Merge pull request #6047 from owncloud/excds/feature/add_capabilities_indicating_read-only_attributes

reva/frontend: Add capabilities to indicate attributes that are read-only

services/frontend/README.md

@@ -1,6 +1,6 @@
 # Frontend
 
-The frontend service translates various owncloud related HTTP APIs to CS3 requests. 
+The frontend service translates various owncloud related HTTP APIs to CS3 requests.
 
 ## Endpoints Overview
 
@@ -25,3 +25,7 @@ The ocs endpoint, by default `/ocs`, implements the ownCloud 10 Open Collaborati
 ## Scalability
 
 While the frontend service does not persist any data it does cache `Stat()` responses and user information. Therefore, multiple instances of this service can be spawned in a bigger deployment like when using container orchestration with Kubernetes, when configuring `FRONTEND_OCS_RESOURCE_INFO_CACHE_TYPE=redis` and the related config options.
+
+## Define Read-Only Attributes
+
+A lot of user management is made via the standardized libregraph API. Depending on how the system is configured, there might be some user attributes that an ocis instance admin can't change because of properties coming from an external LDAP server, or similar. This can be the case when the ocis admin is not the LDAP admin. To ease life for admins, there are hints as capabilites telling the frontend which attributes are read-only to enable a different optical representation like being grayed out. To configure these hints, use the environment variable `FRONTEND_READONLY_USER_ATTRIBUTES`, which takes a comma separated list of attributes.

services/frontend/pkg/config/config.go

@@ -39,11 +39,12 @@ type Config struct {
 
 	PublicURL string `yaml:"public_url" env:"OCIS_URL;FRONTEND_PUBLIC_URL" desc:"The public facing URL of the oCIS frontend."`
 
-	AppHandler  AppHandler  `yaml:"app_handler"`
-	Archiver    Archiver    `yaml:"archiver"`
-	DataGateway DataGateway `yaml:"data_gateway"`
-	OCS         OCS         `yaml:"ocs"`
-	Checksums   Checksums   `yaml:"checksums"`
+	AppHandler             AppHandler  `yaml:"app_handler"`
+	Archiver               Archiver    `yaml:"archiver"`
+	DataGateway            DataGateway `yaml:"data_gateway"`
+	OCS                    OCS         `yaml:"ocs"`
+	Checksums              Checksums   `yaml:"checksums"`
+	ReadOnlyUserAttributes []string    `yaml:"read_only_user_attributes" env:"FRONTEND_READONLY_USER_ATTRIBUTES" desc:"Comma separated list of user attributes to indicate as read-only."`
 
 	Middleware Middleware `yaml:"middleware"`
 

services/frontend/pkg/revaconfig/config.go

@@ -63,6 +63,11 @@ func FrontendConfigFromStruct(cfg *config.Config) (map[string]interface{}, error
 		}
 	}
 
+	readOnlyUserAttributes := []string{}
+	if cfg.ReadOnlyUserAttributes != nil {
+		readOnlyUserAttributes = cfg.ReadOnlyUserAttributes
+	}
+
 	return map[string]interface{}{
 		"core": map[string]interface{}{
 			"tracing_enabled":      cfg.Tracing.Enabled,
@@ -198,7 +203,8 @@ func FrontendConfigFromStruct(cfg *config.Config) (map[string]interface{}, error
 								"support_url_signing": true,
 							},
 							"graph": map[string]interface{}{
-								"personal_data_export": true,
+								"personal_data_export":      true,
+								"read_only_user_attributes": readOnlyUserAttributes,
 							},
 							"checksums": map[string]interface{}{
 								"supported_types":       cfg.Checksums.SupportedTypes,