DevOps/ansible-role-dex
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Deploy

Browse Source
This commit is contained in:
eric
2026-10-27 16:04:33 -04:00
parent 6de8385829
commit 9a31efc38e
6 changed files with 33 additions and 80 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+16 -15
View File
@@ -59,12 +59,13 @@ is a separate app-side migration, not another set of automatically active OIDC
environment variables. Keep a tested administrator fallback and avoid automatic
email-only account linking when migrating existing users.
The website's `www-ldap` connector uses entryUUID while the legacy `ldap`
connector uses uid. Those produce different subjects for the same directory
entry: do not switch existing accounts between connectors without an explicit
linking/migration plan. The legacy connector still filters for Dex Users; merely
registering an application does not bypass this restriction or grant paid room
access. Each relying application must implement its own authorization policy.
The eom.dev deployment uses one `ldap` connector for legacy POSIX accounts and
website `inetOrgPerson` accounts. It retains `idAttr: uid`, so existing OIDC
subjects remain stable. The website resolves the signed UID to LDAP and anchors
its account link to immutable `entryUUID`. Its combined user filter admits
`inetOrgPerson` entries throughout the configured search base; review that
authentication scope before deployment. Each relying application must still
implement its own authorization policy.
Run the playbook on the controller with its kubeconfig and this role available
in `ANSIBLE_ROLES_PATH`. Load your encrypted variables with Ansible's `--extra-vars`
@@ -145,8 +146,9 @@ passwords to network observers. Restrict it to the trusted internal network with
your cluster's policies; no public LDAP exposure is created by this role.
The generic connector uses `inetOrgPerson` and DN-based group matching. The site
playbook retains ID `ldap`, `idAttr: uid`, its POSIX/group filter,
and `userAttr: cn` group matching. For `uniqueMember` values containing full DNs,
playbook retains ID `ldap`, `idAttr: uid`, its POSIX/Dex Users filter branch plus
website `inetOrgPerson` accounts, and `userAttr: cn` group matching. For
`uniqueMember` values containing full DNs,
set `dex_ldap_group_user_attribute: DN` deliberately after testing. Changing
connector ID or idAttr changes OIDC subjects and can detach existing accounts.
@@ -173,13 +175,12 @@ support `$ENV_NAME` references, such as `bindPW: $DEX_LDAP_BIND_PASSWORD`. The
database password remains a protected Helm/Dex config value; it is not assumed
to support the same connector substitution. Never commit actual secrets.
[tests/example-vars.yml](tests/example-vars.yml) shows a www client and separate
`www-ldap` connector using `entryUUID`, `inetOrgPerson` and DN group matching.
This avoids breaking legacy subjects while supporting new free website users.
The Secret's `WWW_DEX_CLIENT_SECRET` must match the website's `DEX_CLIENT_SECRET`;
set the website's `DEX_CONNECTOR_ID=www-ldap` and exact matching issuer. No new
client or connector is silently enabled by default. Verify that this connector's
search base includes the website account OU before enabling public registration.
[tests/example-vars.yml](tests/example-vars.yml) shows a www client using the
single existing `ldap` connector. The Secret's `WWW_DEX_CLIENT_SECRET` must match
the website's `DEX_CLIENT_SECRET`; set `DEX_CONNECTOR_ID=ldap` and the exact
matching issuer. No client or additional connector is silently enabled by
default. Verify the combined search filter and scope before enabling public
registration.
### Theme