Unify LDAP config settings accross services

This adapts the storage service to the recent changes of the LDAP
settings in reva.

Also we define a new set of LDAP env variables that can be shared
between all LDAP related ocis services (graph, idp, storage-auth-basic,
storage-userprovider, storage-groupprovider, idm). This should simplify
the most LDAP based configurations considerably.

storage/pkg/command/authbasic.go

@@ -50,6 +50,13 @@ func AuthBasic(cfg *config.Config) *cli.Command {
 				Interface("reva-config", rcfg).
 				Msg("config")
 
+			if cfg.Reva.AuthProvider.Driver == "ldap" {
+				if err := waitForLDAPCA(logger, &cfg.Reva.LDAP); err != nil {
+					logger.Error().Err(err).Msg("The configured LDAP CA cert does not exist")
+					return err
+				}
+			}
+
 			gr.Add(func() error {
 				runtime.RunWithOptions(rcfg, pidFile, runtime.WithLogger(&logger.Logger))
 				return nil
@@ -113,25 +120,7 @@ func authBasicConfigFromStruct(c *cli.Context, cfg *config.Config) map[string]in
 						"json": map[string]interface{}{
 							"users": cfg.Reva.AuthProvider.JSON,
 						},
-						"ldap": map[string]interface{}{
-							"hostname":      cfg.Reva.LDAP.Hostname,
-							"port":          cfg.Reva.LDAP.Port,
-							"cacert":        cfg.Reva.LDAP.CACert,
-							"insecure":      cfg.Reva.LDAP.Insecure,
-							"base_dn":       cfg.Reva.LDAP.BaseDN,
-							"loginfilter":   cfg.Reva.LDAP.LoginFilter,
-							"bind_username": cfg.Reva.LDAP.BindDN,
-							"bind_password": cfg.Reva.LDAP.BindPassword,
-							"idp":           cfg.Reva.LDAP.IDP,
-							"gatewaysvc":    cfg.Reva.Gateway.Endpoint,
-							"schema": map[string]interface{}{
-								"dn":          "dn",
-								"uid":         cfg.Reva.LDAP.UserSchema.UID,
-								"mail":        cfg.Reva.LDAP.UserSchema.Mail,
-								"displayName": cfg.Reva.LDAP.UserSchema.DisplayName,
-								"cn":          cfg.Reva.LDAP.UserSchema.CN,
-							},
-						},
+						"ldap": ldapConfigFromString(cfg),
 						"owncloudsql": map[string]interface{}{
 							"dbusername":        cfg.Reva.UserOwnCloudSQL.DBUsername,
 							"dbpassword":        cfg.Reva.UserOwnCloudSQL.DBPassword,

storage/pkg/command/groups.go

@@ -46,6 +46,13 @@ func Groups(cfg *config.Config) *cli.Command {
 
 			rcfg := groupsConfigFromStruct(c, cfg)
 
+			if cfg.Reva.Groups.Driver == "ldap" {
+				if err := waitForLDAPCA(logger, &cfg.Reva.LDAP); err != nil {
+					logger.Error().Err(err).Msg("The configured LDAP CA cert does not exist")
+					return err
+				}
+			}
+
 			gr.Add(func() error {
 				runtime.RunWithOptions(
 					rcfg,
@@ -113,28 +120,7 @@ func groupsConfigFromStruct(c *cli.Context, cfg *config.Config) map[string]inter
 						"json": map[string]interface{}{
 							"groups": cfg.Reva.Groups.JSON,
 						},
-						"ldap": map[string]interface{}{
-							"hostname":        cfg.Reva.LDAP.Hostname,
-							"port":            cfg.Reva.LDAP.Port,
-							"cacert":          cfg.Reva.LDAP.CACert,
-							"insecure":        cfg.Reva.LDAP.Insecure,
-							"base_dn":         cfg.Reva.LDAP.BaseDN,
-							"groupfilter":     cfg.Reva.LDAP.GroupFilter,
-							"attributefilter": cfg.Reva.LDAP.GroupAttributeFilter,
-							"findfilter":      cfg.Reva.LDAP.GroupFindFilter,
-							"memberfilter":    cfg.Reva.LDAP.GroupMemberFilter,
-							"bind_username":   cfg.Reva.LDAP.BindDN,
-							"bind_password":   cfg.Reva.LDAP.BindPassword,
-							"idp":             cfg.Reva.LDAP.IDP,
-							"schema": map[string]interface{}{
-								"dn":          "dn",
-								"gid":         cfg.Reva.LDAP.GroupSchema.GID,
-								"mail":        cfg.Reva.LDAP.GroupSchema.Mail,
-								"displayName": cfg.Reva.LDAP.GroupSchema.DisplayName,
-								"cn":          cfg.Reva.LDAP.GroupSchema.CN,
-								"gidNumber":   cfg.Reva.LDAP.GroupSchema.GIDNumber,
-							},
-						},
+						"ldap": ldapConfigFromString(cfg),
 						"rest": map[string]interface{}{
 							"client_id":                      cfg.Reva.UserGroupRest.ClientID,
 							"client_secret":                  cfg.Reva.UserGroupRest.ClientSecret,

