Levels

membership/deploy/dex-membership.example.yaml

@@ -1,5 +1,5 @@
 # Merge with the EXISTING Dex configuration; do not replace its storage/issuer.
-# A new connector avoids changing subjects for other applications using LDAP.
+# Extend the existing ldap connector instead of adding a second login option.
 staticClients:
   - id: www-membership
     name: eom.dev Membership
@@ -9,8 +9,8 @@ staticClients:
 
 connectors:
   - type: ldap
-    id: www-ldap
-    name: eom.dev accounts
+    id: ldap
+    name: eom.dev account
     config:
       host: ldap.eom.dev:636
       insecureNoSSL: false
@@ -19,10 +19,10 @@ connectors:
       bindDN: cn=dex-reader,ou=system,dc=eom,dc=dev
       bindPW: $DEX_LDAP_BIND_PASSWORD
       userSearch:
-        baseDN: ou=people,dc=eom,dc=dev
-        filter: "(objectClass=inetOrgPerson)"
+        baseDN: dc=eom,dc=dev
+        filter: "(|(&(objectClass=posixAccount)(memberOf=cn=Dex Users,ou=Dex,ou=Services,dc=eom,dc=dev))(objectClass=inetOrgPerson))"
         username: uid
-        idAttr: entryUUID
+        idAttr: uid
         emailAttr: mail
         nameAttr: cn
         preferredUsernameAttr: uid

membership/deploy/groups.example.ldif

@@ -6,6 +6,8 @@ objectClass: organizationalRole
 cn: membership-sentinel
 description: Non-login placeholder for empty paid membership groups
 
+# Legacy paid level-0 group. Keep until existing deployments have synchronized
+# all accounts and removed their former Supporter grants.
 dn: cn=www-level-0,ou=groups,dc=eom,dc=dev
 objectClass: top
 objectClass: groupOfUniqueNames
@@ -35,3 +37,9 @@ objectClass: top
 objectClass: groupOfUniqueNames
 cn: www-level-4
 uniqueMember: cn=membership-sentinel,ou=system,dc=eom,dc=dev
+
+dn: cn=www-level-5,ou=groups,dc=eom,dc=dev
+objectClass: top
+objectClass: groupOfUniqueNames
+cn: www-level-5
+uniqueMember: cn=membership-sentinel,ou=system,dc=eom,dc=dev