fix(idm): sync bind config when resetting a service user password
Resetting an IDM service user password with `ocis idm resetpassword
--user-type service` only changed the entry in the IDM directory. Services
such as auth-basic, users and groups still bound to LDAP as the reva service
user using the old bind_password from their configuration, so after a restart
those binds failed and regular admin login started returning 401 Unauthorized.
The command now rewrites the matching bind_password and service_user_passwords
keys in ocis.yaml when it is present, and always prints the environment
variables that must carry the new password for env-var and distributed
deployments it cannot rewrite.
Fixes: https://github.com/owncloud/ocis/issues/12569
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* feat(idm): add --service-user flag to resetpassword command
The DN was hardcoded to ou=users, making it impossible to reset
passwords for service accounts (libregraph, idp, reva) which live
under ou=sysusers. The new --service-user flag selects the correct OU.
Fixes: #12106
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Paul Faure <paul@faure.ca>
* docs: update changelog with PR number
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Paul Faure <paul@faure.ca>
* refactor(idm): use --user-type flag instead of --service-user bool
Replace the --service-user boolean flag with a --user-type string flag
that accepts 'user' (default) or 'service'. This is more extensible
if additional user types are added in the future.
Addresses review feedback from mklos-kw.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: Paul Faure <paul@faure.ca>
---------
Signed-off-by: Paul Faure <paul@faure.ca>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
For certain setups we don't need the ADMIN_USER_ID to be set. It is
mainly needed for bootstrapping the internal idm and the initial role
assignment. If roles are assigned by other means (e.g. OIDC claims
in the future) we don't need it.
This makes the ADMIN_USER_ID optional, also if ADMIN_USER_ID is unset
we don't need to configure a password for the admin user. We will still
generated the admin_id and password when running 'ocis init', but it is
ok to run manual setups without those settings.
The help flag is configured automatically by default already. We don't
need to redo that for every single service.
This also addresses one of the finding of "go race" (#4088)
