diff --git a/services/graph/pkg/service/v0/users.go b/services/graph/pkg/service/v0/users.go index 06e08d4a6..9dfdde5b4 100644 --- a/services/graph/pkg/service/v0/users.go +++ b/services/graph/pkg/service/v0/users.go @@ -291,6 +291,7 @@ func (g Graph) GetUsers(w http.ResponseWriter, r *http.Request) { Id: u.Id, DisplayName: u.DisplayName, UserType: u.UserType, + Identities: u.Identities, } if g.config.API.ShowUserEmailInResults { diff --git a/services/idm/idm.go b/services/idm/idm.go index be4a60e54..6b00e766f 100644 --- a/services/idm/idm.go +++ b/services/idm/idm.go @@ -4,8 +4,12 @@ import ( _ "embed" ) +// BaseLDIF is a template for base LDAP entries +// //go:embed ldif/base.ldif.tmpl var BaseLDIF string -//go:embed ldif/demousers.ldif +// DemoUsersLDIF is a template for demo users +// +//go:embed ldif/demousers.ldif.tmpl var DemoUsersLDIF string diff --git a/services/idm/ldif/base.ldif.tmpl b/services/idm/ldif/base.ldif.tmpl index 640fdd874..5d8fb5791 100644 --- a/services/idm/ldif/base.ldif.tmpl +++ b/services/idm/ldif/base.ldif.tmpl @@ -31,6 +31,7 @@ displayName: Admin description: An admin for this oCIS instance. mail: admin@example.org ownCloudUUID: {{ .ID }} +oCExternalIdentity: $ {{ .Issuer }} $ {{ .ID }} {{ else -}} dn: uid={{ .Name }},ou=sysusers,o=libregraph-idm objectClass: account diff --git a/services/idm/ldif/demousers.ldif b/services/idm/ldif/demousers.ldif.tmpl similarity index 94% rename from services/idm/ldif/demousers.ldif rename to services/idm/ldif/demousers.ldif.tmpl index 32111f4f9..8640c7064 100644 --- a/services/idm/ldif/demousers.ldif +++ b/services/idm/ldif/demousers.ldif.tmpl @@ -14,6 +14,7 @@ description: A German-born theoretical physicist who developed the theory of rel mail: einstein@example.org ownCloudUserEnabled: TRUE ownCloudUUID: 4c510ada-c86b-4815-8820-42cdf82c3d51 +oCExternalIdentity: $ {{.}} $ 4c510ada-c86b-4815-8820-42cdf82c3d51 userPassword:: e0FSR09OMn0kYXJnb24yaWQkdj0xOSRtPTY1NTM2LHQ9MSxwPTIkOFpyclR0NXA1a0VmVlhL akNHaVBEUSRnemZCWWwrTHdzTUhXQWJSMEJ2NnRiZk1XZjZaOVJ0Mms5Z3VkSWJ5bzg4 @@ -33,6 +34,7 @@ description: A Polish and naturalized-French physicist and chemist who conducted mail: marie@example.org ownCloudUserEnabled: TRUE ownCloudUUID: f7fbf8c8-139b-4376-b307-cf0a8c2d0d9c +oCExternalIdentity: $ {{.}} $ f7fbf8c8-139b-4376-b307-cf0a8c2d0d9c userPassword:: e0FSR09OMn0kYXJnb24yaWQkdj0xOSRtPTY1NTM2LHQ9MSxwPTIkUHJzWkpQQW9pMkFwZHlJ a2Q1NGkzQSRnalZzR3doTmk2K0djenJ4SVdPalN2UlBpWXhKSXpHVG4vcnpQZzkvSlZN @@ -52,6 +54,7 @@ description: An American mathematician whose calculations of orbital mechanics a mail: katherine@example.org ownCloudUserEnabled: TRUE ownCloudUUID: 534bb038-6f9d-4093-946f-133be61fa4e7 +oCExternalIdentity: $ {{.}} $ 534bb038-6f9d-4093-946f-133be61fa4e7 userPassword:: e0FSR09OMn0kYXJnb24yaWQkdj0xOSRtPTY1NTM2LHQ9MSxwPTIkYVd0b1RXdHdZblZuYjB4 Nk0wRm1adyRyeXVESVg0a3JSNGdmcnduZEh3aVpaSjVDUQ== @@ -71,6 +74,7 @@ description: An American theoretical physicist, known for his work in the path i mail: richard@example.org ownCloudUserEnabled: TRUE ownCloudUUID: 932b4540-8d16-481e-8ef4-588e4b6b151c +oCExternalIdentity: $ {{.}} $ 932b4540-8d16-481e-8ef4-588e4b6b151c userPassword:: e0FSR09OMn0kYXJnb24yaWQkdj0xOSRtPTY1NTM2LHQ9MSxwPTIkNjlNcUQxem5sUUZ2SUha d2dxU00xQSRVQmNEa2NDZktMemVpQnlyb0JjOTdCSVRhTFo2WjZIL2dhbytSTVh6OHhn @@ -90,6 +94,7 @@ description: A worker in the IT Department of Reynholm Industries. Of all the wo mail: moss@example.org ownCloudUserEnabled: TRUE ownCloudUUID: 058bff95-6708-4fe5-91e4-9ea3d377588b +oCExternalIdentity: $ {{.