storage/pkg/command/ldapcfg.go

@@ -0,0 +1,60 @@
+package command
+
+import (
+	"errors"
+	"os"
+	"time"
+
+	"github.com/owncloud/ocis/ocis-pkg/log"
+	"github.com/owncloud/ocis/storage/pkg/config"
+)
+
+const caTimeout = 5
+
+func ldapConfigFromString(cfg *config.Config) map[string]interface{} {
+	return map[string]interface{}{
+		"uri":               cfg.Reva.LDAP.URI,
+		"cacert":            cfg.Reva.LDAP.CACert,
+		"insecure":          cfg.Reva.LDAP.Insecure,
+		"bind_username":     cfg.Reva.LDAP.BindDN,
+		"bind_password":     cfg.Reva.LDAP.BindPassword,
+		"user_base_dn":      cfg.Reva.LDAP.UserBaseDN,
+		"group_base_dn":     cfg.Reva.LDAP.GroupBaseDN,
+		"user_filter":       cfg.Reva.LDAP.UserFilter,
+		"group_filter":      cfg.Reva.LDAP.GroupFilter,
+		"user_objectclass":  cfg.Reva.LDAP.UserObjectClass,
+		"group_objectclass": cfg.Reva.LDAP.GroupObjectClass,
+		"login_attributes":  cfg.Reva.LDAP.LoginAttributes,
+		"idp":               cfg.Reva.LDAP.IDP,
+		"gatewaysvc":        cfg.Reva.Gateway.Endpoint,
+		"user_schema": map[string]interface{}{
+			"id":              cfg.Reva.LDAP.UserSchema.ID,
+			"idIsOctetString": cfg.Reva.LDAP.UserSchema.IDIsOctetString,
+			"mail":            cfg.Reva.LDAP.UserSchema.Mail,
+			"displayName":     cfg.Reva.LDAP.UserSchema.DisplayName,
+			"userName":        cfg.Reva.LDAP.UserSchema.Username,
+		},
+		"group_schema": map[string]interface{}{
+			"id":              cfg.Reva.LDAP.GroupSchema.ID,
+			"idIsOctetString": cfg.Reva.LDAP.GroupSchema.IDIsOctetString,
+			"mail":            cfg.Reva.LDAP.GroupSchema.Mail,
+			"displayName":     cfg.Reva.LDAP.GroupSchema.DisplayName,
+			"groupName":       cfg.Reva.LDAP.GroupSchema.Groupname,
+			"member":          cfg.Reva.LDAP.GroupSchema.Member,
+		},
+	}
+}
+
+func waitForLDAPCA(log log.Logger, cfg *config.LDAP) error {
+	if !cfg.Insecure && cfg.CACert != "" {
+		if _, err := os.Stat(cfg.CACert); errors.Is(err, os.ErrNotExist) {
+			log.Warn().Str("LDAP CACert", cfg.CACert).Msgf("File does not exist. Waiting %d seconds for it to appear.", caTimeout)
+			time.Sleep(caTimeout * time.Second)
+			if _, err := os.Stat(cfg.CACert); errors.Is(err, os.ErrNotExist) {
+				log.Warn().Str("LDAP CACert", cfg.CACert).Msgf("File does still not exist after Timeout")
+				return err
+			}
+		}
+	}
+	return nil
+}

storage/pkg/command/users.go

@@ -48,11 +48,19 @@ func Users(cfg *config.Config) *cli.Command {
 			pidFile := path.Join(os.TempDir(), "revad-"+c.Command.Name+"-"+uuid.String()+".pid")
 
 			rcfg := usersConfigFromStruct(c, cfg)
+
 			logger.Debug().
 				Str("server", "users").
 				Interface("reva-config", rcfg).
 				Msg("config")
 
