Memberships

2026-10-23 12:02:50 -04:00
parent 87dd5453e4
commit 6cf0f0525f
42 changed files with 2145 additions and 7 deletions
@@ -0,0 +1,35 @@
+# Merge with the EXISTING Dex configuration; do not replace its storage/issuer.
+# A new connector avoids changing subjects for other applications using LDAP.
+staticClients:
+  - id: www-membership
+    name: eom.dev Membership
+    secretEnv: WWW_DEX_CLIENT_SECRET
+    redirectURIs:
+      - https://eom.dev/members/oidc/callback/
+
+connectors:
+  - type: ldap
+    id: www-ldap
+    name: eom.dev accounts
+    config:
+      host: ldap.eom.dev:636
+      insecureNoSSL: false
+      insecureSkipVerify: false
+      # rootCA: /etc/dex/ldap-ca.pem  # Mount your CA when not publicly trusted.
+      bindDN: cn=dex-reader,ou=system,dc=eom,dc=dev
+      bindPW: $DEX_LDAP_BIND_PASSWORD
+      userSearch:
+        baseDN: ou=people,dc=eom,dc=dev
+        filter: "(objectClass=inetOrgPerson)"
+        username: uid
+        idAttr: entryUUID
+        emailAttr: mail
+        nameAttr: cn
+        preferredUsernameAttr: uid
+      groupSearch:
+        baseDN: ou=groups,dc=eom,dc=dev
+        filter: "(objectClass=groupOfUniqueNames)"
+        userMatchers:
+          - userAttr: DN
+            groupAttr: uniqueMember
+        nameAttr: cn
@@ -0,0 +1,37 @@
+# Review these DNs against your directory BEFORE applying. Parent OUs and the
+# application bind identity must already exist. Sentinel has no login/password.
+dn: cn=membership-sentinel,ou=system,dc=eom,dc=dev
+objectClass: top
+objectClass: organizationalRole
+cn: membership-sentinel
+description: Non-login placeholder for empty paid membership groups
+
+dn: cn=www-level-0,ou=groups,dc=eom,dc=dev
+objectClass: top
+objectClass: groupOfUniqueNames
+cn: www-level-0
+uniqueMember: cn=membership-sentinel,ou=system,dc=eom,dc=dev
+
+dn: cn=www-level-1,ou=groups,dc=eom,dc=dev
+objectClass: top
+objectClass: groupOfUniqueNames
+cn: www-level-1
+uniqueMember: cn=membership-sentinel,ou=system,dc=eom,dc=dev
+
+dn: cn=www-level-2,ou=groups,dc=eom,dc=dev
+objectClass: top
+objectClass: groupOfUniqueNames
+cn: www-level-2
+uniqueMember: cn=membership-sentinel,ou=system,dc=eom,dc=dev
+
+dn: cn=www-level-3,ou=groups,dc=eom,dc=dev
+objectClass: top
+objectClass: groupOfUniqueNames
+cn: www-level-3
+uniqueMember: cn=membership-sentinel,ou=system,dc=eom,dc=dev
+
+dn: cn=www-level-4,ou=groups,dc=eom,dc=dev
+objectClass: top
+objectClass: groupOfUniqueNames
+cn: www-level-4
+uniqueMember: cn=membership-sentinel,ou=system,dc=eom,dc=dev