}} $ 058bff95-6708-4fe5-91e4-9ea3d377588b userPassword:: e0FSR09OMn0kYXJnb24yaWQkdj0xOSRtPTY1NTM2LHQ9MSxwPTIkZU0xaXR6amQ2dlNSSERx NlZCbXBlQSQxNzBhcTB3YjJZZ2NLU2cwWDhHY3l6ckZwMUllcGplMTNraDdVNjUyNXk4 diff --git a/services/idm/pkg/command/server.go b/services/idm/pkg/command/server.go index 3ec90806a..1c691b468 100644 --- a/services/idm/pkg/command/server.go +++ b/services/idm/pkg/command/server.go @@ -126,6 +126,7 @@ func bootstrap(logger log.Logger, cfg *config.Config, srvcfg server.Config) erro Name string Password string ID string + Issuer string } serviceUsers := []svcUser{ @@ -148,6 +149,7 @@ func bootstrap(logger log.Logger, cfg *config.Config, srvcfg server.Config) erro Name: "admin", Password: cfg.ServiceUserPasswords.OcisAdmin, ID: cfg.AdminUserID, + Issuer: cfg.DemoUsersIssuerUrl, }) } @@ -179,7 +181,7 @@ func bootstrap(logger log.Logger, cfg *config.Config, srvcfg server.Config) erro } } // We need to treat the hash as binary in the LDIF template to avoid - // go-ldap/ldif to to any fancy escaping + // go-ldap/ldif to do any fancy escaping serviceUsers[i].Password = base64.StdEncoding.EncodeToString([]byte(serviceUsers[i].Password)) } var tmplWriter strings.Builder @@ -190,7 +192,16 @@ func bootstrap(logger log.Logger, cfg *config.Config, srvcfg server.Config) erro bootstrapData := tmplWriter.String() if cfg.CreateDemoUsers { - bootstrapData = bootstrapData + "\n" + idm.DemoUsersLDIF + demoUsersTmpl, err := template.New("demousers").Parse(idm.DemoUsersLDIF) + if err != nil { + return err + } + var demoUsersWriter strings.Builder + err = demoUsersTmpl.Execute(&demoUsersWriter, cfg.DemoUsersIssuerUrl) + if err != nil { + return err + } + bootstrapData = bootstrapData + "\n" + demoUsersWriter.String() } s := strings.NewReader(bootstrapData) diff --git a/services/idm/pkg/config/config.go b/services/idm/pkg/config/config.go index b8e0f9665..8aecb07c2 100644 --- a/services/idm/pkg/config/config.go +++ b/services/idm/pkg/config/config.go @@ -16,8 +16,9 @@ type Config struct { Log *Log `yaml:"log"` Debug Debug `yaml:"debug"` - IDM Settings `yaml:"idm"` - CreateDemoUsers bool `yaml:"create_demo_users" env:"IDM_CREATE_DEMO_USERS" desc:"Flag to enable or disable the creation of the demo users." introductionVersion:"pre5.0"` + IDM Settings `yaml:"idm"` + CreateDemoUsers bool `yaml:"create_demo_users" env:"IDM_CREATE_DEMO_USERS" desc:"Flag to enable or disable the creation of the demo users." introductionVersion:"pre5.0"` + DemoUsersIssuerUrl string `yaml:"demo_users_issuer_url" env:"OCIS_URL;OCIS_OIDC_ISSUER" desc:"The OIDC issuer URL to assign to the demo users." introductionVersion:"pre5.0"` ServiceUserPasswords ServiceUserPasswords `yaml:"service_user_passwords"` AdminUserID string `yaml:"admin_user_id" env:"OCIS_ADMIN_USER_ID;IDM_ADMIN_USER_ID" desc:"ID of the user that should receive admin privileges. Consider that the UUID can be encoded in some LDAP deployment configurations like in .ldif files. These need to be decoded beforehand." introductionVersion:"pre5.0"` diff --git a/services/idm/pkg/config/defaults/defaultconfig.go b/services/idm/pkg/config/defaults/defaultconfig.go index 93e77da15..78bc0be0a 100644 --- a/services/idm/pkg/config/defaults/defaultconfig.go +++ b/services/idm/pkg/config/defaults/defaultconfig.go @@ -27,7 +27,8 @@ func DefaultConfig() *config.Config { Service: config.Service{ Name: "idm", }, - CreateDemoUsers: false, + CreateDemoUsers: false, + DemoUsersIssuerUrl: "https://localhost:9200", IDM: config.Settings{ LDAPSAddr: "127.0.0.1:9235", Cert: path.Join(defaults.BaseDataPath(), "idm", "ldap.crt"),