LDAP Directory Information Tree

This document describes how the debops.owncloud Ansible role fits in the LDAP directory structure organized by DebOps.

Directory structure

• cn=host.example.org -> debops.ldap

  • uid=nextcloud

• ou=Roles -> debops.ldap

  • cn=Password Reset Agent

    • roleOccupant: uid=nextcloud,cn=host.example.org,...

Object Classes and Attributes

• uid=nextcloud

  • debops.owncloud: Object Classes, Attributes

Custom objectClasses and attributes from the nextcloud LDAP schema:

• objectClass nextcloudAccount, attributes nextcloudEnabled, nextcloudQuota

• objectClass nextcloudGroup, attributes nextcloudEnabled

Access Control

DebOps LDAP environment includes the 'ldapns' schema which can be used to define access control rules to services. The lists below define the attribute values which will grant access to the service managed by the debops.owncloud role, and specifies other roles with the same access control rules:

• objectClass authorizedServiceObject, attribute authorizedService:

  • all (all services)

  • nextcloud

  • owncloud

  • web:public

LDAP filter definition: owncloud__ldap_login_filter

Parent nodes

• debops.ldap

  • ansible_local.ldap.base_dn -> owncloud__ldap_base_dn

  • ansible_local.ldap.device_dn -> owncloud__ldap_device_dn

Child nodes

There are no child nodes defined for the debops.owncloud Ansible role.