Skip to content

Commit

Permalink
commit 1dab0f7
Browse files Browse the repository at this point in the history 
Author: Ralf Haferkamp <[email protected]>
Date:   Thu Feb 16 10:50:16 2023 +0100

    graph: Improve appRoleAssignemts filters

    This should improve the processing of filters for appRoleAssignments
    a bit when combining them with other filters. We try to avoid reading
    the full user list if possible. And delay the processing of an
    appRoleAssignments filter so we can apply it on a subset of user.

    E.g. a filter:

    `appRoleAssignments/any(m:m/appRoleId eq 71881883-1768-46bd-a24d-a356a2afdf7f) and memberOf/any(m:m/id eq 509a9dcd-bb37-4f4f-a01a-19dca27d9cfa)`

    Will be reordered to first process the memberOf filter (which can be
    executed without reading the full user list) and only apply the
    appRoleAssignments filter on the resultset of the memberOf filter.
  • Loading branch information
@rhafer
rhafer committed Feb 21, 2023
1 parent 1636b55 commit 05543a5
Show file tree
Hide file tree
Showing 2 changed files with 22 additions and 22 deletions.
4 changes: 2 additions & 2 deletions helpers/extended_vars.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -33,15 +33,15 @@ variables:
description: ""
do_ignore: true
- rawname: MICRO_LOG_LEVEL
path: ocis-pkg/log/log.go:35
path: ocis-pkg/log/log.go:31
foundincode: true
name: MICRO_LOG_LEVEL
type: ""
default_value: ""
description: ""
do_ignore: false
- rawname: MICRO_LOG_LEVEL
path: ocis-pkg/log/log.go:31
path: ocis-pkg/log/log.go:35
foundincode: true
name: MICRO_LOG_LEVEL
type: ""
Expand Down
40 changes: 20 additions & 20 deletions services/_includes/adoc/global_configvars.adoc
View file
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ a| [subs=-attributes]
++string ++

a| [subs=-attributes]
++uid=reva,ou=sysusers,o=libregraph-idm ++
++uid=idp,ou=sysusers,o=libregraph-idm ++

a| [subs=-attributes]
LDAP DN to use for simple bind authentication with the target LDAP server.
Expand Down Expand Up @@ -80,7 +80,7 @@ a| [subs=-attributes]
++~/.ocis/idm/ldap.crt ++

a| [subs=-attributes]
Path/File name for the root CA certificate (in PEM format) used to validate TLS server certificates of the LDAP service. If not definied, the root directory derives from $OCIS_BASE_DATA_PATH:/idm.
Path/File name for the root CA certificate (in PEM format) used to validate TLS server certificates of the LDAP service. If not definied, the root directory derives from $OCIS_BASE_DATA_PATH:/idp.

a| `LDAP_GROUP_BASE_DN`

Expand Down Expand Up @@ -131,7 +131,7 @@ a| [subs=-attributes]
++groupOfNames ++

a| [subs=-attributes]
The object class to use for groups in the default group search filter ('groupOfNames').
The object class to use for groups in the default group search filter ('groupOfNames').

a| `LDAP_GROUP_SCHEMA_DISPLAYNAME`

Expand Down Expand Up @@ -178,7 +178,7 @@ a| [subs=-attributes]
++string ++

a| [subs=-attributes]
++ownclouduuid ++
++owncloudUUID ++

a| [subs=-attributes]
LDAP Attribute to use as the unique id for groups. This should be a stable globally unique ID like a UUID.
Expand Down Expand Up @@ -282,7 +282,7 @@ a| [subs=-attributes]
++ldaps://localhost:9235 ++

a| [subs=-attributes]
URI of the LDAP Server to connect to. Supported URI schemes are 'ldaps://' and 'ldap://'
Url of the LDAP service to use as IDP.

a| `LDAP_USER_BASE_DN`

Expand Down Expand Up @@ -336,7 +336,7 @@ a| [subs=-attributes]
++inetOrgPerson ++

a| [subs=-attributes]
The object class to use for users in the default user search filter ('inetOrgPerson').
LDAP User ObjectClass like 'inetOrgPerson'.

a| `LDAP_USER_SCHEMA_DISPLAYNAME`

Expand Down Expand Up @@ -367,10 +367,10 @@ a| [subs=-attributes]
++string ++

a| [subs=-attributes]
++ownclouduuid ++
++uid ++

a| [subs=-attributes]
LDAP Attribute to use as the unique id for users. This should be a stable globally unique id like a UUID.
LDAP User uuid attribute like 'uid'.