+			if cfg.Reva.Users.Driver == "ldap" {
+				if err := waitForLDAPCA(logger, &cfg.Reva.LDAP); err != nil {
+					logger.Error().Err(err).Msg("The configured LDAP CA cert does not exist")
+					return err
+				}
+			}
+
 			gr.Add(func() error {
 				runtime.RunWithOptions(
 					rcfg,
@@ -120,29 +128,7 @@ func usersConfigFromStruct(c *cli.Context, cfg *config.Config) map[string]interf
 						"json": map[string]interface{}{
 							"users": cfg.Reva.Users.JSON,
 						},
-						"ldap": map[string]interface{}{
-							"hostname":        cfg.Reva.LDAP.Hostname,
-							"port":            cfg.Reva.LDAP.Port,
-							"cacert":          cfg.Reva.LDAP.CACert,
-							"insecure":        cfg.Reva.LDAP.Insecure,
-							"base_dn":         cfg.Reva.LDAP.BaseDN,
-							"userfilter":      cfg.Reva.LDAP.UserFilter,
-							"attributefilter": cfg.Reva.LDAP.UserAttributeFilter,
-							"findfilter":      cfg.Reva.LDAP.UserFindFilter,
-							"groupfilter":     cfg.Reva.LDAP.UserGroupFilter,
-							"bind_username":   cfg.Reva.LDAP.BindDN,
-							"bind_password":   cfg.Reva.LDAP.BindPassword,
-							"idp":             cfg.Reva.LDAP.IDP,
-							"schema": map[string]interface{}{
-								"dn":          "dn",
-								"uid":         cfg.Reva.LDAP.UserSchema.UID,
-								"mail":        cfg.Reva.LDAP.UserSchema.Mail,
-								"displayName": cfg.Reva.LDAP.UserSchema.DisplayName,
-								"cn":          cfg.Reva.LDAP.UserSchema.CN,
-								"uidNumber":   cfg.Reva.LDAP.UserSchema.UIDNumber,
-								"gidNumber":   cfg.Reva.LDAP.UserSchema.GIDNumber,
-							},
-						},
+						"ldap": ldapConfigFromString(cfg),
 						"rest": map[string]interface{}{
 							"client_id":                    cfg.Reva.UserGroupRest.ClientID,
 							"client_secret":                cfg.Reva.UserGroupRest.ClientSecret,

storage/pkg/config/config.go

@@ -363,25 +363,23 @@ type OIDC struct {
 
 // LDAP defines the available ldap configuration.
 type LDAP struct {
-	Hostname             string          `yaml:"hostname"`
-	Port                 int             `yaml:"port"`
-	CACert               string          `yaml:"ca_cert"`
-	Insecure             bool            `yaml:"insecure"`
-	BaseDN               string          `yaml:"base_dn"`
-	LoginFilter          string          `yaml:"login_filter"`
-	UserFilter           string          `yaml:"user_filter"`
-	UserAttributeFilter  string          `yaml:"user_attribute_filter"`
-	UserFindFilter       string          `yaml:"user_find_filter"`
-	UserGroupFilter      string          `yaml:"user_group_filter"`
-	GroupFilter          string          `yaml:"group_filter"`
-	GroupAttributeFilter string          `yaml:"group_attribute_filter"`
-	GroupFindFilter      string          `yaml:"group_finder_filter"`
-	GroupMemberFilter    string          `yaml:"group_member_filter"`
-	BindDN               string          `yaml:"bind_dn"`
-	BindPassword         string          `yaml:"bind_password"`
-	IDP                  string          `yaml:"idp"`
-	UserSchema           LDAPUserSchema  `yaml:"user_schema"`
-	GroupSchema          LDAPGroupSchema `yaml:"group_schema"`
+	URI              string          `yaml:"uri"`
+	CACert           string          `yaml:"ca_cert"`
+	Insecure         bool            `yaml:"insecure"`
+	UserBaseDN       string          `yaml:"user_base_dn"`
+	GroupBaseDN      string          `yaml:"group_base_dn"`
+	UserScope        string          `yaml:"user_scope"`
+	GroupScope       string          `yaml:"group_scope"`
+	UserObjectClass  string          `yaml:"user_objectclass"`
+	GroupObjectClass string          `yaml:"group_objectclass"`
+	UserFilter       string          `yaml:"user_filter"`
+	GroupFilter      string          `yaml:"group_filter"`
+	LoginAttributes  []string        `yaml:"login_attributes"`
+	BindDN           string          `yaml:"bind_dn"`
+	BindPassword     string          `yaml:"bind_password"`
+	IDP              string          `yaml:"idp"`
+	UserSchema       LDAPUserSchema  `yaml:"user_schema"`
+	GroupSchema      LDAPGroupSchema `yaml:"group_schema"`
 }
 
