Merge pull request #9819 from rhafer/issue/9813

graph: add identities property to non-admin response of GetUsers

services/graph/pkg/service/v0/users.go

@@ -291,6 +291,7 @@ func (g Graph) GetUsers(w http.ResponseWriter, r *http.Request) {
 				Id:          u.Id,
 				DisplayName: u.DisplayName,
 				UserType:    u.UserType,
+				Identities:  u.Identities,
 			}
 
 			if g.config.API.ShowUserEmailInResults {

services/idm/idm.go

@@ -4,8 +4,12 @@ import (
 	_ "embed"
 )
 
+// BaseLDIF is a template for base LDAP entries
+//
 //go:embed ldif/base.ldif.tmpl
 var BaseLDIF string
 
-//go:embed ldif/demousers.ldif
+// DemoUsersLDIF is a template for demo users
+//
+//go:embed ldif/demousers.ldif.tmpl
 var DemoUsersLDIF string

services/idm/ldif/base.ldif.tmpl

@@ -31,6 +31,7 @@ displayName: Admin
 description: An admin for this oCIS instance.
 mail: admin@example.org
 ownCloudUUID: {{ .ID }}
+oCExternalIdentity:  $ {{ .Issuer }} $ {{ .ID }}
 {{ else -}}
 dn: uid={{ .Name }},ou=sysusers,o=libregraph-idm
 objectClass: account

services/idm/ldif/demousers.ldif.tmpl

@@ -14,6 +14,7 @@ description: A German-born theoretical physicist who developed the theory of rel
 mail: einstein@example.org
 ownCloudUserEnabled: TRUE
 ownCloudUUID: 4c510ada-c86b-4815-8820-42cdf82c3d51
+oCExternalIdentity:  $ {{.}} $ 4c510ada-c86b-4815-8820-42cdf82c3d51
 userPassword:: e0FSR09OMn0kYXJnb24yaWQkdj0xOSRtPTY1NTM2LHQ9MSxwPTIkOFpyclR0NXA1a0VmVlhL
  akNHaVBEUSRnemZCWWwrTHdzTUhXQWJSMEJ2NnRiZk1XZjZaOVJ0Mms5Z3VkSWJ5bzg4
 
@@ -33,6 +34,7 @@ description: A Polish and naturalized-French physicist and chemist who conducted
 mail: marie@example.org
 ownCloudUserEnabled: TRUE
 ownCloudUUID: f7fbf8c8-139b-4376-b307-cf0a8c2d0d9c
+oCExternalIdentity:  $ {{.}} $ f7fbf8c8-139b-4376-b307-cf0a8c2d0d9c
 userPassword:: e0FSR09OMn0kYXJnb24yaWQkdj0xOSRtPTY1NTM2LHQ9MSxwPTIkUHJzWkpQQW9pMkFwZHlJ
  a2Q1NGkzQSRnalZzR3doTmk2K0djenJ4SVdPalN2UlBpWXhKSXpHVG4vcnpQZzkvSlZN
 
@@ -52,6 +54,7 @@ description: An American mathematician whose calculations of orbital mechanics a
 mail: katherine@example.org
 ownCloudUserEnabled: TRUE
 ownCloudUUID: 534bb038-6f9d-4093-946f-133be61fa4e7
+oCExternalIdentity:  $ {{.}} $ 534bb038-6f9d-4093-946f-133be61fa4e7
 userPassword:: e0FSR09OMn0kYXJnb24yaWQkdj0xOSRtPTY1NTM2LHQ9MSxwPTIkYVd0b1RXdHdZblZuYjB4
  Nk0wRm1adyRyeXVESVg0a3JSNGdmcnduZEh3aVpaSjVDUQ==
 
@@ -71,6 +74,7 @@ description: An American theoretical physicist, known for his work in the path i
 mail: richard@example.org
 ownCloudUserEnabled: TRUE
 ownCloudUUID: 932b4540-8d16-481e-8ef4-588e4b6b151c
+oCExternalIdentity:  $ {{.}} $ 932b4540-8d16-481e-8ef4-588e4b6b151c
 userPassword:: e0FSR09OMn0kYXJnb24yaWQkdj0xOSRtPTY1NTM2LHQ9MSxwPTIkNjlNcUQxem5sUUZ2SUha
  d2dxU00xQSRVQmNEa2NDZktMemVpQnlyb0JjOTdCSVRhTFo2WjZIL2dhbytSTVh6OHhn
 
