sevenhill/QSfera
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #141 from opencloud-eu/ldap-schema

Browse Source 
Ldap schema renames
This commit is contained in:
Jörn Friedrich Dreyer
2025-01-29 12:05:27 +01:00
committed by GitHub
parent a51fbe8ef0 fc38c888d9
commit 5ab772bd3f
34 changed files with 372 additions and 288 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deployments/examples/shared/config/ldap/schemas/10_opencloud_schema.ldif
+39
View File
@@ -0,0 +1,39 @@
# This LDIF files describes the OpenCloud schema
dn: cn=opencloud,cn=schema,cn=config
objectClass: olcSchemaConfig
cn: opencloud
olcObjectIdentifier: openCloudOid 1.3.6.1.4.1.63016
# We'll use openCloudOid:1 subarc for LDAP related stuff
# openCloudOid:1.1 for AttributeTypes and openCloudOid:1.2 for ObjectClasses
olcAttributeTypes: ( openCloudOid:1.1.1 NAME 'openCloudUUID'
DESC 'A non-reassignable and persistent account ID)'
EQUALITY uuidMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.1.16.1 SINGLE-VALUE )
olcAttributeTypes: ( openCloudOid:1.1.2 NAME 'openCloudExternalIdentity'
DESC 'A triple separated by "$" representing the objectIdentity resource type of the Graph API ( signInType $ issuer $ issuerAssignedId )'
EQUALITY caseIgnoreMatch
SUBSTR caseIgnoreSubstringsMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
olcAttributeTypes: ( openCloudOid:1.1.3 NAME 'openCloudUserEnabled'
DESC 'A boolean value indicating if the user is enabled'
EQUALITY booleanMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE)
olcAttributeTypes: ( openCloudOid:1.1.4 NAME 'openCloudUserType'
DESC 'User type (e.g. Member or Guest)'
EQUALITY caseIgnoreMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
olcAttributeTypes: ( openCloudOid:1.1.5 NAME 'openCloudLastSignInTimestamp'
DESC 'The timestamp of the last sign-in'
EQUALITY generalizedTimeMatch
ORDERING generalizedTimeOrderingMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE )
olcObjectClasses: ( openCloudOid:1.2.1 NAME 'openCloudObject'
DESC 'OpenCloud base objectclass'
AUXILIARY
MAY ( openCloudUUID ) )
olcObjectClasses: ( openCloudOid:1.2.2 NAME 'openCloudUser'
DESC 'OpenCloud User objectclass'
SUP openCloudObject
AUXILIARY
MAY ( openCloudExternalIdentity $ openCloudUserEnabled $ openCloudUserType $ openCloudLastSignInTimestamp) )
deployments/examples/shared/config/ldap/schemas/20_opencloud_education_schema.ldif
+45
View File
@@ -0,0 +1,45 @@
# This LDIF files describes the LDAP schema related to the Education
# endpoints of the libregraph API
dn: cn=openCloudEdu,cn=schema,cn=config
objectClass: olcSchemaConfig
cn: openCloudEdu
olcAttributeTypes: ( openCloudOid:1.1.6 NAME 'openCloudMemberOfSchool'
DESC 'Used as a backreference to the school(s) to which a user or class is assigned'
EQUALITY uuidMatch
SYNTAX 1.3.6.1.1.16.1 )
olcAttributeTypes: ( openCloudOid:1.1.7 NAME 'openCloudEducationExternalId'
DESC 'An externally assigned string id for an education related object'
EQUALITY caseIgnoreMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
olcAttributeTypes: ( openCloudOid:1.1.8 NAME 'openCloudEducationClassType'
DESC 'category of a class e.g. "course" or "class"'
EQUALITY caseIgnoreMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
olcAttributeTypes: ( openCloudOid:1.1.9 NAME 'openCloudEducationTeacherMember'
DESC 'references a user who is assigned as a teacher to a class'
EQUALITY distinguishedNameMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
olcAttributeTypes: ( openCloudOid:1.1.10 NAME 'openCloudEducationSchoolNumber'
DESC 'An externally assigned identifier for a school'
EQUALITY caseIgnoreMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
olcAttributeTypes: ( openCloudOid:1.1.11 NAME 'openCloudEducationSchoolTerminationTimestamp'
DESC 'A Timestamp at which a school is considered to be disabled'
EQUALITY generalizedTimeMatch
ORDERING generalizedTimeOrderingMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 )
olcObjectClasses: ( openCloudOid:1.2.3 NAME 'openCloudEducationUser'
DESC 'OpenCloud education user objectclass'
SUP openCloudUser
AUXILIARY
MAY ( userClass $ openCloudMemberOfSchool ) )
olcObjectClasses: ( openCloudOid:1.2.4 NAME 'openCloudEducationClass'
DESC 'OpenCloud education class objectclass'
SUP openCloudObject
AUXILIARY
MAY ( openCloudEducationExternalId $ openCloudEducationClassType $ openCloudEducationTeacherMember $ openCloudMemberOfSchool ) )
olcObjectClasses: ( openCloudOid:1.2.5 NAME 'openCloudEducationSchool'
DESC 'OpenCloud education school objectclass'
SUP openCloudObject
AUXILIARY
MAY ( openCloudEducationSchoolNumber $ openCloudEducationSchoolTerminationTimestamp ) )
pkg/oidc/claims.go
+1 -1
View File
@@ -14,7 +14,7 @@ const (
UIDNumber = "uidnumber"
GIDNumber = "gidnumber"
Groups = "groups"
OwncloudUUID = "ownclouduuid"
OpenCloudUUID = "openclouduuid"
OpenCloudRoutingPolicy = "opencloud.routing.policy"
)
services/auth-basic/pkg/config/config.go
+1 -1
View File
@@ -70,7 +70,7 @@ type LDAPProvider struct {
GroupBaseDN string `yaml:"group_base_dn" env:"OC_LDAP_GROUP_BASE_DN;AUTH_BASIC_LDAP_GROUP_BASE_DN" desc:"Search base DN for looking up LDAP groups." introductionVersion:"pre5.0"`
UserScope string `yaml:"user_scope" env:"OC_LDAP_USER_SCOPE;AUTH_BASIC_LDAP_USER_SCOPE" desc:"LDAP search scope to use when looking up users. Supported values are 'base', 'one' and 'sub'." introductionVersion:"pre5.0"`
GroupScope string `yaml:"group_scope" env:"OC_LDAP_GROUP_SCOPE;AUTH_BASIC_LDAP_GROUP_SCOPE" desc:"LDAP search scope to use when looking up groups. Supported values are 'base', 'one' and 'sub'." introductionVersion:"pre5.0"`
UserFilter string `yaml:"user_filter" env:"OC_LDAP_USER_FILTER;AUTH_BASIC_LDAP_USER_FILTER" desc:"LDAP filter to add to the default filters for user search like '(objectclass=ownCloud)'." introductionVersion:"pre5.0"`
UserFilter string `yaml:"user_filter" env:"OC_LDAP_USER_FILTER;AUTH_BASIC_LDAP_USER_FILTER" desc:"LDAP filter to add to the default filters for user search like '(objectclass=openCloudUser)'." introductionVersion:"pre5.0"`
GroupFilter string `yaml:"group_filter" env:"OC_LDAP_GROUP_FILTER;AUTH_BASIC_LDAP_GROUP_FILTER" desc:"LDAP filter to add to the default filters for group searches." introductionVersion:"pre5.0"`
UserObjectClass string `yaml:"user_object_class" env:"OC_LDAP_USER_OBJECTCLASS;AUTH_BASIC_LDAP_USER_OBJECTCLASS" desc:"The object class to use for users in the default user search filter ('inetOrgPerson')." introductionVersion:"pre5.0"`
GroupObjectClass string `yaml:"group_object_class" env:"OC_LDAP_GROUP_OBJECTCLASS;AUTH_BASIC_LDAP_GROUP_OBJECTCLASS" desc:"The object class to use for groups in the default group search filter ('groupOfNames')." introductionVersion:"pre5.0"`
services/auth-basic/pkg/config/defaults/defaultconfig.go
+3 -3
View File
@@ -55,14 +55,14 @@ func DefaultConfig() *config.Config {
LdapDisabledUsersGroupDN: "cn=DisabledUsersGroup,ou=groups,o=libregraph-idm",
IDP: "https://localhost:9200",
UserSchema: config.LDAPUserSchema{
ID: "ownclouduuid",
ID: "openCloudUUID",
Mail: "mail",
DisplayName: "displayname",
Username: "uid",
Enabled: "ownCloudUserEnabled",
Enabled: "openCloudUserEnabled",
},
GroupSchema: config.LDAPGroupSchema{
ID: "ownclouduuid",
ID: "openCloudUUID",
Mail: "mail",
DisplayName: "cn",
Groupname: "cn",
services/graph/pkg/config/config.go
+2 -2
View File
@@ -64,14 +64,14 @@ type LDAP struct {
UserBaseDN string `yaml:"user_base_dn" env:"OC_LDAP_USER_BASE_DN;GRAPH_LDAP_USER_BASE_DN" desc:"Search base DN for looking up LDAP users." introductionVersion:"pre5.0"`
UserSearchScope string `yaml:"user_search_scope" env:"OC_LDAP_USER_SCOPE;GRAPH_LDAP_USER_SCOPE" desc:"LDAP search scope to use when looking up users. Supported scopes are 'base', 'one' and 'sub'." introductionVersion:"pre5.0"`
UserFilter string `yaml:"user_filter" env:"OC_LDAP_USER_FILTER;GRAPH_LDAP_USER_FILTER" desc:"LDAP filter to add to the default filters for user search like '(objectclass=ownCloud)'." introductionVersion:"pre5.0"`
UserFilter string `yaml:"user_filter" env:"OC_LDAP_USER_FILTER;GRAPH_LDAP_USER_FILTER" desc:"LDAP filter to add to the default filters for user search like '(objectclass=openCloudUser)'." introductionVersion:"pre5.0"`
UserObjectClass string `yaml:"user_objectclass" env:"OC_LDAP_USER_OBJECTCLASS;GRAPH_LDAP_USER_OBJECTCLASS" desc:"The object class to use for users in the default user search filter ('inetOrgPerson')." introductionVersion:"pre5.0"`
UserEmailAttribute string `yaml:"user_mail_attribute" env:"OC_LDAP_USER_SCHEMA_MAIL;GRAPH_LDAP_USER_EMAIL_ATTRIBUTE" desc:"LDAP Attribute to use for the email address of users." introductionVersion:"pre5.0"`
UserDisplayNameAttribute string `yaml:"user_displayname_attribute" env:"OC_LDAP_USER_SCHEMA_DISPLAYNAME;LDAP_USER_SCHEMA_DISPLAY_NAME;GRAPH_LDAP_USER_DISPLAYNAME_ATTRIBUTE" desc:"LDAP Attribute to use for the display name of users." introductionVersion:"pre5.0" deprecationVersion:"7.0.0" removalVersion:"%%NEXT_PRODUCTION_VERSION%%" deprecationInfo:"LDAP_USER_SCHEMA_DISPLAY_NAME changing name for consistency" deprecationReplacement:"OC_LDAP_USER_SCHEMA_DISPLAYNAME"`
UserNameAttribute string `yaml:"user_name_attribute" env:"OC_LDAP_USER_SCHEMA_USERNAME;GRAPH_LDAP_USER_NAME_ATTRIBUTE" desc:"LDAP Attribute to use for username of users." introductionVersion:"pre5.0"`
UserIDAttribute string `yaml:"user_id_attribute" env:"OC_LDAP_USER_SCHEMA_ID;GRAPH_LDAP_USER_UID_ATTRIBUTE" desc:"LDAP Attribute to use as the unique ID for users. This should be a stable globally unique ID like a UUID." introductionVersion:"pre5.0"`
UserIDIsOctetString bool `yaml:"user_id_is_octet_string" env:"OC_LDAP_USER_SCHEMA_ID_IS_OCTETSTRING;GRAPH_LDAP_USER_SCHEMA_ID_IS_OCTETSTRING" desc:"Set this to true if the defined 'ID' attribute for users is of the 'OCTETSTRING' syntax. This is required when using the 'objectGUID' attribute of Active Directory for the user ID's." introductionVersion:"pre5.0"`
