ldap-rest 0.11.2 → 0.13.0

package/docs/usage/upgrading.md

@@ -4,6 +4,120 @@ What to check before deploying, newest first. Only releases that need a
 decision or a configuration change appear here; see the
 [CHANGELOG](../../CHANGELOG.md) for everything else.
 
+## To 0.13.0
+
+### An OpenID Connect session ends with its access token
+
+**Who is affected:** a deployment loading `core/auth/openidconnect`.
+
+A session used to last as long as its cookie, a day of inactivity and a week
+at most. It now ends when its access token expires, unless the provider gave
+a refresh token to renew it: a browser then goes back through the provider,
+silently while the provider's own session lasts, and a client asking for
+JSON only (`Accept: application/json`) is answered `401`.
+
+To keep sessions going without that round trip, have the provider issue
+refresh tokens to the client
+([details](plugins/auth/oidc.md#session-lifetime)).
+
+### SCIM `active` reads the lock value
+
+**Who is affected:** a SCIM client of a directory with ppolicy lockouts. An
+account locked out after failed binds now reads `active: true`, is left out
+of `active eq false`, and keeps its lockout on `"active": true`; only the
+configured lock value reads as inactive. See
+[the SCIM plugin documentation](plugins/integrations/scim.md#deactivating-an-account-active).
+
+### twake/instances links an organization before its members
+
+**Who is affected:** a deployment running 0.12.0 with
+`--twake-instance-provider cloudery` and `--twake-instance-organization-base`.
+
+0.12.0 sent each member's `user.created` at once and marked the member, while
+the Cloudery refused it because the organization was not linked to its
+instance. The plugin now links the organization and holds its members until
+then, but only releases members that are not marked, so those already marked
+are not sent again on their own.
+
+To repair an organization, clear `--twake-instance-sent-attribute` on its
+marked members, then replay its `workplace.created` or call
+`ensureOrganization` for it ([details](plugins/integrations/instances.md#organizations)).
+
+### Trash watched bases are separated by `;`
+
+**Who is affected:** a deployment loading `core/ldap/trash` with
+`--trash-watched-bases` set.
+
+The list was split on commas, so a DN such as `ou=users,dc=example,dc=com`
+became the suffixes `ou=users`, `dc=example` and `dc=com`, and the trash
+caught deletes in every branch under `dc=com`. Each base is now a whole DN,
+and bases are separated by `;`:
+`ou=users,dc=example,dc=com;ou=groups,dc=example,dc=com`. A single DN needs
+no change. A list of full DNs joined by commas, such as
+`ou=users,dc=example,dc=com,ou=groups,dc=example,dc=com`, or a list of RDNs,
+such as `ou=users,ou=groups`, now reads as one DN that no entry sits under,
+so the trash catches nothing and deletes there are permanent: rewrite it with
+`;`, each branch as its full DN. The server logs a warning at startup for a
+watched base that is not one DN under `--ldap-base`.
+
+## To 0.12.0
+
+### twake/instances replaces cozyProvision and clouderyProvision
+
+**Who is affected:** a deployment loading `core/twake/cozyProvision` or
+`core/twake/clouderyProvision`.
+
+Replace the plugin with `core/twake/instances`
+([doc](plugins/integrations/instances.md)); the server refuses to start with
+both. Its options are its own. From cozyProvision, with
+`--twake-instance-provider cozy-stack` and `--twake-instance-dn` set to the
+accounts' branch:
+
+- `--cozy-admin-url` → `--twake-instance-cozy-url`
+- `--cozy-admin-user` → `--twake-instance-cozy-user`
+- `--cozy-admin-passphrase` → `--twake-instance-cozy-passphrase`
+- `--cozy-org-domain` → `--twake-instance-cozy-domain` (the instances'
+  domain) and `--twake-instance-cozy-org-domain`
+- `--cozy-org-id` → `--twake-instance-cozy-org-id`
+- `--cozy-context-name` → `--twake-instance-cozy-context`
+- `--cozy-apps` → `--twake-instance-cozy-apps`
+- `--cozy-default-locale` → `--twake-instance-locale`
+- `--cozy-auth-exchange` → `--twake-instance-auth-exchange`
+- `--cozy-b2b-exchange` → `--twake-instance-b2b-exchange`
+- `--cozy-user-created-routing-key` → `--twake-instance-user-created-key`
+
+From clouderyProvision, with `--twake-instance-provider cloudery`:
+
+- `--cloudery-manager-url` → `--twake-instance-cloudery-url`
+- `--cloudery-manager-token` → `--twake-instance-cloudery-token`
+- `--cloudery-offer` → `--twake-instance-cloudery-offer`
+- `--cloudery-domain` → `--twake-instance-cloudery-domain`
+- `--cloudery-default-locale` → `--twake-instance-locale`
+- `--cloudery-fqdn-attribute` → `--twake-instance-fqdn-attribute`
+- `--cloudery-user-branch` → `--twake-instance-dn`, with an `org` group for
+  the organization id; `--twake-instance-id '{uid}{org}'` keeps the slugs
+
+What no longer happens:
+
+- An account gets its instance on any add under `--twake-instance-dn`, not
+  only a SCIM create.
+- `domain.user.deleted` is not published, and `--cozy-user-deleted-routing-key`
+  has no plugin to read it. With the Cloudery, deleting an account no longer
+  deletes its instance; cozy-stack instances still are.
+- clouderyProvision's writes on a SCIM create are gone:
+  `twakeOrganizationId`, `twakeOrganizationRole`, `twakeInvited`,
+  `twakePhones`, `cn` set to the userName, and the lower-casing of the SCIM
+  `userName`. The `x-cloudery-org-*` headers are not read; the organization
+  comes from the DN. `--cloudery-org-*`, `--cloudery-phones-attribute`,
+  `--cloudery-invited-attribute` and the workflow polling options are gone:
+  the address arrives with `workplace.created` instead.
+- With cozy-stack, the instance address drops the uid's dots and lower-cases
+  it, as the Cloudery's slugs do: an account whose uid holds a dot or a
+  capital gets a different address than cozyProvision gave it. Its OIDC id
+  is still the uid.
+
+`user.created` keeps its fields, `twakeId` still being the account's uid.
+
 ## To 0.11.0
 
