DevOps/software-infrastructure
2
0
Fork 0
Code Issues 16 Pull Requests Actions Packages Projects Releases Wiki Activity

Fix memberships: Dex SSO with tier gating across services

Browse Source 
Update role submodules (dex, www, gitea, mastodon, matrix-stack,
peertube) and the membership app's LDAP/Dex settings in www.yaml.
In the root dex.yml, match groups by DN and use cn for names.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
eric
2026-11-06 17:59:04 -05:00
co-authored by Claude Opus 5.5
parent ffe45bda59
commit f363ca0e34
8 changed files with 14 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dex.yml
+2 -2
View File
@@ -42,9 +42,9 @@
dex_ldap_user_base_dn: dc=eom,dc=dev
dex_ldap_user_filter: "(&(objectClass=posixAccount)(memberOf=cn=Dex Users,ou=Dex,ou=Services,dc=eom,dc=dev))"
dex_ldap_id_attribute: uid
dex_ldap_name_attribute: givenName
dex_ldap_name_attribute: cn
dex_ldap_group_base_dn: dc=eom,dc=dev
dex_ldap_group_user_attribute: cn
dex_ldap_group_user_attribute: DN
dex_ldap_group_filter: "(objectClass=groupOfUniqueNames)"
dex_matrix_client_enabled: true
roles/ericomeehan.dex
+1 -1
Submodule roles/ericomeehan.dex updated: 6de8385829...fa17989fed
roles/ericomeehan.gitea
+1 -1
Submodule roles/ericomeehan.gitea updated: 9f46e92cd7...5702010a3d
roles/ericomeehan.mastodon
+1 -1
Submodule roles/ericomeehan.mastodon updated: bf0b82efa3...1c80554eef
roles/ericomeehan.matrix-stack
+1 -1
Submodule roles/ericomeehan.matrix-stack updated: b9395a88ef...6497d19d55
roles/ericomeehan.peertube
+1 -1
Submodule roles/ericomeehan.peertube updated: bdfa22498a...b0ffdc3e89
roles/ericomeehan.www
+1 -1
Submodule roles/ericomeehan.www updated: 827ec93663...ab6dbac3fd
www.yaml
+6 -5
View File
@@ -32,13 +32,14 @@
DEX_ISSUER: https://dex.eom.dev/
DEX_CLIENT_ID: www-membership
DEX_CONNECTOR_ID: ldap
LDAP_URL: ldaps://192.168.1.165
LDAP_BIND_DN: "cn=readwrite,dc=eom,dc=dev"
LDAP_ACCOUNT_BASE_DN: ou=People,dc=example,dc=com
LDAP_SEARCH_BASE_DN: dc=example,dc=com
LDAP_URL: ldap://openldap.openldap.svc.cluster.local
LDAP_BIND_DN: "cn=admin,dc=eom,dc=dev"
LDAP_ACCOUNT_BASE_DN: ou=People,dc=eom,dc=dev
LDAP_SEARCH_BASE_DN: dc=eom,dc=dev
LDAP_PASSWORD_SCHEME: "{ARGON2}"
LDAP_GROUP_PLACEHOLDER_DN: cn=membership-sentinel,ou=system,dc=example,dc=com
LDAP_GROUP_PLACEHOLDER_DN: cn=placeholder,ou=Memberships,dc=eom,dc=dev
LDAP_CA_CERT_FILE: ""
LDAP_ALLOW_INSECURE: "1"
EMAIL_HOST: "postfix.eom.dev"
EMAIL_PORT: "587"
EMAIL_HOST_USER: "accounts@eom.dev"