UserTypeAttribute string `yaml:"user_type_attribute" env:"OC_LDAP_USER_SCHEMA_USER_TYPE;GRAPH_LDAP_USER_TYPE_ATTRIBUTE" desc:"LDAP Attribute to distinguish between 'Member' and 'Guest' users. Default is 'ownCloudUserType'." introductionVersion:"pre5.0"`
UserTypeAttribute string `yaml:"user_type_attribute" env:"OC_LDAP_USER_SCHEMA_USER_TYPE;GRAPH_LDAP_USER_TYPE_ATTRIBUTE" desc:"LDAP Attribute to distinguish between 'Member' and 'Guest' users. Default is 'openCloudUserType'." introductionVersion:"pre5.0"`
UserEnabledAttribute string `yaml:"user_enabled_attribute" env:"OC_LDAP_USER_ENABLED_ATTRIBUTE;GRAPH_USER_ENABLED_ATTRIBUTE" desc:"LDAP Attribute to use as a flag telling if the user is enabled or disabled." introductionVersion:"pre5.0"`
DisableUserMechanism string `yaml:"disable_user_mechanism" env:"OC_LDAP_DISABLE_USER_MECHANISM;GRAPH_DISABLE_USER_MECHANISM" desc:"An option to control the behavior for disabling users. Supported options are 'none', 'attribute' and 'group'. If set to 'group', disabling a user via API will add the user to the configured group for disabled users, if set to 'attribute' this will be done in the ldap user entry, if set to 'none' the disable request is not processed. Default is 'attribute'." introductionVersion:"pre5.0"`
LdapDisabledUsersGroupDN string `yaml:"ldap_disabled_users_group_dn" env:"OC_LDAP_DISABLED_USERS_GROUP_DN;GRAPH_DISABLED_USERS_GROUP_DN" desc:"The distinguished name of the group to which added users will be classified as disabled when 'disable_user_mechanism' is set to 'group'." introductionVersion:"pre5.0"`
services/graph/pkg/config/defaults/defaultconfig.go
+4 -4
View File
@@ -95,9 +95,9 @@ func DefaultConfig() *config.Config {
UserNameAttribute: "uid",
// FIXME: switch this to some more widely available attribute by default
// ideally this needs to be constant for the lifetime of a users
UserIDAttribute: "owncloudUUID",
UserTypeAttribute: "ownCloudUserType",
UserEnabledAttribute: "ownCloudUserEnabled",
UserIDAttribute: "openCloudUUID",
UserTypeAttribute: "openCloudUserType",
UserEnabledAttribute: "openCloudUserEnabled",
DisableUserMechanism: "attribute",
LdapDisabledUsersGroupDN: "cn=DisabledUsersGroup,ou=groups,o=libregraph-idm",
GroupBaseDN: "ou=groups,o=libregraph-idm",
@@ -106,7 +106,7 @@ func DefaultConfig() *config.Config {
GroupObjectClass: "groupOfNames",
GroupNameAttribute: "cn",
GroupMemberAttribute: "member",
GroupIDAttribute: "owncloudUUID",
GroupIDAttribute: "openCloudUUID",
EducationResourcesEnabled: false,
},
},
services/graph/pkg/identity/ldap.go
+3 -3
View File
@@ -24,8 +24,8 @@ import (
const (
givenNameAttribute = "givenname"
surNameAttribute = "sn"
identitiesAttribute = "oCExternalIdentity"
lastSignAttribute = "oCLastSignInTimestamp"
identitiesAttribute = "openCloudExternalIdentity"
lastSignAttribute = "openCloudLastSignInTimestamp"
ldapDateFormat = "20060102150405Z0700"
)
@@ -884,7 +884,7 @@ func (i *LDAP) userToLDAPAttrValues(user libregraph.User) (map[string][]string,
i.userAttributeMap.displayName: {user.GetDisplayName()},
i.userAttributeMap.userName: {user.GetOnPremisesSamAccountName()},
i.userAttributeMap.mail: {user.GetMail()},
"objectClass": {"inetOrgPerson", "organizationalPerson", "person", "top", "ownCloudUser"},
"objectClass": {"inetOrgPerson", "organizationalPerson", "person", "top", "openCloudUser"},
"cn": {user.GetOnPremisesSamAccountName()},
i.userAttributeMap.userType: {user.GetUserType()},
}
services/graph/pkg/identity/ldap_education_class.go
+7 -7
View File
@@ -7,8 +7,8 @@ import (
"github.com/go-ldap/ldap/v3"
"github.com/libregraph/idm/pkg/ldapdn"
libregraph "github.com/owncloud/libre-graph-api-go"
"github.com/opencloud-eu/opencloud/services/graph/pkg/errorcode"
libregraph "github.com/owncloud/libre-graph-api-go"
)
type educationClassAttributeMap struct {
@@ -19,9 +19,9 @@ type educationClassAttributeMap struct {
func newEducationClassAttributeMap() educationClassAttributeMap {
return educationClassAttributeMap{
externalID: "ocEducationExternalId",
classification: "ocEducationClassType",
teachers: "ocEducationTeacherMember",
externalID: "openCloudEducationExternalId",
classification: "openCloudEducationClassType",
teachers: "openCloudEducationTeacherMember",
}
}
@@ -66,7 +66,7 @@ func (i *LDAP) GetEducationClasses(ctx context.Context) ([]*libregraph.Education
// CreateEducationClass implements the EducationBackend interface for the LDAP backend.
// An EducationClass is mapped to an LDAP entry of the "groupOfNames" structural ObjectClass.
// With a few additional Attributes added on top via the "ocEducationClass" auxiliary ObjectClass.
// With a few additional Attributes added on top via the "openCloudEducationClass" auxiliary ObjectClass.
func (i *LDAP) CreateEducationClass(ctx context.Context, class libregraph.EducationClass) (*libregraph.EducationClass, error) {
logger := i.logger.SubloggerWithRequestID(ctx)
logger.Debug().Str("backend", "ldap").Msg("create educationClass")
@@ -208,7 +208,7 @@ func (i *LDAP) UpdateEducationClass(ctx context.Context, id string, class libreg
func (i *LDAP) updateClassExternalID(ctx context.Context, dn, externalID string) (string, error) {
logger := i.logger.SubloggerWithRequestID(ctx)
newDN := fmt.Sprintf("ocEducationExternalId=%s", externalID)
newDN := fmt.Sprintf("openCloudEducationExternalId=%s", externalID)
mrdn := ldap.NewModifyDNRequest(dn, newDN, true, "")
i.logger.Debug().Str("Backend", "ldap").
@@ -339,7 +339,7 @@ func (i *LDAP) groupToEducationClass(group libregraph.Group, e *ldap.Entry) *lib
func (i *LDAP) getEducationClassLDAPDN(class libregraph.EducationClass) string {
attributeTypeAndValue := ldap.AttributeTypeAndValue{
Type: "ocEducationExternalId",
Type: "openCloudEducationExternalId",
Value: class.GetExternalId(),
}
return fmt.Sprintf("%s,%s", attributeTypeAndValue.String(), i.groupBaseDN)
services/graph/pkg/identity/ldap_education_class_test.go
+40 -40
View File
@@ -6,36 +6,36 @@ import (
"testing"
"github.com/go-ldap/ldap/v3"
libregraph "github.com/owncloud/libre-graph-api-go"
"github.com/opencloud-eu/opencloud/services/graph/pkg/identity/mocks"
libregraph "github.com/owncloud/libre-graph-api-go"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/mock"
)
var classEntry = ldap.NewEntry("ocEducationExternalId=Math0123",
var classEntry = ldap.NewEntry("openCloudEducationExternalId=Math0123",
map[string][]string{
"cn": {"Math"},
"ocEducationExternalId": {"Math0123"},
"ocEducationClassType": {"course"},
"entryUUID": {"abcd-defg"},
"cn": {"Math"},
"openCloudEducationExternalId": {"Math0123"},
"openCloudEducationClassType": {"course"},
"entryUUID": {"abcd-defg"},
})
var classEntryWithSchool = ldap.NewEntry("ocEducationExternalId=Math0123",
var classEntryWithSchool = ldap.NewEntry("openCloudEducationExternalId=Math0123",
map[string][]string{
"cn": {"Math"},
"ocEducationExternalId": {"Math0123"},
"ocEducationClassType": {"course"},
"entryUUID": {"abcd-defg"},
"ocMemberOfSchool": {"abcd-defg"},
"cn": {"Math"},
"openCloudEducationExternalId": {"Math0123"},
"openCloudEducationClassType": {"course"},
"entryUUID": {"abcd-defg"},
"openCloudMemberOfSchool": {"abcd-defg"},
})
var classEntryWithMember = ldap.NewEntry("ocEducationExternalId=Math0123",
var classEntryWithMember = ldap.NewEntry("openCloudEducationExternalId=Math0123",
map[string][]string{
"cn": {"Math"},
"ocEducationExternalId": {"Math0123"},
"ocEducationClassType": {"course"},
"entryUUID": {"abcd-defg"},
"member": {"uid=user"},
"cn": {"Math"},
"openCloudEducationExternalId": {"Math0123"},
"openCloudEducationClassType": {"course"},
"entryUUID": {"abcd-defg"},
"member": {"uid=user"},
})
func TestCreateEducationClass(t *testing.T) {
@@ -107,25 +107,25 @@ func TestGetEducationClass(t *testing.T) {
{
name: "Test search class using id",
id: "abcd-defg",
filter: "(&(objectClass=ocEducationClass)(|(entryUUID=abcd-defg)(ocEducationExternalId=abcd-defg)))",
filter: "(&(objectClass=openCloudEducationClass)(|(entryUUID=abcd-defg)(openCloudEducationExternalId=abcd-defg)))",
expectedItemNotFound: false,
},
{
name: "Test search class using unknown Id",
id: "xxxx-xxxx",
filter: "(&(objectClass=ocEducationClass)(|(entryUUID=xxxx-xxxx)(ocEducationExternalId=xxxx-xxxx)))",
filter: "(&(objectClass=openCloudEducationClass)(|(entryUUID=xxxx-xxxx)(openCloudEducationExternalId=xxxx-xxxx)))",
expectedItemNotFound: true,
},
{
name: "Test search class using external ID",
id: "Math0123",
filter: "(&(objectClass=ocEducationClass)(|(entryUUID=Math0123)(ocEducationExternalId=Math0123)))",
filter: "(&(objectClass=openCloudEducationClass)(|(entryUUID=Math0123)(openCloudEducationExternalId=Math0123)))",
expectedItemNotFound: false,
},
{
name: "Test search school using unknown externalID",
id: "Unknown3210",
filter: "(&(objectClass=ocEducationClass)(|(entryUUID=Unknown3210)(ocEducationExternalId=Unknown3210)))",
filter: "(&(objectClass=openCloudEducationClass)(|(entryUUID=Unknown3210)(openCloudEducationExternalId=Unknown3210)))",
expectedItemNotFound: true,
},
}
@@ -137,7 +137,7 @@ func TestGetEducationClass(t *testing.T) {
Scope: 2,
SizeLimit: 1,
Filter: tt.filter,
Attributes: []string{"cn", "entryUUID", "ocEducationClassType", "ocEducationExternalId", "ocMemberOfSchool", "ocEducationTeacherMember"},
Attributes: []string{"cn", "entryUUID", "openCloudEducationClassType", "openCloudEducationExternalId", "openCloudMemberOfSchool", "openCloudEducationTeacherMember"},
Controls: []ldap.Control(nil),
}
if tt.expectedItemNotFound {
@@ -174,25 +174,25 @@ func TestDeleteEducationClass(t *testing.T) {
{
name: "Test search class using id",
id: "abcd-defg",
filter: "(&(objectClass=ocEducationClass)(|(entryUUID=abcd-defg)(ocEducationExternalId=abcd-defg)))",
