sevenhill/QSfera
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

proxy: Allow mapping from an external tenant id to the internal id

Browse Source 
When the tenant id coming in via the OIDC claims doesn't match the
tenant id on the provisioned user, a mapping can be configured and
resolved via the reva TenantAPI service (now started as part of the
"users" service).

Closes: #2310
This commit is contained in:
Ralf Haferkamp
2026-04-09 17:46:50 +02:00
committed by Ralf Haferkamp
parent b8c4f581fb
commit a931e53c26
8 changed files with 252 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/users/pkg/config/config.go
+11
View File
@@ -62,6 +62,11 @@ type LDAPDriver struct {
BindPassword string `yaml:"bind_password" env:"OC_LDAP_BIND_PASSWORD;USERS_LDAP_BIND_PASSWORD" desc:"Password to use for authenticating the 'bind_dn'." introductionVersion:"1.0.0"`
UserBaseDN string `yaml:"user_base_dn" env:"OC_LDAP_USER_BASE_DN;USERS_LDAP_USER_BASE_DN" desc:"Search base DN for looking up LDAP users." introductionVersion:"1.0.0"`
GroupBaseDN string `yaml:"group_base_dn" env:"OC_LDAP_GROUP_BASE_DN;USERS_LDAP_GROUP_BASE_DN" desc:"Search base DN for looking up LDAP groups." introductionVersion:"1.0.0"`
TenantBaseDN string `yaml:"tenant_base_dn" env:"OC_LDAP_TENANT_BASE_DN;USERS_LDAP_TENANT_BASE_DN" desc:"Search base DN for looking up LDAP tenants. Only relevant in multi-tenant setups." introductionVersion:"%%NEXT%%"`
TenantScope string `yaml:"tenant_scope" env:"OC_LDAP_TENANT_SCOPE;USERS_LDAP_TENANT_SCOPE" desc:"LDAP search scope to use when looking up tenants. Supported values are 'base', 'one' and 'sub'. Only relevant in multi-tenant setups." introductionVersion:"%%NEXT%%"`
TenantFilter string `yaml:"tenant_filter" env:"OC_LDAP_TENANT_FILTER;USERS_LDAP_TENANT_FILTER" desc:"LDAP filter to add to the default filters for tenant searches. Only relevant in multi-tenant setups." introductionVersion:"%%NEXT%%"`
TenantObjectClass string `yaml:"tenant_object_class" env:"OC_LDAP_TENANT_OBJECTCLASS;USERS_LDAP_TENANT_OBJECTCLASS" desc:"The object class to use for tenants in the default tenant search filter. Only relevant in multi-tenant setups." introductionVersion:"%%NEXT%%"`
TenantSchema LDAPTenantSchema `yaml:"tenant_schema"`
UserScope string `yaml:"user_scope" env:"OC_LDAP_USER_SCOPE;USERS_LDAP_USER_SCOPE" desc:"LDAP search scope to use when looking up users. Supported values are 'base', 'one' and 'sub'." introductionVersion:"1.0.0"`
GroupScope string `yaml:"group_scope" env:"OC_LDAP_GROUP_SCOPE;USERS_LDAP_GROUP_SCOPE" desc:"LDAP search scope to use when looking up groups. Supported values are 'base', 'one' and 'sub'." introductionVersion:"1.0.0"`
UserSubstringFilterType string `yaml:"user_substring_filter_type" env:"LDAP_USER_SUBSTRING_FILTER_TYPE;USERS_LDAP_USER_SUBSTRING_FILTER_TYPE" desc:"Type of substring search filter to use for substring searches for users. Possible values: 'initial' for doing prefix only searches, 'final' for doing suffix only searches or 'any' for doing full substring searches" introductionVersion:"1.0.0"`
@@ -96,6 +101,12 @@ type LDAPGroupSchema struct {
Member string `yaml:"member" env:"OC_LDAP_GROUP_SCHEMA_MEMBER;USERS_LDAP_GROUP_SCHEMA_MEMBER" desc:"LDAP Attribute that is used for group members." introductionVersion:"1.0.0"`
}
type LDAPTenantSchema struct {
ID string `yaml:"id" env:"OC_LDAP_TENANT_SCHEMA_ID;USERS_LDAP_TENANT_SCHEMA_ID" desc:"LDAP Attribute to use as the unique internal ID for tenants. Only relevant in multi-tenant setups." introductionVersion:"%%NEXT%%"`
ExternalID string `yaml:"external_id" env:"OC_LDAP_TENANT_SCHEMA_EXTERNAL_ID;USERS_LDAP_TENANT_SCHEMA_EXTERNAL_ID" desc:"LDAP Attribute that holds the external tenant ID as it appears in OIDC claims. Only relevant in multi-tenant setups." introductionVersion:"%%NEXT%%"`
Name string `yaml:"name" env:"OC_LDAP_TENANT_SCHEMA_NAME;USERS_LDAP_TENANT_SCHEMA_NAME" desc:"LDAP Attribute to use for the human-readable name of a tenant. Only relevant in multi-tenant setups." introductionVersion:"%%NEXT%%"`
}
type OwnCloudSQLDriver struct {
DBUsername string `yaml:"db_username" env:"USERS_OWNCLOUDSQL_DB_USERNAME" desc:"Database user to use for authenticating with the owncloud database." introductionVersion:"1.0.0"`
DBPassword string `yaml:"db_password" env:"USERS_OWNCLOUDSQL_DB_PASSWORD" desc:"Password for the database user." introductionVersion:"1.0.0"`
services/users/pkg/config/defaults/defaultconfig.go
+1
View File
@@ -45,6 +45,7 @@ func DefaultConfig() *config.Config {
GroupBaseDN: "ou=groups,o=libregraph-idm",
UserScope: "sub",
GroupScope: "sub",
TenantScope: "sub",
UserSubstringFilterType: "any",
UserFilter: "",
GroupFilter: "",
services/users/pkg/revaconfig/config.go
+9
View File
@@ -66,13 +66,17 @@ func ldapConfigFromString(cfg config.LDAPDriver) map[string]interface{} {
"bind_password": cfg.BindPassword,
"user_base_dn": cfg.UserBaseDN,
"group_base_dn": cfg.GroupBaseDN,
"tenant_base_dn": cfg.TenantBaseDN,
"user_scope": cfg.UserScope,
"group_scope": cfg.GroupScope,
"tenant_search_scope": cfg.TenantScope,
"user_substring_filter_type": cfg.UserSubstringFilterType,
"user_filter": cfg.UserFilter,
"group_filter": cfg.GroupFilter,
"tenant_filter": cfg.TenantFilter,
"user_objectclass": cfg.UserObjectClass,
"group_objectclass": cfg.GroupObjectClass,
"tenant_objectclass": cfg.TenantObjectClass,
"user_disable_mechanism": cfg.DisableUserMechanism,
"user_enabled_property": cfg.UserSchema.Enabled,
"user_type_property": cfg.UserTypeAttribute,
@@ -94,5 +98,10 @@ func ldapConfigFromString(cfg config.LDAPDriver) map[string]interface{} {
"groupName": cfg.GroupSchema.Groupname,
"member": cfg.GroupSchema.Member,
},
"tenant_schema": map[string]interface{}{
"id": cfg.TenantSchema.ID,
"externalId": cfg.TenantSchema.ExternalID,
"name": cfg.TenantSchema.Name,
},
}
}