@@ -90,6 +94,7 @@ description: A worker in the IT Department of Reynholm Industries. Of all the wo
 mail: moss@example.org
 ownCloudUserEnabled: TRUE
 ownCloudUUID: 058bff95-6708-4fe5-91e4-9ea3d377588b
+oCExternalIdentity:  $ {{.}} $ 058bff95-6708-4fe5-91e4-9ea3d377588b
 userPassword:: e0FSR09OMn0kYXJnb24yaWQkdj0xOSRtPTY1NTM2LHQ9MSxwPTIkZU0xaXR6amQ2dlNSSERx
  NlZCbXBlQSQxNzBhcTB3YjJZZ2NLU2cwWDhHY3l6ckZwMUllcGplMTNraDdVNjUyNXk4
 

services/idm/pkg/command/server.go

@@ -126,6 +126,7 @@ func bootstrap(logger log.Logger, cfg *config.Config, srvcfg server.Config) erro
 		Name     string
 		Password string
 		ID       string
+		Issuer   string
 	}
 
 	serviceUsers := []svcUser{
@@ -148,6 +149,7 @@ func bootstrap(logger log.Logger, cfg *config.Config, srvcfg server.Config) erro
 			Name:     "admin",
 			Password: cfg.ServiceUserPasswords.OcisAdmin,
 			ID:       cfg.AdminUserID,
+			Issuer:   cfg.DemoUsersIssuerUrl,
 		})
 	}
 
@@ -179,7 +181,7 @@ func bootstrap(logger log.Logger, cfg *config.Config, srvcfg server.Config) erro
 			}
 		}
 		// We need to treat the hash as binary in the LDIF template to avoid
-		// go-ldap/ldif to to any fancy escaping
+		// go-ldap/ldif to do any fancy escaping
 		serviceUsers[i].Password = base64.StdEncoding.EncodeToString([]byte(serviceUsers[i].Password))
 	}
 	var tmplWriter strings.Builder
@@ -190,7 +192,16 @@ func bootstrap(logger log.Logger, cfg *config.Config, srvcfg server.Config) erro
 
 	bootstrapData := tmplWriter.String()
 	if cfg.CreateDemoUsers {
-		bootstrapData = bootstrapData + "\n" + idm.DemoUsersLDIF
+		demoUsersTmpl, err := template.New("demousers").Parse(idm.DemoUsersLDIF)
+		if err != nil {
+			return err
+		}
+		var demoUsersWriter strings.Builder
+		err = demoUsersTmpl.Execute(&demoUsersWriter, cfg.DemoUsersIssuerUrl)
+		if err != nil {
+			return err
+		}
+		bootstrapData = bootstrapData + "\n" + demoUsersWriter.String()
 	}
 
 	s := strings.NewReader(bootstrapData)

services/idm/pkg/config/config.go

@@ -16,8 +16,9 @@ type Config struct {
 	Log     *Log     `yaml:"log"`
 	Debug   Debug    `yaml:"debug"`
 
-	IDM             Settings `yaml:"idm"`
-	CreateDemoUsers bool     `yaml:"create_demo_users" env:"IDM_CREATE_DEMO_USERS" desc:"Flag to enable or disable the creation of the demo users." introductionVersion:"pre5.0"`
+	IDM                Settings `yaml:"idm"`
+	CreateDemoUsers    bool     `yaml:"create_demo_users" env:"IDM_CREATE_DEMO_USERS" desc:"Flag to enable or disable the creation of the demo users." introductionVersion:"pre5.0"`
+	DemoUsersIssuerUrl string   `yaml:"demo_users_issuer_url" env:"OCIS_URL;OCIS_OIDC_ISSUER" desc:"The OIDC issuer URL to assign to the demo users." introductionVersion:"pre5.0"`
 
 	ServiceUserPasswords ServiceUserPasswords `yaml:"service_user_passwords"`
 	AdminUserID          string               `yaml:"admin_user_id" env:"OCIS_ADMIN_USER_ID;IDM_ADMIN_USER_ID" desc:"ID of the user that should receive admin privileges. Consider that the UUID can be encoded in some LDAP deployment configurations like in .ldif files. These need to be decoded beforehand." introductionVersion:"pre5.0"`

services/idm/pkg/config/defaults/defaultconfig.go

@@ -27,7 +27,8 @@ func DefaultConfig() *config.Config {
 		Service: config.Service{
 			Name: "idm",
 		},
-		CreateDemoUsers: false,
+		CreateDemoUsers:    false,
+		DemoUsersIssuerUrl: "https://localhost:9200",
 		IDM: config.Settings{
 			LDAPSAddr:    "127.0.0.1:9235",
 			Cert:         path.Join(defaults.BaseDataPath(), "idm", "ldap.crt"),