From 8b704085ce1b840571df8657347f06898e7f5516 Mon Sep 17 00:00:00 2001 From: Ralf Haferkamp Date: Wed, 15 Mar 2023 16:15:18 +0100 Subject: [PATCH] Allow ADMIN_USER_ID being empty (#5842) For certain setups we don't need the ADMIN_USER_ID to be set. It is mainly needed for bootstrapping the internal idm and the initial role assignment. If roles are assigned by other means (e.g. OIDC claims in the future) we don't need it. This makes the ADMIN_USER_ID optional, also if ADMIN_USER_ID is unset we don't need to configure a password for the admin user. We will still generated the admin_id and password when running 'ocis init', but it is ok to run manual setups without those settings. --- ocis-pkg/config/parser/parse.go | 4 ---- services/idm/pkg/command/server.go | 13 ++++++++----- services/idm/pkg/config/parser/parse.go | 4 ++-- services/settings/pkg/config/parser/parse.go | 2 +- 4 files changed, 11 insertions(+), 12 deletions(-) diff --git a/ocis-pkg/config/parser/parse.go b/ocis-pkg/config/parser/parse.go index 54c94d1e9..b853dd1c6 100644 --- a/ocis-pkg/config/parser/parse.go +++ b/ocis-pkg/config/parser/parse.go @@ -132,9 +132,5 @@ func Validate(cfg *config.Config) error { return shared.MissingSystemUserID("ocis") } - if cfg.AdminUserID == "" { - return shared.MissingAdminUserID("ocis") - } - return nil } diff --git a/services/idm/pkg/command/server.go b/services/idm/pkg/command/server.go index f8e8561dc..9982847ba 100644 --- a/services/idm/pkg/command/server.go +++ b/services/idm/pkg/command/server.go @@ -91,11 +91,6 @@ func bootstrap(logger log.Logger, cfg *config.Config, srvcfg server.Config) erro } serviceUsers := []svcUser{ - { - Name: "admin", - Password: cfg.ServiceUserPasswords.OcisAdmin, - ID: cfg.AdminUserID, - }, { Name: "libregraph", Password: cfg.ServiceUserPasswords.Idm, @@ -110,6 +105,14 @@ func bootstrap(logger log.Logger, cfg *config.Config, srvcfg server.Config) erro }, } + if cfg.AdminUserID != "" { + serviceUsers = append(serviceUsers, svcUser{ + Name: "admin", + Password: cfg.ServiceUserPasswords.OcisAdmin, + ID: cfg.AdminUserID, + }) + } + bdb := &ldbbolt.LdbBolt{} if err := bdb.Configure(srvcfg.Logger, srvcfg.LDAPBaseDN, srvcfg.BoltDBFile, nil); err != nil { diff --git a/services/idm/pkg/config/parser/parse.go b/services/idm/pkg/config/parser/parse.go index 469572560..e1446c175 100644 --- a/services/idm/pkg/config/parser/parse.go +++ b/services/idm/pkg/config/parser/parse.go @@ -33,7 +33,7 @@ func ParseConfig(cfg *config.Config) error { } func Validate(cfg *config.Config) error { - if cfg.AdminUserID == "" { + if cfg.CreateDemoUsers && cfg.AdminUserID == "" { return shared.MissingAdminUserID(cfg.Service.Name) } @@ -41,7 +41,7 @@ func Validate(cfg *config.Config) error { return shared.MissingServiceUserPassword(cfg.Service.Name, "IDM") } - if cfg.ServiceUserPasswords.OcisAdmin == "" { + if cfg.AdminUserID != "" && cfg.ServiceUserPasswords.OcisAdmin == "" { return shared.MissingServiceUserPassword(cfg.Service.Name, "admin") } diff --git a/services/settings/pkg/config/parser/parse.go b/services/settings/pkg/config/parser/parse.go index 4478629a6..02e253e27 100644 --- a/services/settings/pkg/config/parser/parse.go +++ b/services/settings/pkg/config/parser/parse.go @@ -45,7 +45,7 @@ func Validate(cfg *config.Config) error { return shared.MissingSystemUserApiKeyError(cfg.Service.Name) } - if cfg.AdminUserID == "" { + if cfg.SetupDefaultAssignments && cfg.AdminUserID == "" { return shared.MissingAdminUserID(cfg.Service.Name) }