703bbe1113
* fix: [OCISDEV-1523] fix the LDAP master-ID filter for an empty base filter EnhanceFilterWithMasterID replaced an empty LDAP filter with a master-ID-only filter. This action restricted an unrestricted search to master-ID users only. The bug broke the cross-instance user search in multi-instance deployments. The function now keeps an empty filter unchanged. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix: [OCISDEV-1523] require an explicit LDAP user filter with a master ID EnhanceFilterWithMasterID in ocis-pkg/ldap/filter.go now keeps an empty LDAP filter unchanged instead of restricting it to master-ID users only. The auth-basic, users, groups, and graph services reuse this function to compute their default LDAP user filter at startup. An unset filter now means these services resolve or authenticate every user in the shared LDAP directory, not only master-ID users. This action is a behavior change for a deployment that sets OCIS_MULTI_INSTANCE_MASTER_ID without an explicit OCIS_LDAP_USER_FILTER. Each service now rejects startup when OCIS_MULTI_INSTANCE_MASTER_ID is set and its own user filter is empty. This action keeps a multi-instance deployment scoped to its own users by default. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * refactor: [OCISDEV-1523] simplify EnhanceFilterWithMasterID guard clauses The function collapses three early-return guards into one condition. This action removes a duplicated rationale comment between filter.go and filter_test.go. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * docs: [OCISDEV-1523] point the changelog entry at the master backport PR The changelog entry pointed at PR 13096, the stable-8.2 backport. This commit points the entry at the master-branch PR number instead. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
Auth-Basic
The oCIS Auth Basic service provides basic authentication for those clients who cannot handle OpenID Connect. This should only be enabled for tests and development.
The auth-basic service is responsible for validating authentication of incoming requests. To do so, it will use the configured auth manager, see the Auth Managers section. Only HTTP basic auth requests to ocis will involve the auth-basic service.
To enable auth-basic, you first must set PROXY_ENABLE_BASIC_AUTH to true.
The auth Service Family
ocis uses serveral authentication services for different use cases. All services that start with auth- are part of the authentication service family. Each member authenticates requests with different scopes. As of now, these services exist:
auth-apphandles authentication of external 3rd party appsauth-basichandles basic authenticationauth-bearerhandles oidc authenticationauth-machinehandles interservice authentication when a user is impersonatedauth-servicehandles interservice authentication when using service accounts
Auth Managers
Since the auth-basic service does not do any validation itself, it needs to be configured with an authentication manager. One can use the AUTH_BASIC_AUTH_MANAGER environment variable to configure this. Currently only one auth manager is supported: "ldap"
LDAP Auth Manager
Setting AUTH_BASIC_AUTH_MANAGER to "ldap" will configure the auth-basic service to use LDAP as auth manager. This is the recommended option for running in a production and testing environment. More details on how to configure LDAP with ocis can be found in the admin docs.
Other Auth Managers
oCIS currently supports no other auth manager
Scalability
When using "ldap" as auth manager, there is no persistance as requests will just be forwarded to the LDAP server. Therefore, multiple instances of the auth-basic service can be started without further configuration. Be aware, that other auth managers might not allow that.