lyra_phasma/opencloud-compose
1
0
Fork 0
mirror of https://github.com/opencloud-eu/opencloud-compose.git synced 2026-08-07 20:38:42 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat: make role assignment settings configurable

Browse Source 
Allow PROXY_ROLE_ASSIGNMENT_DRIVER and GRAPH_ASSIGN_DEFAULT_USER_ROLE
   to be set via environment variables in .env file.

   - PROXY_ROLE_ASSIGNMENT_DRIVER defaults to oidc
   - GRAPH_ASSIGN_DEFAULT_USER_ROLE defaults to false

   When using PROXY_ROLE_ASSIGNMENT_DRIVER=default, set
   GRAPH_ASSIGN_DEFAULT_USER_ROLE=true to assign the 'user' role
   to new users.
This commit is contained in:
Connor
2026-01-02 20:31:26 -05:00
committed by Michael Barz
parent cda4138e7d
commit 73b02b77d8
2 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
.env.example
View File

@@ -323,6 +323,14 @@ LDAP_BIND_PASSWORD=
## Autoprovisioning Mode ##
# Use together with idm/external-idp.yml
# Role assignment driver for the proxy. Defaults to "oidc".
# Possible values: "oidc", "default"
# When set to "oidc", roles are assigned based on OIDC claims.
# When set to "default", all users get the 'user' role assigned.
PROXY_ROLE_ASSIGNMENT_DRIVER=
# Assign the default 'user' role to new users. Defaults to "false".
# Set to "true" when using PROXY_ROLE_ASSIGNMENT_DRIVER=default
GRAPH_ASSIGN_DEFAULT_USER_ROLE=
# If you want to use a keycloak for local testing, you can use testing/external-keycloak.yml and testing/ldap-manager.yml
# Domain of your Identity Provider.
IDP_DOMAIN=

4
idm/external-idp.yml
View File

@@ -25,7 +25,7 @@ services:
WEBFINGER_IOS_OIDC_CLIENT_SCOPES: ${WEBFINGER_IOS_OIDC_CLIENT_SCOPES}
WEBFINGER_DESKTOP_OIDC_CLIENT_ID: ${WEBFINGER_DESKTOP_OIDC_CLIENT_ID}
WEBFINGER_DESKTOP_OIDC_CLIENT_SCOPES: ${WEBFINGER_DESKTOP_OIDC_CLIENT_SCOPES}
PROXY_ROLE_ASSIGNMENT_DRIVER: "oidc"
PROXY_ROLE_ASSIGNMENT_DRIVER: ${PROXY_ROLE_ASSIGNMENT_DRIVER:-oidc}
OC_OIDC_ISSUER: ${IDP_ISSUER_URL:-https://keycloak.opencloud.test/realms/openCloud}
# This specifies to start all services except idm and idp. These are replaced by external services.
OC_EXCLUDE_RUN_SERVICES: idm,idp
@@ -47,7 +47,7 @@ services:
OC_LDAP_DISABLE_USER_MECHANISM: "attribute"
OC_ADMIN_USER_ID: ""
SETTINGS_SETUP_DEFAULT_ASSIGNMENTS: "false"
GRAPH_ASSIGN_DEFAULT_USER_ROLE: "false"
GRAPH_ASSIGN_DEFAULT_USER_ROLE: ${GRAPH_ASSIGN_DEFAULT_USER_ROLE:-false}
GRAPH_USERNAME_MATCH: "none"
# We need to set the IDP_DOMAIN to allow the CSP rules to be set correctly
IDP_DOMAIN: ${IDP_DOMAIN:-keycloak.opencloud.test}