 // UserGroupRest defines the REST driver specification for user and group resolution.
@@ -413,21 +411,24 @@ type UserOwnCloudSQL struct {
 
 // LDAPUserSchema defines the available ldap user schema configuration.
 type LDAPUserSchema struct {
-	UID         string `yaml:"uid"`
-	Mail        string `yaml:"mail"`
-	DisplayName string `yaml:"display_name"`
-	CN          string `yaml:"cn"`
-	UIDNumber   string `yaml:"uid_number"`
-	GIDNumber   string `yaml:"gid_number"`
+	ID              string `yaml:"id"`
+	IDIsOctetString bool   `yaml:"id_is_octet_string"`
+	Mail            string `yaml:"mail"`
+	DisplayName     string `yaml:"display_name"`
+	Username        string `yaml:"user_name"`
+	UIDNumber       string `yaml:"uid_number"`
+	GIDNumber       string `yaml:"gid_number"`
 }
 
 // LDAPGroupSchema defines the available ldap group schema configuration.
 type LDAPGroupSchema struct {
-	GID         string `yaml:"gid"`
-	Mail        string `yaml:"mail"`
-	DisplayName string `yaml:"display_name"`
-	CN          string `yaml:"cn"`
-	GIDNumber   string `yaml:"gid_number"`
+	ID              string `yaml:"id"`
+	IDIsOctetString bool   `yaml:"id_is_octet_string"`
+	Mail            string `yaml:"mail"`
+	DisplayName     string `yaml:"display_name"`
+	Groupname       string `yaml:"group_name"`
+	Member          string `yaml:"member"`
+	GIDNumber       string `yaml:"gid_number"`
 }
 
 // OCDav defines the available ocdav configuration.
@@ -1020,111 +1021,115 @@ func structMappings(cfg *Config) []shared.EnvBinding {
 
