switch to preferred_username as opaqueid

Signed-off-by: Jörn Friedrich Dreyer <[email protected]>

changelog/unreleased/new-ocis-config.md

@@ -6,5 +6,6 @@ We changed the default configuration to integrate better with ocis.
 - We use a dedicated technical `reva` user to make ldap binds
 - Clients are supposed to use the ocis-proxy endpoint `https://localhost:9200`
 - We removed unneeded ocis configuration from the frontend which no longer serves an oidc provider.
+- We changed the default user OpaqueID attribute from `sub` to `preferred_username`. Tha latter is a claim populated by konnectd that can also be used by the reva ldap user manager to look up users by their OpaqueId
 
 https://github.com/owncloud/ocis-reva/pull/113

pkg/flagset/authbearer.go

@@ -99,8 +99,14 @@ func AuthBearerWithConfig(cfg *config.Config) []cli.Flag {
 			Destination: &cfg.Reva.OIDC.Insecure,
 		},
 		&cli.StringFlag{
-			Name:        "oidc-id-claim",
-			Value:       "sub", // sub is stable and defined as unique. the user manager needs to take care of the sub to user metadata lookup
+			Name: "oidc-id-claim",
+			// preferred_username is a workaround
+			// the user manager needs to take care of the sub to user metadata lookup, which ldap cannot do
+			// TODO sub is stable and defined as unique.
+			// AFAICT we want to use the account id from ocis-accounts
+			// TODO add an ocis middleware to reva that changes the users opaqueid?
+			// TODO add an ocis-accounts backed user manager
+			Value:       "preferred_username",
 			Usage:       "OIDC id claim",
 			EnvVars:     []string{"REVA_OIDC_ID_CLAIM"},
 			Destination: &cfg.Reva.OIDC.IDClaim,