bump reva to get TenantAPI service

vendor/github.com/opencloud-eu/reva/v2/cmd/revad/runtime/loader.go

@@ -46,6 +46,7 @@ import (
 	_ "github.com/opencloud-eu/reva/v2/pkg/share/manager/loader"
 	_ "github.com/opencloud-eu/reva/v2/pkg/storage/fs/loader"
 	_ "github.com/opencloud-eu/reva/v2/pkg/storage/registry/loader"
+	_ "github.com/opencloud-eu/reva/v2/pkg/tenant/manager/loader"
 	_ "github.com/opencloud-eu/reva/v2/pkg/token/manager/loader"
 	_ "github.com/opencloud-eu/reva/v2/pkg/user/manager/loader"
 )

vendor/github.com/opencloud-eu/reva/v2/internal/grpc/services/gateway/gateway.go

@@ -60,6 +60,7 @@ type config struct {
 	OCMCoreEndpoint               string `mapstructure:"ocmcoresvc"`
 	UserProviderEndpoint          string `mapstructure:"userprovidersvc"`
 	GroupProviderEndpoint         string `mapstructure:"groupprovidersvc"`
+	TenantProviderEndpoint        string `mapstructure:"tenantprovidersvc"`
 	DataTxEndpoint                string `mapstructure:"datatx"`
 	DataGatewayEndpoint           string `mapstructure:"datagateway"`
 	PermissionsEndpoint           string `mapstructure:"permissionssvc"`
@@ -110,6 +111,12 @@ func (c *config) init() {
 	c.OCMCoreEndpoint = sharedconf.GetGatewaySVC(c.OCMCoreEndpoint)
 	c.UserProviderEndpoint = sharedconf.GetGatewaySVC(c.UserProviderEndpoint)
 	c.GroupProviderEndpoint = sharedconf.GetGatewaySVC(c.GroupProviderEndpoint)
+	// Fall back to userprovidersvc when no dedicated tenant provider is configured.
+	if c.TenantProviderEndpoint == "" {
+		c.TenantProviderEndpoint = c.UserProviderEndpoint
+	} else {
+		c.TenantProviderEndpoint = sharedconf.GetGatewaySVC(c.TenantProviderEndpoint)
+	}
 	c.DataTxEndpoint = sharedconf.GetGatewaySVC(c.DataTxEndpoint)
 
 	c.DataGatewayEndpoint = sharedconf.GetDataGateway(c.DataGatewayEndpoint)

vendor/github.com/opencloud-eu/reva/v2/internal/grpc/services/gateway/tenantprovider.go

@@ -0,0 +1,61 @@
+// Copyright 2018-2021 CERN
+// Copyright 2026 OpenCloud GmbH
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// In applying this license, CERN does not waive the privileges and immunities
+// granted to it by virtue of its status as an Intergovernmental Organization
+// or submit itself to any jurisdiction.
+
+package gateway
+
+import (
+	"context"
+
+	tenant "github.com/cs3org/go-cs3apis/cs3/identity/tenant/v1beta1"
+	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/status"
+	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool"
+	"github.com/pkg/errors"
+)
+
+func (s *svc) GetTenant(ctx context.Context, req *tenant.GetTenantRequest) (*tenant.GetTenantResponse, error) {
+	c, err := pool.GetTenantProviderServiceClient(s.c.TenantProviderEndpoint)
+	if err != nil {
+		return &tenant.GetTenantResponse{
+			Status: status.NewInternal(ctx, "error getting tenant service client"),
+		}, nil
+	}
+
+	res, err := c.GetTenant(ctx, req)
+	if err != nil {
+		return nil, errors.Wrap(err, "gateway: error calling GetTenant")
+	}
+
+	return res, nil
+}
+
+func (s *svc) GetTenantByClaim(ctx context.Context, req *tenant.GetTenantByClaimRequest) (*tenant.GetTenantByClaimResponse, error) {
+	c, err := pool.GetTenantProviderServiceClient(s.c.TenantProviderEndpoint)
+	if err != nil {
+		return &tenant.GetTenantByClaimResponse{
+			Status: status.NewInternal(ctx, "error getting tenant service client"),
+		}, nil
+	}
+
+	res, err := c.GetTenantByClaim(ctx, req)
+	if err != nil {
+		return nil, errors.Wrap(err, "gateway: error calling GetTenantByClaim")
+	}
+
+	return res, nil
+}

vendor/github.com/opencloud-eu/reva/v2/internal/grpc/services/userprovider/userprovider.go

@@ -29,6 +29,7 @@ import (
 	"github.com/rs/zerolog"
 	"google.golang.org/grpc"
 