 		// ldap
 		{
-			EnvVars:     []string{"STORAGE_LDAP_HOSTNAME"},
-			Destination: &cfg.Reva.LDAP.Hostname,
+			EnvVars:     []string{"LDAP_URI", "STORAGE_LDAP_URI"},
+			Destination: &cfg.Reva.LDAP.URI,
 		},
 		{
-			EnvVars:     []string{"STORAGE_LDAP_PORT"},
-			Destination: &cfg.Reva.LDAP.Port,
-		},
-		{
-			EnvVars:     []string{"STORAGE_LDAP_CACERT"},
+			EnvVars:     []string{"LDAP_CACERT", "STORAGE_LDAP_CACERT"},
 			Destination: &cfg.Reva.LDAP.CACert,
 		},
 		{
-			EnvVars:     []string{"STORAGE_LDAP_INSECURE"},
+			EnvVars:     []string{"LDAP_INSECURE", "STORAGE_LDAP_INSECURE"},
 			Destination: &cfg.Reva.LDAP.Insecure,
 		},
 		{
-			EnvVars:     []string{"STORAGE_LDAP_BASE_DN"},
-			Destination: &cfg.Reva.LDAP.BaseDN,
+			EnvVars:     []string{"LDAP_USER_BASE_DN", "STORAGE_LDAP_USER_BASE_DN"},
+			Destination: &cfg.Reva.LDAP.UserBaseDN,
 		},
 		{
-			EnvVars:     []string{"STORAGE_LDAP_LOGINFILTER"},
-			Destination: &cfg.Reva.LDAP.LoginFilter,
+			EnvVars:     []string{"LDAP_GROUP_BASE_DN", "STORAGE_LDAP_GROUP_BASE_DN"},
+			Destination: &cfg.Reva.LDAP.GroupBaseDN,
 		},
 		{
-			EnvVars:     []string{"STORAGE_LDAP_USERFILTER"},
+			EnvVars:     []string{"LDAP_USER_SCOPE", "STORAGE_LDAP_USER_SCOPE"},
+			Destination: &cfg.Reva.LDAP.UserScope,
+		},
+		{
+			EnvVars:     []string{"LDAP_GROUP_SCOPE", "STORAGE_LDAP_GROUP_SCOPE"},
+			Destination: &cfg.Reva.LDAP.GroupScope,
+		},
+		{
+			EnvVars:     []string{"LDAP_USER_OBJECTCLASS", "STORAGE_LDAP_USER_OBJECTCLASS"},
+			Destination: &cfg.Reva.LDAP.UserObjectClass,
+		},
+		{
+			EnvVars:     []string{"LDAP_GROUP_OBJECTCLASS", "STORAGE_LDAP_GROUP_OBJECTCLASS"},
+			Destination: &cfg.Reva.LDAP.GroupObjectClass,
+		},
+		{
+			EnvVars:     []string{"LDAP_LOGIN_ATTRIBUTES", "STORAGE_LDAP_LOGIN_ATTRIBUTES"},
+			Destination: &cfg.Reva.LDAP.LoginAttributes,
+		},
+		{
+			EnvVars:     []string{"LDAP_USERFILTER", "STORAGE_LDAP_USERFILTER"},
 			Destination: &cfg.Reva.LDAP.UserFilter,
 		},
 		{
-			EnvVars:     []string{"STORAGE_LDAP_USERATTRIBUTEFILTER"},
-			Destination: &cfg.Reva.LDAP.UserAttributeFilter,
-		},
-		{
-			EnvVars:     []string{"STORAGE_LDAP_USERFINDFILTER"},
-			Destination: &cfg.Reva.LDAP.UserFindFilter,
-		},
-		{
-			EnvVars:     []string{"STORAGE_LDAP_USERGROUPFILTER"},
-			Destination: &cfg.Reva.LDAP.UserGroupFilter,
-		},
-		{
-			EnvVars:     []string{"STORAGE_LDAP_GROUPFILTER"},
+			EnvVars:     []string{"LDAP_GROUPFILTER", "STORAGE_LDAP_GROUPFILTER"},
 			Destination: &cfg.Reva.LDAP.GroupFilter,
 		},
 		{
-			EnvVars:     []string{"STORAGE_LDAP_GROUPATTRIBUTEFILTER"},
-			Destination: &cfg.Reva.LDAP.GroupAttributeFilter,
-		},
-		{
-			EnvVars:     []string{"STORAGE_LDAP_GROUPFINDFILTER"},
-			Destination: &cfg.Reva.LDAP.GroupFindFilter,
-		},
-		{
-			EnvVars:     []string{"STORAGE_LDAP_GROUPMEMBERFILTER"},
-			Destination: &cfg.Reva.LDAP.GroupMemberFilter,
-		},
-		{
-			EnvVars:     []string{"STORAGE_LDAP_BIND_DN"},
+			EnvVars:     []string{"LDAP_BIND_DN", "STORAGE_LDAP_BIND_DN"},
 			Destination: &cfg.Reva.LDAP.BindDN,
 		},
 		{
-			EnvVars:     []string{"STORAGE_LDAP_BIND_PASSWORD"},
+			EnvVars:     []string{"LDAP_BIND_PASSWORD", "STORAGE_LDAP_BIND_PASSWORD"},