filter: "(&(objectClass=openCloudEducationClass)(|(entryUUID=abcd-defg)(openCloudEducationExternalId=abcd-defg)))",
expectedItemNotFound: false,
},
{
name: "Test search class using unknown Id",
id: "xxxx-xxxx",
filter: "(&(objectClass=ocEducationClass)(|(entryUUID=xxxx-xxxx)(ocEducationExternalId=xxxx-xxxx)))",
filter: "(&(objectClass=openCloudEducationClass)(|(entryUUID=xxxx-xxxx)(openCloudEducationExternalId=xxxx-xxxx)))",
expectedItemNotFound: true,
},
{
name: "Test search class using external ID",
id: "Math0123",
filter: "(&(objectClass=ocEducationClass)(|(entryUUID=Math0123)(ocEducationExternalId=Math0123)))",
filter: "(&(objectClass=openCloudEducationClass)(|(entryUUID=Math0123)(openCloudEducationExternalId=Math0123)))",
expectedItemNotFound: false,
},
{
name: "Test search school using unknown externalID",
id: "Unknown3210",
filter: "(&(objectClass=ocEducationClass)(|(entryUUID=Unknown3210)(ocEducationExternalId=Unknown3210)))",
filter: "(&(objectClass=openCloudEducationClass)(|(entryUUID=Unknown3210)(openCloudEducationExternalId=Unknown3210)))",
expectedItemNotFound: true,
},
}
@@ -204,7 +204,7 @@ func TestDeleteEducationClass(t *testing.T) {
Scope: 2,
SizeLimit: 1,
Filter: tt.filter,
Attributes: []string{"cn", "entryUUID", "ocEducationClassType", "ocEducationExternalId", "ocMemberOfSchool", "ocEducationTeacherMember"},
Attributes: []string{"cn", "entryUUID", "openCloudEducationClassType", "openCloudEducationExternalId", "openCloudMemberOfSchool", "openCloudEducationTeacherMember"},
Controls: []ldap.Control(nil),
}
if tt.expectedItemNotFound {
@@ -213,7 +213,7 @@ func TestDeleteEducationClass(t *testing.T) {
lm.On("Search", sr).Return(&ldap.SearchResult{Entries: []*ldap.Entry{classEntry}}, nil)
}
dr := &ldap.DelRequest{
DN: "ocEducationExternalId=Math0123",
DN: "openCloudEducationExternalId=Math0123",
}
lm.On("Del", dr).Return(nil)
@@ -243,25 +243,25 @@ func TestGetEducationClassMembers(t *testing.T) {
{
name: "Test search class using id",
id: "abcd-defg",
filter: "(&(objectClass=ocEducationClass)(|(entryUUID=abcd-defg)(ocEducationExternalId=abcd-defg)))",
filter: "(&(objectClass=openCloudEducationClass)(|(entryUUID=abcd-defg)(openCloudEducationExternalId=abcd-defg)))",
expectedItemNotFound: false,
},
{
name: "Test search class using unknown Id",
id: "xxxx-xxxx",
filter: "(&(objectClass=ocEducationClass)(|(entryUUID=xxxx-xxxx)(ocEducationExternalId=xxxx-xxxx)))",
filter: "(&(objectClass=openCloudEducationClass)(|(entryUUID=xxxx-xxxx)(openCloudEducationExternalId=xxxx-xxxx)))",
expectedItemNotFound: true,
},
{
name: "Test search class using external ID",
id: "Math0123",
filter: "(&(objectClass=ocEducationClass)(|(entryUUID=Math0123)(ocEducationExternalId=Math0123)))",
filter: "(&(objectClass=openCloudEducationClass)(|(entryUUID=Math0123)(openCloudEducationExternalId=Math0123)))",
expectedItemNotFound: false,
},
{
name: "Test search school using unknown externalID",
id: "Unknown3210",
filter: "(&(objectClass=ocEducationClass)(|(entryUUID=Unknown3210)(ocEducationExternalId=Unknown3210)))",
filter: "(&(objectClass=openCloudEducationClass)(|(entryUUID=Unknown3210)(openCloudEducationExternalId=Unknown3210)))",
expectedItemNotFound: true,
},
}
@@ -282,7 +282,7 @@ func TestGetEducationClassMembers(t *testing.T) {
Scope: 2,
SizeLimit: 1,
Filter: tt.filter,
Attributes: []string{"cn", "entryUUID", "ocEducationClassType", "ocEducationExternalId", "ocMemberOfSchool", "ocEducationTeacherMember", "member"},
Attributes: []string{"cn", "entryUUID", "openCloudEducationClassType", "openCloudEducationExternalId", "openCloudMemberOfSchool", "openCloudEducationTeacherMember", "member"},
Controls: []ldap.Control(nil),
}
if tt.expectedItemNotFound {
@@ -346,7 +346,7 @@ func TestLDAP_UpdateEducationClass(t *testing.T) {
assertion: func(tt assert.TestingT, err error, i ...interface{}) bool { return assert.Nil(tt, err) },
modifyData: modifyData{
arg: &ldap.ModifyRequest{
DN: "ocEducationExternalId=Math0123",
DN: "openCloudEducationExternalId=Math0123",
Changes: []ldap.Change{
{
Operation: ldap.ReplaceAttribute,
@@ -383,8 +383,8 @@ func TestLDAP_UpdateEducationClass(t *testing.T) {
},
modifyDNData: modifyDNData{
arg: &ldap.ModifyDNRequest{
DN: "ocEducationExternalId=Math0123",
NewRDN: "ocEducationExternalId=Math3210",
DN: "openCloudEducationExternalId=Math0123",
NewRDN: "openCloudEducationExternalId=Math3210",
DeleteOldRDN: true,
NewSuperior: "",
},
@@ -409,7 +409,7 @@ func TestLDAP_UpdateEducationClass(t *testing.T) {
assertion: func(tt assert.TestingT, err error, i ...interface{}) bool { return assert.Nil(tt, err) },
modifyData: modifyData{
arg: &ldap.ModifyRequest{
DN: "ocEducationExternalId=Math3210,ou=groups,dc=test",
DN: "openCloudEducationExternalId=Math3210,ou=groups,dc=test",
Changes: []ldap.Change{
{
Operation: ldap.ReplaceAttribute,
@@ -423,8 +423,8 @@ func TestLDAP_UpdateEducationClass(t *testing.T) {
},
modifyDNData: modifyDNData{
arg: &ldap.ModifyDNRequest{
DN: "ocEducationExternalId=Math0123",
NewRDN: "ocEducationExternalId=Math3210",
DN: "openCloudEducationExternalId=Math0123",
NewRDN: "openCloudEducationExternalId=Math3210",
DeleteOldRDN: true,
NewSuperior: "",
},
services/graph/pkg/identity/ldap_education_school.go
+7 -7
View File
@@ -55,15 +55,15 @@ var (
func defaultEducationConfig() educationConfig {
return educationConfig{
schoolObjectClass: "ocEducationSchool",
schoolObjectClass: "openCloudEducationSchool",
schoolScope: ldap.ScopeWholeSubtree,
memberOfSchoolAttribute: "ocMemberOfSchool",
memberOfSchoolAttribute: "openCloudMemberOfSchool",
schoolAttributeMap: newSchoolAttributeMap(),
userObjectClass: "ocEducationUser",
userObjectClass: "openCloudEducationUser",
userAttributeMap: newEducationUserAttributeMap(),
classObjectClass: "ocEducationClass",
classObjectClass: "openCloudEducationClass",
classAttributeMap: newEducationClassAttributeMap(),
}
}
@@ -104,9 +104,9 @@ func newEducationConfig(config config.LDAP) (educationConfig, error) {
func newSchoolAttributeMap() schoolAttributeMap {
return schoolAttributeMap{
displayName: "ou",
schoolNumber: "ocEducationSchoolNumber",
id: "owncloudUUID",
terminationDate: "ocEducationSchoolTerminationTimestamp",
schoolNumber: "openCloudEducationSchoolNumber",
id: "openCloudUUID",
terminationDate: "openCloudEducationSchoolTerminationTimestamp",
}
}
services/graph/pkg/identity/ldap_education_school_test.go
+46 -46
View File
@@ -7,10 +7,10 @@ import (
"time"
"github.com/go-ldap/ldap/v3"
libregraph "github.com/owncloud/libre-graph-api-go"
"github.com/opencloud-eu/opencloud/services/graph/pkg/config"
"github.com/opencloud-eu/opencloud/services/graph/pkg/errorcode"
"github.com/opencloud-eu/opencloud/services/graph/pkg/identity/mocks"
libregraph "github.com/owncloud/libre-graph-api-go"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/mock"
)
@@ -42,30 +42,30 @@ var eduConfig = config.LDAP{
var schoolEntry = ldap.NewEntry("ou=Test School",
map[string][]string{
"ou": {"Test School"},
"ocEducationSchoolNumber": {"0123"},
"owncloudUUID": {"abcd-defg"},
"ou": {"Test School"},
"openCloudEducationSchoolNumber": {"0123"},
"openCloudUUID": {"abcd-defg"},
})
var schoolEntry1 = ldap.NewEntry("ou=Test School1",
map[string][]string{
"ou": {"Test School1"},
"ocEducationSchoolNumber": {"0042"},
"owncloudUUID": {"hijk-defg"},
"ou": {"Test School1"},
"openCloudEducationSchoolNumber": {"0042"},
"openCloudUUID": {"hijk-defg"},
})
var schoolEntryWithTermination = ldap.NewEntry("ou=Test School",
map[string][]string{
"ou": {"Test School"},
"ocEducationSchoolNumber": {"0123"},
"owncloudUUID": {"abcd-defg"},
"ocEducationSchoolTerminationTimestamp": {"20420131120000Z"},
"ou": {"Test School"},
"openCloudEducationSchoolNumber": {"0123"},
"openCloudUUID": {"abcd-defg"},
"openCloudEducationSchoolTerminationTimestamp": {"20420131120000Z"},
})
var (
filterSchoolSearchByIdExisting = "(&(objectClass=ocEducationSchool)(|(owncloudUUID=abcd-defg)(ocEducationSchoolNumber=abcd-defg)))"
filterSchoolSearchByIdNonexistant = "(&(objectClass=ocEducationSchool)(|(owncloudUUID=xxxx-xxxx)(ocEducationSchoolNumber=xxxx-xxxx)))"
filterSchoolSearchByNumberExisting = "(&(objectClass=ocEducationSchool)(|(owncloudUUID=0123)(ocEducationSchoolNumber=0123)))"
filterSchoolSearchByNumberNonexistant = "(&(objectClass=ocEducationSchool)(|(owncloudUUID=3210)(ocEducationSchoolNumber=3210)))"
filterSchoolSearchByIdExisting = "(&(objectClass=openCloudEducationSchool)(|(openCloudUUID=abcd-defg)(openCloudEducationSchoolNumber=abcd-defg)))"
filterSchoolSearchByIdNonexistant = "(&(objectClass=openCloudEducationSchool)(|(openCloudUUID=xxxx-xxxx)(openCloudEducationSchoolNumber=xxxx-xxxx)))"
filterSchoolSearchByNumberExisting = "(&(objectClass=openCloudEducationSchool)(|(openCloudUUID=0123)(openCloudEducationSchoolNumber=0123)))"
filterSchoolSearchByNumberNonexistant = "(&(objectClass=openCloudEducationSchool)(|(openCloudUUID=3210)(openCloudEducationSchoolNumber=3210)))"
)
func TestCreateEducationSchool(t *testing.T) {
@@ -104,7 +104,7 @@ func TestCreateEducationSchool(t *testing.T) {
return false
}
for _, attr := range ar.Attributes {
if attr.Type == "ocEducationSchoolTerminationTimestamp" {
if attr.Type == "openCloudEducationSchoolTerminationTimestamp" {
return false
}
}
@@ -124,8 +124,8 @@ func TestCreateEducationSchool(t *testing.T) {
BaseDN: "",
Scope: 2,
SizeLimit: 1,
Filter: "(&(objectClass=ocEducationSchool)(ocEducationSchoolNumber=0123))",
Attributes: []string{"ou", "owncloudUUID", "ocEducationSchoolNumber", "ocEducationSchoolTerminationTimestamp"},
Filter: "(&(objectClass=openCloudEducationSchool)(openCloudEducationSchoolNumber=0123))",
Attributes: []string{"ou", "openCloudUUID", "openCloudEducationSchoolNumber", "openCloudEducationSchoolTerminationTimestamp"},
Controls: []ldap.Control(nil),
}
lm.On("Search", schoolNumberSearchRequest).
