Levels

membership/deploy/dex-membership.example.yaml

@@ -1,5 +1,5 @@
 # Merge with the EXISTING Dex configuration; do not replace its storage/issuer.
-# A new connector avoids changing subjects for other applications using LDAP.
+# Extend the existing ldap connector instead of adding a second login option.
 staticClients:
   - id: www-membership
     name: eom.dev Membership
@@ -9,8 +9,8 @@ staticClients:
 
 connectors:
   - type: ldap
-    id: www-ldap
-    name: eom.dev accounts
+    id: ldap
+    name: eom.dev account
     config:
       host: ldap.eom.dev:636
       insecureNoSSL: false
@@ -19,10 +19,10 @@ connectors:
       bindDN: cn=dex-reader,ou=system,dc=eom,dc=dev
       bindPW: $DEX_LDAP_BIND_PASSWORD
       userSearch:
-        baseDN: ou=people,dc=eom,dc=dev
-        filter: "(objectClass=inetOrgPerson)"
+        baseDN: dc=eom,dc=dev
+        filter: "(|(&(objectClass=posixAccount)(memberOf=cn=Dex Users,ou=Dex,ou=Services,dc=eom,dc=dev))(objectClass=inetOrgPerson))"
         username: uid
-        idAttr: entryUUID
+        idAttr: uid
         emailAttr: mail
         nameAttr: cn
         preferredUsernameAttr: uid