Auth Basic Service Configuration

Table of Contents

Introduction
Default Values
The auth Service Family
Auth Managers
- LDAP Auth Manager
- Other Auth Managers
Scalability
Configuration
- Environment Variables
- YAML Example

Introduction

The Infinite Scale Auth Basic service provides basic authentication for those clients who cannot handle OIDC. This is a rare case, is usually not necessary and mainly used for tests or development.

The auth-basic service is responsible for validating authentication of incoming requests. To do so, it will use the configured auth manager, see the Auth Managers section. Only HTTP basic auth requests to ocis will involve the auth-basic service.

To enable auth-basic, you first must set PROXY_ENABLE_BASIC_AUTH to true.

The basic authentication implementation does not support cookies and is therefore not intended to be used for benchmarks.

Default Values

Auth Basic listens on port 9146 by default.

The `auth` Service Family

Infinite Scale uses several authentication services for different use cases. All services that start with auth- are part of the authentication service family. Each member authenticates requests with different scopes.

As of now, these `auth` services exist
auth-app	Handles 3rd party app authentication.
auth-basic	Handles basic authentication.
auth-bearer	Handles OIDC authentication.
auth-machine	Handles interservice authentication when a user is impersonated.
auth-service	Handles interservice authentication when using service accounts.

As of now, these auth services exist

auth-app

Handles 3rd party app authentication.

auth-basic

Handles basic authentication.

auth-bearer

Handles OIDC authentication.

auth-machine

Handles interservice authentication when a user is impersonated.

auth-service

Handles interservice authentication when using service accounts.

Auth Managers

Since the auth-basic service does not do any validation itself, it needs to be configured with an authentication manager. One can use the AUTH_BASIC_AUTH_PROVIDER environment variable to configure this.

LDAP Auth Manager

Setting AUTH_BASIC_AUTH_PROVIDER to "ldap" will configure the auth-basic service to use LDAP as auth manager. This is the recommended option for running in a production and testing environment. More details on how to configure LDAP with ocis can be found in the admin docs.

Other Auth Managers

The possible auth mangers which can be selected are "ldap" and "owncloudsql". Those are tested and usable though "ldap" is the recommend manager. Refer to the admin docs for additional information about those.

Scalability

Scalability, just like memory and CPU consumption, are highly dependent on the configured auth manager. When using the recommended one which is "ldap", there is no persistance as requests will just be forwarded to the LDAP server. Therefore, multiple instances of the auth-basic service can be started without further configuration. Be aware, that other auth managers might not allow that.

Configuration

Environment Variables

The auth-basic service is configured via the following environment variables. Read the Environment Variable Types documentation for important details. Column IV shows with which release the environment variable has been introduced.

