Deploy

playbooks/deploy-eom.yml

@@ -31,7 +31,8 @@
     dex_postgres_password: "{{ dex_admin_password }}"
     dex_postgres_admin_password: "{{ postgresql_admin_password | default('') }}"
 
-    # Explicitly preserve internal plaintext LDAP and legacy OIDC subjects.
+    # Keep the existing connector ID and UID subject mapping. The filter also
+    # admits website inetOrgPerson accounts so there is one Dex login option.
     dex_ldap_host: openldap.openldap.svc.cluster.local
     dex_ldap_insecure_no_ssl: true
     dex_ldap_start_tls: false
@@ -40,7 +41,7 @@
     dex_ldap_connector_id: ldap
     dex_ldap_connector_name: eom.dev account
     dex_ldap_user_base_dn: dc=eom,dc=dev
-    dex_ldap_user_filter: "(&(objectClass=posixAccount)(memberOf=cn=Dex Users,ou=Dex,ou=Services,dc=eom,dc=dev))"
+    dex_ldap_user_filter: "(|(&(objectClass=posixAccount)(memberOf=cn=Dex Users,ou=Dex,ou=Services,dc=eom,dc=dev))(objectClass=inetOrgPerson))"
     dex_ldap_id_attribute: uid
     dex_ldap_name_attribute: givenName
     dex_ldap_group_base_dn: dc=eom,dc=dev
@@ -93,31 +94,5 @@
         # Override from its admin screen if your installation rewrites index.php.
         redirectURIs:
           - https://nextcloud.eom.dev/index.php/apps/user_oidc/code
-    dex_additional_connectors:
-      - "{{ _dex_eom_www_connector }}"
-    _dex_eom_www_connector:
-      type: ldap
-      id: www-ldap
-      name: eom.dev Membership
-      config:
-        host: openldap.openldap.svc.cluster.local
-        insecureNoSSL: true
-        bindDN: cn=readonly,dc=eom,dc=dev
-        bindPW: "{{ openldap_readonly_password }}"
-        userSearch:
-          baseDN: ou=people,dc=eom,dc=dev
-          filter: "(objectClass=inetOrgPerson)"
-          username: uid
-          idAttr: entryUUID
-          emailAttr: mail
-          nameAttr: cn
-          preferredUsernameAttr: uid
-        groupSearch:
-          baseDN: ou=groups,dc=eom,dc=dev
-          filter: "(objectClass=groupOfUniqueNames)"
-          userMatchers:
-            - userAttr: DN
-              groupAttr: uniqueMember
-          nameAttr: cn
   roles:
     - ansible-role-dex