Merge pull request #3476 from rhafer/share-ldap-con

[full-ci] adapt for new LDAP config

.drone.star

@@ -1642,8 +1642,7 @@ def ocisServer(storage, accounts_hash_difficulty = 4, volumes = [], depends_on =
             "STORAGE_LDAP_IDP": "https://keycloak/auth/realms/owncloud",
             "WEB_OIDC_SCOPE": "openid profile email owncloud",
             # LDAP bind
-            "STORAGE_LDAP_HOSTNAME": "openldap",
-            "STORAGE_LDAP_PORT": 636,
+            "STORAGE_LDAP_URI": "ldaps://openldap",
             "STORAGE_LDAP_INSECURE": "true",
             "STORAGE_LDAP_BIND_DN": "cn=admin,dc=owncloud,dc=com",
             "STORAGE_LDAP_BIND_PASSWORD": "admin",
@@ -1652,25 +1651,24 @@ def ocisServer(storage, accounts_hash_difficulty = 4, volumes = [], depends_on =
             "PROXY_ACCOUNT_BACKEND_TYPE": "cs3",  # proxy should get users from CS3APIS (which gets it from LDAP)
             "PROXY_USER_OIDC_CLAIM": "ocis.user.uuid",  # claim was added in Keycloak
             "PROXY_USER_CS3_CLAIM": "userid",  # equals STORAGE_LDAP_USER_SCHEMA_UID
-            "STORAGE_LDAP_BASE_DN": "dc=owncloud,dc=com",
+            "STORAGE_LDAP_GROUP_BASE_DN": "ou=testgroups,dc=owncloud,dc=com",
+            "STORAGE_LDAP_GROUP_OBJECTCLASS": "groupOfUniqueNames",
+            "STORAGE_LDAP_GROUPFILTER": "(objectclass=owncloud)",
             "STORAGE_LDAP_GROUP_SCHEMA_DISPLAYNAME": "cn",
             "STORAGE_LDAP_GROUP_SCHEMA_GID_NUMBER": "gidnumber",
-            "STORAGE_LDAP_GROUP_SCHEMA_GID": "cn",
+            "STORAGE_LDAP_GROUP_SCHEMA_ID": "cn",
             "STORAGE_LDAP_GROUP_SCHEMA_MAIL": "mail",
-            "STORAGE_LDAP_GROUPATTRIBUTEFILTER": "(&(objectclass=posixGroup)(objectclass=owncloud)({{attr}}={{value}}))",
-            "STORAGE_LDAP_GROUPFILTER": "(&(objectclass=groupOfUniqueNames)(objectclass=owncloud)(ownclouduuid={{.OpaqueId}}*))",
-            "STORAGE_LDAP_GROUPMEMBERFILTER": "(&(objectclass=posixAccount)(objectclass=owncloud)(ownclouduuid={{.OpaqueId}}*))",
-            "STORAGE_LDAP_USERGROUPFILTER": "(&(objectclass=posixGroup)(objectclass=owncloud)(ownclouduuid={{.OpaqueId}}*))",
-            "STORAGE_LDAP_USER_SCHEMA_CN": "cn",
+            "STORAGE_LDAP_GROUP_SCHEMA_MEMBER": "cn",
+            "STORAGE_LDAP_USER_BASE_DN": "ou=testusers,dc=owncloud,dc=com",
+            "STORAGE_LDAP_USER_OBJECTCLASS": "posixAccount",
+            "STORAGE_LDAP_USERFILTER": "(objectclass=owncloud)",
+            "STORAGE_LDAP_USER_SCHEMA_USERNAME": "cn",
             "STORAGE_LDAP_USER_SCHEMA_DISPLAYNAME": "displayname",
             "STORAGE_LDAP_USER_SCHEMA_GID_NUMBER": "gidnumber",
             "STORAGE_LDAP_USER_SCHEMA_MAIL": "mail",
             "STORAGE_LDAP_USER_SCHEMA_UID_NUMBER": "uidnumber",
-            "STORAGE_LDAP_USER_SCHEMA_UID": "ownclouduuid",
-            "STORAGE_LDAP_LOGINFILTER": "(&(objectclass=posixAccount)(objectclass=owncloud)(|(uid={{login}})(mail={{login}})))",
-            "STORAGE_LDAP_USERATTRIBUTEFILTER": "(&(objectclass=posixAccount)(objectclass=owncloud)({{attr}}={{value}}))",
-            "STORAGE_LDAP_USERFILTER": "(&(objectclass=posixAccount)(objectclass=owncloud)(|(ownclouduuid={{.OpaqueId}})(uid={{.OpaqueId}})))",
-            "STORAGE_LDAP_USERFINDFILTER": "(&(objectclass=posixAccount)(objectclass=owncloud)(|(cn={{query}}*)(displayname={{query}}*)(mail={{query}}*)))",
+            "STORAGE_LDAP_USER_SCHEMA_ID": "ownclouduuid",
+            "STORAGE_LDAP_LOGIN_ATTRIBUTES": "uid,mail",
             # ownCloudSQL storage driver
             "STORAGE_HOME_DRIVER": "owncloudsql",
             "STORAGE_USERS_DRIVER": "owncloudsql",

