Dex: send LDAP groups, accept membership accounts, gate Mastodon

- Match groups by DN so the groups claim is populated
- Use cn for names; membership-created accounts have no givenName
- Add a mastodon connector that only admits Mastodon Users, and pin
  every client to its connector via allowedConnectors
- Register Nextcloud's user_oidc callback without index.php

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

playbooks/deploy-eom.yml

@@ -4,7 +4,7 @@
 - name: Deploy eom.dev Dex with Catppuccin branding
   hosts: alpha-control-plane
   vars_files:
-    ../secrets.yaml
+    ~/Desktop/secrets.yaml
   become: true
   vars:
     dex_namespace: dex
@@ -43,9 +43,9 @@
     dex_ldap_user_base_dn: dc=eom,dc=dev
     dex_ldap_user_filter: "(|(&(objectClass=posixAccount)(memberOf=cn=Dex Users,ou=Dex,ou=Services,dc=eom,dc=dev))(objectClass=inetOrgPerson))"
     dex_ldap_id_attribute: uid
-    dex_ldap_name_attribute: givenName
+    dex_ldap_name_attribute: cn
     dex_ldap_group_base_dn: dc=eom,dc=dev
-    dex_ldap_group_user_attribute: cn
+    dex_ldap_group_user_attribute: DN
     dex_ldap_group_filter: "(objectClass=groupOfUniqueNames)"
 
     # All clients are declared once below; don't also emit the convenience client.
@@ -56,34 +56,41 @@
       - id: "{{ matrix_dex_oidc_client_id }}"
         name: Matrix Auth Service
         secret: "{{ matrix_dex_oidc_client_secret }}"
+        allowedConnectors: [ldap]
         redirectURIs:
           - https://mas.eom.dev/upstream/callback/01K96AQEZKKABW34PY3R6BVNJ4
       - id: www-membership
         name: eom.dev Membership
         secret: "{{ www_dex_client_secret }}"
+        allowedConnectors: [ldap]
         redirectURIs:
           - https://www.eom.dev/members/oidc/callback/
       - id: gitea
         name: Gitea
         secret: "{{ gitea_dex_client_secret }}"
-        # Authentication source in Gitea must be named exactly "dex".
+        # Authentication source in Gitea must be named exactly "Dex".
+        allowedConnectors: [ldap]
         redirectURIs:
-          - https://gitea.eom.dev/user/oauth2/dex/callback
+          - https://gitea.eom.dev/user/oauth2/Dex/callback
       - id: discourse
         name: Discourse
         secret: "{{ discourse_dex_client_secret }}"
         # discourse-openid-connect strategy name is oidc.
+        allowedConnectors: [ldap]
         redirectURIs:
           - https://discourse.eom.dev/auth/oidc/callback
       - id: peertube
         name: PeerTube
         secret: "{{ peertube_dex_client_secret }}"
         # Requires peertube-plugin-auth-openid-connect.
+        allowedConnectors: [ldap]
         redirectURIs:
-          - https://peertube.eom.dev/plugins/auth-openid-connect/router/code-cb
+          - https://peertube.eom.dev/plugins/oidc-cnr/router/code-cb
       - id: mastodon
         name: Mastodon
         secret: "{{ mastodon_dex_client_secret }}"
+        # Tier gate: only the connector that admits Mastodon Users.
+        allowedConnectors: [mastodon]
         # Matches OIDC_REDIRECT_URI in the existing Mastodon deployment.
         redirectURIs:
           - https://mastodon.eom.dev/auth/auth/openid_connect/callback
@@ -92,7 +99,28 @@
         secret: "{{ nextcloud_dex_client_secret }}"
         # This chooses the user_oidc app, not oidc_login or the OIDC provider app.
         # Override from its admin screen if your installation rewrites index.php.
+        allowedConnectors: [ldap]
         redirectURIs:
+          - https://nextcloud.eom.dev/apps/user_oidc/code
           - https://nextcloud.eom.dev/index.php/apps/user_oidc/code
+    # Per-service gate for clients that cannot check group claims themselves.
+    # Same idAttr as the main connector; subjects differ per connector ID.
+    dex_additional_connectors:
+      - type: ldap
+        id: mastodon
+        name: eom.dev account
+        config:
+          host: openldap.openldap.svc.cluster.local
+          insecureNoSSL: true
+          bindDN: cn=readonly,dc=eom,dc=dev
+          bindPW: "{{ openldap_readonly_password }}"
+          userSearch:
+            baseDN: dc=eom,dc=dev
+            filter: "(&(objectClass=inetOrgPerson)(memberOf=cn=Mastodon Users,ou=Mastodon,ou=Services,dc=eom,dc=dev))"
+            username: uid
+            idAttr: uid
+            emailAttr: mail
+            nameAttr: cn
+            preferredUsernameAttr: uid
   roles:
-    - ansible-role-dex
+    - roles/ericomeehan.dex