reva/frontend: Add capabilities to indicate attributes that are read-only.

services/frontend/README.md

@@ -1,6 +1,6 @@
 # Frontend
 
-The frontend service translates various owncloud related HTTP APIs to CS3 requests. 
+The frontend service translates various owncloud related HTTP APIs to CS3 requests.
 
 ## Endpoints Overview
 
@@ -25,3 +25,22 @@ The ocs endpoint, by default `/ocs`, implements the ownCloud 10 Open Collaborati
 ## Scalability
 
 While the frontend service does not persist any data it does cache `Stat()` responses and user information. Therefore, multiple instances of this service can be spawned in a bigger deployment like when using container orchestration with Kubernetes, when configuring `FRONTEND_OCS_RESOURCE_INFO_CACHE_TYPE=redis` and the related config options.
+
+## libregraph service interactions
+
+A lot of user management is done via a standardized libregraph API.
+Depending on how the system is configured there might be some attributes
+for users that an instance admin user can't change because of properties
+coming from an external LDAP server, or similar. To make life easier for
+admin users there are hints as capabilites telling which attributes are
+read-only or not. To configure these hints we have the following
+environment variables:
+
+- FRONTEND_READONLY_ATTRIBUTES_ACCOUNT_ENABLED: Default is false
+- FRONTEND_READONLY_ATTRIBUTES_DISPLAY_NAME: Default is true
+- FRONTEND_READONLY_ATTRIBUTES_GIVEN_NAME: Default is true
+- FRONTEND_READONLY_ATTRIBUTES_ID: Default is true
+- FRONTEND_READONLY_ATTRIBUTES_MAIL: Default is true
+- FRONTEND_READONLY_ATTRIBUTES_ON_PREMISES_SAM_ACCOUNT_NAME: Default is true
+- FRONTEND_READONLY_ATTRIBUTES_SURNAME: Default is true
+- FRONTEND_READONLY_ATTRIBUTES_QUOTA: Default is false