changelog/unreleased/ldap-config.md

@@ -0,0 +1,39 @@
+Enhancement: Unify LDAP config settings accross services
+
+The storage services where updated to adapt for the recent changes of the LDAP
+settings in reva.
+
+Also we allow now to use a new set of top-level LDAP environment variables that
+are shared between all LDAP-using services in ocis (graph, idp,
+storage-auth-basic, storage-userprovider, storage-groupprovider, idm). This
+should simplify the most LDAP based configurations considerably.
+
+Here is a list of the new environment variables:
+LDAP_URI
+LDAP_INSECURE
+LDAP_CACERT
+LDAP_BIND_DN
+LDAP_BIND_PASSWORD
+LDAP_LOGIN_ATTRIBUTES
+LDAP_USER_BASE_DN
+LDAP_USER_SCOPE
+LDAP_USER_FILTER
+LDAP_USER_OBJECTCLASS
+LDAP_USER_SCHEMA_MAIL
+LDAP_USER_SCHEMA_DISPLAY_NAME
+LDAP_USER_SCHEMA_USERNAME
+LDAP_USER_SCHEMA_ID
+LDAP_USER_SCHEMA_ID_IS_OCTETSTRING
+LDAP_GROUP_BASE_DN
+LDAP_GROUP_SCOPE
+LDAP_GROUP_FILTER
+LDAP_GROUP_OBJECTCLASS
+LDAP_GROUP_SCHEMA_GROUPNAME
+LDAP_GROUP_SCHEMA_ID
+LDAP_GROUP_SCHEMA_ID_IS_OCTETSTRING
+
+Where need these can be overwritten by service specific variables. E.g. it is possible
+to use STORAGE_LDAP_URI to overide the top-level LDAP_URI variable.
+
+https://github.com/owncloud/ocis/pull/3476
+https://github.com/owncloud/ocis/issues/3150

changelog/unreleased/update-reva.md

@@ -5,5 +5,7 @@ Updated reva to version 2.x.x. This update includes:
   * TODO
 
 https://github.com/owncloud/ocis/pull/3430
+https://github.com/owncloud/ocis/pull/3476
 https://github.com/owncloud/ocis/pull/3482
 https://github.com/owncloud/ocis/pull/3497
+

