Rename konnectd to IDP

.codacy.yml

@@ -8,8 +8,8 @@ exclude_paths:
   - 'docs/**'
   - '**/docs/**'
   - '**/pkg/proto/**'
-  - 'konnectd/ui_config/**'
-  - 'konnectd/scripts/**'
+  - 'idp/ui_config/**'
+  - 'idp/scripts/**'
   - 'settings/rollup.config.js'
   - 'accounts/rollup.config.js'
   - 'ocis/docker/eos-ocis/Dockerfile'

.drone.star

@@ -2,7 +2,7 @@ config = {
   'modules': {
     'accounts': 'frontend',
     'glauth':'',
-    'konnectd':'',
+    'idp':'',
     'ocis': '',
     'web':'',
     'ocis-pkg':'',
@@ -1370,8 +1370,8 @@ def ocisServer(storage, accounts_hash_difficulty = 4, volumes=[]):
     'STORAGE_SHARING_USER_JSON_FILE': '/srv/app/tmp/ocis/shares.json',
     'PROXY_ENABLE_BASIC_AUTH': True,
     'WEB_UI_CONFIG': '/drone/src/tests/config/drone/ocis-config.json',
-    'KONNECTD_IDENTIFIER_REGISTRATION_CONF': '/drone/src/tests/config/drone/identifier-registration.yml',
-    'KONNECTD_TLS': 'true',
+    'IDP_IDENTIFIER_REGISTRATION_CONF': '/drone/src/tests/config/drone/identifier-registration.yml',
+    'IDP_TLS': 'true',
     'OCIS_LOG_LEVEL': 'warn',
   }
 

.gitignore

@@ -14,7 +14,7 @@ node_modules/
 yarn-error.log
 
 # Konnectd
-konnectd/assets/identifier
+idp/assets/identifier
 
 # Composer - used for API acceptance tests
 composer.lock

Makefile

@@ -15,7 +15,7 @@ RESET := $(shell tput -Txterm sgr0)
 OCIS_MODULES = \
 	accounts \
 	glauth \
-	konnectd \
+	idp \
 	ocis \
 	ocis-pkg \
 	ocs \

accounts/pkg/proto/v0/accounts.pb.micro_test.go

@@ -126,7 +126,7 @@ func getGroup(group string) *proto.Group {
 	switch group {
 	case "sysusers":
 		return &proto.Group{Id: "34f38767-c937-4eb6-b847-1c175829a2a0", GidNumber: 15000, OnPremisesSamAccountName: "sysusers", DisplayName: "Technical users", Description: "A group for technical users. They should not show up in sharing dialogs.", Members: []*proto.Account{
-			{Id: "820ba2a1-3f54-4538-80a4-2d73007e30bf"}, // konnectd
+			{Id: "820ba2a1-3f54-4538-80a4-2d73007e30bf"}, // idp
 			{Id: "bc596f3c-c955-4328-80a0-60d018b4ad57"}, // reva
 		}}
 	case "users":

