Registry testing - part 16

tests/docker/docker-compose.yml

@@ -177,14 +177,14 @@ services:
       LDAP_TLS_KEY_FILENAME: "key.pem"
       LDAP_TLS_CA_CRT_FILENAME: "cert.pem"
       LDAP_TLS_VERIFY_CLIENT: "never"
-      LDAP_SEED_INTERNAL_LDIF_PATH: "/seed"
     ports:
       - "127.0.0.1:389:389"
       - "127.0.0.1:636:636"
     volumes:
-      - ./ldap/seed.ldif:/seed/50-stalwart.ldif:ro
+      - ./ldap/50-users.ldif:/seed/50-users.ldif:ro
+      - ./ldap/60-groups.ldif:/seed/60-groups.ldif:ro
       - certs:/certs-shared:ro
-    entrypoint: [ "/bin/bash", "-c", "cp /certs-shared/* /container/service/slapd/assets/certs/ 2>/dev/null; exec /container/tool/run" ]
+    entrypoint: [ "/bin/bash", "-c", "mkdir -p /container/service/slapd/assets/config/bootstrap/ldif/custom && cp /seed/*.ldif /container/service/slapd/assets/config/bootstrap/ldif/custom/ && cp /certs-shared/* /container/service/slapd/assets/certs/ 2>/dev/null; exec /container/tool/run" ]
 
   # ---------------------------------------------------------------------------
   # Pebble (ACME server)  –  ports 14000 (directory) + 15000 (management)

tests/docker/keycloak/stalwart-realm.json

@@ -11,14 +11,23 @@
       "enabled": true,
       "clientAuthenticatorType": "client-secret",
       "secret": "stalwart-secret",
-      "redirectUris": ["*"],
-      "webOrigins": ["*"],
+      "redirectUris": [
+        "*"
+      ],
+      "webOrigins": [
+        "*"
+      ],
       "publicClient": false,
       "protocol": "openid-connect",
       "directAccessGrantsEnabled": true,
       "standardFlowEnabled": true,
       "serviceAccountsEnabled": true,
-      "defaultClientScopes": ["openid", "email", "profile", "roles"],
+      "defaultClientScopes": [
+        "openid",
+        "email",
+        "profile",
+        "roles"
+      ],
       "protocolMappers": [
         {
           "name": "groups",
@@ -46,6 +55,17 @@
             "userinfo.token.claim": "true",
             "jsonType.label": "String"
           }
+        },
+        {
+          "name": "audience",
+          "protocol": "openid-connect",
+          "protocolMapper": "oidc-audience-mapper",
+          "consentRequired": false,
+          "config": {
+            "included.client.audience": "stalwart",
+            "id.token.claim": "false",
+            "access.token.claim": "true"
+          }
         }
       ]
     }
@@ -65,7 +85,9 @@
           "temporary": false
         }
       ],
-      "groups": ["/sales@example.org"]
+      "groups": [
+        "/sales@example.org"
+      ]
     },
     {
       "username": "jane.smith@example.org",
@@ -81,7 +103,10 @@
           "temporary": false
         }
       ],
-      "groups": ["/sales@example.org", "/corporate@example.org"]
+      "groups": [
+        "/sales@example.org",
+        "/corporate@example.org"
+      ]
     },
     {
       "username": "bill.foobar@example.org",
@@ -97,7 +122,9 @@
           "temporary": false
         }
       ],
-      "groups": ["/corporate@example.org"]
+      "groups": [
+        "/corporate@example.org"
+      ]
     }
   ],
   "groups": [
@@ -110,4 +137,4 @@
       "path": "/corporate@example.org"
     }
   ]
-}
+}

tests/docker/ldap/50-users.ldif

@@ -1,23 +1,20 @@
-# Organizational Units
 dn: ou=users,dc=stalwart,dc=test
 objectClass: organizationalUnit
 ou: users
 
-dn: ou=groups,dc=stalwart,dc=test
-objectClass: organizationalUnit
-ou: groups
-
-# Users
 dn: uid=john.doe,ou=users,dc=stalwart,dc=test
 objectClass: inetOrgPerson
 objectClass: posixAccount
 objectClass: shadowAccount
+objectClass: extensibleObject
 uid: john.doe
 cn: John Doe
 sn: Doe
 givenName: John
 mail: john.doe@example.org
-userPassword: this is an LDAP password
+mailAlias: john@example.org
+userPassword: this is John's LDAP password
+shadowLastChange: 19723
 uidNumber: 10001
 gidNumber: 10001
 homeDirectory: /home/john.doe
@@ -32,7 +29,8 @@ cn: Jane Smith
 sn: Smith
 givenName: Jane
 mail: jane.smith@example.org
-userPassword: this is an LDAP password
+userPassword: this is Jane's LDAP password
+shadowLastChange: 19724
 uidNumber: 10002
 gidNumber: 10002
 homeDirectory: /home/jane.smith
@@ -47,23 +45,8 @@ cn: Bill Foobar
 sn: Foobar
 givenName: Bill
 mail: bill.foobar@example.org
-userPassword: this is an LDAP password
+userPassword: this is Bill's LDAP password
 uidNumber: 10003
 gidNumber: 10003
 homeDirectory: /home/bill.foobar
 loginShell: /bin/bash
-
-# Groups with email addresses
-dn: cn=sales,ou=groups,dc=stalwart,dc=test
-objectClass: groupOfNames
-cn: sales
-mail: sales@example.org
-member: uid=john.doe,ou=users,dc=stalwart,dc=test
-member: uid=jane.smith,ou=users,dc=stalwart,dc=test
-
-dn: cn=corporate,ou=groups,dc=stalwart,dc=test
-objectClass: groupOfNames
-cn: corporate
-mail: corporate@example.org
-member: uid=bill.foobar,ou=users,dc=stalwart,dc=test
-member: uid=jane.smith,ou=users,dc=stalwart,dc=test

tests/docker/ldap/60-groups.ldif

@@ -0,0 +1,20 @@
+dn: ou=groups,dc=stalwart,dc=test
+objectClass: organizationalUnit
+ou: groups
+
+dn: cn=sales,ou=groups,dc=stalwart,dc=test
+objectClass: groupOfNames
+objectClass: extensibleObject
+cn: sales
+mail: sales@example.org
+member: uid=john.doe,ou=users,dc=stalwart,dc=test
+member: uid=jane.smith,ou=users,dc=stalwart,dc=test
+
+dn: cn=corporate,ou=groups,dc=stalwart,dc=test
+objectClass: groupOfNames
+objectClass: extensibleObject
+cn: corporate
+mail: corporate@example.org
+mailAlias: everyone@example.org
+member: uid=bill.foobar,ou=users,dc=stalwart,dc=test
+member: uid=jane.smith,ou=users,dc=stalwart,dc=test