* fix: [OCISDEV-1523] fix the LDAP master-ID filter for an empty base filter
EnhanceFilterWithMasterID replaced an empty LDAP filter with a master-ID-only
filter. This action restricted an unrestricted search to master-ID users
only. The bug broke the cross-instance user search in multi-instance
deployments. The function now keeps an empty filter unchanged.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* fix: [OCISDEV-1523] require an explicit LDAP user filter with a master ID
EnhanceFilterWithMasterID in ocis-pkg/ldap/filter.go now keeps an empty
LDAP filter unchanged instead of restricting it to master-ID users only.
The auth-basic, users, groups, and graph services reuse this function to
compute their default LDAP user filter at startup.
An unset filter now means these services resolve or authenticate every
user in the shared LDAP directory, not only master-ID users. This action
is a behavior change for a deployment that sets
OCIS_MULTI_INSTANCE_MASTER_ID without an explicit OCIS_LDAP_USER_FILTER.
Each service now rejects startup when OCIS_MULTI_INSTANCE_MASTER_ID is
set and its own user filter is empty. This action keeps a multi-instance
deployment scoped to its own users by default.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* refactor: [OCISDEV-1523] simplify EnhanceFilterWithMasterID guard clauses
The function collapses three early-return guards into one condition.
This action removes a duplicated rationale comment between filter.go
and filter_test.go.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* docs: [OCISDEV-1523] point the changelog entry at the master backport PR
The changelog entry pointed at PR 13096, the stable-8.2 backport. This
commit points the entry at the master-branch PR number instead.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
* fix: use "ownCloudUUID" as attribute name everywhere
* fix: use "displayName" as LDAP attribute
* fix: ensure the WopiFolderURLBaseURL always ends with "/"
* fix: restore wrong substitution
* Revert "fix: use "displayName" as LDAP attribute"
This reverts commit 02de7a2db7.
Note that the default values outside of the graph service still remains
Bump the vendored reva dependency to pick up the opt-in bounded LDAP
connection pool (owncloud/reva#658, #665), and wire it into oCIS: add
pool_enabled/pool_size/pool_checkout_timeout config to auth-basic,
users, groups and graph, forward it into the reva config map for the
first three, and unify graph's identity backend onto reva's LDAP
client (utils.GetLDAPClientFromConfig) instead of its own hand-rolled
reconnecting client, now that reva implements PasswordModify and
ModifyWithResult on both LDAP clients. Pooling is off by default and
fully backwards compatible.
Signed-off-by: Lukas Hirt <info@hirt.cz>
test(ldap): [OCISDEV-1031] run graph LDAP suites with pooling enabled in CI
Add a dedicated ldap-pool-tests job to acceptance-tests.yml that reruns
apiGraphUser/apiGraph/apiGraphGroup with OCIS_LDAP_POOL_ENABLED=true, so
concurrent behat requests exercise checkout/release, eviction and the
pooled PasswordModify/ModifyWithResult path end-to-end, in addition to
the existing pooling-disabled runs of the same suites.
Signed-off-by: Lukas Hirt <info@hirt.cz>
fix(ldap): [OCISDEV-1031] set real pool_size/pool_checkout_timeout defaults
Only PoolEnabled: false was set in the four defaultconfig.go files;
PoolSize/PoolCheckoutTimeout were left as Go zero values (0/0s),
relying on reva's NewLDAPPool substituting 5/30s when <= 0. That
reads as "zero connections" to an operator in the generated yaml
config rather than "default 5". Set the real defaults (5, 30s)
so documented defaults match what's emitted.
Signed-off-by: Lukas Hirt <info@hirt.cz>
chore(deps): [OCISDEV-1031] bump reva to pick up LDAP TLS fixes
Bumps the vendored reva dependency to owncloud/reva@8ee2020, picking
up owncloud/reva#672 (restore MinVersion: tls.VersionTLS12 on LDAP
TLS connections) and owncloud/reva#674 (restore pinned-CA-only trust
and PEM validation for the CA-cert path), both flagged during review
of this PR.
Signed-off-by: Lukas Hirt <info@hirt.cz>
docs: point changelog fragment at forward-port PR #12689
Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
Update services/gateway/README.md
Co-authored-by: Martin <github@diemattels.at>
fix env tag
Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
For some reason LDAP_BIND_PASSWORD was forgotten when all the other global LDAP_
variables got renamed.
Also marks LDAP_BIND_PASSWORD and LDAP_USER_SCHEMA_ID_IS_OCTETSTRING for removal with 5.0.0
Partial: #7176
* enhancement: use reva client pool selectors
register mock service to registry and pass tests
* enhancement: bump reva
* Fix a couple of linter issues
---------
Co-authored-by: Ralf Haferkamp <rhaferkamp@owncloud.com>
