Thanks to visit codestin.com
Credit goes to github.com

Skip to content

use ldap instead of ldaps internally #2880

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dragonchaser merged 3 commits into from
Jun 3, 2026
Merged

use ldap instead of ldaps internally #2880

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
698eda9
use ldap instead of ldaps internally
dragonchaser Jun 2, 2026
a47da33
force ldap to listen only on localhost
dragonchaser Jun 3, 2026
392c9d5
incorporate requested changes
dragonchaser Jun 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 1 addition & 5 deletions services/auth-basic/pkg/config/defaults/defaultconfig.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,6 @@
package defaults

import (
"path/filepath"

"github.com/opencloud-eu/opencloud/pkg/config/defaults"
"github.com/opencloud-eu/opencloud/pkg/shared"
"github.com/opencloud-eu/opencloud/pkg/structs"
"github.com/opencloud-eu/opencloud/services/auth-basic/pkg/config"
Expand Down Expand Up @@ -38,8 +35,7 @@ func DefaultConfig() *config.Config {
AuthProvider: "ldap",
AuthProviders: config.AuthProviders{
LDAP: config.LDAPProvider{
URI: "ldaps://localhost:9235",
CACert: filepath.Join(defaults.BaseDataPath(), "idm", "ldap.crt"),
URI: "ldap://localhost:9236",
Insecure: false,
UserBaseDN: "ou=users,o=libregraph-idm",
GroupBaseDN: "ou=groups,o=libregraph-idm",
Expand Down
5 changes: 1 addition & 4 deletions services/graph/pkg/config/defaults/defaultconfig.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,9 @@
package defaults

import (
"path"
"strings"
"time"

"github.com/opencloud-eu/opencloud/pkg/config/defaults"
"github.com/opencloud-eu/opencloud/pkg/shared"
"github.com/opencloud-eu/opencloud/pkg/structs"
"github.com/opencloud-eu/opencloud/services/graph/pkg/config"
Expand Down Expand Up @@ -79,9 +77,8 @@ func DefaultConfig() *config.Config {
Identity: config.Identity{
Backend: "ldap",
LDAP: config.LDAP{
URI: "ldaps://localhost:9235",
URI: "ldap://localhost:9236",
Insecure: false,
CACert: path.Join(defaults.BaseDataPath(), "idm", "ldap.crt"),
BindDN: "uid=libregraph,ou=sysusers,o=libregraph-idm",
UseServerUUID: false,
UsePasswordModExOp: true,
Expand Down
6 changes: 1 addition & 5 deletions services/groups/pkg/config/defaults/defaultconfig.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,6 @@
package defaults

import (
"path/filepath"

"github.com/opencloud-eu/opencloud/pkg/config/defaults"
"github.com/opencloud-eu/opencloud/pkg/shared"
"github.com/opencloud-eu/opencloud/pkg/structs"
"github.com/opencloud-eu/opencloud/services/groups/pkg/config"
Expand Down Expand Up @@ -38,8 +35,7 @@ func DefaultConfig() *config.Config {
Driver: "ldap",
Drivers: config.Drivers{
LDAP: config.LDAPDriver{
URI: "ldaps://localhost:9235",
CACert: filepath.Join(defaults.BaseDataPath(), "idm", "ldap.crt"),
URI: "ldap://localhost:9236",
Insecure: false,
UserBaseDN: "ou=users,o=libregraph-idm",
GroupBaseDN: "ou=groups,o=libregraph-idm",
Expand Down
27 changes: 15 additions & 12 deletions services/idm/pkg/command/server.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,10 +8,11 @@ import (
"html/template"
"os"
"os/signal"
"path"
"strings"

"github.com/opencloud-eu/opencloud/pkg/config/configlog"
pkgcrypto "github.com/opencloud-eu/opencloud/pkg/crypto"
"github.com/opencloud-eu/opencloud/pkg/config/defaults"
"github.com/opencloud-eu/opencloud/pkg/log"
"github.com/opencloud-eu/opencloud/pkg/runner"
"github.com/opencloud-eu/opencloud/services/idm"
Expand Down Expand Up @@ -47,23 +48,25 @@ func Server(cfg *config.Config) *cobra.Command {
gr := runner.NewGroup()
{
servercfg := server.Config{
Logger: log.LogrusWrap(logger.Logger),
LDAPHandler: "boltdb",
LDAPSListenAddr: cfg.IDM.LDAPSAddr,
TLSCertFile: cfg.IDM.Cert,
TLSKeyFile: cfg.IDM.Key,
LDAPBaseDN: "o=libregraph-idm",
LDAPAdminDN: "uid=libregraph,ou=sysusers,o=libregraph-idm",
Logger: log.LogrusWrap(logger.Logger),
LDAPHandler: "boltdb",
LDAPListenAddr: cfg.IDM.LDAPAddr,
Comment thread
dragonchaser marked this conversation as resolved.
LDAPBaseDN: "o=libregraph-idm",
LDAPAdminDN: "uid=libregraph,ou=sysusers,o=libregraph-idm",

