computer-playbook/roles/web-app-moodle/tasks/05_ldap_sync.yml

---
# Configure Moodle's auth_ldap plugin. In variant 0 (hybrid) it runs
# in sync-only mode (login = auth_oidc); in variant 1 (LDAP-only) it
# is the primary login plugin. Field mapping is identical between
# variants.

- name: "▶️ Run Moodle DB upgrade for auth_ldap plugin"
  shell: >
    container exec --user {{ MOODLE_RUNTIME_USER }} {{ MOODLE_CONTAINER_ADDRESS }}
    php {{ MOODLE_CLI_DIR }}/upgrade.php --non-interactive
  failed_when: false
  changed_when: false

- name: "🔧 Configure auth_ldap connection + field mapping"
  loop:
    - { name: "host_url", value: "{{ LDAP.SERVER.URI }}" }
    - { name: "ldap_version", value: 3 }
    - { name: "start_tls", value: 0 }
    - { name: "user_type", value: "rfc2307" }
    - { name: "contexts", value: "{{ LDAP.DN.OU.USERS }}" }
    - { name: "search_sub", value: 1 }
    - { name: "user_attribute", value: "uid" }
    - { name: "objectclass", value: "(objectClass=inetOrgPerson)" }
    - { name: "memberattribute", value: "memberOf" }
    - { name: "memberattribute_isdn", value: 1 }
    - { name: "bind_dn", value: "{{ LDAP.DN.ADMINISTRATOR.DATA }}" }
    - { name: "bind_pw", value: "{{ LDAP.BIND_CREDENTIAL }}" }
    - { name: "creators", value: "*" }
    - { name: "auth_user_create", value: "{{ MOODLE_OIDC_ENABLED | bool | ternary(0, 1) }}" }
    - { name: "removeuser", value: 1 } # 1 = suspend (preserve history); 2 = delete
    - { name: "sync_suspended", value: 1 }
    - { name: "field_map_firstname", value: "givenName" }
    - { name: "field_lock_firstname", value: "locked" }
    - { name: "field_updatelocal_firstname", value: "oncreate" }
    - { name: "field_map_lastname", value: "sn" }
    - { name: "field_lock_lastname", value: "locked" }
    - { name: "field_updatelocal_lastname", value: "oncreate" }
    - { name: "field_map_middlename", value: "initials" }
    - { name: "field_lock_middlename", value: "locked" }
    - { name: "field_updatelocal_middlename", value: "oncreate" }
    - { name: "field_map_alternatename", value: "displayName" }
    - { name: "field_lock_alternatename", value: "locked" }
    - { name: "field_updatelocal_alternatename", value: "oncreate" }
    - { name: "field_map_email", value: "mail" }
    - { name: "field_lock_email", value: "locked" }
    - { name: "field_updatelocal_email", value: "oncreate" }
    - { name: "field_map_phone1", value: "telephoneNumber" }
    - { name: "field_lock_phone1", value: "locked" }
    - { name: "field_updatelocal_phone1", value: "oncreate" }
    - { name: "field_map_phone2", value: "mobile" }
    - { name: "field_lock_phone2", value: "locked" }
    - { name: "field_updatelocal_phone2", value: "oncreate" }
    - { name: "field_map_address", value: "street" }
    - { name: "field_lock_address", value: "locked" }
    - { name: "field_updatelocal_address", value: "oncreate" }
    - { name: "field_map_city", value: "l" }
    - { name: "field_lock_city", value: "locked" }
    - { name: "field_updatelocal_city", value: "oncreate" }
    - { name: "field_map_country", value: "c" }
    - { name: "field_lock_country", value: "locked" }
    - { name: "field_updatelocal_country", value: "oncreate" }
    - { name: "field_map_institution", value: "o" }
    - { name: "field_lock_institution", value: "locked" }
    - { name: "field_updatelocal_institution", value: "oncreate" }
    - { name: "field_map_department", value: "ou" }
    - { name: "field_lock_department", value: "locked" }
    - { name: "field_updatelocal_department", value: "oncreate" }
    - { name: "field_map_description", value: "description" }
    - { name: "field_lock_description", value: "locked" }
    - { name: "field_updatelocal_description", value: "oncreate" }
    - { name: "field_map_idnumber", value: "employeeNumber" }
    - { name: "field_lock_idnumber", value: "locked" }
    - { name: "field_updatelocal_idnumber", value: "oncreate" }
    - { name: "field_map_url", value: "labeledURI" }
    - { name: "field_lock_url", value: "locked" }
    - { name: "field_updatelocal_url", value: "oncreate" }
    - { name: "field_map_lang", value: "preferredLanguage" }
    - { name: "field_lock_lang", value: "locked" }
    - { name: "field_updatelocal_lang", value: "oncreate" }
    - { name: "field_map_firstnamephonetic", value: "infinitoNamePhoneticGiven" }
    - { name: "field_lock_firstnamephonetic", value: "locked" }
    - { name: "field_updatelocal_firstnamephonetic", value: "oncreate" }
    - { name: "field_map_lastnamephonetic", value: "infinitoNamePhoneticFamily" }
    - { name: "field_lock_lastnamephonetic", value: "locked" }
    - { name: "field_updatelocal_lastnamephonetic", value: "oncreate" }
    - { name: "field_map_timezone", value: "infinitoTimezone" }
    - { name: "field_lock_timezone", value: "locked" }
    - { name: "field_updatelocal_timezone", value: "oncreate" }
  loop_control:
    label: "{{ item.name }}"
  shell: >
    container exec --user {{ MOODLE_RUNTIME_USER }} {{ MOODLE_CONTAINER_ADDRESS }}
    php {{ MOODLE_CLI_DIR }}/cfg.php --component=auth_ldap
    --name={{ item.name }} --set="{{ item.value }}"
  no_log: "{{ MASK_CREDENTIALS_IN_LOGS | bool }}"
  changed_when: false

- name: "🟢 Enable auth_ldap plugin"
  shell: >
    container exec --user {{ MOODLE_RUNTIME_USER }} {{ MOODLE_CONTAINER_ADDRESS }}
    php {{ MOODLE_CLI_DIR }}/cfg.php --name=auth --set=ldap
  when: not (MOODLE_OIDC_ENABLED | bool)
  changed_when: false

- name: "🟢 Variant 0: enable both auth_oidc + auth_ldap (oidc primary)"
  shell: >
    container exec --user {{ MOODLE_RUNTIME_USER }} {{ MOODLE_CONTAINER_ADDRESS }}
    php {{ MOODLE_CLI_DIR }}/cfg.php --name=auth --set=oidc,ldap
  when: MOODLE_OIDC_ENABLED | bool
  changed_when: false

- name: "🔑 Hide auth_ldap from login page in variant 0 (OIDC is the only entry point)"
  shell: >
    container exec --user {{ MOODLE_RUNTIME_USER }} {{ MOODLE_CONTAINER_ADDRESS }}
    php {{ MOODLE_CLI_DIR }}/cfg.php --component=auth_ldap
    --name=removecontexts --set=1
  when: MOODLE_OIDC_ENABLED | bool
  changed_when: false

- name: "⚡ Trigger auth_ldap sync to pre-provision LDAP users"
  shell: >
    container exec --user {{ MOODLE_RUNTIME_USER }} {{ MOODLE_CONTAINER_ADDRESS }}
    php {{ MOODLE_CLI_DIR }}/scheduled_task.php
    --execute='\auth_ldap\task\sync_task'
  failed_when: false
  changed_when: false