+	tenantpb "github.com/cs3org/go-cs3apis/cs3/identity/tenant/v1beta1"
 	userpb "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1"
 	"github.com/opencloud-eu/reva/v2/pkg/appctx"
 	revactx "github.com/opencloud-eu/reva/v2/pkg/ctx"
@@ -36,8 +37,11 @@ import (
 	"github.com/opencloud-eu/reva/v2/pkg/plugin"
 	"github.com/opencloud-eu/reva/v2/pkg/rgrpc"
 	"github.com/opencloud-eu/reva/v2/pkg/rgrpc/status"
+	"github.com/opencloud-eu/reva/v2/pkg/sharedconf"
+	"github.com/opencloud-eu/reva/v2/pkg/tenant"
+	tenantRegistry "github.com/opencloud-eu/reva/v2/pkg/tenant/manager/registry"
 	"github.com/opencloud-eu/reva/v2/pkg/user"
-	"github.com/opencloud-eu/reva/v2/pkg/user/manager/registry"
+	userRegistry "github.com/opencloud-eu/reva/v2/pkg/user/manager/registry"
 )
 
 func init() {
@@ -45,14 +49,29 @@ func init() {
 }
 
 type config struct {
-	Driver  string                            `mapstructure:"driver"`
-	Drivers map[string]map[string]interface{} `mapstructure:"drivers"`
+	Driver        string                            `mapstructure:"driver"`
+	Drivers       map[string]map[string]interface{} `mapstructure:"drivers"`
+	TenantDriver  string                            `mapstructure:"tenant_driver"`
+	TenantDrivers map[string]map[string]interface{} `mapstructure:"tenant_drivers"`
 }
 
 func (c *config) init() {
 	if c.Driver == "" {
 		c.Driver = "json"
 	}
+
+	// Fall back to user driver/drivers when no tenant-specific config is provided.
+	if c.TenantDriver == "" {
+		c.TenantDriver = c.Driver
+	}
+	if c.TenantDrivers == nil {
+		c.TenantDrivers = c.Drivers
+	}
+
+	// Force "null" driver if multi-tenancy is disabled
+	if !sharedconf.MultiTenantEnabled() {
+		c.TenantDriver = "null"
+	}
 }
 
 func parseConfig(m map[string]interface{}) (*config, error) {
@@ -80,7 +99,7 @@ func getDriver(c *config) (user.Manager, *plugin.RevaPlugin, error) {
 		return manager, p, nil
 	} else if _, ok := err.(errtypes.NotFound); ok {
 		// plugin not found, fetch the driver from the in-memory registry
-		if f, ok := registry.NewFuncs[c.Driver]; ok {
+		if f, ok := userRegistry.NewFuncs[c.Driver]; ok {
 			mgr, err := f(c.Drivers[c.Driver])
 			return mgr, nil, err
 		}
@@ -90,6 +109,14 @@ func getDriver(c *config) (user.Manager, *plugin.RevaPlugin, error) {
 	return nil, nil, errtypes.NotFound(fmt.Sprintf("driver %s not found for user manager", c.Driver))
 }
 
+func getTenantManager(c *config) (tenant.Manager, error) {
+	if f, ok := tenantRegistry.NewFuncs[c.TenantDriver]; ok {
+		mgr, err := f(c.TenantDrivers[c.TenantDriver])
+		return mgr, err
+	}
+	return nil, errtypes.NotFound(fmt.Sprintf("driver %s not found for tenant manager", c.TenantDriver))
+}
+
 // New returns a new UserProviderServiceServer.
 func New(m map[string]interface{}, ss *grpc.Server, _ *zerolog.Logger) (rgrpc.Service, error) {
 	c, err := parseConfig(m)
@@ -100,17 +127,27 @@ func New(m map[string]interface{}, ss *grpc.Server, _ *zerolog.Logger) (rgrpc.Se
 	if err != nil {
 		return nil, err
 	}
-	svc := &service{
-		usermgr: userManager,
-		plugin:  plug,
+	tenantManager, err := getTenantManager(c)
+	if err != nil {
+		return nil, err
 	}
 
-	return svc, nil
+	return NewWithManagers(userManager, tenantManager, plug), nil
+}
+
+// NewWithManagers returns a new UserProviderService with the given managers.
+func NewWithManagers(um user.Manager, tm tenant.Manager, plug *plugin.RevaPlugin) rgrpc.Service {
+	return &service{
+		usermgr:   um,
+		tenantmgr: tm,
+		plugin:    plug,
+	}
 }
 
 type service struct {
-	usermgr user.Manager
-	plugin  *plugin.RevaPlugin
+	usermgr   user.Manager
+	tenantmgr tenant.Manager
+	plugin    *plugin.RevaPlugin
 }
 
 func (s *service) Close() error {
@@ -126,6 +163,7 @@ func (s *service) UnprotectedEndpoints() []string {
 
 func (s *service) Register(ss *grpc.Server) {
 	userpb.RegisterUserAPIServer(ss, s)
+	tenantpb.RegisterTenantAPIServer(ss, s)
 }
 