accounts/pkg/service/v0/service.go

@@ -236,14 +236,14 @@ func (s Service) createDefaultAccounts() (err error) {
 		// technical users for kopano and reva
 		{
 			Id:                       "820ba2a1-3f54-4538-80a4-2d73007e30bf",
-			PreferredName:            "konnectd",
-			OnPremisesSamAccountName: "konnectd",
+			PreferredName:            "idp",
+			OnPremisesSamAccountName: "idp",
 			Mail:                     "idp@example.org",
-			DisplayName:              "Kopano Konnectd",
+			DisplayName:              "Kopano IDP",
 			UidNumber:                10000,
 			GidNumber:                15000,
 			PasswordProfile: &proto.PasswordProfile{
-				Password: "$2a$11$ntoTP2W/kyQIuoYpH5mRBuNzaEERYWSwn/zCsY5rtffen4d41y9.6",
+				Password: "$2y$12$ywfGLDPsSlBTVZU0g.2GZOPO8Wap3rVOpm8e3192VlytNdGWH7x72",
 			},
 			AccountEnabled: true,
 			MemberOf: []*proto.Group{
@@ -309,7 +309,7 @@ func (s Service) createDefaultAccounts() (err error) {
 	for _, accountID := range []string{
 		"058bff95-6708-4fe5-91e4-9ea3d377588b", //moss
 		"ddc2004c-0977-11eb-9d3f-a793888cd0f8", //admin
-		"820ba2a1-3f54-4538-80a4-2d73007e30bf", //konnectd
+		"820ba2a1-3f54-4538-80a4-2d73007e30bf", //idp
 		"bc596f3c-c955-4328-80a0-60d018b4ad57", //reva
 	} {
 		assignRoleToUser(accountID, settings_svc.BundleUUIDRoleAdmin, s.RoleService, s.log)
@@ -327,7 +327,7 @@ func (s Service) createDefaultAccounts() (err error) {
 func (s Service) createDefaultGroups() (err error) {
 	groups := []proto.Group{
 		{Id: "34f38767-c937-4eb6-b847-1c175829a2a0", GidNumber: 15000, OnPremisesSamAccountName: "sysusers", DisplayName: "Technical users", Description: "A group for technical users. They should not show up in sharing dialogs.", Members: []*proto.Account{
-			{Id: "820ba2a1-3f54-4538-80a4-2d73007e30bf"}, // konnectd
+			{Id: "820ba2a1-3f54-4538-80a4-2d73007e30bf"}, // idp
 			{Id: "bc596f3c-c955-4328-80a0-60d018b4ad57"}, // reva
 		}},
 		{Id: "509a9dcd-bb37-4f4f-a01a-19dca27d9cfa", GidNumber: 30000, OnPremisesSamAccountName: "users", DisplayName: "Users", Description: "A group every normal user belongs to.", Members: []*proto.Account{

accounts/ui/tests/acceptance/features/accounts.feature

@@ -4,7 +4,7 @@ Feature: Accounts
 		Given user "Moss" has logged in using the webUI
 		When the user browses to the accounts page
 		Then user "einstein" should be displayed in the accounts list on the WebUI
-		And user "konnectd" should be displayed in the accounts list on the WebUI
+		And user "idp" should be displayed in the accounts list on the WebUI
 		And user "marie" should be displayed in the accounts list on the WebUI
 		And user "reva" should be displayed in the accounts list on the WebUI
 		And user "richard" should be displayed in the accounts list on the WebUI
@@ -72,4 +72,4 @@ Feature: Accounts
 		Given user "Moss" has logged in using the webUI
 		And the user browses to the accounts page
 		When the user deletes user "bob" using the WebUI
-		Then user "bob" should not be displayed in the accounts list on the WebUI
+		Then user "bob" should not be displayed in the accounts list on the WebUI

deployments/examples/owncloud10_with_oc_web/docker-compose.yml

@@ -72,11 +72,11 @@ services:
       PROXY_CONFIG_FILE: "/config/proxy-config.json"
       PROXY_ENABLE_PRESIGNEDURLS: "false"
       PROXY_TLS: "false"
-      # konnectd - binddn must exist as oc10 admin user
-      KONNECTD_IDENTIFIER_REGISTRATION_CONF: "/config/identifier-registration.yaml"
-      KONNECTD_INSECURE: "${INSECURE:-false}"
-      KONNECTD_SIGNING_KID: super
-      KONNECTD_TLS: 0
+      # idp - binddn must exist as oc10 admin user
+      IDP_IDENTIFIER_REGISTRATION_CONF: "/config/identifier-registration.yaml"
+      IDP_INSECURE: "${INSECURE:-false}"
+      IDP_SIGNING_KID: super
+      IDP_TLS: 0
       LDAP_BASEDN: "dc=example,dc=org"
       LDAP_BINDDN: "cn=admin,dc=example,dc=org"
       LDAP_BINDPW: "admin"

docs/Makefile

@@ -3,7 +3,7 @@ SHELL := bash
 OCIS_MODULES = \
 	accounts \
 	glauth \
-	konnectd \
+	idp \
 	ocis \
 	ocs \
 	ocis-pkg \