master + Rolling 6.6.1

Environment variables for the auth-basic service
Name	IV	Type	Default Value	Description
`OCIS_TRACING_ENABLED` `AUTH_BASIC_TRACING_ENABLED`	pre5.0	bool	false	Activates tracing.
`OCIS_TRACING_TYPE` `AUTH_BASIC_TRACING_TYPE`	pre5.0	string		The type of tracing. Defaults to '', which is the same as 'jaeger'. Allowed tracing types are 'jaeger' and '' as of now.
`OCIS_TRACING_ENDPOINT` `AUTH_BASIC_TRACING_ENDPOINT`	pre5.0	string		The endpoint of the tracing agent.
`OCIS_TRACING_COLLECTOR` `AUTH_BASIC_TRACING_COLLECTOR`	pre5.0	string		The HTTP endpoint for sending spans directly to a collector, i.e. http://jaeger-collector:14268/api/traces. Only used if the tracing endpoint is unset.
`OCIS_LOG_LEVEL` `AUTH_BASIC_LOG_LEVEL`	pre5.0	string		The log level. Valid values are: 'panic', 'fatal', 'error', 'warn', 'info', 'debug', 'trace'.
`OCIS_LOG_PRETTY` `AUTH_BASIC_LOG_PRETTY`	pre5.0	bool	false	Activates pretty log output.
`OCIS_LOG_COLOR` `AUTH_BASIC_LOG_COLOR`	pre5.0	bool	false	Activates colorized log output.
`OCIS_LOG_FILE` `AUTH_BASIC_LOG_FILE`	pre5.0	string		The path to the log file. Activates logging to this file if set.
`AUTH_BASIC_DEBUG_ADDR`	pre5.0	string	127.0.0.1:9147	Bind address of the debug server, where metrics, health, config and debug endpoints will be exposed.
`AUTH_BASIC_DEBUG_TOKEN`	pre5.0	string		Token to secure the metrics endpoint.
`AUTH_BASIC_DEBUG_PPROF`	pre5.0	bool	false	Enables pprof, which can be used for profiling.
`AUTH_BASIC_DEBUG_ZPAGES`	pre5.0	bool	false	Enables zpages, which can be used for collecting and viewing traces in-memory.
`AUTH_BASIC_GRPC_ADDR`	pre5.0	string	127.0.0.1:9146	The bind address of the GRPC service.
`OCIS_GRPC_PROTOCOL` `AUTH_BASIC_GRPC_PROTOCOL`	pre5.0	string	tcp	The transport protocol of the GRPC service.
`OCIS_JWT_SECRET` `AUTH_BASIC_JWT_SECRET`	pre5.0	string		The secret to mint and validate jwt tokens.
`OCIS_REVA_GATEWAY`	pre5.0	string	com.owncloud.api.gateway	The CS3 gateway endpoint.
`OCIS_GRPC_CLIENT_TLS_MODE`	pre5.0	string		TLS mode for grpc connection to the go-micro based grpc services. Possible values are 'off', 'insecure' and 'on'. 'off': disables transport security for the clients. 'insecure' allows using transport security, but disables certificate verification (to be used with the autogenerated self-signed certificates). 'on' enables transport security, including server certificate verification.
`OCIS_GRPC_CLIENT_TLS_CACERT`	pre5.0	string		Path/File name for the root CA certificate (in PEM format) used to validate TLS server certificates of the go-micro based grpc services.
`AUTH_BASIC_SKIP_USER_GROUPS_IN_TOKEN`	pre5.0	bool	false	Disables the encoding of the user’s group memberships in the reva access token. This reduces the token size, especially when users are members of a large number of groups.
`AUTH_BASIC_AUTH_MANAGER`	pre5.0	string	ldap	The authentication manager to check if credentials are valid. Supported value is 'ldap'.
`OCIS_LDAP_URI` `AUTH_BASIC_LDAP_URI`	pre5.0	string	ldaps://localhost:9235	URI of the LDAP Server to connect to. Supported URI schemes are 'ldaps://' and 'ldap://'
`OCIS_LDAP_CACERT` `AUTH_BASIC_LDAP_CACERT`	pre5.0	string	/var/lib/ocis/idm/ldap.crt	Path/File name for the root CA certificate (in PEM format) used to validate TLS server certificates of the LDAP service. If not defined, the root directory derives from $OCIS_BASE_DATA_PATH/idm.
`OCIS_LDAP_INSECURE` `AUTH_BASIC_LDAP_INSECURE`	pre5.0	bool	false	Disable TLS certificate validation for the LDAP connections. Do not set this in production environments.
`OCIS_LDAP_BIND_DN` `AUTH_BASIC_LDAP_BIND_DN`	pre5.0	string	uid=reva,ou=sysusers,o=libregraph-idm	LDAP DN to use for simple bind authentication with the target LDAP server.
`OCIS_LDAP_BIND_PASSWORD` `AUTH_BASIC_LDAP_BIND_PASSWORD`	pre5.0	string		Password to use for authenticating the 'bind_dn'.
`OCIS_LDAP_USER_BASE_DN` `AUTH_BASIC_LDAP_USER_BASE_DN`	pre5.0	string	ou=users,o=libregraph-idm	Search base DN for looking up LDAP users.
`OCIS_LDAP_GROUP_BASE_DN` `AUTH_BASIC_LDAP_GROUP_BASE_DN`	pre5.0	string	ou=groups,o=libregraph-idm	Search base DN for looking up LDAP groups.
`OCIS_LDAP_USER_SCOPE` `AUTH_BASIC_LDAP_USER_SCOPE`	pre5.0	string	sub	LDAP search scope to use when looking up users. Supported values are 'base', 'one' and 'sub'.
`OCIS_LDAP_GROUP_SCOPE` `AUTH_BASIC_LDAP_GROUP_SCOPE`	pre5.0	string	sub	LDAP search scope to use when looking up groups. Supported values are 'base', 'one' and 'sub'.
`OCIS_LDAP_USER_FILTER` `AUTH_BASIC_LDAP_USER_FILTER`	pre5.0	string		LDAP filter to add to the default filters for user search like '(objectclass=ownCloud)'.
`OCIS_LDAP_GROUP_FILTER` `AUTH_BASIC_LDAP_GROUP_FILTER`	pre5.0	string		LDAP filter to add to the default filters for group searches.