 func (s *service) GetUser(ctx context.Context, req *userpb.GetUserRequest) (*userpb.GetUserResponse, error) {
@@ -232,3 +270,41 @@ func (s *service) GetUserGroups(ctx context.Context, req *userpb.GetUserGroupsRe
 	}
 	return res, nil
 }
+
+func (s *service) GetTenant(ctx context.Context, req *tenantpb.GetTenantRequest) (*tenantpb.GetTenantResponse, error) {
+	log := appctx.GetLogger(ctx)
+	t, err := s.tenantmgr.GetTenant(ctx, req.GetTenantId())
+	if err != nil {
+		log.Warn().Err(err).Interface("tenantid", req.GetTenantId()).Msg("error getting tenant")
+		res := &tenantpb.GetTenantResponse{
+			Status: status.NewInternal(ctx, "error getting tenant"),
+		}
+		if _, ok := err.(errtypes.NotFound); ok {
+			res.Status = status.NewNotFound(ctx, "tenant not found")
+		}
+		return res, nil
+	}
+	return &tenantpb.GetTenantResponse{
+		Status: status.NewOK(ctx),
+		Tenant: t,
+	}, nil
+}
+
+func (s *service) GetTenantByClaim(ctx context.Context, req *tenantpb.GetTenantByClaimRequest) (*tenantpb.GetTenantByClaimResponse, error) {
+	log := appctx.GetLogger(ctx)
+	t, err := s.tenantmgr.GetTenantByClaim(ctx, req.GetClaim(), req.GetValue())
+	if err != nil {
+		log.Warn().Err(err).Interface("claim", req.GetClaim()).Interface("value", req.GetValue()).Msg("error getting tenant")
+		res := &tenantpb.GetTenantByClaimResponse{
+			Status: status.NewInternal(ctx, "error getting tenant"),
+		}
+		if _, ok := err.(errtypes.NotFound); ok {
+			res.Status = status.NewNotFound(ctx, "tenant not found")
+		}
+		return res, nil
+	}
+	return &tenantpb.GetTenantByClaimResponse{
+		Status: status.NewOK(ctx),
+		Tenant: t,
+	}, nil
+}

vendor/github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool/client.go

@@ -26,6 +26,7 @@ import (
 	authregistry "github.com/cs3org/go-cs3apis/cs3/auth/registry/v1beta1"
 	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
 	group "github.com/cs3org/go-cs3apis/cs3/identity/group/v1beta1"
+	tenant "github.com/cs3org/go-cs3apis/cs3/identity/tenant/v1beta1"
 	user "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1"
 	ocmcore "github.com/cs3org/go-cs3apis/cs3/ocm/core/v1beta1"
 	invitepb "github.com/cs3org/go-cs3apis/cs3/ocm/invite/v1beta1"
@@ -52,6 +53,12 @@ func GetUserProviderServiceClient(id string, opts ...Option) (user.UserAPIClient
 	return selector.Next()
 }
 
+// GetTenantProviderServiceClient returns a TenantProviderServiceClient.
+func GetTenantProviderServiceClient(id string, opts ...Option) (tenant.TenantAPIClient, error) {
+	selector, _ := IdentityTenantSelector(id, opts...)
+	return selector.Next()
+}
+
 // GetGroupProviderServiceClient returns a GroupProviderServiceClient.
 func GetGroupProviderServiceClient(id string, opts ...Option) (group.GroupAPIClient, error) {
 	selector, _ := IdentityGroupSelector(id, opts...)

vendor/github.com/opencloud-eu/reva/v2/pkg/rgrpc/todo/pool/selector.go

@@ -30,6 +30,7 @@ import (
 	authRegistry "github.com/cs3org/go-cs3apis/cs3/auth/registry/v1beta1"
 	gateway "github.com/cs3org/go-cs3apis/cs3/gateway/v1beta1"
 	identityGroup "github.com/cs3org/go-cs3apis/cs3/identity/group/v1beta1"
+	identityTenant "github.com/cs3org/go-cs3apis/cs3/identity/tenant/v1beta1"
 	identityUser "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1"
 	ocmCore "github.com/cs3org/go-cs3apis/cs3/ocm/core/v1beta1"
 	ocmInvite "github.com/cs3org/go-cs3apis/cs3/ocm/invite/v1beta1"
@@ -174,6 +175,16 @@ func IdentityGroupSelector(id string, options ...Option) (*Selector[identityGrou
 	), nil
 }
 
+// IdentityTentantSelector returns a Selector[identityTenant.TenantAPIClient].
+func IdentityTenantSelector(id string, options ...Option) (*Selector[identityTenant.TenantAPIClient], error) {
+	return GetSelector[identityTenant.TenantAPIClient](
+		"IdentityTenantSelector",
+		id,
+		identityTenant.NewTenantAPIClient,
+		options...,
+	), nil
+}
+
 // StorageProviderSelector returns a Selector[storageProvider.ProviderAPIClient].
 func StorageProviderSelector(id string, options ...Option) (*Selector[storageProvider.ProviderAPIClient], error) {
 	return GetSelector[storageProvider.ProviderAPIClient](

