mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 4.7
490f0919ab
INFINITO_CMD is a per-invocation argument, not a config value — drop it from default.env, the passthrough STATIC_KEYS, and the dotenv-generator test, and rename to lowercase `cmd` in Makefile targets, exec scripts, internal callers, and user-facing docs. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
1.4 KiB
1.4 KiB
LDAP Integration (Transitive) 📒
OpenTalk does not open LDAP connections itself. It relies on Keycloak's LDAP federation (svc-db-openldap is mapped into the central Keycloak realm) and queries Keycloak's admin Web API for user lookups. This avoids dual-source-of-truth problems and keeps LDAP credentials away from the OpenTalk service account.
Chain 🔗
svc-db-openldapis the directory of record for users and groups.- Keycloak's
LDAP user federationmirrors users into the realm in read-only mode. - OpenTalk authenticates users via OIDC and resolves invitee searches via
https://<keycloak>/admin/realms/<realm>/users?search=….
Backend Choice ⚙️
Upstream OpenTalk supports two [user_search].backend values: keycloak_webapi and disabled. There is no native LDAP backend, so binding OpenTalk directly to OpenLDAP would require a custom backend that is not currently maintained.
Inspect The Keycloak ↔ LDAP Federation 🩺
make compose-exec cmd="container exec keycloak /opt/keycloak/bin/kcadm.sh get components -r {{ OIDC.CLIENT.REALM }} --query type=org.keycloak.storage.UserStorageProvider"
If users created in OpenLDAP do not appear in OpenTalk, force a Keycloak full sync (component IDs vary per environment):
make compose-exec cmd="container exec keycloak /opt/keycloak/bin/kcadm.sh create user-storage/<id>/sync?action=triggerFullSync -r {{ OIDC.CLIENT.REALM }}"