IDM Service Configuration

Introduction

The Infinite Scale IDM service provides a minimal LDAP service for Infinite Scale. It is started as part of the runtime and serves as a central place for storing user and group information. The IDM Service is based on LibreGraph Identity Management.

  • IDM is mainly targeted at small Infinite Scale installations or testing.

  • For larger setups or production environments, it is highly recommended to use a “real” LDAP server or to switch to an external Identity Management Solution instead.

The IDM service is by design limited in its functionality:

  • IDM only supports a subset of the LDAP operations
    namely BIND, SEARCH, ADD, MODIFY and DELETE.

  • IDM currently does not do any LDAP schema verification like
    structural vs. auxiliary object classes,
    require and option attributes,
    syntax checks, …

  • IDM currently does not support features like 2FA and device management.

  • Check the Restrict Username Patterns documentation.

Therefore the IDM service is not meant to replace a general purpose LDAP server.

Default Values

  • IDM listens on port 9325 by default.

  • In the default configuration it only accepts TLS-protected connections (LDAPS).

  • The BaseDN of the LDAP tree is o=libregraph-idm.

  • IDM gives LDAP write permissions to a single user
    (DN: uid=libregraph,ou=sysusers,o=libregraph-idm). Any other authenticated user has read-only access.

  • IDM stores its data in a boltdb file idm/ocis.boltdb inside the Infinite Scale Base Data Directory.

Configuration Hints

TLS Server Certificates

By default, IDM generates a self-signed certificate and key on first startup to be able to provide TLS-protected services. The certificate is stored in idm/ldap.crt inside the Infinite Scale Base Data Directory. The key is in idm/ldap.key in the same directory. You can use a custom server certificate by setting the IDM_LDAPS_CERT and IDM_LDAPS_KEY.

Default and Demo Users

On startup, IDM creates a set of default service users that are needed internally to provide access to IDM to other Infinite Scale services. These users are stored in a separate subtree.

The base DN of that subtree is: ou=sysusers,o=libregraph-idm.

The service users are:

  • uid=libregraph,ou=sysusers,o=libregraph-idm
    This is the only user with write access to the LDAP tree. It is used by the Graph service to look up, create, delete and modify users and groups.

  • uid=idp,ou=sysusers,o=libregraph-idm
    This user is used by the IDP service to perform user lookups for authentication.

  • uid=reva,ou=sysusers,o=libregraph-idm
    This user is used by the "reva" services user, group and auth-basic.

IDM is also able to create Demo Users upon startup.

Access via LDAP Command Line Tools

For testing purposes it is sometimes helpful to query IDM using the ldap command line clients. To e.g. list all users, this command can be used:

ldapsearch -x -H ldaps://127.0.0.1:9235 -x \
    -D uid=libregraph,ou=sysusers,o=libregraph-idm \
    -W -b o=libregraph-idm objectclass=inetorgperson

When using the default configuration with the self-signed server certificate, you might need to switch off the certificate validation using the LDAPTL_REQCERT env variable:

LDAPTLS_REQCERT=never \
    ldapsearch -x -H ldaps://127.0.0.1:9235 -x \
    -D uid=libregraph,ou=sysusers,o=libregraph-idm \
    -W -b o=libregraph-idm objectclass=inetorgperson

Extract the idm_password password to enter from the ocis.yaml config file which is located in the Infinite Scale configuration directory.

Configuration

Environment Variables

The idm service is configured via the following environment variables. Read the Environment Variable Types documentation for important details. Column IV shows with which release the environment variable has been introduced.

404: Not Found

  • 8.2.0

404: Not Found

YAML Example

  • 8.2.0

404: Not Found