`OCIS_LDAP_USER_OBJECTCLASS` `AUTH_BASIC_LDAP_USER_OBJECTCLASS`	pre5.0	string	inetOrgPerson	The object class to use for users in the default user search filter ('inetOrgPerson').
`OCIS_LDAP_GROUP_OBJECTCLASS` `AUTH_BASIC_LDAP_GROUP_OBJECTCLASS`	pre5.0	string	groupOfNames	The object class to use for groups in the default group search filter ('groupOfNames').
`LDAP_LOGIN_ATTRIBUTES` `AUTH_BASIC_LDAP_LOGIN_ATTRIBUTES`	pre5.0	[]string	[uid]	A list of user object attributes that can be used for login. See the Environment Variable Types description for more details.
`OCIS_URL` `OCIS_OIDC_ISSUER` `AUTH_BASIC_IDP_URL`	pre5.0	string	https://localhost:9200	The identity provider value to set in the userids of the CS3 user objects for users returned by this user provider.
`OCIS_LDAP_DISABLE_USER_MECHANISM` `AUTH_BASIC_DISABLE_USER_MECHANISM`	pre5.0	string	attribute	An option to control the behavior for disabling users. Valid options are 'none', 'attribute' and 'group'. If set to 'group', disabling a user via API will add the user to the configured group for disabled users, if set to 'attribute' this will be done in the ldap user entry, if set to 'none' the disable request is not processed.
`OCIS_LDAP_DISABLED_USERS_GROUP_DN` `AUTH_BASIC_DISABLED_USERS_GROUP_DN`	pre5.0	string	cn=DisabledUsersGroup,ou=groups,o=libregraph-idm	The distinguished name of the group to which added users will be classified as disabled when 'disable_user_mechanism' is set to 'group'.
`OCIS_LDAP_USER_SCHEMA_ID` `AUTH_BASIC_LDAP_USER_SCHEMA_ID`	pre5.0	string	ownclouduuid	LDAP Attribute to use as the unique ID for users. This should be a stable globally unique ID like a UUID.
`OCIS_LDAP_USER_SCHEMA_ID_IS_OCTETSTRING` `AUTH_BASIC_LDAP_USER_SCHEMA_ID_IS_OCTETSTRING`	pre5.0	bool	false	Set this to true if the defined 'ID' attribute for users is of the 'OCTETSTRING' syntax. This is e.g. required when using the 'objectGUID' attribute of Active Directory for the user IDs.
`OCIS_LDAP_USER_SCHEMA_MAIL` `AUTH_BASIC_LDAP_USER_SCHEMA_MAIL`	pre5.0	string	mail	LDAP Attribute to use for the email address of users.
`OCIS_LDAP_USER_SCHEMA_DISPLAYNAME` `AUTH_BASIC_LDAP_USER_SCHEMA_DISPLAYNAME`	pre5.0	string	displayname	LDAP Attribute to use for the displayname of users.
`OCIS_LDAP_USER_SCHEMA_USERNAME` `AUTH_BASIC_LDAP_USER_SCHEMA_USERNAME`	pre5.0	string	uid	LDAP Attribute to use for username of users.
`OCIS_LDAP_USER_ENABLED_ATTRIBUTE` `AUTH_BASIC_LDAP_USER_ENABLED_ATTRIBUTE`	pre5.0	string	ownCloudUserEnabled	LDAP attribute to use as a flag telling if the user is enabled or disabled.
`OCIS_LDAP_GROUP_SCHEMA_ID` `AUTH_BASIC_LDAP_GROUP_SCHEMA_ID`	pre5.0	string	ownclouduuid	LDAP Attribute to use as the unique id for groups. This should be a stable globally unique id (e.g. a UUID).
`OCIS_LDAP_GROUP_SCHEMA_ID_IS_OCTETSTRING` `AUTH_BASIC_LDAP_GROUP_SCHEMA_ID_IS_OCTETSTRING`	pre5.0	bool	false	Set this to true if the defined 'id' attribute for groups is of the 'OCTETSTRING' syntax. This is e.g. required when using the 'objectGUID' attribute of Active Directory for the group IDs.
`OCIS_LDAP_GROUP_SCHEMA_MAIL` `AUTH_BASIC_LDAP_GROUP_SCHEMA_MAIL`	pre5.0	string	mail	LDAP Attribute to use for the email address of groups (can be empty).
`OCIS_LDAP_GROUP_SCHEMA_DISPLAYNAME` `AUTH_BASIC_LDAP_GROUP_SCHEMA_DISPLAYNAME`	pre5.0	string	cn	LDAP Attribute to use for the displayname of groups (often the same as groupname attribute).
`OCIS_LDAP_GROUP_SCHEMA_GROUPNAME` `AUTH_BASIC_LDAP_GROUP_SCHEMA_GROUPNAME`	pre5.0	string	cn	LDAP Attribute to use for the name of groups.
`OCIS_LDAP_GROUP_SCHEMA_MEMBER` `AUTH_BASIC_LDAP_GROUP_SCHEMA_MEMBER`	pre5.0	string	member	LDAP Attribute that is used for group members.
`AUTH_BASIC_OWNCLOUDSQL_DB_USERNAME`	pre5.0	string	owncloud	Database user to use for authenticating with the owncloud database.
`AUTH_BASIC_OWNCLOUDSQL_DB_PASSWORD`	pre5.0	string		Password for the database user.
`AUTH_BASIC_OWNCLOUDSQL_DB_HOST`	pre5.0	string	mysql	Hostname of the database server.
`AUTH_BASIC_OWNCLOUDSQL_DB_PORT`	pre5.0	int	3306	Network port to use for the database connection.
`AUTH_BASIC_OWNCLOUDSQL_DB_NAME`	pre5.0	string	owncloud	Name of the owncloud database.
`AUTH_BASIC_OWNCLOUDSQL_IDP`	pre5.0	string	https://localhost:9200	The identity provider value to set in the userids of the CS3 user objects for users returned by this user provider.
`AUTH_BASIC_OWNCLOUDSQL_NOBODY`	pre5.0	int64	90	Fallback number if no numeric UID and GID properties are provided.
`AUTH_BASIC_OWNCLOUDSQL_JOIN_USERNAME`	pre5.0	bool	false	Join the user properties table to read usernames
`AUTH_BASIC_OWNCLOUDSQL_JOIN_OWNCLOUD_UUID`	pre5.0	bool	false	Join the user properties table to read user ID’s.