deployments/examples/oc10_ocis_parallel/docker-compose.yml

@@ -58,8 +58,7 @@ services:
       STORAGE_LDAP_IDP: https://${KEYCLOAK_DOMAIN:-keycloak.owncloud.test}/auth/realms/${KEYCLOAK_REALM:-owncloud}
       WEB_OIDC_SCOPE: openid profile email owncloud
       # LDAP bind
-      STORAGE_LDAP_HOSTNAME: openldap
-      STORAGE_LDAP_PORT: 636
+      STORAGE_LDAP_URI: "ldaps://openldap"
       STORAGE_LDAP_INSECURE: "true"
       STORAGE_LDAP_BIND_DN: "cn=admin,dc=owncloud,dc=com"
       STORAGE_LDAP_BIND_PASSWORD: ${LDAP_ADMIN_PASSWORD:-admin}
@@ -68,25 +67,22 @@ services:
       PROXY_ACCOUNT_BACKEND_TYPE: cs3 # proxy should get users from CS3APIS (which gets it from LDAP)
       PROXY_USER_OIDC_CLAIM: ocis.user.uuid # claim was added in Keycloak
       PROXY_USER_CS3_CLAIM: userid # equals STORAGE_LDAP_USER_SCHEMA_UID
-      STORAGE_LDAP_BASE_DN: "dc=owncloud,dc=com"
+      STORAGE_LDAP_GROUP_BASE_DN: "dc=owncloud,dc=com"
       STORAGE_LDAP_GROUP_SCHEMA_DISPLAYNAME: "cn"
       STORAGE_LDAP_GROUP_SCHEMA_GID_NUMBER: "gidnumber"
-      STORAGE_LDAP_GROUP_SCHEMA_GID: "cn"
+      STORAGE_LDAP_GROUP_SCHEMA_ID: "cn"
       STORAGE_LDAP_GROUP_SCHEMA_MAIL: "mail"
-      STORAGE_LDAP_GROUPATTRIBUTEFILTER: "(&(objectclass=posixGroup)(objectclass=owncloud)({{attr}}={{value}}))"
-      STORAGE_LDAP_GROUPFILTER: "(&(objectclass=groupOfUniqueNames)(objectclass=owncloud)(ownclouduuid={{.OpaqueId}}*))"
-      STORAGE_LDAP_GROUPMEMBERFILTER: "(&(objectclass=posixAccount)(objectclass=owncloud)(ownclouduuid={{.OpaqueId}}*))"
-      STORAGE_LDAP_USERGROUPFILTER: "(&(objectclass=posixGroup)(objectclass=owncloud)(ownclouduuid={{.OpaqueId}}*))"
-      STORAGE_LDAP_USER_SCHEMA_CN: "cn"
+      STORAGE_LDAP_GROUP_SCHEMA_MEMBER: "cn"
+      STORAGE_LDAP_GROUP_OBJECTCLASS: "groupOfUniqueNames"
+      STORAGE_LDAP_GROUPFILTER: "(objectclass=owncloud)"
+      STORAGE_LDAP_USER_BASE_DN: "dc=owncloud,dc=com"
+      STORAGE_LDAP_USER_SCHEMA_USERNAME: "cn"
       STORAGE_LDAP_USER_SCHEMA_DISPLAYNAME: "displayname"
       STORAGE_LDAP_USER_SCHEMA_GID_NUMBER: "gidnumber"
       STORAGE_LDAP_USER_SCHEMA_MAIL: "mail"
       STORAGE_LDAP_USER_SCHEMA_UID_NUMBER: "uidnumber"
-      STORAGE_LDAP_USER_SCHEMA_UID: "ownclouduuid"
-      STORAGE_LDAP_LOGINFILTER: "(&(objectclass=posixAccount)(objectclass=owncloud)(|(uid={{login}})(mail={{login}})))"
-      STORAGE_LDAP_USERATTRIBUTEFILTER: "(&(objectclass=posixAccount)(objectclass=owncloud)({{attr}}={{value}}))"
-      STORAGE_LDAP_USERFILTER: "(&(objectclass=posixAccount)(objectclass=owncloud)(|(ownclouduuid={{.OpaqueId}})(uid={{.OpaqueId}})))"
-      STORAGE_LDAP_USERFINDFILTER: "(&(objectclass=posixAccount)(objectclass=owncloud)(|(cn={{query}}*)(displayname={{query}}*)(mail={{query}}*)))"
+      STORAGE_LDAP_USER_SCHEMA_ID: "ownclouduuid"
+      STORAGE_LDAP_LOGIN_ATTRIBUTES: "uid,mail"
       # ownCloudSQL storage driver
       STORAGE_USERS_DRIVER: owncloudsql
       STORAGE_METADATA_DRIVER: ocis # keep metadata on ocis storage since this are only small files atm