docs/extensions/konnectd/_index.md → docs/extensions/idp/_index.md

@@ -2,7 +2,7 @@
 title: Konnectd
 weight: 20
 geekdocRepo: https://github.com/owncloud/ocis
-geekdocEditPath: edit/master/docs/extensions/konnectd
+geekdocEditPath: edit/master/docs/extensions/idp
 geekdocFilePath: _index.md
 geekdocCollapseSection: true
 ---

docs/ocis/_index.md

@@ -24,9 +24,9 @@ We run a huge [test suite](https://github.com/owncloud/core/tree/master/tests),
 {{< mermaid class="text-center">}}
 graph TD
 proxy -->
-    konnectd & web & thumbnails & ocs & webdav & storage & accounts & store & settings
+    idp & web & thumbnails & ocs & webdav & storage & accounts & store & settings
 
-konnectd --> glauth
+idp --> glauth
 
 storage --> REVA
 

docs/ocis/deployment/basic-remote-setup.md

@@ -61,7 +61,7 @@ PROXY_HTTP_ADDR=0.0.0.0:9200 \
 OCIS_URL=https://your-server:9200 \
 PROXY_TRANSPORT_TLS_KEY=./certs/your-host.key \
 PROXY_TRANSPORT_TLS_CERT=./certs/your-host.crt \
-KONNECTD_TLS=0 \
+IDP_TLS=0 \
 ./bin/ocis server
 ```
 

docs/ocis/deployment/bridge.md

@@ -101,7 +101,7 @@ Groups should work as well:
 $ ldapsearch -x -H ldap://localhost:9125 -b dc=example,dc=com -D "cn=admin,dc=example,dc=com" -W '(objectclass=posixgroup)'
 ```
 
-> Note: This is currently a readonly implementation and minimal to the usecase of authenticating users with konnectd.
+> Note: This is currently a readonly implementation and minimal to the usecase of authenticating users with idp.
 
 ### Start ocis-web
 
@@ -124,21 +124,21 @@ $ bin/web server --web-config-server https://cloud.example.com --oidc-authority
 
 `ocis-web` needs to know
 - `--web-config-server https://cloud.example.com` is ownCloud url with webdav and ocs endpoints (oc10 or ocis)
-- `--oidc-authority https://192.168.1.100:9130` the openid connect issuing authority, in our case `oidc-konnectd`, running on port 9130
+- `--oidc-authority https://192.168.1.100:9130` the openid connect issuing authority, in our case `oidc-idp`, running on port 9130
 - `--oidc-metadata-url https://192.168.1.100:9130/.well-known/openid-configuration` the openid connect configuration endpoint, typically the issuer host with `.well-known/openid-configuration`, but there are cases when another endpoint is used, eg. ping identity provides multiple endpoints to separate domains
-- `--oidc-client-id ocis` the client id we will register later with `ocis-konnectd` in the `identifier-registration.yaml`
+- `--oidc-client-id ocis` the client id we will register later with `ocis-idp` in the `identifier-registration.yaml`
 
-### Start ocis-konnectd
+### Start ocis-idp
 
 #### Get it!
 
 In an `ocis` folder
 ```
-$ git clone git@github.com:owncloud/ocis-konnectd.git
-$ cd ocis-konnectd
+$ git clone git@github.com:owncloud/ocis-idp.git
+$ cd ocis-idp
 $ make
 ```
-This should give you a `bin/ocis-konnectd` binary. Try listing the help with `bin/ocis-konnectd --help`.
+This should give you a `bin/ocis-idp` binary. Try listing the help with `bin/ocis-idp --help`.
 
