# Merge with the EXISTING Dex configuration; do not replace its storage/issuer.
# A new connector avoids changing subjects for other applications using LDAP.
staticClients:
  - id: www-membership
    name: eom.dev Membership
    secretEnv: WWW_DEX_CLIENT_SECRET
    redirectURIs:
      - https://eom.dev/members/oidc/callback/

connectors:
  - type: ldap
    id: www-ldap
    name: eom.dev accounts
    config:
      host: ldap.eom.dev:636
      insecureNoSSL: false
      insecureSkipVerify: false
      # rootCA: /etc/dex/ldap-ca.pem  # Mount your CA when not publicly trusted.
      bindDN: cn=dex-reader,ou=system,dc=eom,dc=dev
      bindPW: $DEX_LDAP_BIND_PASSWORD
      userSearch:
        baseDN: ou=people,dc=eom,dc=dev
        filter: "(objectClass=inetOrgPerson)"
        username: uid
        idAttr: entryUUID
        emailAttr: mail
        nameAttr: cn
        preferredUsernameAttr: uid
      groupSearch:
        baseDN: ou=groups,dc=eom,dc=dev
        filter: "(objectClass=groupOfUniqueNames)"
        userMatchers:
          - userAttr: DN
            groupAttr: uniqueMember
        nameAttr: cn