deployments/examples/ocis_individual_services/docker-compose.yml

@@ -608,8 +608,7 @@ services:
       STORAGE_USERPROVIDER_ADDR: 0.0.0.0:9144
 
       STORAGE_USERPROVIDER_DRIVER: ldap
-      STORAGE_LDAP_HOSTNAME: glauth
-      STORAGE_LDAP_PORT: 9126
+      STORAGE_LDAP_URI: "ldaps://glauth:9126"
       STORAGE_LDAP_INSECURE: "true"
       STORAGE_LDAP_BIND_PASSWORD: ${STORAGE_LDAP_BIND_PASSWORD:-reva}
       STORAGE_LDAP_IDP: https://${OCIS_DOMAIN:-ocis.owncloud.test}
@@ -639,8 +638,7 @@ services:
       STORAGE_GROUPPROVIDER_ADDR: 0.0.0.0:9160
 
       STORAGE_GROUPPROVIDER_DRIVER: ldap
-      STORAGE_LDAP_HOSTNAME: glauth
-      STORAGE_LDAP_PORT: 9126
+      STORAGE_LDAP_URI: "ldaps://glauth:9126"
       STORAGE_LDAP_INSECURE: "true"
       STORAGE_LDAP_BIND_PASSWORD: ${STORAGE_LDAP_BIND_PASSWORD:-reva}
       STORAGE_LDAP_IDP: https://${OCIS_DOMAIN:-ocis.owncloud.test}

deployments/examples/ocis_ldap/docker-compose.yml

@@ -53,26 +53,21 @@ services:
       - /entrypoint-override.sh
     environment:
       # CS3 users from ldap specific configuration
-      IDP_LDAP_FILTER: "(&(objectclass=inetOrgPerson)(objectClass=owncloud))"
-      IDP_LDAP_URI: ldap://ldap-server:389
-      IDP_LDAP_BIND_DN: "cn=admin,dc=owncloud,dc=com"
-      IDP_LDAP_BIND_PASSWORD: ${LDAP_ADMIN_PASSWORD:-admin}
-      IDP_LDAP_BASE_DN: "dc=owncloud,dc=com"
-      IDP_LDAP_LOGIN_ATTRIBUTE: uid
+      LDAP_URI: ldaps://ldap-server
+      LDAP_INSECURE: "true"
+      LDAP_BIND_DN: "cn=admin,dc=owncloud,dc=com"
+      LDAP_BIND_PASSWORD: ${LDAP_ADMIN_PASSWORD:-admin}
+      LDAP_GROUP_BASE_DN: "dc=owncloud,dc=com"
+      LDAP_GROUPFILTER: "(objectclass=owncloud)"
+      LDAP_GROUP_OBJECTCLASS: "groupOfUniqueNames"
+      LDAP_USER_BASE_DN: "dc=owncloud,dc=com"
+      LDAP_USERFILTER: "(objectclass=owncloud)"
+      LDAP_USER_OBEJECTCLASS: "inetOrgPerson"
+      LDAP_LOGIN_ATTRIBUTES: "uid,mail"
+      IDP_LDAP_LOGIN_ATTRIBUTE: "uid"
       IDP_LDAP_UUID_ATTRIBUTE: "ownclouduuid"
       IDP_LDAP_UUID_ATTRIBUTE_TYPE: binary
       PROXY_ACCOUNT_BACKEND_TYPE: cs3
-      STORAGE_LDAP_HOSTNAME: ldap-server
-      STORAGE_LDAP_PORT: 636
-      STORAGE_LDAP_INSECURE: "true"
-      STORAGE_LDAP_BASE_DN: "dc=owncloud,dc=com"
-      STORAGE_LDAP_BIND_DN: "cn=admin,dc=owncloud,dc=com"
-      STORAGE_LDAP_BIND_PASSWORD: ${LDAP_ADMIN_PASSWORD:-admin}
-      STORAGE_LDAP_LOGINFILTER: '(&(objectclass=inetOrgPerson)(objectclass=owncloud)(|(uid={{login}})(mail={{login}})))'
-      STORAGE_LDAP_USERFILTER: '(&(objectclass=inetOrgPerson)(objectclass=owncloud)(|(ownclouduuid={{.OpaqueId}})(uid={{.OpaqueId}})))'
-      STORAGE_LDAP_ATTRIBUTEFILTER: '(&(objectclass=owncloud)({{attr}}={{value}}))'
-      STORAGE_LDAP_FINDFILTER: '(&(objectclass=owncloud)(|(uid={{query}}*)(cn={{query}}*)(displayname={{query}}*)(mail={{query}}*)(description={{query}}*)))'
-      STORAGE_LDAP_GROUPFILTER: '(&(objectclass=groupOfUniqueNames)(objectclass=owncloud)(ownclouduuid={{.OpaqueId}}*))'
       # web ui
       WEB_UI_CONFIG: "/var/tmp/ocis/.config/web-config.json"
       # General oCIS config