a| `LDAP_USER_SCHEMA_ID_IS_OCTETSTRING`

Expand Down Expand Up @@ -404,7 +404,7 @@ a| [subs=-attributes]
++mail ++

a| [subs=-attributes]
LDAP Attribute to use for the email address of users.
LDAP User email attribute like 'mail'.

a| `LDAP_USER_SCHEMA_USERNAME`

Expand All @@ -419,10 +419,10 @@ a| [subs=-attributes]
++string ++

a| [subs=-attributes]
++uid ++
++displayName ++

a| [subs=-attributes]
LDAP Attribute to use for username of users.
LDAP User name attribute like 'displayName'.

a| `LDAP_USER_SCOPE`

Expand Down Expand Up @@ -538,7 +538,7 @@ a| [subs=-attributes]
++[]string ++

a| [subs=-attributes]
++[Authorization Origin Content-Type Accept X-Requested-With] ++
++[Origin Accept Content-Type Depth Authorization Ocs-Apirequest If-None-Match If-Match Destination Overwrite X-Request-Id X-Requested-With Tus-Resumable Tus-Checksum-Algorithm Upload-Concat Upload-Length Upload-Metadata Upload-Defer-Length Upload-Expires Upload-Checksum Upload-Offset X-HTTP-Method-Override] ++

a| [subs=-attributes]
A comma-separated list of allowed CORS headers. See following chapter for more details: *Access-Control-Request-Headers* at \https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Request-Headers.
Expand All @@ -556,7 +556,7 @@ a| [subs=-attributes]
++[]string ++

a| [subs=-attributes]
++[GET POST PUT PATCH DELETE OPTIONS] ++
++[OPTIONS HEAD GET PUT POST DELETE MKCOL PROPFIND PROPPATCH MOVE COPY REPORT SEARCH] ++

a| [subs=-attributes]
A comma-separated list of allowed CORS methods. See following chapter for more details: *Access-Control-Request-Method* at \https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Request-Method
Expand Down Expand Up @@ -598,7 +598,7 @@ a| [subs=-attributes]
++false ++

a| [subs=-attributes]
Enable TLS for the connection to the events broker. The events broker is the ocis service which receives and delivers events between the services.
Enable TLS for the connection to the events broker. The events broker is the ocis service which receives and delivers events between the services..

a| `OCIS_GRPC_CLIENT_TLS_CACERT`

Expand Down Expand Up @@ -1086,7 +1086,7 @@ a| [subs=-attributes]
++ ++

a| [subs=-attributes]
Machine auth API key used to validate internal requests necessary for the access to resources from other services.
The machine auth API key used to validate internal requests necessary to access resources from other services.

a| `OCIS_OIDC_ISSUER`

Expand All @@ -1107,7 +1107,7 @@ a| [subs=-attributes]
++https://localhost:9200 ++

a| [subs=-attributes]
The identity provider value to set in the group IDs of the CS3 group objects for groups returned by this group provider.
The OIDC issuer URL to use.

a| `OCIS_SYSTEM_USER_API_KEY`

Expand Down Expand Up @@ -1145,7 +1145,7 @@ a| [subs=-attributes]
++ ++

a| [subs=-attributes]
ID of the oCIS STORAGE-SYSTEM system user. Admins need to set the ID for the STORAGE-SYSTEM system user in this config option which is then used to reference the user. Any reasonable long string is possible, preferably this would be an UUIDv4 format.
ID of the oCIS storage-system system user. Admins need to set the ID for the STORAGE-SYSTEM system user in this config option which is then used to reference the user. Any reasonable long string is possible, preferably this would be an UUIDv4 format.

a| `OCIS_SYSTEM_USER_IDP`

Expand Down Expand Up @@ -1351,10 +1351,10 @@ a| [subs=-attributes]
++string ++

a| [subs=-attributes]
++https://127.0.0.1:9200 ++
++https://localhost:9200/ ++

a| [subs=-attributes]
URL, where oCIS is reachable for users.
Base url to navigate back from the app the containing folder in the file list.

a| `REVA_GATEWAY`

Expand Down Expand Up @@ -1404,7 +1404,7 @@ a| [subs=-attributes]
++ ++

a| [subs=-attributes]
The storage transfer secret.
Transfer secret for signing file up- and download requests.

a| `STORAGE_USERS_OCIS_ASYNC_UPLOADS`

Expand Down

0 comments on commit 05543a5

Please sign in to comment.