YAML Example

Note the file shown below must be renamed and placed in the correct folder according to the Configuration File Naming conventions to be effective.
See the Notes for Environment Variables if you want to use environment variables in the yaml file.

master + Rolling 6.6.1

# Autogenerated
# Filename: auth-basic-config-example.yaml

tracing:
  enabled: false
  type: ""
  endpoint: ""
  collector: ""
log:
  level: ""
  pretty: false
  color: false
  file: ""
debug:
  addr: 127.0.0.1:9147
  token: ""
  pprof: false
  zpages: false
grpc:
  addr: 127.0.0.1:9146
  tls: null
  protocol: tcp
token_manager:
  jwt_secret: ""
reva:
  address: com.owncloud.api.gateway
  tls:
    mode: ""
    cacert: ""
skip_user_groups_in_token: false
auth_provider: ldap
auth_providers:
  ldap:
    uri: ldaps://localhost:9235
    ca_cert: /var/lib/ocis/idm/ldap.crt
    insecure: false
    bind_dn: uid=reva,ou=sysusers,o=libregraph-idm
    bind_password: ""
    user_base_dn: ou=users,o=libregraph-idm
    group_base_dn: ou=groups,o=libregraph-idm
    user_scope: sub
    group_scope: sub
    user_filter: ""
    group_filter: ""
    user_object_class: inetOrgPerson
    group_object_class: groupOfNames
    login_attributes:
    - uid
    idp: https://localhost:9200
    disable_user_mechanism: attribute
    ldap_disabled_users_group_dn: cn=DisabledUsersGroup,ou=groups,o=libregraph-idm
    user_schema:
      id: ownclouduuid
      id_is_octet_string: false
      mail: mail
      display_name: displayname
      user_name: uid
      user_enabled: ownCloudUserEnabled
    group_schema:
      id: ownclouduuid
      id_is_octet_string: false
      mail: mail
      display_name: cn
      group_name: cn
      member: member
  owncloudsql:
    db_username: owncloud
    db_password: ""
    db_host: mysql
    db_port: 3306
    db_name: owncloud
    idp: https://localhost:9200
    nobody: 90
    join_username: false
    join_owncloud_uuid: false