From 47f5245f555f663aa9c9f9c24a764364593a4c97 Mon Sep 17 00:00:00 2001 From: Ralf Haferkamp Date: Wed, 24 May 2023 11:01:15 +0200 Subject: [PATCH] ocis_keycloak: Fix deployment example After commit 52951b42b0db1 we need to set PROXY_USER_CS3_CLAIM and PROXY_USER_OIDC_CLAIM for the keycloak example to still work. Also update release notes to mentions the changed default. --- changelog/3.0.0_2023-05-22/fix-idp-sub-recreation.md | 6 ++++++ deployments/examples/ocis_keycloak/docker-compose.yml | 2 ++ 2 files changed, 8 insertions(+) diff --git a/changelog/3.0.0_2023-05-22/fix-idp-sub-recreation.md b/changelog/3.0.0_2023-05-22/fix-idp-sub-recreation.md index 7ce6ad4fc..da1d954e1 100644 --- a/changelog/3.0.0_2023-05-22/fix-idp-sub-recreation.md +++ b/changelog/3.0.0_2023-05-22/fix-idp-sub-recreation.md @@ -7,6 +7,12 @@ use the user's unique id (`owncloudUUID` by default) for computing the `sub` claim. So that user's recreated with the same name will be treated as different users by the IDP. +This changed also the default values of the 'PROXY_USER_OIDC_CLAIM' and +'PROXY_USER_CS3_CLAIM' settings map the IDP users to CS3 user by the userid in +the default setup. The old behavior of matching by username can be achieved +byt setting 'PROXY_USER_OIDC_CLAIM=preferred_username' and +'PROXY_USER_CS3_CLAIM=username'. + https://github.com/owncloud/ocis/issues/904 https://github.com/owncloud/ocis/pull/6326 https://github.com/owncloud/ocis/pull/6338 diff --git a/deployments/examples/ocis_keycloak/docker-compose.yml b/deployments/examples/ocis_keycloak/docker-compose.yml index da47ef1e3..5ffafdba6 100644 --- a/deployments/examples/ocis_keycloak/docker-compose.yml +++ b/deployments/examples/ocis_keycloak/docker-compose.yml @@ -69,6 +69,8 @@ services: OCIS_LOG_LEVEL: ${OCIS_LOG_LEVEL:-info} OCIS_LOG_COLOR: "${OCIS_LOG_COLOR:-false}" PROXY_TLS: "false" # do not use SSL between Traefik and oCIS + PROXY_USER_OIDC_CLAIM: "preferred_username" + PROXY_USER_CS3_CLAIM: "username" # INSECURE: needed if oCIS / Traefik is using self generated certificates OCIS_INSECURE: "${INSECURE:-false}" OCIS_ADMIN_USER_ID: ""