go.mod

@@ -22,7 +22,7 @@ require (
 	github.com/blevesearch/bleve/v2 v2.3.2
 	github.com/coreos/go-oidc/v3 v3.1.0
 	github.com/cs3org/go-cs3apis v0.0.0-20220328105952-297bef33e13f
-	github.com/cs3org/reva/v2 v2.0.0-20220408142652-148b87297214
+	github.com/cs3org/reva/v2 v2.0.0-20220411161034-134ed5a0801f
 	github.com/disintegration/imaging v1.6.2
 	github.com/glauth/glauth/v2 v2.0.0-20211021011345-ef3151c28733
 	github.com/go-chi/chi/v5 v5.0.7
@@ -52,6 +52,7 @@ require (
 	github.com/oklog/run v1.1.0
 	github.com/olekukonko/tablewriter v0.0.5
 	github.com/onsi/ginkgo v1.16.5
+	github.com/onsi/ginkgo/v2 v2.1.3
 	github.com/onsi/gomega v1.19.0
 	github.com/owncloud/libre-graph-api-go v0.13.3
 	github.com/pkg/errors v0.9.1

go.sum

@@ -335,8 +335,8 @@ github.com/crewjam/httperr v0.2.0/go.mod h1:Jlz+Sg/XqBQhyMjdDiC+GNNRzZTD7x39Gu3p
 github.com/crewjam/saml v0.4.6 h1:XCUFPkQSJLvzyl4cW9OvpWUbRf0gE7VUpU8ZnilbeM4=
 github.com/crewjam/saml v0.4.6/go.mod h1:ZBOXnNPFzB3CgOkRm7Nd6IVdkG+l/wF+0ZXLqD96t1A=
 github.com/cs3org/cato v0.0.0-20200828125504-e418fc54dd5e/go.mod h1:XJEZ3/EQuI3BXTp/6DUzFr850vlxq11I6satRtz0YQ4=
-github.com/cs3org/reva/v2 v2.0.0-20220408142652-148b87297214 h1:8Akb8HGdilByInCNDEzwo2TSRTd7JNcHjU73Y3f6Yuo=
-github.com/cs3org/reva/v2 v2.0.0-20220408142652-148b87297214/go.mod h1:rE2wCGoiGiUuQ3zj6aD7sZ+BhboLyNsNQ3z3auunWm4=
+github.com/cs3org/reva/v2 v2.0.0-20220411161034-134ed5a0801f h1:SNQSbtvhsQ6KvdDJlW536pUMq8RzghQMDCkYYKEFn8c=
+github.com/cs3org/reva/v2 v2.0.0-20220411161034-134ed5a0801f/go.mod h1:rE2wCGoiGiUuQ3zj6aD7sZ+BhboLyNsNQ3z3auunWm4=
 github.com/cubewise-code/go-mime v0.0.0-20200519001935-8c5762b177d8 h1:Z9lwXumT5ACSmJ7WGnFl+OMLLjpz5uR2fyz7dC255FI=
 github.com/cubewise-code/go-mime v0.0.0-20200519001935-8c5762b177d8/go.mod h1:4abs/jPXcmJzYoYGF91JF9Uq9s/KL5n1jvFDix8KcqY=
 github.com/cyberdelia/templates v0.0.0-20141128023046-ca7fffd4298c/go.mod h1:GyV+0YP4qX0UQ7r2MoYZ+AvYDp12OF5yg4q8rGnyNh4=