 ### Group reads are judged

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ldap-rest",
-  "version": "0.11.2",
+  "version": "0.13.0",
   "description": "Light directory manager",
   "keywords": [
     "Identity-Manager"
@@ -268,10 +268,30 @@
       "types": "./dist/src/plugins/twake/drive.d.ts",
       "import": "./dist/plugins/twake/drive.js"
     },
+    "./plugin-twake-groups": {
+      "types": "./dist/src/plugins/twake/groups.d.ts",
+      "import": "./dist/plugins/twake/groups.js"
+    },
+    "./plugin-twake-instances": {
+      "types": "./dist/src/plugins/twake/instances.d.ts",
+      "import": "./dist/plugins/twake/instances.js"
+    },
     "./plugin-twake-james": {
       "types": "./dist/src/plugins/twake/james.d.ts",
       "import": "./dist/plugins/twake/james.js"
     },
+    "./plugin-twake-lifecycleattributes": {
+      "types": "./dist/src/plugins/twake/lifecycleAttributes.d.ts",
+      "import": "./dist/plugins/twake/lifecycleAttributes.js"
+    },
+    "./plugin-twake-lifecycleevents": {
+      "types": "./dist/src/plugins/twake/lifecycleEvents.d.ts",
+      "import": "./dist/plugins/twake/lifecycleEvents.js"
+    },
+    "./plugin-twake-tombstone": {
+      "types": "./dist/src/plugins/twake/tombstone.d.ts",
+      "import": "./dist/plugins/twake/tombstone.js"
+    },
     "./plugin-weblogs": {
       "types": "./dist/src/plugins/weblogs.d.ts",
       "import": "./dist/plugins/weblogs.js"
@@ -644,6 +664,10 @@
       "import": "./static/schemas/twake/nomenclature/twakeTitle.json",
       "require": "./static/schemas/twake/nomenclature/twakeTitle.json"
     },
+    "./schema-twake-organizationgroups": {
+      "import": "./static/schemas/twake/organizationGroups.json",
+      "require": "./static/schemas/twake/organizationGroups.json"
+    },
     "./schema-twake-organizations": {
       "import": "./static/schemas/twake/organizations.json",
       "require": "./static/schemas/twake/organizations.json"

package/static/schemas/twake/organizationGroups.json

@@ -0,0 +1,32 @@
+{
+  "strict": true,
+  "attributes": {
+    "objectClass": {
+      "type": "array",
+      "items": {
+        "type": "string",
+        "test": "^[a-zA-Z][a-zA-Z0-9-]*$"
+      },
+      "default": ["top", "groupOfNames", "twakeGroup"],
+      "required": true,
+      "fixed": true
+    },
+    "cn": {
+      "type": "string",
+      "test": "^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$",
+      "required": true
+    },
+    "member": {
+      "type": "array",
+      "items": {
+        "type": "string",
+        "test": "^[a-zA-Z]+=.*,__LDAP_BASE__$"
+      },
+      "required": false
+    },
+    "description": {
+      "type": "string",
+      "required": false
+    }
+  }
+}