 			Destination: &cfg.Reva.LDAP.BindPassword,
 		},
 		{
-			EnvVars:     []string{"STORAGE_LDAP_USER_SCHEMA_UID"},
-			Destination: &cfg.Reva.LDAP.UserSchema.UID,
+			EnvVars:     []string{"LDAP_USER_SCHEMA_ID", "STORAGE_LDAP_USER_SCHEMA_ID"},
+			Destination: &cfg.Reva.LDAP.UserSchema.ID,
 		},
 		{
-			EnvVars:     []string{"STORAGE_LDAP_USER_SCHEMA_MAIL"},
+			EnvVars:     []string{"LDAP_USER_SCHEMA_ID_IS_OCTETSTRING", "STORAGE_LDAP_USER_SCHEMA_ID_IS_OCTETSTRING"},
+			Destination: &cfg.Reva.LDAP.UserSchema.IDIsOctetString,
+		},
+		{
+			EnvVars:     []string{"LDAP_USER_SCHEMA_MAIL", "STORAGE_LDAP_USER_SCHEMA_MAIL"},
 			Destination: &cfg.Reva.LDAP.UserSchema.Mail,
 		},
 		{
-			EnvVars:     []string{"STORAGE_LDAP_USER_SCHEMA_DISPLAYNAME"},
+			EnvVars:     []string{"LDAP_USER_SCHEMA_DISPLAYNAME", "STORAGE_LDAP_USER_SCHEMA_DISPLAYNAME"},
 			Destination: &cfg.Reva.LDAP.UserSchema.DisplayName,
 		},
 		{
-			EnvVars:     []string{"STORAGE_LDAP_USER_SCHEMA_CN"},
-			Destination: &cfg.Reva.LDAP.UserSchema.CN,
+			EnvVars:     []string{"LDAP_USER_SCHEMA_USERNAME", "STORAGE_LDAP_USER_SCHEMA_USERNAME"},
+			Destination: &cfg.Reva.LDAP.UserSchema.Username,
 		},
 		{
-			EnvVars:     []string{"STORAGE_LDAP_USER_SCHEMA_UID_NUMBER"},
+			EnvVars:     []string{"LDAP_USER_SCHEMA_UID_NUMBER", "STORAGE_LDAP_USER_SCHEMA_UID_NUMBER"},
 			Destination: &cfg.Reva.LDAP.UserSchema.UIDNumber,
 		},
 		{
-			EnvVars:     []string{"STORAGE_LDAP_USER_SCHEMA_GID_NUMBER"},
+			EnvVars:     []string{"LDAP_USER_SCHEMA_GID_NUMBER", "STORAGE_LDAP_USER_SCHEMA_GID_NUMBER"},
 			Destination: &cfg.Reva.LDAP.UserSchema.GIDNumber,
 		},
 		{
-			EnvVars:     []string{"STORAGE_LDAP_GROUP_SCHEMA_GID"},
-			Destination: &cfg.Reva.LDAP.GroupSchema.GID,
+			EnvVars:     []string{"LDAP_GROUP_SCHEMA_ID", "STORAGE_LDAP_GROUP_SCHEMA_ID"},
+			Destination: &cfg.Reva.LDAP.GroupSchema.ID,
 		},
 		{
-			EnvVars:     []string{"STORAGE_LDAP_GROUP_SCHEMA_MAIL"},
+			EnvVars:     []string{"LDAP_GROUP_SCHEMA_ID_IS_OCTETSTRING", "STORAGE_LDAP_GROUP_SCHEMA_ID_IS_OCTETSTRING"},
+			Destination: &cfg.Reva.LDAP.GroupSchema.IDIsOctetString,
+		},
+		{
+			EnvVars:     []string{"LDAP_GROUP_SCHEMA_MAIL", "STORAGE_LDAP_GROUP_SCHEMA_MAIL"},
 			Destination: &cfg.Reva.LDAP.GroupSchema.Mail,
 		},
 		{
-			EnvVars:     []string{"STORAGE_LDAP_GROUP_SCHEMA_DISPLAYNAME"},
+			EnvVars:     []string{"LDAP_GROUP_SCHEMA_DISPLAYNAME", "STORAGE_LDAP_GROUP_SCHEMA_DISPLAYNAME"},
 			Destination: &cfg.Reva.LDAP.GroupSchema.DisplayName,
 		},
 		{
-			EnvVars:     []string{"STORAGE_LDAP_GROUP_SCHEMA_CN"},
-			Destination: &cfg.Reva.LDAP.GroupSchema.CN,
+			EnvVars:     []string{"LDAP_GROUP_SCHEMA_GROUPNAME", "STORAGE_LDAP_GROUP_SCHEMA_GROUPNAME"},
+			Destination: &cfg.Reva.LDAP.GroupSchema.Groupname,
 		},
 		{
-			EnvVars:     []string{"STORAGE_LDAP_GROUP_SCHEMA_GID_NUMBER"},
+			EnvVars:     []string{"LDAP_GROUP_SCHEMA_MEMBER", "STORAGE_LDAP_GROUP_SCHEMA_MEMBER"},
+			Destination: &cfg.Reva.LDAP.GroupSchema.Member,
+		},
+		{
+			EnvVars:     []string{"LDAP_GROUP_SCHEMA_GID_NUMBER", "STORAGE_LDAP_GROUP_SCHEMA_GID_NUMBER"},
 			Destination: &cfg.Reva.LDAP.GroupSchema.GIDNumber,
 		},
 