vendor/github.com/opencloud-eu/reva/v2/pkg/tenant/manager/ldap/ldap.go

@@ -0,0 +1,121 @@
+// Copyright 2018-2021 CERN
+// Copyright 2026 OpenCloud GmbH
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// In applying this license, CERN does not waive the privileges and immunities
+// granted to it by virtue of its status as an Intergovernmental Organization
+// or submit itself to any jurisdiction.
+
+package ldap
+
+import (
+	"context"
+	"fmt"
+
+	tenantpb "github.com/cs3org/go-cs3apis/cs3/identity/tenant/v1beta1"
+	"github.com/go-ldap/ldap/v3"
+	"github.com/mitchellh/mapstructure"
+	"github.com/opencloud-eu/reva/v2/pkg/appctx"
+	"github.com/opencloud-eu/reva/v2/pkg/tenant"
+	"github.com/opencloud-eu/reva/v2/pkg/tenant/manager/registry"
+	"github.com/opencloud-eu/reva/v2/pkg/utils"
+	ldapIdentity "github.com/opencloud-eu/reva/v2/pkg/utils/ldap"
+	"github.com/pkg/errors"
+)
+
+func init() {
+	registry.Register("ldap", New)
+}
+
+type config struct {
+	utils.LDAPConn `mapstructure:",squash"`
+	LDAPIdentity   ldapIdentity.Identity `mapstructure:",squash"`
+}
+
+func parseConfig(m map[string]interface{}) (*config, error) {
+	c := &config{
+		LDAPIdentity: ldapIdentity.New(),
+	}
+	if err := mapstructure.Decode(m, c); err != nil {
+		err = errors.Wrap(err, "error decoding conf")
+		return nil, err
+	}
+	return c, nil
+}
+
+type manager struct {
+	conf *config
+	ldap ldap.Client
+}
+
+// New returns a new user manager.
+func New(m map[string]interface{}) (tenant.Manager, error) {
+	mgr := &manager{}
+	err := mgr.Configure(m)
+	if err != nil {
+		return nil, err
+	}
+
+	mgr.ldap, err = utils.GetLDAPClientWithReconnect(&mgr.conf.LDAPConn)
+
+	return mgr, err
+}
+
+func (m *manager) Configure(ml map[string]interface{}) error {
+	c, err := parseConfig(ml)
+	if err != nil {
+		return err
+	}
+	if err = c.LDAPIdentity.Setup(); err != nil {
+		return fmt.Errorf("error setting up Identity config: %w", err)
+	}
+	m.conf = c
+
+	return nil
+}
+
+func (m *manager) GetTenant(ctx context.Context, id string) (*tenantpb.Tenant, error) {
+	log := appctx.GetLogger(ctx)
+
+	tenantEntry, err := m.conf.LDAPIdentity.GetLDAPTenantByID(ctx, m.ldap, id)
+	if err != nil {
+		return nil, err
+	}
+
+	log.Debug().Interface("entry", tenantEntry).Msg("entries")
+
+	t, err := m.ldapEntryToTenant(tenantEntry)
+	if err != nil {
+		return nil, err
+	}
+
+	return t, nil
+}
+
+func (m *manager) GetTenantByClaim(ctx context.Context, claim, value string) (*tenantpb.Tenant, error) {
+	tenantEntry, err := m.conf.LDAPIdentity.GetLDAPTenantByAttribute(ctx, m.ldap, claim, value)
+	if err != nil {
+		return nil, err
+	}
+	return m.ldapEntryToTenant(tenantEntry)
+}
+
+func (m *manager) ldapEntryToTenant(entry *ldap.Entry) (*tenantpb.Tenant, error) {
+	t := &tenantpb.Tenant{
+		Id:         entry.GetEqualFoldAttributeValue(m.conf.LDAPIdentity.Tenant.Schema.ID),
+		ExternalId: entry.GetEqualFoldAttributeValue(m.conf.LDAPIdentity.Tenant.Schema.ExternalID),
+		Name:       entry.GetEqualFoldAttributeValue(m.conf.LDAPIdentity.Tenant.Schema.Name),
+	}
+	return t, nil
+}

vendor/github.com/opencloud-eu/reva/v2/pkg/tenant/manager/loader/loader.go

@@ -0,0 +1,28 @@
+// Copyright 2018-2021 CERN
+// Copyright 2026 OpenCloud GmbH
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// In applying this license, CERN does not waive the privileges and immunities
+// granted to it by virtue of its status as an Intergovernmental Organization
+// or submit itself to any jurisdiction.
+
+package loader
+
+import (
+	// Load core user manager drivers.
+	_ "github.com/opencloud-eu/reva/v2/pkg/tenant/manager/ldap"
+	_ "github.com/opencloud-eu/reva/v2/pkg/tenant/manager/memory"
+	_ "github.com/opencloud-eu/reva/v2/pkg/tenant/manager/null"
+	// Add your own here
+)

