0 Fork 0

mirror of https://github.com/kevinveenbirkenbach/computer-playbook.git synced 2026-11-09 20:26:33 +00:00

Files

T

kevinveenbirkenbachandClaude Opus 4.7 01e0937240 fix(iam): make OpenCloud and OpenTalk Playwright OIDC scenarios pass and add OpenTalk recorder

Iterates the role-local Playwright specs from a structural skeleton into
fully green end-to-end scenarios that exercise the SSO handoff for both
the administrator and the biber LDAP persona, against the actual
deployed stack, and adds optional meeting recording for OpenTalk.

OpenCloud (web-app-opencloud)
- Add Keycloak's URL to connect-src and frame-src in the role CSP via
  lookup('tls', 'web-app-keycloak', 'url.base') so the SPA can hit the
  OIDC discovery and authorize endpoints from the browser
- Switch to read-only LDAP semantics: PROXY_AUTOPROVISION_ACCOUNTS=false,
  GRAPH_USERNAME_MATCH removed, GRAPH_ASSIGN_DEFAULT_USER_ROLE=true
- Set OC_LDAP_DISABLE_USER_MECHANISM=none so the user-lookup filter
  stops referencing the OpenCloud-only `openclouduserenabled` attribute
  that the central LDAP schema does not define
- Pin the image to opencloudeu/opencloud:4.0.6
- Spec primes localStorage forceAllowOldBrowser, bypasses the "browser
  not supported" splash, submits via Enter, asserts the Files-view banner

OpenTalk (web-app-opentalk)
- Provision a dedicated confidential Keycloak client `opentalk-controller`
  via kcadm so the controller can introspect access tokens; the shared
  realm client stays public for the browser PKCE flow. The service
  account is granted the realm-management view-users / query-users roles
  for the Keycloak admin Web API user-search backend
- Inject an nginx vhost extension via webserver_extra_configuration that
  routes /v1/, /signaling, and /livekit on open.talk.<DOMAIN> to the
  controller and LiveKit upstreams; the default route stays on the
  frontend
- Fix the frontend env vars to upstream names (OIDC_ISSUER, BASE_URL=""),
  pin the frontend image to v2.8.1
- Spec races between auto-redirect and explicit "Sign in" CTA, submits
  via Enter, asserts the post-login Home-link in the dashboard
- Add OpenTalk recorder (registry.opencode.de/opentalk/recorder v0.16.2)
  plus RabbitMQ broker (rabbitmq:4.2.4); wire the controller to publish
  recording jobs on the `opentalk_recorder` queue and the recorder to
  consume them; provision a dedicated confidential `opentalk-recorder`
  Keycloak client for the recorder service account
- Reference Keycloak and the cross-app domain through lookup('tls', ...)
  and lookup('domain', ...) in meta/server.yml instead of literal
  `auth.<DOMAIN>` / `open.cloud.<DOMAIN>` strings

Cross-cutting
- Rename canonical hostnames to the <vendor>.<category> pattern:
  - web-app-opentalk:    talk.<DOMAIN>  -> open.talk.<DOMAIN>
  - web-app-bigbluebutton: meet.<DOMAIN> -> bbb.talk.<DOMAIN>
- Restructure both READMEs to the per-role README contract; drop emojis
  from headings; strip em dashes / history phrases / self-SPOT
  declarations from IAM.md / LDAP.md / TODO.md
- Replace technical galaxy_info descriptions with user-facing copy so
  the dashboard cards read clearly

Validated end-to-end via the Role Loop (deploy-fresh-kept-apps then
deploy-reuse-kept-apps with SERVICES_DISABLED=matomo,email): all
seven OpenTalk containers + the OpenCloud container come up healthy,
scripts/tests/e2e/rerun-spec.sh web-app-opencloud and
scripts/tests/e2e/rerun-spec.sh web-app-opentalk both finish with
`2 passed`, and `make test` is green (1604 + 162 tests).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

2026-05-05 17:05:10 +02:00

1.7 KiB

Raw Blame History

Identity and Access Management 🔐

OpenCloud delegates authentication to the central Keycloak realm and consumes user and group data from the central OpenLDAP directory. Local password login is disabled when services.oidc.enabled is true (the default), and accounts are auto-provisioned on first OIDC login.

OIDC 🪪

Issuer URL: {{ OIDC.CLIENT.ISSUER_URL }}
Client ID: shared OIDC.CLIENT.ID (one Keycloak client per realm covers every web app)
Username claim: preferred_username, mapped to OpenCloud username
Role claim: groups (Keycloak group memberships flow into OpenCloud roles)
Auto-provisioning: enabled via PROXY_AUTOPROVISION_ACCOUNTS=true
Built-in IDP excluded via OC_EXCLUDE_RUN_SERVICES=idp

Verify OIDC discovery 🩺

make exec CMD="container exec opencloud sh -c 'curl -fsS {{ OIDC.CLIENT.DISCOVERY_DOCUMENT }} | head -c 200'"

LDAP 📒

OpenCloud reads users from the central svc-db-openldap service.

URI: {{ LDAP.SERVER.URI }}
Bind DN: {{ LDAP.DN.ADMINISTRATOR.DATA }}
User base DN: {{ LDAP.DN.OU.USERS }}
Group base DN: {{ LDAP.DN.OU.GROUPS }}
User filter: (objectclass=inetOrgPerson)
Group filter: (objectclass=groupOfNames)

Members of the application_administrators group (per requirement 004) gain OpenCloud admin rights when they log in.

Verify LDAP wiring 🩺

make exec CMD="container exec opencloud opencloud config get ldap"

Federation 🔗

If a Keycloak user is not present in OpenLDAP, OpenCloud auto-provisions the user on first login using the preferred_username claim. To keep usernames stable across Nextcloud, OpenCloud, and OpenTalk, all three apps share the same OIDC.CLIENT.REALM and the same LDAP.DN.OU.USERS source.

1.7 KiB Raw Blame History