IDM Service Configuration

Introduction

The Infinite Scale IDM service provides a minimal LDAP Service for Infinite Scale. It is started as part of the the runtime and serves as a central place for storing user and group information. The IDM Service is based on LibreGraph Identity Management.

Services are under development because of the beta badge 1 stage of Infinite Scale. Their service, environment variables and configuration may change. Forgive us if there are mistakes or information is missing. Feel free to report issues and we’ll take care of them as soon as possible on github. You want to fix them yourself? We’d appreciate that even more.
It is mainly targeted at small Infinite Scale installations. For larger setups it is recommended to replace the IDM service with a “real” LDAP server or to switch to an external Identity Management Solution.
The IDM service is limited in its functionality. It only supports a subset of the LDAP operations (namely BIND, SEARCH, ADD, MODIFY and DELETE). Also IDM currently does not do any schema verification (e.g. structural vs. auxiliary object classes, require and option attributes, syntax checks, …). It is not meant as a general purpose LDAP server.

Default Values

  • IDM listens on port 9325 by default.

  • In the default configuration it only accepts TLS-protected connections (LDAPS).

  • The BaseDN of the LDAP tree is o=libregraph-idm.

  • IDM gives LDAP write permissions to a single user
    (DN: uid=libregraph,ou=sysusers,o=libregraph-idm). Any other authenticated user has read-only access.

  • IDM stores its data in a boltdb file idm/ocis.boltdb inside the Infinite Scale base data directory.

Configuration Hints

TLS Server Certificates

By default, IDM generates a self-signed certificate and key on first startup to be able to provide TLS-protected services. The certificate is stored in idm/ldap.crt inside the Infinite Scale base data directory. The key is in idm/ldap.key in the same directory. You can use a custom server certificate by setting the IDM_LDAPS_CERT and IDM_LDAPS_KEY.

Default and Demo Users

On startup, IDM creates a set of default service users that are needed internally to provide access to IDM to other Infinite Scale services. These users are stored in a separate subtree.

The base DN of that subtree is: ou=sysusers,o=libregraph-idm.

The service users are:

  • uid=libregraph,ou=sysusers,o=libregraph-idm
    This is the only user with write access to the LDAP tree. It is used by the Graph service to look up, create, delete and modify users and groups.

  • uid=idp,ou=sysusers,o=libregraph-idm
    This user is used by the IDP service to perform user lookups for authentication.

  • uid=reva,ou=sysusers,o=libregraph-idm
    This user is used by the "reva" services user, group and auth-basic.

IDM is also able to create Demo Users upon startup.

Access via LDAP Command Line Tools

For testing purposes it is sometimes helpful to query IDM using the ldap command line clients. To e.g. list all users, this command can be used:

ldapsearch -x -H ldaps://127.0.0.1:9235 -x \
    -D uid=libregraph,ou=sysusers,o=libregraph-idm \
    -w idm -b o=libregraph-idm objectclass=inetorgperson

When using the default configuration with the self-signed server certificate, you might need to switch off the certificate validation using the LDAPTL_REQCERT env variable:

LDAPTLS_REQCERT=never \
    ldapsearch -x -H ldaps://127.0.0.1:9235 -x \
    -D uid=libregraph,ou=sysusers,o=libregraph-idm \
    -w idm -b o=libregraph-idm objectclass=inetorgperson

Configuration

Environment Variables

The idm extension is configured via the following environment variables:

Environment variables for the idm extension
Name Type Default Value Description

OCIS_TRACING_ENABLED
IDM_TRACING_ENABLED

bool

false

Activates tracing.

OCIS_TRACING_TYPE
IDM_TRACING_TYPE

string

The type of tracing. Defaults to "", which is the same as "jaeger". Allowed tracing types are "jaeger" and "" as of now.

OCIS_TRACING_ENDPOINT
IDM_TRACING_ENDPOINT

string

The endpoint of the tracing agent.

OCIS_TRACING_COLLECTOR
IDM_TRACING_COLLECTOR

string

The HTTP endpoint for sending spans directly to a collector, i.e. http://jaeger-collector:14268/api/traces. Only used if the tracing endpoint is unset.

OCIS_LOG_LEVEL
IDM_LOG_LEVEL

string

The log level. Valid values are: "panic", "fatal", "error", "warn", "info", "debug", "trace".

OCIS_LOG_PRETTY
IDM_LOG_PRETTY

bool

false

Activates pretty log output.

OCIS_LOG_COLOR
IDM_LOG_COLOR

bool

false

Activates colorized log output.

OCIS_LOG_FILE
IDM_LOG_FILE

string

The path to the log file. Activates logging to this file if set.

IDM_DEBUG_ADDR

string

127.0.0.1:9239

Bind address of the debug server, where metrics, health, config and debug endpoints will be exposed.

IDM_DEBUG_TOKEN

string

Token to secure the metrics endpoint

IDM_DEBUG_PPROF

bool

false

Enables pprof, which can be used for profiling

IDM_DEBUG_ZPAGES

bool

false

Enables zpages, which can be used for collecting and viewing in-memory traces.

IDM_LDAPS_ADDR

string

127.0.0.1:9235

Listen address for the ldaps listener (ip-addr:port)

IDM_LDAPS_CERT

string

~/.ocis/idm/ldap.crt

File name of the TLS server certificate for the ldaps listener

IDM_LDAPS_KEY

string

~/.ocis/idm/ldap.key

File name for the TLS certificate key for the server certificate

IDM_DATABASE_PATH

string

~/.ocis/idm/ocis.boltdb

Full path to the idm backend database

IDM_CREATE_DEMO_USERS
ACCOUNTS_DEMO_USERS_AND_GROUPS

bool

false

Flag to enabe/disable the creation of the demo users

IDM_ADMIN_PASSWORD

string

Password to set for the ocis "admin" user. Either cleartext or an argon2id hash

IDM_SVC_PASSWORD

string

Password to set for the "idm" service user. Either cleartext or an argon2id hash

IDM_REVASVC_PASSWORD

string

Password to set for the "reva" service user. Either cleartext or an argon2id hash

IDM_IDPSVC_PASSWORD

string

Password to set for the "idp" service user. Either cleartext or an argon2id hash

OCIS_ADMIN_USER_ID
IDM_ADMIN_USER_ID

string

ID of a user, that should receive admin privileges.

Since Version: + added, - deprecated

YAML Example

# Autogenerated
# Filename: idm-config-example.yaml

tracing:
  enabled: false
  type: ""
  endpoint: ""
  collector: ""
log:
  level: ""
  pretty: false
  color: false
  file: ""
debug:
  addr: 127.0.0.1:9239
  token: ""
  pprof: false
  zpages: false
idm:
  ldaps_addr: 127.0.0.1:9235
  cert: ~/.ocis/idm/ldap.crt
  key: ~/.ocis/idm/ldap.key
  database: ~/.ocis/idm/ocis.boltdb
create_demo_users: false
service_user_passwords:
  admin_password: ""
  idm_password: ""
  reva_password: ""
  idp_password: ""
admin_user_id: ""