@@ -138,8 +138,8 @@ func TestCreateEducationSchool(t *testing.T) {
BaseDN: "",
Scope: 2,
SizeLimit: 1,
Filter: "(&(objectClass=ocEducationSchool)(ocEducationSchoolNumber=0666))",
Attributes: []string{"ou", "owncloudUUID", "ocEducationSchoolNumber", "ocEducationSchoolTerminationTimestamp"},
Filter: "(&(objectClass=openCloudEducationSchool)(openCloudEducationSchoolNumber=0666))",
Attributes: []string{"ou", "openCloudUUID", "openCloudEducationSchoolNumber", "openCloudEducationSchoolTerminationTimestamp"},
Controls: []ldap.Control(nil),
}
lm.On("Search", existingSchoolNumberSearchRequest).
@@ -152,8 +152,8 @@ func TestCreateEducationSchool(t *testing.T) {
BaseDN: "",
Scope: 2,
SizeLimit: 1,
Filter: "(&(objectClass=ocEducationSchool)(ocEducationSchoolNumber=1111))",
Attributes: []string{"ou", "owncloudUUID", "ocEducationSchoolNumber", "ocEducationSchoolTerminationTimestamp"},
Filter: "(&(objectClass=openCloudEducationSchool)(openCloudEducationSchoolNumber=1111))",
Attributes: []string{"ou", "openCloudUUID", "openCloudEducationSchoolNumber", "openCloudEducationSchoolTerminationTimestamp"},
Controls: []ldap.Control(nil),
}
lm.On("Search", schoolNumberSearchRequestError).
@@ -166,8 +166,8 @@ func TestCreateEducationSchool(t *testing.T) {
BaseDN: "ou=Test School,",
Scope: 0,
SizeLimit: 1,
Filter: "(objectClass=ocEducationSchool)",
Attributes: []string{"ou", "owncloudUUID", "ocEducationSchoolNumber", "ocEducationSchoolTerminationTimestamp"},
Filter: "(objectClass=openCloudEducationSchool)",
Attributes: []string{"ou", "openCloudUUID", "openCloudEducationSchoolNumber", "openCloudEducationSchoolTerminationTimestamp"},
Controls: []ldap.Control(nil),
}
lm.On("Search", schoolLookupAfterCreate).
@@ -209,7 +209,7 @@ func TestUpdateEducationSchoolTerminationDate(t *testing.T) {
}
for _, mod := range mr.Changes {
if mod.Operation == ldap.ReplaceAttribute &&
mod.Modification.Type == "ocEducationSchoolTerminationTimestamp" &&
mod.Modification.Type == "openCloudEducationSchoolTerminationTimestamp" &&
mod.Modification.Vals[0] == "20420131120000Z" {
return true
}
@@ -355,7 +355,7 @@ func TestDeleteEducationSchool(t *testing.T) {
Scope: 2,
SizeLimit: 1,
Filter: tt.filter,
Attributes: []string{"ou", "owncloudUUID", "ocEducationSchoolNumber", "ocEducationSchoolTerminationTimestamp"},
Attributes: []string{"ou", "openCloudUUID", "openCloudEducationSchoolNumber", "openCloudEducationSchoolTerminationTimestamp"},
Controls: []ldap.Control(nil),
}
if tt.expectedItemNotFound {
@@ -424,7 +424,7 @@ func TestGetEducationSchool(t *testing.T) {
Scope: 2,
SizeLimit: 1,
Filter: tt.filter,
Attributes: []string{"ou", "owncloudUUID", "ocEducationSchoolNumber", "ocEducationSchoolTerminationTimestamp"},
Attributes: []string{"ou", "openCloudUUID", "openCloudEducationSchoolNumber", "openCloudEducationSchoolTerminationTimestamp"},
Controls: []ldap.Control(nil),
}
if tt.expectedItemNotFound {
@@ -457,8 +457,8 @@ func TestGetEducationSchools(t *testing.T) {
BaseDN: "",
Scope: 2,
SizeLimit: 0,
Filter: "(objectClass=ocEducationSchool)",
Attributes: []string{"ou", "owncloudUUID", "ocEducationSchoolNumber", "ocEducationSchoolTerminationTimestamp"},
Filter: "(objectClass=openCloudEducationSchool)",
Attributes: []string{"ou", "openCloudUUID", "openCloudEducationSchoolNumber", "openCloudEducationSchoolTerminationTimestamp"},
Controls: []ldap.Control(nil),
}
lm.On("Search", sr1).Return(&ldap.SearchResult{Entries: []*ldap.Entry{schoolEntry, schoolEntry1}}, nil)
@@ -475,7 +475,7 @@ var schoolByIDSearch1 *ldap.SearchRequest = &ldap.SearchRequest{
Scope: 2,
SizeLimit: 1,
Filter: filterSchoolSearchByIdExisting,
Attributes: []string{"ou", "owncloudUUID", "ocEducationSchoolNumber", "ocEducationSchoolTerminationTimestamp"},
Attributes: []string{"ou", "openCloudUUID", "openCloudEducationSchoolNumber", "openCloudEducationSchoolTerminationTimestamp"},
Controls: []ldap.Control(nil),
}
@@ -484,7 +484,7 @@ var schoolByNumberSearch *ldap.SearchRequest = &ldap.SearchRequest{
Scope: 2,
SizeLimit: 1,
Filter: filterSchoolSearchByNumberExisting,
Attributes: []string{"ou", "owncloudUUID", "ocEducationSchoolNumber", "ocEducationSchoolTerminationTimestamp"},
Attributes: []string{"ou", "openCloudUUID", "openCloudEducationSchoolNumber", "openCloudEducationSchoolTerminationTimestamp"},
Controls: []ldap.Control(nil),
}
@@ -492,7 +492,7 @@ var userByIDSearch1 *ldap.SearchRequest = &ldap.SearchRequest{
BaseDN: "ou=people,dc=test",
Scope: 2,
SizeLimit: 1,
Filter: "(&(objectClass=ocEducationUser)(|(uid=abcd-defg)(entryUUID=abcd-defg)))",
Filter: "(&(objectClass=openCloudEducationUser)(|(uid=abcd-defg)(entryUUID=abcd-defg)))",
Attributes: eduUserAttrs,
Controls: []ldap.Control(nil),
}
@@ -501,7 +501,7 @@ var userByIDSearch2 *ldap.SearchRequest = &ldap.SearchRequest{
BaseDN: "ou=people,dc=test",
Scope: 2,
SizeLimit: 1,
Filter: "(&(objectClass=ocEducationUser)(|(uid=does-not-exist)(entryUUID=does-not-exist)))",
Filter: "(&(objectClass=openCloudEducationUser)(|(uid=does-not-exist)(entryUUID=does-not-exist)))",
Attributes: eduUserAttrs,
Controls: []ldap.Control(nil),
}
@@ -512,7 +512,7 @@ var userToSchoolModRequest *ldap.ModifyRequest = &ldap.ModifyRequest{
{
Operation: ldap.AddAttribute,
Modification: ldap.PartialAttribute{
Type: "ocMemberOfSchool",
Type: "openCloudMemberOfSchool",
Vals: []string{"abcd-defg"},
},
},
@@ -525,7 +525,7 @@ var userFromSchoolModRequest *ldap.ModifyRequest = &ldap.ModifyRequest{
{
Operation: ldap.DeleteAttribute,
Modification: ldap.PartialAttribute{
Type: "ocMemberOfSchool",
Type: "openCloudMemberOfSchool",
Vals: []string{"abcd-defg"},
},
},
@@ -533,12 +533,12 @@ var userFromSchoolModRequest *ldap.ModifyRequest = &ldap.ModifyRequest{
}
var classToSchoolModRequest *ldap.ModifyRequest = &ldap.ModifyRequest{
DN: "ocEducationExternalId=Math0123",
DN: "openCloudEducationExternalId=Math0123",
Changes: []ldap.Change{
{
Operation: ldap.AddAttribute,
Modification: ldap.PartialAttribute{
Type: "ocMemberOfSchool",
Type: "openCloudMemberOfSchool",
Vals: []string{"abcd-defg"},
},
},
@@ -546,12 +546,12 @@ var classToSchoolModRequest *ldap.ModifyRequest = &ldap.ModifyRequest{
}
var classFromSchoolModRequest *ldap.ModifyRequest = &ldap.ModifyRequest{
DN: "ocEducationExternalId=Math0123",
DN: "openCloudEducationExternalId=Math0123",
Changes: []ldap.Change{
{
Operation: ldap.DeleteAttribute,
Modification: ldap.PartialAttribute{
Type: "ocMemberOfSchool",
Type: "openCloudMemberOfSchool",
Vals: []string{"abcd-defg"},
},
},
@@ -609,7 +609,7 @@ var usersBySchoolIDSearch *ldap.SearchRequest = &ldap.SearchRequest{
BaseDN: "ou=people,dc=test",
Scope: 2,
SizeLimit: 0,
Filter: "(&(objectClass=ocEducationUser)(ocMemberOfSchool=abcd-defg))",
Filter: "(&(objectClass=openCloudEducationUser)(openCloudMemberOfSchool=abcd-defg))",
Attributes: eduUserAttrs,
Controls: []ldap.Control(nil),
}
@@ -632,8 +632,8 @@ var classesBySchoolIDSearch *ldap.SearchRequest = &ldap.SearchRequest{
BaseDN: "ou=groups,dc=test",
Scope: 2,
SizeLimit: 0,
Filter: "(&(objectClass=ocEducationClass)(ocMemberOfSchool=abcd-defg))",
Attributes: []string{"cn", "entryUUID", "ocEducationClassType", "ocEducationExternalId", "ocMemberOfSchool", "ocEducationTeacherMember"},
Filter: "(&(objectClass=openCloudEducationClass)(openCloudMemberOfSchool=abcd-defg))",
