LDAP Integration 📒

OpenCloud uses the central svc-db-openldap instance for user and group lookups. Configuration is rendered into the role’s environment file at deploy time using the LDAP group_var dictionary, so no LDAP value is hard-coded in the role.

Variable Mapping 🗺️

OpenCloud env	Group variable
OC_LDAP_URI	LDAP.SERVER.URI
OC_LDAP_BIND_DN	LDAP.DN.ADMINISTRATOR.DATA
OC_LDAP_BIND_PASSWORD	LDAP.BIND_CREDENTIAL (Vault)
OC_LDAP_USER_BASE_DN	LDAP.DN.OU.USERS
OC_LDAP_GROUP_BASE_DN	LDAP.DN.OU.GROUPS
OC_LDAP_USER_SCHEMA_USERNAME	LDAP.USER.ATTRIBUTES.ID
OC_LDAP_USER_SCHEMA_MAIL	LDAP.USER.ATTRIBUTES.MAIL
OC_LDAP_USER_SCHEMA_DISPLAY_NAME	LDAP.USER.ATTRIBUTES.FULLNAME

Read-only Mode 🔒

GRAPH_LDAP_SERVER_WRITE_ENABLED=false keeps OpenCloud from modifying the directory. User lifecycle is owned by the LDAP and Keycloak side.

Inspect LDAP Entries 🩺

make compose-exec cmd="container exec opencloud opencloud users list"