graph/pkg/config/config.go

@@ -37,26 +37,28 @@ type Spaces struct {
 }
 
 type LDAP struct {
-	URI           string `yaml:"uri" env:"GRAPH_LDAP_URI"`
+	URI           string `yaml:"uri" env:"LDAP_URI;GRAPH_LDAP_URI"`
 	Insecure      bool   `yaml:"insecure" env:"OCIS_INSECURE;GRAPH_LDAP_INSECURE"`
-	BindDN        string `yaml:"bind_dn" env:"GRAPH_LDAP_BIND_DN"`
-	BindPassword  string `yaml:"bind_password" env:"GRAPH_LDAP_BIND_PASSWORD"`
+	BindDN        string `yaml:"bind_dn" env:"LDAP_BIND_DN;GRAPH_LDAP_BIND_DN"`
+	BindPassword  string `yaml:"bind_password" env:"LDAP_BIND_PASSWORD;GRAPH_LDAP_BIND_PASSWORD"`
 	UseServerUUID bool   `yaml:"use_server_uuid" env:"GRAPH_LDAP_SERVER_UUID"`
 	WriteEnabled  bool   `yaml:"write_enabled" env:"GRAPH_LDAP_SERVER_WRITE_ENABLED"`
 
-	UserBaseDN               string `yaml:"user_base_dn" env:"GRAPH_LDAP_USER_BASE_DN"`
-	UserSearchScope          string `yaml:"user_search_scope" env:"GRAPH_LDAP_USER_SCOPE"`
-	UserFilter               string `yaml:"user_filter" env:"GRAPH_LDAP_USER_FILTER"`
-	UserEmailAttribute       string `yaml:"user_mail_attribute" env:"GRAPH_LDAP_USER_EMAIL_ATTRIBUTE"`
-	UserDisplayNameAttribute string `yaml:"user_displayname_attribute" env:"GRAPH_LDAP_USER_DISPLAYNAME_ATTRIBUTE"`
-	UserNameAttribute        string `yaml:"user_name_attribute" env:"GRAPH_LDAP_USER_NAME_ATTRIBUTE"`
-	UserIDAttribute          string `yaml:"user_id_attribute" env:"GRAPH_LDAP_USER_UID_ATTRIBUTE"`
+	UserBaseDN               string `yaml:"user_base_dn" env:"LDAP_USER_BASE_DN;GRAPH_LDAP_USER_BASE_DN"`
+	UserSearchScope          string `yaml:"user_search_scope" env:"LDAP_USER_SCOPE;GRAPH_LDAP_USER_SCOPE"`
+	UserFilter               string `yaml:"user_filter" env:"LDAP_USER_FILTER;GRAPH_LDAP_USER_FILTER"`
+	UserObjectClass          string `yaml:"user_objectclass" env:"LDAP_USER_OBJECTCLASS;GRAPH_LDAP_USER_OBJECTCLASS"`
+	UserEmailAttribute       string `yaml:"user_mail_attribute" env:"LDAP_USER_SCHEMA_MAIL;GRAPH_LDAP_USER_EMAIL_ATTRIBUTE"`
+	UserDisplayNameAttribute string `yaml:"user_displayname_attribute" env:"LDAP_USER_SCHEMA_DISPLAY_NAME;GRAPH_LDAP_USER_DISPLAYNAME_ATTRIBUTE"`
+	UserNameAttribute        string `yaml:"user_name_attribute" env:"LDAP_USER_SCHEMA_USERNAME;GRAPH_LDAP_USER_NAME_ATTRIBUTE"`
+	UserIDAttribute          string `yaml:"user_id_attribute" env:"LDAP_USER_SCHEMA_ID;GRAPH_LDAP_USER_UID_ATTRIBUTE"`
 