Attributes: []string{"cn", "entryUUID", "openCloudEducationClassType", "openCloudEducationExternalId", "openCloudMemberOfSchool", "openCloudEducationTeacherMember"},
Controls: []ldap.Control(nil),
}
@@ -655,8 +655,8 @@ var classesByUUIDSearchNotFound *ldap.SearchRequest = &ldap.SearchRequest{
BaseDN: "ou=groups,dc=test",
Scope: 2,
SizeLimit: 1,
Filter: "(&(objectClass=ocEducationClass)(|(entryUUID=does-not-exist)(ocEducationExternalId=does-not-exist)))",
Attributes: []string{"cn", "entryUUID", "ocEducationClassType", "ocEducationExternalId", "ocMemberOfSchool", "ocEducationTeacherMember"},
Filter: "(&(objectClass=openCloudEducationClass)(|(entryUUID=does-not-exist)(openCloudEducationExternalId=does-not-exist)))",
Attributes: []string{"cn", "entryUUID", "openCloudEducationClassType", "openCloudEducationExternalId", "openCloudMemberOfSchool", "openCloudEducationTeacherMember"},
Controls: []ldap.Control(nil),
}
@@ -664,8 +664,8 @@ var classesByUUIDSearchFound *ldap.SearchRequest = &ldap.SearchRequest{
BaseDN: "ou=groups,dc=test",
Scope: 2,
SizeLimit: 1,
Filter: "(&(objectClass=ocEducationClass)(|(entryUUID=abcd-defg)(ocEducationExternalId=abcd-defg)))",
Attributes: []string{"cn", "entryUUID", "ocEducationClassType", "ocEducationExternalId", "ocMemberOfSchool", "ocEducationTeacherMember"},
Filter: "(&(objectClass=openCloudEducationClass)(|(entryUUID=abcd-defg)(openCloudEducationExternalId=abcd-defg)))",
Attributes: []string{"cn", "entryUUID", "openCloudEducationClassType", "openCloudEducationExternalId", "openCloudMemberOfSchool", "openCloudEducationTeacherMember"},
Controls: []ldap.Control(nil),
}
services/graph/pkg/identity/ldap_education_user_test.go
+17 -17
View File
@@ -5,8 +5,8 @@ import (
"testing"
"github.com/go-ldap/ldap/v3"
libregraph "github.com/owncloud/libre-graph-api-go"
"github.com/opencloud-eu/opencloud/services/graph/pkg/identity/mocks"
libregraph "github.com/owncloud/libre-graph-api-go"
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/mock"
)
@@ -20,9 +20,9 @@ var eduUserAttrs = []string{
"givenname",
"userEnabledAttribute",
"userTypeAttribute",
"oCExternalIdentity",
"openCloudExternalIdentity",
"userClass",
"ocMemberOfSchool",
"openCloudMemberOfSchool",
}
var eduUserEntry = ldap.NewEntry("uid=user,ou=people,dc=test",
@@ -32,7 +32,7 @@ var eduUserEntry = ldap.NewEntry("uid=user,ou=people,dc=test",
"mail": {"user@example"},
"entryuuid": {"abcd-defg"},
"userClass": {"student"},
"oCExternalIdentity": {
"openCloudExternalIdentity": {
"$ http://idp $ testuser",
"xxx $ http://idpnew $ xxxxx-xxxxx-xxxxx",
},
@@ -46,7 +46,7 @@ var renamedEduUserEntry = ldap.NewEntry("uid=newtestuser,ou=people,dc=test",
"mail": {"user@example"},
"entryuuid": {"abcd-defg"},
"userClass": {"student"},
"oCExternalIdentity": {
"openCloudExternalIdentity": {
"$ http://idp $ testuser",
"xxx $ http://idpnew $ xxxxx-xxxxx-xxxxx",
},
@@ -55,13 +55,13 @@ var renamedEduUserEntry = ldap.NewEntry("uid=newtestuser,ou=people,dc=test",
})
var eduUserEntryWithSchool = ldap.NewEntry("uid=user,ou=people,dc=test",
map[string][]string{
"uid": {"testuser"},
"displayname": {"Test User"},
"mail": {"user@example"},
"entryuuid": {"abcd-defg"},
"userClass": {"student"},
"ocMemberOfSchool": {"abcd-defg"},
"oCExternalIdentity": {
"uid": {"testuser"},
"displayname": {"Test User"},
"mail": {"user@example"},
"entryuuid": {"abcd-defg"},
"userClass": {"student"},
"openCloudMemberOfSchool": {"abcd-defg"},
"openCloudExternalIdentity": {
"$ http://idp $ testuser",
"xxx $ http://idpnew $ xxxxx-xxxxx-xxxxx",
},
@@ -71,7 +71,7 @@ var sr1 *ldap.SearchRequest = &ldap.SearchRequest{
BaseDN: "ou=people,dc=test",
Scope: 2,
SizeLimit: 1,
Filter: "(&(objectClass=ocEducationUser)(|(uid=abcd-defg)(entryUUID=abcd-defg)))",
Filter: "(&(objectClass=openCloudEducationUser)(|(uid=abcd-defg)(entryUUID=abcd-defg)))",
Attributes: eduUserAttrs,
Controls: []ldap.Control(nil),
}
@@ -79,7 +79,7 @@ var sr2 *ldap.SearchRequest = &ldap.SearchRequest{
BaseDN: "ou=people,dc=test",
Scope: 2,
SizeLimit: 1,
Filter: "(&(objectClass=ocEducationUser)(|(uid=xxxx-xxxx)(entryUUID=xxxx-xxxx)))",
Filter: "(&(objectClass=openCloudEducationUser)(|(uid=xxxx-xxxx)(entryUUID=xxxx-xxxx)))",
Attributes: eduUserAttrs,
Controls: []ldap.Control(nil),
}
@@ -166,7 +166,7 @@ func TestGetEducationUsers(t *testing.T) {
BaseDN: "ou=people,dc=test",
Scope: 2,
SizeLimit: 0,
Filter: "(objectClass=ocEducationUser)",
Filter: "(objectClass=openCloudEducationUser)",
Attributes: eduUserAttrs,
Controls: []ldap.Control(nil),
}
@@ -186,7 +186,7 @@ func TestUpdateEducationUser(t *testing.T) {
BaseDN: "ou=people,dc=test",
Scope: 2,
SizeLimit: 1,
Filter: "(&(objectClass=ocEducationUser)(|(uid=testuser)(entryUUID=testuser)))",
Filter: "(&(objectClass=openCloudEducationUser)(|(uid=testuser)(entryUUID=testuser)))",
Attributes: eduUserAttrs,
}
userLookupReq := &ldap.SearchRequest{
@@ -200,7 +200,7 @@ func TestUpdateEducationUser(t *testing.T) {
BaseDN: "uid=newtestuser,ou=people,dc=test",
Scope: 0,
SizeLimit: 1,
Filter: "(objectClass=ocEducationUser)",
Filter: "(objectClass=openCloudEducationUser)",
Attributes: eduUserAttrs,
}
groupSearchReq := &ldap.SearchRequest{
services/graph/pkg/identity/ldap_group.go
+2 -2
View File
@@ -448,8 +448,8 @@ func (i *LDAP) groupToLDAPAttrValues(group libregraph.Group) (map[string][]strin
}
if !i.useServerUUID {
attrs["owncloudUUID"] = []string{uuid.Must(uuid.NewV4()).String()}
attrs["objectClass"] = append(attrs["objectClass"], "owncloud")
attrs["openCloudUUID"] = []string{uuid.Must(uuid.NewV4()).String()}
attrs["objectClass"] = append(attrs["objectClass"], "openCloudObject")
}
return attrs, nil
}
services/graph/pkg/identity/ldap_group_test.go
+2 -2
View File
@@ -317,7 +317,7 @@ func TestGetGroupsSearch(t *testing.T) {
}
}
func TestUpdateGroupName(t *testing.T) {
groupDn := "cn=TheGroup,ou=groups,dc=owncloud,dc=com"
groupDn := "cn=TheGroup,ou=groups,dc=example,dc=org"
type args struct {
groupId string
@@ -404,7 +404,7 @@ func TestUpdateGroupName(t *testing.T) {
&ldap.SearchResult{
Entries: []*ldap.Entry{
{
DN: "cn=TheGroup,ou=groups,dc=owncloud,dc=com",
DN: "cn=TheGroup,ou=groups,dc=example,dc=org",
Attributes: []*ldap.EntryAttribute{
{
Name: "cn",
services/graph/pkg/identity/ldap_test.go
+2 -2
View File
@@ -72,7 +72,7 @@ var invalidUserEntry = ldap.NewEntry("uid=user",
var logger = log.NewLogger(log.Level("debug"))
var ldapUserAttributes = []string{"displayname", "entryUUID", "mail", "uid", "sn", "givenname", "userEnabledAttribute", "userTypeAttribute", "oCExternalIdentity", "oCLastSignInTimestamp"}
var ldapUserAttributes = []string{"displayname", "entryUUID", "mail", "uid", "sn", "givenname", "userEnabledAttribute", "userTypeAttribute", "openCloudExternalIdentity", "openCloudLastSignInTimestamp"}
func TestNewLDAPBackend(t *testing.T) {
l := &mocks.Client{}
@@ -123,7 +123,7 @@ func TestCreateUser(t *testing.T) {
ar.Attribute(lconfig.UserEnabledAttribute, []string{"TRUE"})
ar.Attribute(lconfig.UserTypeAttribute, []string{"Member"})
ar.Attribute("cn", []string{userName})
ar.Attribute("objectClass", []string{"inetOrgPerson", "organizationalPerson", "person", "top", "ownCloudUser"})
ar.Attribute("objectClass", []string{"inetOrgPerson", "organizationalPerson", "person", "top", "openCloudUser"})
l := &mocks.Client{}
l.On("Search", mock.Anything).
