mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 4.7
490f0919ab
INFINITO_CMD is a per-invocation argument, not a config value — drop it from default.env, the passthrough STATIC_KEYS, and the dotenv-generator test, and rename to lowercase `cmd` in Makefile targets, exec scripts, internal callers, and user-facing docs. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
26 lines
1.4 KiB
Markdown
26 lines
1.4 KiB
Markdown
# LDAP Integration (Transitive) 📒
|
|
|
|
OpenTalk does not open LDAP connections itself. It relies on Keycloak's LDAP federation (`svc-db-openldap` is mapped into the central Keycloak realm) and queries Keycloak's admin Web API for user lookups. This avoids dual-source-of-truth problems and keeps LDAP credentials away from the OpenTalk service account.
|
|
|
|
## Chain 🔗
|
|
|
|
1. `svc-db-openldap` is the directory of record for users and groups.
|
|
2. Keycloak's `LDAP user federation` mirrors users into the realm in read-only mode.
|
|
3. OpenTalk authenticates users via OIDC and resolves invitee searches via `https://<keycloak>/admin/realms/<realm>/users?search=…`.
|
|
|
|
## Backend Choice ⚙️
|
|
|
|
Upstream OpenTalk supports two `[user_search].backend` values: `keycloak_webapi` and `disabled`. There is no native LDAP backend, so binding OpenTalk directly to OpenLDAP would require a custom backend that is not currently maintained.
|
|
|
|
## Inspect The Keycloak ↔ LDAP Federation 🩺
|
|
|
|
```bash
|
|
make compose-exec cmd="container exec keycloak /opt/keycloak/bin/kcadm.sh get components -r {{ OIDC.CLIENT.REALM }} --query type=org.keycloak.storage.UserStorageProvider"
|
|
```
|
|
|
|
If users created in OpenLDAP do not appear in OpenTalk, force a Keycloak full sync (component IDs vary per environment):
|
|
|
|
```bash
|
|
make compose-exec cmd="container exec keycloak /opt/keycloak/bin/kcadm.sh create user-storage/<id>/sync?action=triggerFullSync -r {{ OIDC.CLIENT.REALM }}"
|
|
```
|