vendor/github.com/opencloud-eu/reva/v2/pkg/tenant/manager/memory/memory.go

@@ -0,0 +1,106 @@
+// Copyright 2018-2021 CERN
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// In applying this license, CERN does not waive the privileges and immunities
+// granted to it by virtue of its status as an Intergovernmental Organization
+// or submit itself to any jurisdiction.
+
+package memory
+
+import (
+	"context"
+
+	tenantpb "github.com/cs3org/go-cs3apis/cs3/identity/tenant/v1beta1"
+	"github.com/mitchellh/mapstructure"
+	"github.com/opencloud-eu/reva/v2/pkg/errtypes"
+	"github.com/opencloud-eu/reva/v2/pkg/tenant"
+	"github.com/opencloud-eu/reva/v2/pkg/tenant/manager/registry"
+	"github.com/pkg/errors"
+)
+
+func init() {
+	registry.Register("memory", New)
+}
+
+// tenantEntry is used only for mapstructure decoding of the config.
+type tenantEntry struct {
+	ID         string `mapstructure:"id"`
+	ExternalID string `mapstructure:"external_id"`
+	Name       string `mapstructure:"name"`
+}
+
+type config struct {
+	Tenants map[string]*tenantEntry `mapstructure:"tenants"`
+}
+
+func parseConfig(m map[string]interface{}) (*config, error) {
+	c := &config{}
+	if err := mapstructure.Decode(m, c); err != nil {
+		return nil, errors.Wrap(err, "error decoding conf")
+	}
+	return c, nil
+}
+
+type manager struct {
+	catalog map[string]*tenantpb.Tenant
+}
+
+// New returns a new tenant manager.
+func New(m map[string]interface{}) (tenant.Manager, error) {
+	mgr := &manager{}
+	err := mgr.Configure(m)
+	return mgr, err
+}
+
+func (m *manager) Configure(ml map[string]interface{}) error {
+	c, err := parseConfig(ml)
+	if err != nil {
+		return err
+	}
+	m.catalog = make(map[string]*tenantpb.Tenant, len(c.Tenants))
+	for k, t := range c.Tenants {
+		m.catalog[k] = &tenantpb.Tenant{
+			Id:         t.ID,
+			ExternalId: t.ExternalID,
+			Name:       t.Name,
+		}
+	}
+	return nil
+}
+
+func (m *manager) GetTenant(ctx context.Context, id string) (*tenantpb.Tenant, error) {
+	if t, ok := m.catalog[id]; ok {
+		return t, nil
+	}
+	return nil, errtypes.NotFound(id)
+}
+
+func (m *manager) GetTenantByClaim(ctx context.Context, claim, value string) (*tenantpb.Tenant, error) {
+	for _, t := range m.catalog {
+		if tenantClaim, err := extractClaim(t, claim); err == nil && value == tenantClaim {
+			return t, nil
+		}
+	}
+	return nil, errtypes.NotFound(value)
+}
+
+func extractClaim(t *tenantpb.Tenant, claim string) (string, error) {
+	switch claim {
+	case "id":
+		return t.Id, nil
+	case "externalid":
+		return t.ExternalId, nil
+	}
+	return "", errors.New("memory: invalid claim")
+}

vendor/github.com/opencloud-eu/reva/v2/pkg/tenant/manager/null/null.go

@@ -0,0 +1,49 @@
+// Copyright 2018-2020 CERN
+// Copyright 2026 OpenCloud GmbH
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// In applying this license, CERN does not waive the privileges and immunities
+// granted to it by virtue of its status as an Intergovernmental Organization
+// or submit itself to any jurisdiction.
+
+package null
+
+import (
+	"context"
+
+	tenantpb "github.com/cs3org/go-cs3apis/cs3/identity/tenant/v1beta1"
+	"github.com/opencloud-eu/reva/v2/pkg/errtypes"
+	"github.com/opencloud-eu/reva/v2/pkg/tenant"
+	"github.com/opencloud-eu/reva/v2/pkg/tenant/manager/registry"
+)
+
+func init() {
+	registry.Register("null", New)
+}
+
+type manager struct {
+}
+
+// New returns a tenant manager implementation that return NOT FOUND or empty result set for every call
+func New(m map[string]interface{}) (tenant.Manager, error) {
+	return &manager{}, nil
+}
+
+func (m *manager) GetTenant(ctx context.Context, id string) (*tenantpb.Tenant, error) {
+	return nil, errtypes.NotFound(id)
+}
+
+func (m *manager) GetTenantByClaim(ctx context.Context, claim, value string) (*tenantpb.Tenant, error) {
+	return nil, errtypes.NotFound(value)
+}

vendor/github.com/opencloud-eu/reva/v2/pkg/tenant/manager/registry/registry.go

@@ -0,0 +1,36 @@
+// Copyright 2018-2021 CERN
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// In applying this license, CERN does not waive the privileges and immunities
+// granted to it by virtue of its status as an Intergovernmental Organization
+// or submit itself to any jurisdiction.
+
+package registry
+
+import (
+	"github.com/opencloud-eu/reva/v2/pkg/tenant"
+)
+
+// NewFunc is the function that tenant managers
+// should register at init time.
+type NewFunc func(map[string]interface{}) (tenant.Manager, error)
+
+// NewFuncs is a map containing all the registered user managers.
+var NewFuncs = map[string]NewFunc{}
+
+// Register registers a new user manager new function.
+// Not safe for concurrent use. Safe for use from package init.
+func Register(name string, f NewFunc) {
+	NewFuncs[name] = f
+}

vendor/github.com/opencloud-eu/reva/v2/pkg/tenant/tenant.go

@@ -0,0 +1,34 @@
+// Copyright 2018-2021 CERN
+// Copyright 2026 OpenCloud
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// In applying this license, CERN does not waive the privileges and immunities
+// granted to it by virtue of its status as an Intergovernmental Organization
+// or submit itself to any jurisdiction.
+
+package tenant
+
+import (
+	"context"
+
+	tenant "github.com/cs3org/go-cs3apis/cs3/identity/tenant/v1beta1"
+)
+
+// Manager is the interface to implement to manipulate users.
+type Manager interface {
+	// GetTenant returns the tenant metadata identified by an id.
+	GetTenant(ctx context.Context, id string) (*tenant.Tenant, error)
+	// GetUserByClaim returns the user identified by a specific value for a given claim.
+	GetTenantByClaim(ctx context.Context, claim, value string) (*tenant.Tenant, error)
+}

vendor/github.com/opencloud-eu/reva/v2/pkg/utils/ldap/identity.go

@@ -38,8 +38,9 @@ import (
 
 // Identity provides methods to query users and groups from an LDAP server
 type Identity struct {
-	User  userConfig  `mapstructure:",squash"`
-	Group groupConfig `mapstructure:",squash"`
+	User   userConfig   `mapstructure:",squash"`
+	Group  groupConfig  `mapstructure:",squash"`
+	Tenant tenantConfig `mapstructure:",squash"`
 }
 
 const tracerName = "pkg/utils/ldap"
@@ -71,6 +72,15 @@ type groupConfig struct {
 	LocalDisabledDN string `mapstructure:"group_local_disabled_dn"`
 }
 