services/graph/pkg/service/v0/drives_test.go
+2 -2
View File
@@ -46,8 +46,8 @@ var sortTests = []sortTest{
DrivesSorted: []*libregraph.Drive{
drive("3", "project", "Admin", time3),
drive("1", "project", "Alan", &time1),
drive("2", "project", "Mary", &time2),
drive("4", "project", "Margaret", &time4),
drive("2", "project", "Mary", &time2),
},
},
{
@@ -62,8 +62,8 @@ var sortTests = []sortTest{
},
},
DrivesSorted: []*libregraph.Drive{
drive("4", "project", "Margaret", &time4),
drive("2", "project", "Mary", &time2),
drive("4", "project", "Margaret", &time4),
drive("1", "project", "Alan", &time1),
drive("3", "project", "Admin", time3),
},
services/graph/pkg/service/v0/password_test.go
+2 -2
View File
@@ -68,10 +68,10 @@ var _ = Describe("Users changing their own password", func() {
UserDisplayNameAttribute: "displayName",
UserNameAttribute: "uid",
UserEmailAttribute: "mail",
UserIDAttribute: "ownclouduuid",
UserIDAttribute: "openCloudUUID",
UserSearchScope: "sub",
GroupNameAttribute: "cn",
GroupIDAttribute: "ownclouduuid",
GroupIDAttribute: "openCloudUUID",
GroupSearchScope: "sub",
}
loggger := log.NewLogger()
services/groups/pkg/config/config.go
+1 -1
View File
@@ -70,7 +70,7 @@ type LDAPDriver struct {
UserScope string `yaml:"user_scope" env:"OC_LDAP_USER_SCOPE;GROUPS_LDAP_USER_SCOPE" desc:"LDAP search scope to use when looking up users. Supported scopes are 'base', 'one' and 'sub'." introductionVersion:"pre5.0"`
GroupScope string `yaml:"group_scope" env:"OC_LDAP_GROUP_SCOPE;GROUPS_LDAP_GROUP_SCOPE" desc:"LDAP search scope to use when looking up groups. Supported scopes are 'base', 'one' and 'sub'." introductionVersion:"pre5.0"`
GroupSubstringFilterType string `yaml:"group_substring_filter_type" env:"LDAP_GROUP_SUBSTRING_FILTER_TYPE;GROUPS_LDAP_GROUP_SUBSTRING_FILTER_TYPE" desc:"Type of substring search filter to use for substring searches for groups. Supported values are 'initial', 'final' and 'any'. The value 'initial' is used for doing prefix only searches, 'final' for doing suffix only searches or 'any' for doing full substring searches" introductionVersion:"pre5.0"`
UserFilter string `yaml:"user_filter" env:"OC_LDAP_USER_FILTER;GROUPS_LDAP_USER_FILTER" desc:"LDAP filter to add to the default filters for user search like '(objectclass=ownCloud)'." introductionVersion:"pre5.0"`
UserFilter string `yaml:"user_filter" env:"OC_LDAP_USER_FILTER;GROUPS_LDAP_USER_FILTER" desc:"LDAP filter to add to the default filters for user search like '(objectclass=openCloudUser)'." introductionVersion:"pre5.0"`
GroupFilter string `yaml:"group_filter" env:"OC_LDAP_GROUP_FILTER;GROUPS_LDAP_GROUP_FILTER" desc:"LDAP filter to add to the default filters for group searches." introductionVersion:"pre5.0"`
UserObjectClass string `yaml:"user_object_class" env:"OC_LDAP_USER_OBJECTCLASS;GROUPS_LDAP_USER_OBJECTCLASS" desc:"The object class to use for users in the default user search filter ('inetOrgPerson')." introductionVersion:"pre5.0"`
GroupObjectClass string `yaml:"group_object_class" env:"OC_LDAP_GROUP_OBJECTCLASS;GROUPS_LDAP_GROUP_OBJECTCLASS" desc:"The object class to use for groups in the default group search filter ('groupOfNames')." introductionVersion:"pre5.0"`
services/groups/pkg/config/defaults/defaultconfig.go
+2 -2
View File
@@ -53,13 +53,13 @@ func DefaultConfig() *config.Config {
BindDN: "uid=reva,ou=sysusers,o=libregraph-idm",
IDP: "https://localhost:9200",
UserSchema: config.LDAPUserSchema{
ID: "ownclouduuid",
ID: "openCloudUUID",
Mail: "mail",
DisplayName: "displayname",
Username: "uid",
},
GroupSchema: config.LDAPGroupSchema{
ID: "ownclouduuid",
ID: "openCloudUUID",
Mail: "mail",
DisplayName: "cn",
Groupname: "cn",
services/idm/ldif/base.ldif.tmpl
+4 -4
View File
@@ -19,8 +19,8 @@ ou: groups
dn: uid=admin,ou=users,o=libregraph-idm
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: ownCloudUser
objectClass: ownCloud
objectClass: openCloudUser
objectClass: openCloudObject
objectClass: person
objectClass: top
uid: admin
@@ -30,8 +30,8 @@ cn: admin
displayName: Admin
description: An admin for this OpenCloud instance.
mail: admin@example.org
ownCloudUUID: {{ .ID }}
oCExternalIdentity: $ {{ .Issuer }} $ {{ .ID }}
openCloudUUID: {{ .ID }}
openCloudExternalIdentity: $ {{ .Issuer }} $ {{ .ID }}
{{ else -}}
dn: uid={{ .Name }},ou=sysusers,o=libregraph-idm
objectClass: account
services/idm/ldif/demousers.ldif.tmpl
+36 -36
View File
@@ -1,8 +1,8 @@
dn: uid=alan,ou=users,o=libregraph-idm
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: ownCloudUser
objectClass: ownCloud
objectClass: openCloudUser
objectClass: openCloudObject
objectClass: person
objectClass: top
uid: alan
@@ -12,16 +12,16 @@ cn: alan
displayName: Alan Turing
description: An English mathematician, computer scientist, logician, cryptanalyst, philosopher and theoretical biologist. He was highly influential in the development of theoretical computer science, providing a formalisation of the concepts of algorithm and computation with the Turing machine.
mail: alan@example.org
ownCloudUserEnabled: TRUE
ownCloudUUID: b1f74ec4-dd7e-11ef-a543-03775734d0f7
oCExternalIdentity: $ {{.}} $ b1f74ec4-dd7e-11ef-a543-03775734d0f7
openCloudUserEnabled: TRUE
openCloudUUID: b1f74ec4-dd7e-11ef-a543-03775734d0f7
openCloudExternalIdentity: $ {{.}} $ b1f74ec4-dd7e-11ef-a543-03775734d0f7
userPassword:: e0FSR09OMn0kYXJnb24yaWQkdj0xOSRtPTY1NTM2LHQ9MSxwPTE2JGg1NUxqckhWVjdEdXVzTkxjbXRoa0EkMzZ3aGZSMjdyTDFOYXQxa0xTajdrVGFubTBnb3VKRGZ0ck9DTStuRHo5cw==
dn: uid=mary,ou=users,o=libregraph-idm
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: ownCloudUser
objectClass: ownCloud
objectClass: openCloudUser
objectClass: openCloudObject
objectClass: person
objectClass: top
uid: mary
@@ -31,16 +31,16 @@ cn: mary
displayName: Mary Kenneth Keller
description: Mary Kenneth Keller of the Sisters of Charity of the Blessed Virgin Mary was a pioneer in computer science.
mail: mary@example.org
ownCloudUserEnabled: TRUE
ownCloudUUID: 056fc874-dd7f-11ef-ba84-af6fca4b7289
oCExternalIdentity: $ {{.}} $ 056fc874-dd7f-11ef-ba84-af6fca4b7289
openCloudUserEnabled: TRUE
openCloudUUID: 056fc874-dd7f-11ef-ba84-af6fca4b7289
openCloudExternalIdentity: $ {{.}} $ 056fc874-dd7f-11ef-ba84-af6fca4b7289
userPassword:: e0FSR09OMn0kYXJnb24yaWQkdj0xOSRtPTY1NTM2LHQ9MSxwPTE2JGg1NUxqckhWVjdEdXVzTkxjbXRoa0EkMzZ3aGZSMjdyTDFOYXQxa0xTajdrVGFubTBnb3VKRGZ0ck9DTStuRHo5cw==
dn: uid=margaret,ou=users,o=libregraph-idm
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: ownCloudUser
objectClass: ownCloud
objectClass: openCloudUser
objectClass: openCloudObject
objectClass: person
objectClass: top
uid: margaret
@@ -50,16 +50,16 @@ cn: margaret
displayName: Margaret Hamilton
description: A director of the Software Engineering Division of the MIT Instrumentation Laboratory, which developed on-board flight software for NASA's Apollo program.
mail: margaret@example.org
ownCloudUserEnabled: TRUE
ownCloudUUID: 801abee4-dd7f-11ef-a324-83f55a754b62
oCExternalIdentity: $ {{.}} $ 801abee4-dd7f-11ef-a324-83f55a754b62
openCloudUserEnabled: TRUE
openCloudUUID: 801abee4-dd7f-11ef-a324-83f55a754b62
openCloudExternalIdentity: $ {{.}} $ 801abee4-dd7f-11ef-a324-83f55a754b62
userPassword:: e0FSR09OMn0kYXJnb24yaWQkdj0xOSRtPTY1NTM2LHQ9MSxwPTE2JGg1NUxqckhWVjdEdXVzTkxjbXRoa0EkMzZ3aGZSMjdyTDFOYXQxa0xTajdrVGFubTBnb3VKRGZ0ck9DTStuRHo5cw==
dn: uid=dennis,ou=users,o=libregraph-idm
objectClass: inetOrgPerson
objectClass: organizationalPerson
objectClass: ownCloudUser
objectClass: ownCloud
objectClass: openCloudUser
objectClass: openCloudObject
objectClass: person
objectClass: top
uid: dennis
@@ -69,18 +69,18 @@ cn: dennis
displayName: Dennis Ritchie
description: American computer scientist. He created the C programming language and the Unix operating system and B language with long-time colleague Ken Thompson.
