# Merge with the EXISTING Dex configuration; do not replace its storage/issuer.
# Extend the existing ldap connector instead of adding a second login option.
staticClients:
  - id: www-membership
    name: eom.dev Membership
    secretEnv: WWW_DEX_CLIENT_SECRET
    redirectURIs:
      - https://eom.dev/members/oidc/callback/

connectors:
  - type: ldap
    id: ldap
    name: eom.dev account
    config:
      host: ldap.eom.dev:636
      insecureNoSSL: false
      insecureSkipVerify: false
      # rootCA: /etc/dex/ldap-ca.pem  # Mount your CA when not publicly trusted.
      bindDN: cn=dex-reader,ou=system,dc=eom,dc=dev
      bindPW: $DEX_LDAP_BIND_PASSWORD
      userSearch:
        baseDN: dc=eom,dc=dev
        filter: "(|(&(objectClass=posixAccount)(memberOf=cn=Dex Users,ou=Dex,ou=Services,dc=eom,dc=dev))(objectClass=inetOrgPerson))"
        username: uid
        idAttr: uid
        emailAttr: mail
        nameAttr: cn
        preferredUsernameAttr: uid
      groupSearch:
        baseDN: ou=groups,dc=eom,dc=dev
        filter: "(objectClass=groupOfUniqueNames)"
        userMatchers:
          - userAttr: DN
            groupAttr: uniqueMember
        nameAttr: cn