+type tenantConfig struct {
+	BaseDN      string `mapstructure:"tenant_base_dn"`
+	Scope       string `mapstructure:"tenant_search_scope"`
+	scopeVal    int
+	Filter      string       `mapstructure:"tenant_filter"`
+	Objectclass string       `mapstructure:"tenant_objectclass"`
+	Schema      tenantSchema `mapstructure:"tenant_schema"`
+}
+
 type groupSchema struct {
 	// GID is an immutable group id, see https://docs.microsoft.com/en-us/azure/active-directory/hybrid/plan-connect-design-concepts
 	ID              string `mapstructure:"id"`
@@ -106,6 +116,12 @@ type userSchema struct {
 	TenantID string `mapstructure:"tenantId"`
 }
 
+type tenantSchema struct {
+	ID         string `mapstructure:"id"`
+	ExternalID string `mapstructure:"externalId"`
+	Name       string `mapstructure:"name"`
+}
+
 // Default userConfig (somewhat inspired by Active Directory)
 var userDefaults = userConfig{
 	Scope:       "sub",
@@ -138,11 +154,23 @@ var groupDefaults = groupConfig{
 	SubstringFilterType: "initial",
 }
 
+// Default tenantConfig (works with OpenCloud's education Schema)
+var tenantDefaults = tenantConfig{
+	Scope:       "sub",
+	Objectclass: "openCloudEducationSchool",
+	Schema: tenantSchema{
+		ID:         "openCloudUUID",
+		ExternalID: "openCloudEducationExternalId",
+		Name:       "ou",
+	},
+}
+
 // New initializes the default config
 func New() Identity {
 	return Identity{
-		User:  userDefaults,
-		Group: groupDefaults,
+		User:   userDefaults,
+		Group:  groupDefaults,
+		Tenant: tenantDefaults,
 	}
 }
 
@@ -159,6 +187,10 @@ func (i *Identity) Setup() error {
 		return fmt.Errorf("error configuring group scope: %w", err)
 	}
 
+	if i.Tenant.scopeVal, err = stringToScope(i.Tenant.Scope); err != nil {
+		return fmt.Errorf("error configuring tenant scope: %w", err)
+	}
+
 	if i.User.substringFilterVal, err = stringToFilterType(i.User.SubstringFilterType); err != nil {
 		return fmt.Errorf("error configuring user substring filter type: %w", err)
 	}
@@ -847,6 +879,107 @@ func (i *Identity) getUserLDAPAttrTypes() []string {
 	}
 	return attrs
 }
+
+// GetLDAPTenantByID looks up a tenant by the supplied Id. Returns the corresponding
+// ldap.Entry
+func (i *Identity) GetLDAPTenantByID(ctx context.Context, lc ldap.Client, id string) (*ldap.Entry, error) {
+	var filter string
+	var err error
+	if filter, err = i.getTenantFilter(id); err != nil {
+		return nil, err
+	}
+	return i.GetLDAPTenantByFilter(ctx, lc, filter)
+}
+
+// GetLDAPTenantByAttribute looks up a single user by attribute (can be "externalid" or "id")
+func (i *Identity) GetLDAPTenantByAttribute(ctx context.Context, lc ldap.Client, attribute, value string) (*ldap.Entry, error) {
+	var filter string
+	var err error
+	if filter, err = i.getTenantAttributeFilter(attribute, value); err != nil {
+		return nil, err
+	}
+	return i.GetLDAPTenantByFilter(ctx, lc, filter)
+}
+
+// GetLDAPTenantByFilter looks up a single user by the supplied LDAP filter
+// returns the corresponding ldap.Entry
+func (i *Identity) GetLDAPTenantByFilter(ctx context.Context, lc ldap.Client, filter string) (*ldap.Entry, error) {
+	log := appctx.GetLogger(ctx)
+	_, span := appctx.GetTracerProvider(ctx).Tracer(tracerName).Start(ctx, "GetLDAPTenantByFilter")
+	defer span.End()
+	searchRequest := ldap.NewSearchRequest(
+		i.Tenant.BaseDN, i.Tenant.scopeVal, ldap.NeverDerefAliases, 1, 0, false,
+		filter,
+		i.getTenantLDAPAttrTypes(),
+		nil,
+	)
+
+	setLDAPSearchSpanAttributes(span, searchRequest)
+	log.Debug().Str("backend", "ldap").Str("basedn", i.Tenant.BaseDN).Str("filter", filter).Int("scope", i.Tenant.scopeVal).Msg("LDAP Search")
+	res, err := lc.Search(searchRequest)
+	if err != nil {
+		log.Debug().Str("backend", "ldap").Err(err).Str("tenantfilter", filter).Msg("Error looking up tenant by filter")
+		var errmsg string
+		if lerr, ok := err.(*ldap.Error); ok {
+			if lerr.ResultCode == ldap.LDAPResultSizeLimitExceeded {
+				errmsg = fmt.Sprintf("too many results searching for tenant '%s'", filter)
+			}
+		}
+		span.SetAttributes(attribute.String("ldap.error", errmsg))
+		span.SetStatus(codes.Error, errmsg)
+		return nil, errtypes.NotFound(errmsg)
+	}
+	if len(res.Entries) == 0 {
+		return nil, errtypes.NotFound(filter)
+	}
+	span.SetStatus(codes.Ok, "")
+
+	return res.Entries[0], nil
+}
+
+func (i *Identity) getTenantLDAPAttrTypes() []string {
+	// The are the attributes we request unconditionally when looking up users
+	// as they are needed to populate a user object
+	return []string{
+		i.Tenant.Schema.ID,
+		i.Tenant.Schema.ExternalID,
+		i.Tenant.Schema.Name,
+	}
+}
+
+func (i *Identity) getTenantFilter(id string) (string, error) {
+	var escapedUUID string
+	escapedUUID, err := filterEscapeAttribute(i.Tenant.Schema.ID, false, id)
+	if err != nil {
+		return "", fmt.Errorf("error parsing id '%s' as UUID: %w", id, err)
+	}
+	return fmt.Sprintf("(&%s(objectclass=%s)(%s=%s))",
+		i.Tenant.Filter,
+		i.Tenant.Objectclass,
+		i.Tenant.Schema.ID,
+		escapedUUID,
+	), nil
+}
+
+func (i *Identity) getTenantAttributeFilter(attribute, value string) (string, error) {
+	switch attribute {
+	case "id":
+		attribute = i.Tenant.Schema.ID
+	case "externalid":
+		attribute = i.Tenant.Schema.ExternalID
+	}
+	escapedValue, err := filterEscapeAttribute("", false, value)
+	if err != nil {
+		return "", fmt.Errorf("error escaping filter value %q: %w", value, err)
+	}
+	return fmt.Sprintf("(&%s(objectclass=%s)(%s=%s))",
+		i.Tenant.Filter,
+		i.Tenant.Objectclass,
+		attribute,
+		escapedValue,
+	), nil
+}
+
 func setLDAPSearchSpanAttributes(span trace.Span, request *ldap.SearchRequest) {
 	span.SetAttributes(
 		attribute.String("ldap.basedn", request.BaseDN),