BoltDBFile: cfg.IDM.DatabasePath,
}

if cfg.IDM.LDAPSAddr != "" {
// Generate a self-signing cert if no certificate is present
if err := pkgcrypto.GenCert(cfg.IDM.Cert, cfg.IDM.Key, logger); err != nil {
logger.Fatal().Err(err).Msgf("Could not generate test-certificate")
}
servercfg.LDAPSListenAddr = cfg.IDM.LDAPSAddr
Comment thread
dragonchaser marked this conversation as resolved.
servercfg.TLSCertFile = cfg.IDM.Cert
servercfg.TLSKeyFile = cfg.IDM.Key
}

if err := os.MkdirAll(path.Join(defaults.BaseDataPath(), "idm"), 0700); err != nil {
logger.Fatal().Err(err).Msgf("Could not create data directory for idm")
}

if _, err := os.Stat(servercfg.BoltDBFile); errors.Is(err, os.ErrNotExist) {
logger.Debug().Msg("Bootstrapping IDM database")
if err = bootstrap(logger, cfg, servercfg); err != nil {
Expand Down
1 change: 1 addition & 0 deletions services/idm/pkg/config/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@ type Config struct {

type Settings struct {
LDAPSAddr string `yaml:"ldaps_addr" env:"IDM_LDAPS_ADDR" desc:"Listen address for the LDAPS listener (ip-addr:port)." introductionVersion:"1.0.0"`
LDAPAddr string
Cert string `yaml:"cert" env:"IDM_LDAPS_CERT" desc:"File name of the TLS server certificate for the LDAPS listener. If not defined, the root directory derives from $OC_BASE_DATA_PATH/idm." introductionVersion:"1.0.0"`
Key string `yaml:"key" env:"IDM_LDAPS_KEY" desc:"File name for the TLS certificate key for the server certificate. If not defined, the root directory derives from $OC_BASE_DATA_PATH/idm." introductionVersion:"1.0.0"`
DatabasePath string `yaml:"database" env:"IDM_DATABASE_PATH" desc:"Full path to the IDM backend database. If not defined, the root directory derives from $OC_BASE_DATA_PATH/idm." introductionVersion:"1.0.0"`
Expand Down
6 changes: 2 additions & 4 deletions services/idm/pkg/config/defaults/defaultconfig.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,9 +30,7 @@ func DefaultConfig() *config.Config {
CreateDemoUsers: false,
DemoUsersIssuerUrl: "https://localhost:9200",
IDM: config.Settings{
LDAPSAddr: "127.0.0.1:9235",
Cert: path.Join(defaults.BaseDataPath(), "idm", "ldap.crt"),
Key: path.Join(defaults.BaseDataPath(), "idm", "ldap.key"),
LDAPAddr: "127.0.0.1:9236",
DatabasePath: path.Join(defaults.BaseDataPath(), "idm", "idm.boltdb"),
},
}
Expand All @@ -51,5 +49,5 @@ func EnsureDefaults(cfg *config.Config) {

// Sanitize sanitizes the configuration
func Sanitize(cfg *config.Config) {
// nothing to sanitize here
// nothing to do yet
}
21 changes: 21 additions & 0 deletions services/idm/pkg/config/parser/parse.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ package parser

import (
"errors"
"net"

occfg "github.com/opencloud-eu/opencloud/pkg/config"
"github.com/opencloud-eu/opencloud/pkg/shared"
Expand Down Expand Up @@ -53,5 +54,25 @@ func Validate(cfg *config.Config) error {
return shared.MissingServiceUserPassword(cfg.Service.Name, "REVA")
}

ip, err := net.ResolveTCPAddr("tcp", cfg.IDM.LDAPAddr) // validate the LDAP address if set

if err != nil {
return errors.New("invalid configuration: 'ldap_addr' is not a valid address")
}

if !ip.IP.IsLoopback() {
// loopback addresses are allowed to be used with ldap_addr, but not with ldaps_addr, for security reasons
return errors.New("invalid configuration: 'ldap_addr' is set but 'ldaps_addr' is not set. For security reasons, the 'ldap_addr' setting is only allowed to be used with loopback addresses. Please set 'ldaps_addr' to a valid address and port to listen for LDAPS connections")
}

if cfg.IDM.LDAPSAddr != "" {
if cfg.IDM.Cert == "" {
return errors.New("invalid configuration: 'ldaps_addr' is set but 'cert' is not set. Please set 'cert' to a valid path to a TLS certificate")
}
if cfg.IDM.Key == "" {
return errors.New("invalid configuration: 'ldaps_addr' is set but 'key' is not set. Please set 'key' to a valid path to a TLS certificate key")
}
}

return nil
}
3 changes: 1 addition & 2 deletions services/idp/pkg/config/defaults/defaultconfig.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -119,8 +119,7 @@ func DefaultConfig() *config.Config {
},
},
Ldap: config.Ldap{
URI: "ldaps://localhost:9235",
TLSCACert: filepath.Join(defaults.BaseDataPath(), "idm", "ldap.crt"),
URI: "ldap://localhost:9236",
BindDN: "uid=idp,ou=sysusers,o=libregraph-idm",
BaseDN: "ou=users,o=libregraph-idm",
Scope: "sub",
Expand Down
6 changes: 1 addition & 5 deletions services/users/pkg/config/defaults/defaultconfig.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,6 @@
package defaults

import (
"path/filepath"

"github.com/opencloud-eu/opencloud/pkg/config/defaults"
"github.com/opencloud-eu/opencloud/pkg/shared"
"github.com/opencloud-eu/opencloud/pkg/structs"
"github.com/opencloud-eu/opencloud/services/users/pkg/config"
Expand Down Expand Up @@ -38,8 +35,7 @@ func DefaultConfig() *config.Config {
Driver: "ldap",
Drivers: config.Drivers{
LDAP: config.LDAPDriver{
URI: "ldaps://localhost:9235",
CACert: filepath.Join(defaults.BaseDataPath(), "idm", "ldap.crt"),
URI: "ldap://localhost:9236",
Insecure: false,
UserBaseDN: "ou=users,o=libregraph-idm",
GroupBaseDN: "ou=groups,o=libregraph-idm",
Expand Down