-	GroupBaseDN        string `yaml:"group_base_dn" env:"GRAPH_LDAP_GROUP_BASE_DN"`
-	GroupSearchScope   string `yaml:"group_search_scope" env:"GRAPH_LDAP_GROUP_SEARCH_SCOPE"`
-	GroupFilter        string `yaml:"group_filter" env:"GRAPH_LDAP_GROUP_FILTER"`
-	GroupNameAttribute string `yaml:"group_name_attribute" env:"GRAPH_LDAP_GROUP_NAME_ATTRIBUTE"`
-	GroupIDAttribute   string `yaml:"group_id_attribute" env:"GRAPH_LDAP_GROUP_ID_ATTRIBUTE"`
+	GroupBaseDN        string `yaml:"group_base_dn" env:"LDAP_GROUP_BASE_DN;GRAPH_LDAP_GROUP_BASE_DN"`
+	GroupSearchScope   string `yaml:"group_search_scope" env:"LDAP_GROUP_SCOPE;GRAPH_LDAP_GROUP_SEARCH_SCOPE"`
+	GroupFilter        string `yaml:"group_filter" env:"LDAP_GROUP_FILTER;GRAPH_LDAP_GROUP_FILTER"`
+	GroupObjectClass   string `yaml:"group_objectclass" env:"LDAP_GROUP_OBJECTCLASS;GRAPH_LDAP_GROUP_OBJECTCLASS"`
+	GroupNameAttribute string `yaml:"group_name_attribute" env:"LDAP_GROUP_SCHEMA_GROUPNAME;GRAPH_LDAP_GROUP_NAME_ATTRIBUTE"`
+	GroupIDAttribute   string `yaml:"group_id_attribute" env:"LDAP_GROUP_SCHEMA_ID;GRAPH_LDAP_GROUP_ID_ATTRIBUTE"`
 }
 
 type Identity struct {

graph/pkg/config/defaults/defaultconfig.go

@@ -43,7 +43,8 @@ func DefaultConfig() *config.Config {
 				WriteEnabled:             false,
 				UserBaseDN:               "ou=users,dc=ocis,dc=test",
 				UserSearchScope:          "sub",
-				UserFilter:               "(objectClass=inetOrgPerson)",
+				UserFilter:               "",
+				UserObjectClass:          "inetOrgPerson",
 				UserEmailAttribute:       "mail",
 				UserDisplayNameAttribute: "displayName",
 				UserNameAttribute:        "uid",
@@ -52,7 +53,8 @@ func DefaultConfig() *config.Config {
 				UserIDAttribute:    "owncloudUUID",
 				GroupBaseDN:        "ou=groups,dc=ocis,dc=test",
 				GroupSearchScope:   "sub",
-				GroupFilter:        "(objectclass=groupOfNames)",
+				GroupFilter:        "",
+				GroupObjectClass:   "groupOfNames",
 				GroupNameAttribute: "cn",
 				GroupIDAttribute:   "owncloudUUID",
 			},

graph/pkg/identity/ldap.go

@@ -27,11 +27,13 @@ type LDAP struct {
 
 	userBaseDN       string
 	userFilter       string
+	userObjectClass  string
 	userScope        int
 	userAttributeMap userAttributeMap
 
 	groupBaseDN       string
 	groupFilter       string
+	groupObjectClass  string
 	groupScope        int
 	groupAttributeMap groupAttributeMap
 
