a715c8e532
User creation failed with "openCloudUUID: attribute type undefined" because OpenLDAP was missing the OpenCloud schema (OIDs under 1.3.6.1.4.1.63016). Changes: - Add opencloud-ldap-schema.yaml ConfigMap with the official OpenCloud LDAP schema defining openCloudUUID, openCloudUser, openCloudExternalIdentity, openCloudUserEnabled, openCloudUserType, openCloudLastSignInTimestamp - Mount the ConfigMap into the OpenLDAP pod - Add lifecycle postStart hook to load schema via ldapadd -Y EXTERNAL -H ldapi:/// (idempotent: skips if already loaded) - Re-exclude IDM in OpenCloud deployment (external LDAP handles user storage) Co-Authored-By: Paperclip <noreply@paperclip.ing>
58 lines
2.2 KiB
YAML
58 lines
2.2 KiB
YAML
---
|
|
# OpenCloud LDAP schema ConfigMap
|
|
# Defines openCloudUser objectClass and related attributes (OIDs under 1.3.6.1.4.1.63016)
|
|
# Mounted into OpenLDAP pod and loaded via lifecycle postStart hook
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: opencloud-ldap-schema
|
|
namespace: opencloud
|
|
data:
|
|
10_opencloud_schema.ldif: |
|
|
dn: cn=opencloud,cn=schema,cn=config
|
|
objectClass: olcSchemaConfig
|
|
cn: opencloud
|
|
olcAttributeTypes: ( 1.3.6.1.4.1.63016.1.1.1
|
|
NAME 'openCloudUUID'
|
|
DESC 'A non-reassignable and persistent account ID'
|
|
EQUALITY caseIgnoreMatch
|
|
SUBSTR caseIgnoreSubstringsMatch
|
|
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256}
|
|
SINGLE-VALUE )
|
|
olcAttributeTypes: ( 1.3.6.1.4.1.63016.1.1.2
|
|
NAME 'openCloudExternalIdentity'
|
|
DESC 'Represents the objectIdentity resource type of the Graph API'
|
|
EQUALITY caseIgnoreMatch
|
|
SUBSTR caseIgnoreSubstringsMatch
|
|
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
|
|
olcAttributeTypes: ( 1.3.6.1.4.1.63016.1.1.3
|
|
NAME 'openCloudUserEnabled'
|
|
DESC 'Indicates if the user account is enabled'
|
|
EQUALITY booleanMatch
|
|
SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
|
|
SINGLE-VALUE )
|
|
olcAttributeTypes: ( 1.3.6.1.4.1.63016.1.1.4
|
|
NAME 'openCloudUserType'
|
|
DESC 'Specifies the user type (Member or Guest)'
|
|
EQUALITY caseIgnoreMatch
|
|
SUBSTR caseIgnoreSubstringsMatch
|
|
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
|
SINGLE-VALUE )
|
|
olcAttributeTypes: ( 1.3.6.1.4.1.63016.1.1.5
|
|
NAME 'openCloudLastSignInTimestamp'
|
|
DESC 'Timestamp of the most recent authentication event'
|
|
EQUALITY generalizedTimeMatch
|
|
ORDERING generalizedTimeOrderingMatch
|
|
SYNTAX 1.3.6.1.4.1.1466.115.121.1.24
|
|
SINGLE-VALUE )
|
|
olcObjectClasses: ( 1.3.6.1.4.1.63016.1.2.1
|
|
NAME 'openCloudObject'
|
|
DESC 'Base auxiliary class for OpenCloud objects'
|
|
AUXILIARY
|
|
MAY ( openCloudUUID ) )
|
|
olcObjectClasses: ( 1.3.6.1.4.1.63016.1.2.2
|
|
NAME 'openCloudUser'
|
|
DESC 'Auxiliary class for OpenCloud user accounts'
|
|
AUXILIARY
|
|
SUP openCloudObject
|
|
MAY ( openCloudExternalIdentity $ openCloudUserEnabled $ openCloudUserType $ openCloudLastSignInTimestamp ) )
|