* feat(ldap): [OCISDEV-1031] add opt-in LDAP connection pool
Bump the vendored reva dependency to pick up the opt-in bounded LDAP
connection pool (owncloud/reva#658, #665), and wire it into oCIS: add
pool_enabled/pool_size/pool_checkout_timeout config to auth-basic,
users, groups and graph, forward it into the reva config map for the
first three, and unify graph's identity backend onto reva's LDAP
client (utils.GetLDAPClientFromConfig) instead of its own hand-rolled
reconnecting client, now that reva implements PasswordModify and
ModifyWithResult on both LDAP clients. Pooling is off by default and
fully backwards compatible.
Signed-off-by: Lukas Hirt <info@hirt.cz>
test(ldap): [OCISDEV-1031] run graph LDAP suites with pooling enabled in CI
Add a dedicated ldap-pool-tests job to acceptance-tests.yml that reruns
apiGraphUser/apiGraph/apiGraphGroup with OCIS_LDAP_POOL_ENABLED=true, so
concurrent behat requests exercise checkout/release, eviction and the
pooled PasswordModify/ModifyWithResult path end-to-end, in addition to
the existing pooling-disabled runs of the same suites.
Signed-off-by: Lukas Hirt <info@hirt.cz>
fix(ldap): [OCISDEV-1031] set real pool_size/pool_checkout_timeout defaults
Only PoolEnabled: false was set in the four defaultconfig.go files;
PoolSize/PoolCheckoutTimeout were left as Go zero values (0/0s),
relying on reva's NewLDAPPool substituting 5/30s when <= 0. That
reads as "zero connections" to an operator in the generated yaml
config rather than "default 5". Set the real defaults (5, 30s)
so documented defaults match what's emitted.
Signed-off-by: Lukas Hirt <info@hirt.cz>
chore(deps): [OCISDEV-1031] bump reva to pick up LDAP TLS fixes
Bumps the vendored reva dependency to owncloud/reva@8ee2020, picking
up owncloud/reva#672 (restore MinVersion: tls.VersionTLS12 on LDAP
TLS connections) and owncloud/reva#674 (restore pinned-CA-only trust
and PEM validation for the CA-cert path), both flagged during review
of this PR.
Signed-off-by: Lukas Hirt <info@hirt.cz>
docs: point changelog fragment at forward-port PR #12688
* feat(ldap): [OCISDEV-1031] add opt-in LDAP connection pool
Bump the vendored reva dependency to pick up the opt-in bounded LDAP
connection pool (owncloud/reva#658, #665), and wire it into oCIS: add
pool_enabled/pool_size/pool_checkout_timeout config to auth-basic,
users, groups and graph, forward it into the reva config map for the
first three, and unify graph's identity backend onto reva's LDAP
client (utils.GetLDAPClientFromConfig) instead of its own hand-rolled
reconnecting client, now that reva implements PasswordModify and
ModifyWithResult on both LDAP clients. Pooling is off by default and
fully backwards compatible.
Signed-off-by: Lukas Hirt <info@hirt.cz>
test(ldap): [OCISDEV-1031] run graph LDAP suites with pooling enabled in CI
Add a dedicated ldap-pool-tests job to acceptance-tests.yml that reruns
apiGraphUser/apiGraph/apiGraphGroup with OCIS_LDAP_POOL_ENABLED=true, so
concurrent behat requests exercise checkout/release, eviction and the
pooled PasswordModify/ModifyWithResult path end-to-end, in addition to
the existing pooling-disabled runs of the same suites.
Signed-off-by: Lukas Hirt <info@hirt.cz>
fix(ldap): [OCISDEV-1031] set real pool_size/pool_checkout_timeout defaults
Only PoolEnabled: false was set in the four defaultconfig.go files;
PoolSize/PoolCheckoutTimeout were left as Go zero values (0/0s),
relying on reva's NewLDAPPool substituting 5/30s when <= 0. That
reads as "zero connections" to an operator in the generated yaml
config rather than "default 5". Set the real defaults (5, 30s)
so documented defaults match what's emitted.
Signed-off-by: Lukas Hirt <info@hirt.cz>
chore(deps): [OCISDEV-1031] bump reva to pick up LDAP TLS fixes
Bumps the vendored reva dependency to owncloud/reva@8ee2020, picking
up owncloud/reva#672 (restore MinVersion: tls.VersionTLS12 on LDAP
TLS connections) and owncloud/reva#674 (restore pinned-CA-only trust
and PEM validation for the CA-cert path), both flagged during review
of this PR.
Signed-off-by: Lukas Hirt <info@hirt.cz>
docs: point changelog fragment at forward-port PR #12688
* chore: bump brace-expansion
---------
Co-authored-by: Michal Klos <michal.klos@kiteworks.com>
Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
Update services/gateway/README.md
Co-authored-by: Martin <github@diemattels.at>
fix env tag
Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
For some reason LDAP_BIND_PASSWORD was forgotten when all the other global LDAP_
variables got renamed.
Also marks LDAP_BIND_PASSWORD and LDAP_USER_SCHEMA_ID_IS_OCTETSTRING for removal with 5.0.0
Partial: #7176
* enhancement: use reva client pool selectors
register mock service to registry and pass tests
* enhancement: bump reva
* Fix a couple of linter issues
---------
Co-authored-by: Ralf Haferkamp <rhaferkamp@owncloud.com>
This PR adds configuration parameters to the auth-basic and users
services that passes them through to reva. These configuration parameters
are all related to the new user disable mechanism that @Excds added to
the graph API, and that I added to reva.
