Deploy

tests/example-vars.yml

@@ -20,29 +20,9 @@ dex_static_clients:
     redirectURIs:
       - https://www.eom.dev/members/oidc/callback/
 
-# Additional connector: don't alter legacy ldap/idAttr uid, which changes sub
-# identifiers for existing applications. This connector admits free web accounts.
-dex_additional_connectors:
-  - type: ldap
-    id: www-ldap
-    name: eom.dev Membership
-    config:
-      host: openldap.openldap.svc.cluster.local
-      insecureNoSSL: true
-      bindDN: cn=readonly,dc=eom,dc=dev
-      bindPW: $DEX_LDAP_BIND_PASSWORD
-      userSearch:
-        baseDN: ou=people,dc=eom,dc=dev
-        filter: "(objectClass=inetOrgPerson)"
-        username: uid
-        idAttr: entryUUID
-        emailAttr: mail
-        nameAttr: cn
-        preferredUsernameAttr: uid
-      groupSearch:
-        baseDN: ou=groups,dc=eom,dc=dev
-        filter: "(objectClass=groupOfUniqueNames)"
-        userMatchers:
-          - userAttr: DN
-            groupAttr: uniqueMember
-        nameAttr: cn
+# One LDAP connector admits both legacy POSIX accounts and website accounts.
+# Keep its ID and idAttr unchanged so existing OIDC subjects remain stable.
+dex_ldap_connector_id: ldap
+dex_ldap_id_attribute: uid
+dex_ldap_user_base_dn: dc=eom,dc=dev
+dex_ldap_user_filter: "(|(&(objectClass=posixAccount)(memberOf=cn=Dex Users,ou=Dex,ou=Services,dc=eom,dc=dev))(objectClass=inetOrgPerson))"