storage/pkg/config/defaults/defaultconfig.go

@@ -44,36 +44,35 @@ func DefaultConfig() *config.Config {
 				IDClaim:  "preferred_username",
 			},
 			LDAP: config.LDAP{
-				Hostname:             "localhost",
-				Port:                 9126,
-				CACert:               path.Join(defaults.BaseDataPath(), "ldap", "ldap.crt"),
-				Insecure:             false,
-				BaseDN:               "dc=ocis,dc=test",
-				LoginFilter:          "(&(objectclass=posixAccount)(|(cn={{login}})(mail={{login}})))",
-				UserFilter:           "(&(objectclass=posixAccount)(|(ownclouduuid={{.OpaqueId}})(cn={{.OpaqueId}})))",
-				UserAttributeFilter:  "(&(objectclass=posixAccount)({{attr}}={{value}}))",
-				UserFindFilter:       "(&(objectclass=posixAccount)(|(cn={{query}}*)(displayname={{query}}*)(mail={{query}}*)))",
-				UserGroupFilter:      "(&(objectclass=posixGroup)(cn={{query}}*))",
-				GroupFilter:          "(&(objectclass=posixGroup)(|(ownclouduuid={{.OpaqueId}})(cn={{.OpaqueId}})))",
-				GroupAttributeFilter: "(&(objectclass=posixGroup)({{attr}}={{value}}))",
-				GroupFindFilter:      "(&(objectclass=posixGroup)(|(cn={{query}}*)(displayname={{query}}*)(mail={{query}}*)))",
-				GroupMemberFilter:    "(&(objectclass=posixAccount)(ownclouduuid={{.OpaqueId}}*))",
-				BindDN:               "cn=reva,ou=sysusers,dc=ocis,dc=test",
-				BindPassword:         "reva",
-				IDP:                  defaultPublicURL,
+				URI:              "ldaps://localhost:9126",
+				CACert:           path.Join(defaults.BaseDataPath(), "ldap", "ldap.crt"),
+				Insecure:         false,
+				UserBaseDN:       "dc=ocis,dc=test",
+				GroupBaseDN:      "dc=ocis,dc=test",
+				UserScope:        "sub",
+				GroupScope:       "sub",
+				LoginAttributes:  []string{"cn", "mail"},
+				UserFilter:       "",
+				GroupFilter:      "",
+				UserObjectClass:  "posixAccount",
+				GroupObjectClass: "posixGroup",
+				BindDN:           "cn=reva,ou=sysusers,dc=ocis,dc=test",
+				BindPassword:     "reva",
+				IDP:              defaultPublicURL,
 				UserSchema: config.LDAPUserSchema{
-					UID:         "ownclouduuid",
+					ID:          "ownclouduuid",
 					Mail:        "mail",
 					DisplayName: "displayname",
-					CN:          "cn",
+					Username:    "cn",
 					UIDNumber:   "uidnumber",
 					GIDNumber:   "gidnumber",
 				},
 				GroupSchema: config.LDAPGroupSchema{
-					GID:         "cn",
+					ID:          "cn",
 					Mail:        "mail",
 					DisplayName: "cn",
-					CN:          "cn",
+					Groupname:   "cn",
+					Member:      "cn",
 					GIDNumber:   "gidnumber",
 				},
 			},