mail: dennis@example.org
ownCloudUserEnabled: TRUE
ownCloudUUID: cd88bf9a-dd7f-11ef-a609-7f78deb2345f
oCExternalIdentity: $ {{.}} $ cd88bf9a-dd7f-11ef-a609-7f78deb2345f
openCloudUserEnabled: TRUE
openCloudUUID: cd88bf9a-dd7f-11ef-a609-7f78deb2345f
openCloudExternalIdentity: $ {{.}} $ cd88bf9a-dd7f-11ef-a609-7f78deb2345f
userPassword:: e0FSR09OMn0kYXJnb24yaWQkdj0xOSRtPTY1NTM2LHQ9MSxwPTE2JGg1NUxqckhWVjdEdXVzTkxjbXRoa0EkMzZ3aGZSMjdyTDFOYXQxa0xTajdrVGFubTBnb3VKRGZ0ck9DTStuRHo5cw==
dn: cn=users,ou=groups,o=libregraph-idm
objectClass: groupOfNames
objectClass: ownCloud
objectClass: openCloudObject
objectClass: top
cn: users
description: Users
ownCloudUUID: 509a9dcd-bb37-4f4f-a01a-19dca27d9cfa
openCloudUUID: 509a9dcd-bb37-4f4f-a01a-19dca27d9cfa
member: uid=alan,ou=users,o=libregraph-idm
member: uid=mary,ou=users,o=libregraph-idm
member: uid=margaret,ou=users,o=libregraph-idm
@@ -89,65 +89,65 @@ member: uid=admin,ou=users,o=libregraph-idm
dn: cn=chess-lovers,ou=groups,o=libregraph-idm
objectClass: groupOfNames
objectClass: ownCloud
objectClass: openCloudObject
objectClass: top
cn: sailing-lovers
description: Chess lovers
ownCloudUUID: 9d31ec04-dd80-11ef-ac47-a38ba68cc36d
openCloudUUID: 9d31ec04-dd80-11ef-ac47-a38ba68cc36d
member: uid=alan,ou=users,o=libregraph-idm
dn: cn=violin-haters,ou=groups,o=libregraph-idm
objectClass: groupOfNames
objectClass: ownCloud
objectClass: openCloudObject
objectClass: top
cn: violin-haters
description: Violin haters
ownCloudUUID: d901562a-dd80-11ef-a510-fba1ed43fb21
openCloudUUID: d901562a-dd80-11ef-a510-fba1ed43fb21
member: uid=alan,ou=users,o=libregraph-idm
dn: cn=bible-readers,ou=groups,o=libregraph-idm
objectClass: groupOfNames
objectClass: ownCloud
objectClass: openCloudObject
objectClass: top
cn: bible-readers
description: Bible readers
ownCloudUUID: 2fc6ba22-dd81-11ef-89e6-e3eff494a998
openCloudUUID: 2fc6ba22-dd81-11ef-89e6-e3eff494a998
member: uid=mary,ou=users,o=libregraph-idm
dn: cn=apollos,ou=groups,o=libregraph-idm
objectClass: groupOfNames
objectClass: ownCloud
objectClass: openCloudObject
objectClass: top
cn: apollos
description: Contributors to the Appollo mission
ownCloudUUID: 6f9bab36-dd94-11ef-a252-dbbdd20299dd
openCloudUUID: 6f9bab36-dd94-11ef-a252-dbbdd20299dd
member: uid=margaret,ou=users,o=libregraph-idm
dn: cn=unix-lovers,ou=groups,o=libregraph-idm
objectClass: groupOfNames
objectClass: ownCloud
objectClass: openCloudObject
objectClass: top
cn: unix-lovers
description: Unix lovers
ownCloudUUID: 75bc3882-dd94-11ef-ad60-335f3df6cef3
openCloudUUID: 75bc3882-dd94-11ef-ad60-335f3df6cef3
member: uid=dennis,ou=users,o=libregraph-idm
dn: cn=basic-haters,ou=groups,o=libregraph-idm
objectClass: groupOfNames
objectClass: ownCloud
objectClass: openCloudObject
objectClass: top
cn: basic-haters
description: Haters of the Basic programming language
ownCloudUUID: a4eb2c12-dd94-11ef-9ebe-eb96f938d517
openCloudUUID: a4eb2c12-dd94-11ef-9ebe-eb96f938d517
member: uid=dennis,ou=users,o=libregraph-idm
dn: cn=programmers,ou=groups,o=libregraph-idm
objectClass: groupOfNames
objectClass: ownCloud
objectClass: openCloudObject
objectClass: top
cn: programmers
description: Computer Programmer
ownCloudUUID: ce4aa240-dd94-11ef-82b8-4f4828849072
openCloudUUID: ce4aa240-dd94-11ef-82b8-4f4828849072
member: uid=alan,ou=users,o=libregraph-idm
member: uid=margaret,ou=users,o=libregraph-idm
member: uid=dennis,ou=users,o=libregraph-idm
services/idp/pkg/backends/cs3/identifier/cs3.go
-1
View File
@@ -210,7 +210,6 @@ func (b *CS3Backend) DestroySession(_ context.Context, sessionRef *string) error
// for the user specified by the userID.
func (b *CS3Backend) UserClaims(_ string, _ map[string]bool) map[string]interface{} {
return nil
// TODO should we return the "ownclouduuid" as a claim? there is also "LibgreGraph.UUID" / lico.ScopeUniqueUserID
}
// ScopesSupported implements the Backend interface, providing supported scopes
services/idp/pkg/config/config.go
+1 -1
View File
@@ -49,7 +49,7 @@ type Ldap struct {
UUIDAttributeType string `yaml:"uuid_attribute_type" env:"IDP_LDAP_UUID_ATTRIBUTE_TYPE" desc:"LDAP User uuid attribute type like 'text'." introductionVersion:"pre5.0"`
UserEnabledAttribute string `yaml:"user_enabled_attribute" env:"OC_LDAP_USER_ENABLED_ATTRIBUTE;IDP_USER_ENABLED_ATTRIBUTE" desc:"LDAP Attribute to use as a flag telling if the user is enabled or disabled." introductionVersion:"pre5.0"`
Filter string `yaml:"filter" env:"OC_LDAP_USER_FILTER;IDP_LDAP_FILTER" desc:"LDAP filter to add to the default filters for user search like '(objectclass=ownCloud)'." introductionVersion:"pre5.0"`
Filter string `yaml:"filter" env:"OC_LDAP_USER_FILTER;IDP_LDAP_FILTER" desc:"LDAP filter to add to the default filters for user search like '(objectclass=openCloudUser)'." introductionVersion:"pre5.0"`
ObjectClass string `yaml:"objectclass" env:"OC_LDAP_USER_OBJECTCLASS;IDP_LDAP_OBJECTCLASS" desc:"LDAP User ObjectClass like 'inetOrgPerson'." introductionVersion:"pre5.0"`
}
services/idp/pkg/config/defaults/defaultconfig.go
+2 -2
View File
@@ -120,11 +120,11 @@ func DefaultConfig() *config.Config {
LoginAttribute: "uid",
EmailAttribute: "mail",
NameAttribute: "displayName",
UUIDAttribute: "ownCloudUUID",
UUIDAttribute: "openCloudUUID",
UUIDAttributeType: "text",
Filter: "",
ObjectClass: "inetOrgPerson",
UserEnabledAttribute: "ownCloudUserEnabled",
UserEnabledAttribute: "openCloudUserEnabled",
},
}
}
services/invitations/md-sources/example-realm.json
+83 -82
View File
@@ -833,39 +833,6 @@
}
],
"clientScopes": [
{
"id": "c2db58e8-ea51-4151-83dd-c862c6d28ee3",
"name": "opencloud",
"description": "OpenCloud UUID",
"protocol": "openid-connect",
"attributes": {
"include.in.token.scope": "true",
"display.on.consent.screen": "true",
"gui.order": "",
"consent.screen.text": ""
},
"protocolMappers": [
{
"id": "596f067b-ae2f-4771-96c5-d0c3942b04da",
"name": "opencloud-uuid",
"protocol": "openid-connect",
"protocolMapper": "oidc-usermodel-attribute-mapper",
"consentRequired": false,
"config": {
"aggregate.attrs": "false",
"introspection.token.claim": "true",
"multivalued": "false",
"userinfo.token.claim": "true",
"user.attribute": "LDAP_ID",
"lightweight.claim": "false",
"id.token.claim": "true",
"access.token.claim": "true",
"claim.name": "opencloud\\.user\\.uuid",
"jsonType.label": "String"
}
}
]
},
{
"id": "b71c1814-9e82-4215-8a96-88c4a11033c7",
"name": "role_list",
@@ -933,6 +900,39 @@
}
]
},
{
"id": "c2db58e8-ea51-4151-83dd-c862c6d28ee3",
"name": "opencloud",
"description": "OpenCloud UUID",
"protocol": "openid-connect",
"attributes": {
"include.in.token.scope": "true",
"display.on.consent.screen": "true",
"gui.order": "",
"consent.screen.text": ""
},
"protocolMappers": [
{
"id": "596f067b-ae2f-4771-96c5-d0c3942b04da",
"name": "opencloud-uuid",
"protocol": "openid-connect",
"protocolMapper": "oidc-usermodel-attribute-mapper",
"consentRequired": false,
"config": {
"aggregate.attrs": "false",
"introspection.token.claim": "true",
"multivalued": "false",
"userinfo.token.claim": "true",
"user.attribute": "LDAP_ID",
"id.token.claim": "true",
"lightweight.claim": "false",
"access.token.claim": "true",
"claim.name": "opencloud\\.user\\.uuid",
"jsonType.label": "String"
}
}
]
},
{
"id": "8fa166b9-603d-411a-b155-3cda24c6f396",
"name": "address",
@@ -1003,8 +1003,9 @@
"consentRequired": false,
"config": {
"user.session.note": "AUTH_TIME",
"id.token.claim": "true",
"introspection.token.claim": "true",
"userinfo.token.claim": "true",
"id.token.claim": "true",
"access.token.claim": "true",
"claim.name": "auth_time",
"jsonType.label": "long"
@@ -1575,14 +1576,14 @@
"subComponents": {},
"config": {
"allowed-protocol-mapper-types": [
"oidc-address-mapper",
"saml-user-attribute-mapper",
"oidc-usermodel-attribute-mapper",
"oidc-full-name-mapper",
"oidc-sha256-pairwise-sub-mapper",
"saml-role-list-mapper",
"saml-user-property-mapper",
"oidc-usermodel-property-mapper",
"oidc-usermodel-attribute-mapper"
"oidc-address-mapper",
"saml-user-attribute-mapper",
"saml-user-property-mapper"
]
}
},
@@ -1594,14 +1595,14 @@
"subComponents": {},
"config": {
"allowed-protocol-mapper-types": [
"oidc-address-mapper",
"saml-user-property-mapper",
"oidc-full-name-mapper",
"oidc-sha256-pairwise-sub-mapper",
"saml-role-list-mapper",
"saml-user-attribute-mapper",
"oidc-usermodel-attribute-mapper",
"oidc-full-name-mapper",
"oidc-address-mapper",
"oidc-usermodel-property-mapper",
"saml-user-attribute-mapper"
"saml-user-property-mapper"
]
}
},
@@ -1687,17 +1688,20 @@
"group.name.ldap.attribute": [
"cn"
],
"ignore.missing.groups": [
"false"
"membership.ldap.attribute": [
"member"
],
"membership.user.ldap.attribute": [
"uid"
],
"ignore.missing.groups": [
"false"
],
"preserve.group.inheritance": [
"false"
],
"membership.ldap.attribute": [
"member"
"groups.dn": [
"ou=groups,dc=example,dc=org"
],
"group.object.classes": [
"groupOfNames"
@@ -1705,14 +1709,11 @@
"memberof.ldap.attribute": [
"memberOf"
],
"groups.dn": [
"ou=groups,dc=opencloud,dc=eu"
"drop.non.existing.groups.during.sync": [
"false"
],
"groups.path": [
"/"
],
"drop.non.existing.groups.during.sync": [
"false"
]
}
},
@@ -1728,10 +1729,10 @@
"is.mandatory.in.ldap": [
"true"
],
"always.read.value.from.ldap": [
"read.only": [
"false"
],
"read.only": [
"always.read.value.from.ldap": [
"false"
