mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 02:54:26 +00:00
kevinveenbirkenbachandClaude Opus 4.7
490f0919ab
INFINITO_CMD is a per-invocation argument, not a config value — drop it from default.env, the passthrough STATIC_KEYS, and the dotenv-generator test, and rename to lowercase `cmd` in Makefile targets, exec scripts, internal callers, and user-facing docs. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
27 lines
1.0 KiB
Markdown
27 lines
1.0 KiB
Markdown
# LDAP Integration 📒
|
|
|
|
OpenCloud uses the central `svc-db-openldap` instance for user and group lookups. Configuration is rendered into the role's environment file at deploy time using the `LDAP` group_var dictionary, so no LDAP value is hard-coded in the role.
|
|
|
|
## Variable Mapping 🗺️
|
|
|
|
| OpenCloud env | Group variable |
|
|
|---|---|
|
|
| `OC_LDAP_URI` | `LDAP.SERVER.URI` |
|
|
| `OC_LDAP_BIND_DN` | `LDAP.DN.ADMINISTRATOR.DATA` |
|
|
| `OC_LDAP_BIND_PASSWORD` | `LDAP.BIND_CREDENTIAL` (Vault) |
|
|
| `OC_LDAP_USER_BASE_DN` | `LDAP.DN.OU.USERS` |
|
|
| `OC_LDAP_GROUP_BASE_DN` | `LDAP.DN.OU.GROUPS` |
|
|
| `OC_LDAP_USER_SCHEMA_USERNAME` | `LDAP.USER.ATTRIBUTES.ID` |
|
|
| `OC_LDAP_USER_SCHEMA_MAIL` | `LDAP.USER.ATTRIBUTES.MAIL` |
|
|
| `OC_LDAP_USER_SCHEMA_DISPLAY_NAME` | `LDAP.USER.ATTRIBUTES.FULLNAME` |
|
|
|
|
## Read-only Mode 🔒
|
|
|
|
`GRAPH_LDAP_SERVER_WRITE_ENABLED=false` keeps OpenCloud from modifying the directory. User lifecycle is owned by the LDAP and Keycloak side.
|
|
|
|
## Inspect LDAP Entries 🩺
|
|
|
|
```bash
|
|
make compose-exec cmd="container exec opencloud opencloud users list"
|
|
```
|