|
| 1 | +#!/bin/bash |
| 2 | +# |
| 3 | +# Configure Nextcloud's user_ldap backend against the `openldap` service. |
| 4 | +# |
| 5 | +# Runs only when the `ldap` docker-compose profile is active (the `openldap` |
| 6 | +# hostname resolves). Sets up a single LDAP config so the seeded user `alice` |
| 7 | +# logs in as `alice` but is mapped to a canonical UID derived from her LDAP |
| 8 | +# entryUUID — the divergent loginName/UID condition that reproduces GH #980. |
| 9 | +# |
| 10 | +# Idempotent: reuses an existing config id if present, else creates one. |
| 11 | +# |
| 12 | + |
| 13 | +set -e |
| 14 | + |
| 15 | +echo "====================================================================" |
| 16 | +echo "Configuring user_ldap backend for OpenLDAP..." |
| 17 | +echo "====================================================================" |
| 18 | + |
| 19 | +# Quick check: is the openldap service in the Docker network? |
| 20 | +# When the `ldap` profile is not active, this hostname won't resolve, so the |
| 21 | +# hook is a no-op for every other lane. |
| 22 | +if ! getent hosts openldap >/dev/null 2>&1; then |
| 23 | + echo " OpenLDAP service not detected in Docker network (ldap profile not active)" |
| 24 | + echo " Skipping user_ldap configuration" |
| 25 | + exit 0 |
| 26 | +fi |
| 27 | + |
| 28 | +php /var/www/html/occ app:enable user_ldap |
| 29 | + |
| 30 | +# Reuse an existing config id (idempotent re-run), else create a fresh one. |
| 31 | +# The trailing `|| true` guards the whole command substitution under `set -e` |
| 32 | +# (grep exits non-zero when no config exists yet on a fresh install); keep it on |
| 33 | +# this pipeline if refactoring. |
| 34 | +CONFIG_ID=$(php /var/www/html/occ ldap:show-config 2>/dev/null \ |
| 35 | + | grep -E '^\| Configuration' | grep -oE 's[0-9]+' | head -n1 || true) |
| 36 | +if [ -z "$CONFIG_ID" ]; then |
| 37 | + CONFIG_ID=$(php /var/www/html/occ ldap:create-empty-config | grep -oE 's[0-9]+' | head -n1) |
| 38 | +fi |
| 39 | +echo "Using user_ldap config: $CONFIG_ID" |
| 40 | + |
| 41 | +set_cfg() { php /var/www/html/occ ldap:set-config "$CONFIG_ID" "$1" "$2" >/dev/null; } |
| 42 | + |
| 43 | +# Connection (openldap = internal docker hostname; admin bind = uid=admin). |
| 44 | +set_cfg ldapHost openldap |
| 45 | +set_cfg ldapPort 389 |
| 46 | +set_cfg ldapAgentName "uid=admin,dc=example,dc=org" |
| 47 | +set_cfg ldapAgentPassword "ldap_admin_pw" |
| 48 | +set_cfg ldapBase "dc=example,dc=org" |
| 49 | +set_cfg ldapBaseUsers "ou=people,dc=example,dc=org" |
| 50 | +# Filters + attribute mapping. Leaving the internal-username attribute at its |
| 51 | +# default makes Nextcloud derive the UID from entryUUID (below), so loginName |
| 52 | +# (uid=alice) differs from the canonical UID — the point of this lane. |
| 53 | +set_cfg ldapUserFilter "(objectClass=inetOrgPerson)" |
| 54 | +set_cfg ldapLoginFilter "(&(objectClass=inetOrgPerson)(uid=%uid))" |
| 55 | +set_cfg ldapUserDisplayName "cn" |
| 56 | +set_cfg ldapEmailAttribute "mail" |
| 57 | +set_cfg ldapExpertUUIDUserAttr "entryUUID" |
| 58 | +set_cfg ldapTLS 0 |
| 59 | +set_cfg turnOffCertCheck 1 |
| 60 | +set_cfg ldapConfigurationActive 1 |
| 61 | + |
| 62 | +# Wait for OpenLDAP to answer by retrying the connection test itself — no extra |
| 63 | +# client tooling needed in the app image. This doubles as validation. |
| 64 | +echo "Verifying LDAP connection..." |
| 65 | +MAX_RETRIES=30 |
| 66 | +RETRY_COUNT=0 |
| 67 | +while [ $RETRY_COUNT -lt $MAX_RETRIES ]; do |
| 68 | + if php /var/www/html/occ ldap:test-config "$CONFIG_ID" 2>/dev/null | grep -q "valid"; then |
| 69 | + echo "====================================================================" |
| 70 | + echo "✓ user_ldap backend configured ($CONFIG_ID)" |
| 71 | + echo "====================================================================" |
| 72 | + exit 0 |
| 73 | + fi |
| 74 | + echo " Waiting for OpenLDAP... (attempt $((RETRY_COUNT + 1))/$MAX_RETRIES)" |
| 75 | + sleep 5 |
| 76 | + RETRY_COUNT=$((RETRY_COUNT + 1)) |
| 77 | +done |
| 78 | + |
| 79 | +echo "⚠ Warning: LDAP connection could not be verified after $MAX_RETRIES attempts" |
| 80 | +php /var/www/html/occ ldap:test-config "$CONFIG_ID" || true |
| 81 | +exit 0 |
0 commit comments