vendor/github.com/opencloud-eu/reva/v2/tests/cs3mocks/mocks/GatewayAPIClient.go

@@ -56,6 +56,8 @@ import (
 
 	registryv1beta1 "github.com/cs3org/go-cs3apis/cs3/app/registry/v1beta1"
 
+	tenantv1beta1 "github.com/cs3org/go-cs3apis/cs3/identity/tenant/v1beta1"
+
 	txv1beta1 "github.com/cs3org/go-cs3apis/cs3/tx/v1beta1"
 
 	userv1beta1 "github.com/cs3org/go-cs3apis/cs3/identity/user/v1beta1"
@@ -3507,6 +3509,152 @@ func (_c *GatewayAPIClient_GetShare_Call) RunAndReturn(run func(context.Context,
 	return _c
 }
 
+// GetTenant provides a mock function with given fields: ctx, in, opts
+func (_m *GatewayAPIClient) GetTenant(ctx context.Context, in *tenantv1beta1.GetTenantRequest, opts ...grpc.CallOption) (*tenantv1beta1.GetTenantResponse, error) {
+	var tmpRet mock.Arguments
+	if len(opts) > 0 {
+		tmpRet = _m.Called(ctx, in, opts)
+	} else {
+		tmpRet = _m.Called(ctx, in)
+	}
+	ret := tmpRet
+
+	if len(ret) == 0 {
+		panic("no return value specified for GetTenant")
+	}
+
+	var r0 *tenantv1beta1.GetTenantResponse
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *tenantv1beta1.GetTenantRequest, ...grpc.CallOption) (*tenantv1beta1.GetTenantResponse, error)); ok {
+		return rf(ctx, in, opts...)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, *tenantv1beta1.GetTenantRequest, ...grpc.CallOption) *tenantv1beta1.GetTenantResponse); ok {
+		r0 = rf(ctx, in, opts...)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*tenantv1beta1.GetTenantResponse)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, *tenantv1beta1.GetTenantRequest, ...grpc.CallOption) error); ok {
+		r1 = rf(ctx, in, opts...)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// GatewayAPIClient_GetTenant_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'GetTenant'
+type GatewayAPIClient_GetTenant_Call struct {
+	*mock.Call
+}
+
+// GetTenant is a helper method to define mock.On call
+//   - ctx context.Context
+//   - in *tenantv1beta1.GetTenantRequest
+//   - opts ...grpc.CallOption
+func (_e *GatewayAPIClient_Expecter) GetTenant(ctx interface{}, in interface{}, opts ...interface{}) *GatewayAPIClient_GetTenant_Call {
+	return &GatewayAPIClient_GetTenant_Call{Call: _e.mock.On("GetTenant",
+		append([]interface{}{ctx, in}, opts...)...)}
+}
+
+func (_c *GatewayAPIClient_GetTenant_Call) Run(run func(ctx context.Context, in *tenantv1beta1.GetTenantRequest, opts ...grpc.CallOption)) *GatewayAPIClient_GetTenant_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		variadicArgs := make([]grpc.CallOption, len(args)-2)
+		for i, a := range args[2:] {
+			if a != nil {
+				variadicArgs[i] = a.(grpc.CallOption)
+			}
+		}
+		run(args[0].(context.Context), args[1].(*tenantv1beta1.GetTenantRequest), variadicArgs...)
+	})
+	return _c
+}
+
+func (_c *GatewayAPIClient_GetTenant_Call) Return(_a0 *tenantv1beta1.GetTenantResponse, _a1 error) *GatewayAPIClient_GetTenant_Call {
+	_c.Call.Return(_a0, _a1)
+	return _c
+}
+
+func (_c *GatewayAPIClient_GetTenant_Call) RunAndReturn(run func(context.Context, *tenantv1beta1.GetTenantRequest, ...grpc.CallOption) (*tenantv1beta1.GetTenantResponse, error)) *GatewayAPIClient_GetTenant_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
+// GetTenantByClaim provides a mock function with given fields: ctx, in, opts
+func (_m *GatewayAPIClient) GetTenantByClaim(ctx context.Context, in *tenantv1beta1.GetTenantByClaimRequest, opts ...grpc.CallOption) (*tenantv1beta1.GetTenantByClaimResponse, error) {
+	var tmpRet mock.Arguments
+	if len(opts) > 0 {
+		tmpRet = _m.Called(ctx, in, opts)
+	} else {
+		tmpRet = _m.Called(ctx, in)
+	}
+	ret := tmpRet
+
+	if len(ret) == 0 {
+		panic("no return value specified for GetTenantByClaim")
+	}
+
+	var r0 *tenantv1beta1.GetTenantByClaimResponse
+	var r1 error
+	if rf, ok := ret.Get(0).(func(context.Context, *tenantv1beta1.GetTenantByClaimRequest, ...grpc.CallOption) (*tenantv1beta1.GetTenantByClaimResponse, error)); ok {
+		return rf(ctx, in, opts...)
+	}
+	if rf, ok := ret.Get(0).(func(context.Context, *tenantv1beta1.GetTenantByClaimRequest, ...grpc.CallOption) *tenantv1beta1.GetTenantByClaimResponse); ok {
+		r0 = rf(ctx, in, opts...)
+	} else {
+		if ret.Get(0) != nil {
+			r0 = ret.Get(0).(*tenantv1beta1.GetTenantByClaimResponse)
+		}
+	}
+
+	if rf, ok := ret.Get(1).(func(context.Context, *tenantv1beta1.GetTenantByClaimRequest, ...grpc.CallOption) error); ok {
+		r1 = rf(ctx, in, opts...)
+	} else {
+		r1 = ret.Error(1)
+	}
+
+	return r0, r1
+}
+
+// GatewayAPIClient_GetTenantByClaim_Call is a *mock.Call that shadows Run/Return methods with type explicit version for method 'GetTenantByClaim'
+type GatewayAPIClient_GetTenantByClaim_Call struct {
+	*mock.Call
+}
+
+// GetTenantByClaim is a helper method to define mock.On call
+//   - ctx context.Context
+//   - in *tenantv1beta1.GetTenantByClaimRequest
+//   - opts ...grpc.CallOption
+func (_e *GatewayAPIClient_Expecter) GetTenantByClaim(ctx interface{}, in interface{}, opts ...interface{}) *GatewayAPIClient_GetTenantByClaim_Call {
+	return &GatewayAPIClient_GetTenantByClaim_Call{Call: _e.mock.On("GetTenantByClaim",
+		append([]interface{}{ctx, in}, opts...)...)}
+}
+
+func (_c *GatewayAPIClient_GetTenantByClaim_Call) Run(run func(ctx context.Context, in *tenantv1beta1.GetTenantByClaimRequest, opts ...grpc.CallOption)) *GatewayAPIClient_GetTenantByClaim_Call {
+	_c.Call.Run(func(args mock.Arguments) {
+		variadicArgs := make([]grpc.CallOption, len(args)-2)
+		for i, a := range args[2:] {
+			if a != nil {
+				variadicArgs[i] = a.(grpc.CallOption)
+			}
+		}
+		run(args[0].(context.Context), args[1].(*tenantv1beta1.GetTenantByClaimRequest), variadicArgs...)
+	})
+	return _c
+}
+
+func (_c *GatewayAPIClient_GetTenantByClaim_Call) Return(_a0 *tenantv1beta1.GetTenantByClaimResponse, _a1 error) *GatewayAPIClient_GetTenantByClaim_Call {
+	_c.Call.Return(_a0, _a1)
+	return _c
+}
+
+func (_c *GatewayAPIClient_GetTenantByClaim_Call) RunAndReturn(run func(context.Context, *tenantv1beta1.GetTenantByClaimRequest, ...grpc.CallOption) (*tenantv1beta1.GetTenantByClaimResponse, error)) *GatewayAPIClient_GetTenantByClaim_Call {
+	_c.Call.Return(run)
+	return _c
+}
+
 // GetTransferStatus provides a mock function with given fields: ctx, in, opts
 func (_m *GatewayAPIClient) GetTransferStatus(ctx context.Context, in *txv1beta1.GetTransferStatusRequest, opts ...grpc.CallOption) (*txv1beta1.GetTransferStatusResponse, error) {
 	var tmpRet mock.Arguments