Digitalboard/reference-ansible
6
1
Fork 0
Code Pull requests Activity Actions

feat: use authentik ldap outpost for ldap instead of 389ds+keycloak

Browse source 
Signed-off-by: Bert-Jan Fikse <bert-jan@whatwedo.ch>
This commit is contained in:
Bert-Jan Fikse 2026-04-10 15:18:53 +02:00
parent 1641956dd2
commit 0e1c07625a
Signed by: bert-jan
GPG key ID: C1E0AB516AC16D1A
5 changed files with 111 additions and 40 deletions
Download patch file Download diff file Expand all files Collapse all files

58
inventories/vagrant/host_vars/backend/nextcloud.yml
View file

@ -30,34 +30,38 @@ nextcloud_s3_ssl: false
nextcloud_s3_usepath_style: true
# Extra hosts for container DNS resolution (Vagrant only)
nextcloud_extra_networks:
- ldap
nextcloud_extra_hosts:
- "storage.local.test:192.168.56.11"
- "keycloak.local.test:192.168.56.11"
- "authentik.local.test:192.168.56.11"
- "389ds:192.168.56.11"
# - "389ds:192.168.56.11" # only needed when using 389ds LDAP directly
# LDAP backend (pre-create users synced from Keycloak via 389ds)
# LDAP backend (Authentik LDAP outpost)
nextcloud_ldap_enabled: true
nextcloud_ldap_config:
ldapHost: "ldaps://389ds"
ldapPort: "3636"
ldapAgentName: "cn=Directory Manager"
ldapHost: "ldap://authentik-outpost-ldap-ldap-1"
ldapPort: "3389"
ldapAgentName: "cn=akadmin,ou=users,dc=local,dc=test"
ldapAgentPassword: "admin"
ldapBase: "dc=local,dc=test"
ldapBaseUsers: "ou=users,dc=local,dc=test"
ldapTLS: "0"
turnOffCertCheck: "1"
ldapUserFilter: "(&(objectclass=inetOrgPerson)(uid=*))"
ldapUserFilterObjectclass: "inetOrgPerson"
ldapLoginFilter: "(&(objectclass=inetOrgPerson)(uid=%uid))"
ldapUserFilter: "(&(objectClass=user)(cn=*))"
ldapUserFilterObjectclass: "user"
ldapLoginFilter: "(&(objectClass=user)(cn=%uid))"
ldapLoginFilterUsername: "1"
ldapUserDisplayName: "displayName"
ldapUserDisplayName: "cn"
ldapEmailAttribute: "mail"
ldapExpertUsernameAttr: "uid"
ldapExpertUUIDUserAttr: "nsuniqueid"
ldapExpertUsernameAttr: "cn"
ldapExpertUUIDUserAttr: "uid"
ldapExpertUUIDGroupAttr: "uid"
ldapBaseGroups: "ou=groups,dc=local,dc=test"
ldapGroupFilter: "(&(objectClass=groupOfNames))"
ldapGroupFilterObjectclass: "groupOfNames"
ldapGroupFilter: "(&(objectClass=group))"
ldapGroupFilterObjectclass: "group"
ldapGroupDisplayName: "cn"
ldapGroupMemberAssocAttr: "member"
ldapAdminGroup: "admins"
@ -65,6 +69,34 @@ nextcloud_ldap_config:
ldapPagingSize: "500"
ldapExperiencedAdmin: "1"
ldapConfigurationActive: "1"
# LDAP backend (389ds via Keycloak federation)
# nextcloud_ldap_config:
# ldapHost: "ldaps://389ds"
# ldapPort: "3636"
# ldapAgentName: "cn=Directory Manager"
# ldapAgentPassword: "admin"
# ldapBase: "dc=local,dc=test"
# ldapBaseUsers: "ou=users,dc=local,dc=test"
# ldapTLS: "0"
# turnOffCertCheck: "1"
# ldapUserFilter: "(&(objectclass=inetOrgPerson)(uid=*))"
# ldapUserFilterObjectclass: "inetOrgPerson"
# ldapLoginFilter: "(&(objectclass=inetOrgPerson)(uid=%uid))"
# ldapLoginFilterUsername: "1"
# ldapUserDisplayName: "displayName"
# ldapEmailAttribute: "mail"
# ldapExpertUsernameAttr: "uid"
# ldapExpertUUIDUserAttr: "nsuniqueid"
# ldapBaseGroups: "ou=groups,dc=local,dc=test"
# ldapGroupFilter: "(&(objectClass=groupOfNames))"
# ldapGroupFilterObjectclass: "groupOfNames"
# ldapGroupDisplayName: "cn"
# ldapGroupMemberAssocAttr: "member"
# ldapAdminGroup: "admins"
# ldapCacheTTL: "600"
# ldapPagingSize: "500"
# ldapExperiencedAdmin: "1"
# ldapConfigurationActive: "1"
# OIDC providers for login
nextcloud_oidc_providers: