0 Fork 0

mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-08 03:38:23 +00:00

Files

T

kevinveenbirkenbach 53e817fa22 refactor(compose): migrate from docker-compose.yml to compose.yml everywhere

- Rename all docker-compose.yml templates to compose.yml
- Update override and CA override filenames accordingly
- Adjust compose wrapper, lookup plugins, filters and path helpers
- Update roles, tasks, handlers and scripts to use compose CLI
- Rewrite documentation and admin guides to reference compose
- Update unit and integration tests to expect compose.yml
- Keep internal variable keys for backward compatibility where needed

https://chatgpt.com/share/69870272-b168-800f-84c3-6417398e441f

2026-02-07 10:14:21 +01:00

2.2 KiB

Raw Blame History

Identity and Access Management

IAM(Identity and Access Management) is setup via Keycloak and LDAP.

OpenID Connect (OIDC) Support 🔐

OIDC is supported in this role—for example, via Keycloak. OIDC-specific tasks are included when enabled, allowing integration of external authentication providers seamlessly.

Verify OIDC Configuration

compose exec -u www-data application /var/www/html/occ config:app:get sociallogin custom_providers

LDAP

More information: https://docs.nextcloud.com/server/latest/admin_manual/configuration_user/user_auth_ldap.html

Get LDAP Configuration

compose exec -u www-data application php occ ldap:show-config

Get all relevant entries except password

SELECT * FROM `oc_appconfig` WHERE appid LIKE "%ldap%" and configkey != "s01ldap_agent_password";

Update User with LDAP values

compose exec -it -u www-data application php occ ldap:check-user --update {{username}}

Update LDAP Sync

compose exec -u www-data application php occ user:sync-account-data

Update Each User

If you want to update every LDAP user, run:

for user in $(compose exec -u www-data application php occ user:list --output=json | jq -r 'keys[]'); do
    compose exec -u www-data application php occ ldap:check-user --update "$user"
done

Unlink All

for user in $(compose exec -u www-data application php occ ldap:show-remnants | tail -n +3 | awk -F '|' '{print $2}' | tr -d ' ' | grep -v '^$'); do
    echo "Unlinking user from LDAP: $user"
    echo "y" | compose exec -T -u www-data application php occ ldap:reset-user "$user"
done

Reset LDAP Links for Orphaned Users

Run this corrected script:

for user in $(compose exec -u www-data application php occ ldap:show-remnants | tail -n +3 | awk -F '|' '{print $2}' | tr -d ' ' | grep -v '^$'); do
    echo "Resetting LDAP link for user: $user"
    echo "y" | compose exec -T -u www-data application php occ ldap:reset-user "$user"
done

Federation

If users are just created via Keycloak and not via LDAP, they have a different username. Due to this reaso concider to use LDAP to guaranty that the username is valid.

2.2 KiB Raw Blame History