],
"user.model.attribute": [
@@ -1769,7 +1770,7 @@
"subComponents": {},
"config": {
"ldap.attribute": [
"ownCloudUserType"
"openCloudUserType"
],
"attribute.default.value": [
"Guest"
@@ -1806,10 +1807,10 @@
"is.mandatory.in.ldap": [
"false"
],
"always.read.value.from.ldap": [
"read.only": [
"false"
],
"read.only": [
"always.read.value.from.ldap": [
"false"
],
"user.model.attribute": [
@@ -1875,12 +1876,12 @@
"is.mandatory.in.ldap": [
"true"
],
"always.read.value.from.ldap": [
"true"
],
"read.only": [
"false"
],
"always.read.value.from.ldap": [
"true"
],
"user.model.attribute": [
"lastName"
]
@@ -1893,14 +1894,14 @@
"subComponents": {},
"config": {
"ldap.attribute": [
"ownCloudUUID"
],
"attribute.force.default": [
"false"
"openCloudUUID"
],
"is.mandatory.in.ldap": [
"true"
],
"attribute.force.default": [
"false"
],
"is.binary.attribute": [
"false"
],
@@ -1918,47 +1919,47 @@
]
},
"config": {
"fullSyncPeriod": [
"299"
],
"pagination": [
"false"
],
"fullSyncPeriod": [
"299"
],
"startTls": [
"false"
],
"usersDn": [
"ou=users,dc=opencloud,dc=eu"
],
"connectionPooling": [
"false"
],
"usersDn": [
"ou=users,dc=example,dc=org"
],
"cachePolicy": [
"EVICT_DAILY"
],
"useKerberosForPasswordAuthentication": [
"false"
],
"evictionHour": [
"0"
],
"useKerberosForPasswordAuthentication": [
"false"
],
"importEnabled": [
"true"
],
"enabled": [
"true"
],
"bindCredential": [
"**********"
"usernameLDAPAttribute": [
"uid"
],
"changedSyncPeriod": [
"-1"
],
"bindDn": [
"cn=admin,dc=opencloud,dc=eu"
"bindCredential": [
"**********"
],
"usernameLDAPAttribute": [
"uid"
"bindDn": [
"cn=admin,dc=example,dc=org"
],
"lastSync": [
"1679575179"
@@ -1967,7 +1968,7 @@
"other"
],
"uuidLDAPAttribute": [
"ownCloudUUID"
"openCloudUUID"
],
"allowKerberosAuthentication": [
"false"
@@ -1982,7 +1983,7 @@
"simple"
],
"searchScope": [
"1"
"2"
],
"useTruststoreSpi": [
"always"
@@ -1994,7 +1995,7 @@
"true"
],
"userObjectClasses": [
"inetOrgPerson, organizationalPerson, ownCloudUser"
"inetOrgPerson, organizationalPerson, openCloudUser"
],
"evictionMinute": [
"0"
@@ -2733,4 +2734,4 @@
"clientPolicies": {
"policies": []
}
}
}
services/proxy/pkg/middleware/authentication_test.go
+1 -1
View File
@@ -146,7 +146,7 @@ var _ = Describe("Authenticating requests", Label("Authentication"), func() {
testHandler := handler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
Expect(oidc.FromContext(r.Context())).To(Equal(map[string]interface{}{
"email": "testuser@example.com",
"ownclouduuid": "OpaqueId",
"openclouduuid": "OpaqueId",
"iss": "IdpId",
"preferred_username": "testuser",
}))
services/proxy/pkg/middleware/basic_auth.go
+1 -1
View File
@@ -45,7 +45,7 @@ func (m BasicAuthenticator) Authenticate(r *http.Request) (*http.Request, bool)
oidc.Iss: user.Id.Idp,
oidc.PreferredUsername: user.Username,
oidc.Email: user.Mail,
oidc.OwncloudUUID: user.Id.OpaqueId,
oidc.OpenCloudUUID: user.Id.OpaqueId,
}
if m.UserCS3Claim == "userid" {
services/proxy/pkg/middleware/basic_auth_test.go
+1 -1
View File
@@ -61,7 +61,7 @@ var _ = Describe("Authenticating requests", Label("BasicAuthenticator"), func()
Expect(claims[oidc.Iss]).To(Equal("IdpId"))
Expect(claims[oidc.PreferredUsername]).To(Equal("testuser"))
Expect(claims[oidc.Email]).To(Equal("testuser@example.com"))
Expect(claims[oidc.OwncloudUUID]).To(Equal("OpaqueId"))
Expect(claims[oidc.OpenCloudUUID]).To(Equal("OpaqueId"))
})
})
})
services/users/pkg/config/config.go
+2 -2
View File
@@ -72,13 +72,13 @@ type LDAPDriver struct {
UserScope string `yaml:"user_scope" env:"OC_LDAP_USER_SCOPE;USERS_LDAP_USER_SCOPE" desc:"LDAP search scope to use when looking up users. Supported values are 'base', 'one' and 'sub'." introductionVersion:"pre5.0"`
GroupScope string `yaml:"group_scope" env:"OC_LDAP_GROUP_SCOPE;USERS_LDAP_GROUP_SCOPE" desc:"LDAP search scope to use when looking up groups. Supported values are 'base', 'one' and 'sub'." introductionVersion:"pre5.0"`
UserSubstringFilterType string `yaml:"user_substring_filter_type" env:"LDAP_USER_SUBSTRING_FILTER_TYPE;USERS_LDAP_USER_SUBSTRING_FILTER_TYPE" desc:"Type of substring search filter to use for substring searches for users. Possible values: 'initial' for doing prefix only searches, 'final' for doing suffix only searches or 'any' for doing full substring searches" introductionVersion:"pre5.0"`
UserFilter string `yaml:"user_filter" env:"OC_LDAP_USER_FILTER;USERS_LDAP_USER_FILTER" desc:"LDAP filter to add to the default filters for user search like '(objectclass=ownCloud)'." introductionVersion:"pre5.0"`
UserFilter string `yaml:"user_filter" env:"OC_LDAP_USER_FILTER;USERS_LDAP_USER_FILTER" desc:"LDAP filter to add to the default filters for user search like '(objectclass=openCloudUser)'." introductionVersion:"pre5.0"`
GroupFilter string `yaml:"group_filter" env:"OC_LDAP_GROUP_FILTER;USERS_LDAP_GROUP_FILTER" desc:"LDAP filter to add to the default filters for group searches." introductionVersion:"pre5.0"`
UserObjectClass string `yaml:"user_object_class" env:"OC_LDAP_USER_OBJECTCLASS;USERS_LDAP_USER_OBJECTCLASS" desc:"The object class to use for users in the default user search filter like 'inetOrgPerson'." introductionVersion:"pre5.0"`
GroupObjectClass string `yaml:"group_object_class" env:"OC_LDAP_GROUP_OBJECTCLASS;USERS_LDAP_GROUP_OBJECTCLASS" desc:"The object class to use for groups in the default group search filter like 'groupOfNames'." introductionVersion:"pre5.0"`
IDP string `yaml:"idp" env:"OC_URL;OC_OIDC_ISSUER;USERS_IDP_URL" desc:"The identity provider value to set in the userids of the CS3 user objects for users returned by this user provider." introductionVersion:"pre5.0"`
DisableUserMechanism string `yaml:"disable_user_mechanism" env:"OC_LDAP_DISABLE_USER_MECHANISM;USERS_LDAP_DISABLE_USER_MECHANISM" desc:"An option to control the behavior for disabling users. Valid options are 'none', 'attribute' and 'group'. If set to 'group', disabling a user via API will add the user to the configured group for disabled users, if set to 'attribute' this will be done in the ldap user entry, if set to 'none' the disable request is not processed." introductionVersion:"pre5.0"`
UserTypeAttribute string `yaml:"user_type_attribute" env:"OC_LDAP_USER_SCHEMA_USER_TYPE;USERS_LDAP_USER_TYPE_ATTRIBUTE" desc:"LDAP Attribute to distinguish between 'Member' and 'Guest' users. Default is 'ownCloudUserType'." introductionVersion:"pre5.0"`
UserTypeAttribute string `yaml:"user_type_attribute" env:"OC_LDAP_USER_SCHEMA_USER_TYPE;USERS_LDAP_USER_TYPE_ATTRIBUTE" desc:"LDAP Attribute to distinguish between 'Member' and 'Guest' users. Default is 'openCloudUserType'." introductionVersion:"pre5.0"`
LdapDisabledUsersGroupDN string `yaml:"ldap_disabled_users_group_dn" env:"OC_LDAP_DISABLED_USERS_GROUP_DN;USERS_LDAP_DISABLED_USERS_GROUP_DN" desc:"The distinguished name of the group to which added users will be classified as disabled when 'disable_user_mechanism' is set to 'group'." introductionVersion:"pre5.0"`
UserSchema LDAPUserSchema `yaml:"user_schema"`
GroupSchema LDAPGroupSchema `yaml:"group_schema"`
services/users/pkg/config/defaults/defaultconfig.go
+4 -4
View File
@@ -53,17 +53,17 @@ func DefaultConfig() *config.Config {
BindDN: "uid=reva,ou=sysusers,o=libregraph-idm",
DisableUserMechanism: "attribute",
LdapDisabledUsersGroupDN: "cn=DisabledUsersGroup,ou=groups,o=libregraph-idm",
UserTypeAttribute: "ownCloudUserType",
UserTypeAttribute: "openCloudUserType",
IDP: "https://localhost:9200",
UserSchema: config.LDAPUserSchema{
ID: "ownclouduuid",
ID: "openclouduuid",
Mail: "mail",
DisplayName: "displayname",
Username: "uid",
Enabled: "ownCloudUserEnabled",
Enabled: "openclouduserenabled",
},
GroupSchema: config.LDAPGroupSchema{
ID: "ownclouduuid",
ID: "openclouduuid",
Mail: "mail",
DisplayName: "cn",
Groupname: "cn",
tests/acceptance/TestHelpers/OcHelper.php
+2 -2
View File
@@ -206,7 +206,7 @@ class OcHelper {
*/
public static function getBaseDN(): string {
$dn = \getenv("REVA_LDAP_BASE_DN");
return $dn ?: "dc=owncloud,dc=com";
return $dn ?: "dc=example,dc=org";
}
/**
@@ -245,7 +245,7 @@ class OcHelper {
*/
public static function getBindDN(): string {
$dn = \getenv("REVA_LDAP_BIND_DN");
return $dn ?: "cn=admin,dc=owncloud,dc=com";
return $dn ?: "cn=admin,dc=example,dc=org";
}
/**
tests/acceptance/bootstrap/Provisioning.php
+4 -4
View File
@@ -445,8 +445,8 @@ trait Provisioning {
$entry['uidNumber'] = $uidNumber;
if (!OcHelper::isTestingOnReva()) {
$entry['objectclass'][] = 'ownCloud';
$entry['ownCloudUUID'] = WebDavHelper::generateUUIDv4();
$entry['objectclass'][] = 'openCloudObject';
$entry['openCloudUUID'] = WebDavHelper::generateUUIDv4();
}
try {
@@ -490,8 +490,8 @@ trait Provisioning {
$entry['member'] = "";
}
if (!OcHelper::isTestingOnReva()) {
$entry['objectclass'][] = 'ownCloud';
$entry['ownCloudUUID'] = WebDavHelper::generateUUIDv4();
$entry['objectclass'][] = 'openCloudObject';
$entry['openCloudUUID'] = WebDavHelper::generateUUIDv4();
}
try {
tests/acceptance/config/ldap-users.ldif
+3 -3
View File
@@ -1,9 +1,9 @@
dn: ou=TestUsers,dc=owncloud,dc=com
dn: ou=TestUsers,dc=example,dc=org
objectclass: top
objectclass: organizationalUnit
ou: TestUsers
dn: ou=TestGroups,dc=owncloud,dc=com
dn: ou=TestGroups,dc=example,dc=org
objectclass: top
objectclass: organizationalUnit
ou: TestGroups
ou: TestGroups