Deploy

tests/example-vars.yml

@@ -20,29 +20,9 @@ dex_static_clients:
     redirectURIs:
       - https://www.eom.dev/members/oidc/callback/
 
-# Additional connector: don't alter legacy ldap/idAttr uid, which changes sub
-# identifiers for existing applications. This connector admits free web accounts.
-dex_additional_connectors:
-  - type: ldap
-    id: www-ldap
-    name: eom.dev Membership
-    config:
-      host: openldap.openldap.svc.cluster.local
-      insecureNoSSL: true
-      bindDN: cn=readonly,dc=eom,dc=dev
-      bindPW: $DEX_LDAP_BIND_PASSWORD
-      userSearch:
-        baseDN: ou=people,dc=eom,dc=dev
-        filter: "(objectClass=inetOrgPerson)"
-        username: uid
-        idAttr: entryUUID
-        emailAttr: mail
-        nameAttr: cn
-        preferredUsernameAttr: uid
-      groupSearch:
-        baseDN: ou=groups,dc=eom,dc=dev
-        filter: "(objectClass=groupOfUniqueNames)"
-        userMatchers:
-          - userAttr: DN
-            groupAttr: uniqueMember
-        nameAttr: cn
+# One LDAP connector admits both legacy POSIX accounts and website accounts.
+# Keep its ID and idAttr unchanged so existing OIDC subjects remain stable.
+dex_ldap_connector_id: ldap
+dex_ldap_id_attribute: uid
+dex_ldap_user_base_dn: dc=eom,dc=dev
+dex_ldap_user_filter: "(|(&(objectClass=posixAccount)(memberOf=cn=Dex Users,ou=Dex,ou=Services,dc=eom,dc=dev))(objectClass=inetOrgPerson))"

tests/validate.py

@@ -31,6 +31,8 @@ for fixture_run in (1,):
     assert resolved['dex_ldap_group_user_attribute'] == 'cn'
     assert resolved['dex_theme_enabled'] is True
     assert resolved['dex_postgres_manage'] is False
+    assert resolved['dex_additional_connectors'] == []
+    assert resolved['dex_ldap_user_filter'] == '(|(&(objectClass=posixAccount)(memberOf=cn=Dex Users,ou=Dex,ou=Services,dc=eom,dc=dev))(objectClass=inetOrgPerson))'
     clients = {client['id']: client for client in resolved['dex_static_clients']}
     assert len(clients) == len(resolved['dex_static_clients']) == 7
     assert resolved['dex_matrix_client_enabled'] is False
@@ -42,7 +44,6 @@ for fixture_run in (1,):
     assert clients['mastodon']['redirectURIs'] == ['https://mastodon.eom.dev/auth/auth/openid_connect/callback']
     assert clients['nextcloud']['redirectURIs'] == ['https://nextcloud.eom.dev/index.php/apps/user_oidc/code']
     assert all(client['secret'] and len(client['redirectURIs']) == 1 for client in clients.values())
-    assert resolved['dex_additional_connectors'][0]['config']['userSearch']['idAttr'] == 'entryUUID'
 
 values = yaml.safe_load(Path('/tmp/dex-values.yml').read_text())
 config = values['config']
@@ -53,6 +54,7 @@ ldap = config['connectors'][0]
 assert ldap['id'] == 'ldap'
 assert ldap['config']['insecureNoSSL'] is True
 assert ldap['config']['startTLS'] is False
+assert len(config['connectors']) == 1
 assert ldap['config']['userSearch']['idAttr'] == 'uid'
 assert ldap['config']['groupSearch']['userMatchers'][0]['userAttr'] == 'DN'
 assert config['staticClients'][0]['id'] == 'matrix-fixture'