016.1.2.1
      NAME 'openCloudObject'
      DESC 'Base auxiliary class for OpenCloud objects'
      AUXILIARY
      MAY ( openCloudUUID ) )
    olcObjectClasses: ( 1.3.6.1.4.1.63016.1.2.2
      NAME 'openCloudUser'
      DESC 'Auxiliary class for OpenCloud user accounts'
      AUXILIARY
      SUP openCloudObject
      MAY ( openCloudExternalIdentity $ openCloudUserEnabled $ openCloudUserType $ openCloudLastSignInTimestamp ) )