@@ -89,10 +91,12 @@ func NewLDAPBackend(lc ldap.Client, config config.LDAP, logger *log.Logger) (*LD
 		useServerUUID:     config.UseServerUUID,
 		userBaseDN:        config.UserBaseDN,
 		userFilter:        config.UserFilter,
+		userObjectClass:   config.UserObjectClass,
 		userScope:         userScope,
 		userAttributeMap:  uam,
 		groupBaseDN:       config.GroupBaseDN,
 		groupFilter:       config.GroupFilter,
+		groupObjectClass:  config.GroupObjectClass,
 		groupScope:        groupScope,
 		groupAttributeMap: gam,
 		logger:            logger,
@@ -311,7 +315,7 @@ func (i *LDAP) getLDAPUserByNameOrID(nameOrID string) (*ldap.Entry, error) {
 func (i *LDAP) getLDAPUserByFilter(filter string) (*ldap.Entry, error) {
 	searchRequest := ldap.NewSearchRequest(
 		i.userBaseDN, i.userScope, ldap.NeverDerefAliases, 1, 0, false,
-		fmt.Sprintf("(&%s%s)", i.userFilter, filter),
+		fmt.Sprintf("(&%s(objectClass=%s)%s)", i.userFilter, i.userObjectClass, filter),
 		[]string{
 			i.userAttributeMap.displayName,
 			i.userAttributeMap.id,
@@ -357,7 +361,7 @@ func (i *LDAP) GetUsers(ctx context.Context, queryParam url.Values) ([]*libregra
 	if search == "" {
 		search = queryParam.Get("$search")
 	}
-	userFilter := i.userFilter
+	userFilter := fmt.Sprintf("%s(objectClass=%s)", i.userFilter, i.userObjectClass)
 	if search != "" {
 		search = ldap.EscapeFilter(search)
 		userFilter = fmt.Sprintf(
@@ -428,7 +432,7 @@ func (i *LDAP) getLDAPGroupByFilter(filter string, requestMembers bool) (*ldap.E
 
 // Search for LDAP Groups matching the specified filter, if requestMembers is true the groupMemberShip
 // attribute will be part of the result attributes. The LDAP filter is combined with the configured groupFilter
-// resulting in a filter like "(&(LDAP.groupFilter)(<filter_from_args>))"
+// resulting in a filter like "(&(LDAP.groupFilter)(objectClass=LDAP.groupObjectClass)(<filter_from_args>))"
 func (i *LDAP) getLDAPGroupsByFilter(filter string, requestMembers, single bool) ([]*ldap.Entry, error) {
 	attrs := []string{
 		i.groupAttributeMap.name,
@@ -445,7 +449,7 @@ func (i *LDAP) getLDAPGroupsByFilter(filter string, requestMembers, single bool)
 	}
 	searchRequest := ldap.NewSearchRequest(
 		i.groupBaseDN, i.groupScope, ldap.NeverDerefAliases, sizelimit, 0, false,
-		fmt.Sprintf("(&%s%s)", i.groupFilter, filter),
+		fmt.Sprintf("(&%s(objectClass=%s)%s)", i.groupFilter, i.groupObjectClass, filter),
 		attrs,
 		nil,
 	)
@@ -511,7 +515,7 @@ func (i *LDAP) GetGroups(ctx context.Context, queryParam url.Values) ([]*libregr
 	if search == "" {
 		search = queryParam.Get("$search")
 	}
-	groupFilter := i.groupFilter
+	groupFilter := fmt.Sprintf("%s(objectClass=%s)", i.groupFilter, i.groupObjectClass)
 	if search != "" {
 		search = ldap.EscapeFilter(search)
 		groupFilter = fmt.Sprintf(