 #### Set environment variables
 
@@ -183,12 +183,12 @@ Replace `localhost:9100` in the redirect URIs with your `ocis-web` host and port
 
 #### Run it!
 
-You can now bring up `ocis-konnectd` with:
+You can now bring up `ocis-idp` with:
 ```console
-$ bin/ocis-konnectd server --iss https://192.168.1.100:9130 --identifier-registration-conf assets/identifier-registration.yaml --signing-kid gen1-2020-02-27
+$ bin/ocis-idp server --iss https://192.168.1.100:9130 --identifier-registration-conf assets/identifier-registration.yaml --signing-kid gen1-2020-02-27
 ```
 
-`ocis-konnectd` needs to know
+`ocis-idp` needs to know
 - `--iss https://192.168.1.100:9130` the issuer, which must be a reachable https endpoint. For testing an ip works. HTTPS is NOT optional. This url is exposed in the `https://192.168.1.100:9130/.well-known/openid-configuration` endpoint and clients need to be able to connect to it
 - `--identifier-registration-conf assets/identifier-registration.yaml` the identifier-registration.yaml you created
 - `--signing-kid gen1-2020-02-27` a signature key id, otherwise the jwks key has no name, which might cause problems with clients. a random key is ok, but it should change when the actual signing key changes.
@@ -203,7 +203,7 @@ $ curl https://192.168.1.100:9130/.well-known/openid-configuration
 
 2. Check if the login works at https://192.168.1.100:9130/signin/v1/identifier
 
-> Note: If you later get a `Unable to find a key for (algorithm, kid):PS256, )` Error make sure you did set a `--signing-kid` when starting `ocis-konnectd` by checking it is present in https://192.168.1.100:9130/konnect/v1/jwks.json
+> Note: If you later get a `Unable to find a key for (algorithm, kid):PS256, )` Error make sure you did set a `--signing-kid` when starting `ocis-idp` by checking it is present in https://192.168.1.100:9130/konnect/v1/jwks.json
 
 ### Patch owncloud
 
@@ -241,7 +241,7 @@ $CONFIG = [
 ```
 
 In the above configuration replace
-- `provider-url` with the URL to your `ocis-konnectd` issuer
+- `provider-url` with the URL to your `ocis-idp` issuer
 - `https://cloud.example.com` with the URL to your ownCloud 10 instance
 - `http://localhost:9100` with the URL to your ownCloud Web instance
 
@@ -251,4 +251,4 @@ In the above configuration replace
 
 Aside from the above todos these are the next steps
 - tie it all together behind `ocis-proxy`
-- create an `ocis bridge` command that runs all the ocis services in one step with a properly preconfigured `ocis-konnectd` `identifier-registration.yaml` file for `ownCloud Web` and the owncloud 10 `openidconnect` app, as well as a randomized `--signing-kid`.
+- create an `ocis bridge` command that runs all the ocis services in one step with a properly preconfigured `ocis-idp` `identifier-registration.yaml` file for `ownCloud Web` and the owncloud 10 `openidconnect` app, as well as a randomized `--signing-kid`.

docs/ocis/deployment/ocis_keycloak.md

@@ -19,7 +19,7 @@ geekdocFilePath: ocis_keycloak.md
 
 The docker stack consists 4 containers. One of them is Traefik, a proxy which is terminating ssl and forwards the requests to oCIS in the internal docker network.
 
-Keykloak add two containers: Keycloak itself and a PostgreSQL as database. Keycloak will be configured as oCIS' IDP instead of the internal IDP [Konnectd]({{< ref "../../extensions/konnectd/_index.md" >}})
+Keykloak add two containers: Keycloak itself and a PostgreSQL as database. Keycloak will be configured as oCIS' IDP instead of the internal IDP [Konnectd]({{< ref "../../extensions/idp/_index.md" >}})
 
 The other container is oCIS itself running all extensions in one container. In this example oCIS uses [oCIS storage driver]({{< ref "../../extensions/storage/storages.md#storage-drivers" >}})
 

docs/ocis/deployment/ocis_traefik.md

@@ -18,7 +18,7 @@ geekdocFilePath: ocis_traefik.md
 
 The docker stack consists of two containers. One of them is Traefik, a proxy which is terminating ssl and forwards the requests to oCIS in the internal docker network.
 
-The other one is oCIS itself running all extensions in one container. In this example oCIS uses its internal IDP [Konnectd]({{< ref "../../extensions/konnectd/_index.md" >}}) and the [oCIS storage driver]({{< ref "../../extensions/storage/storages.md#storage-drivers" >}})
+The other one is oCIS itself running all extensions in one container. In this example oCIS uses its internal IDP [Konnectd]({{< ref "../../extensions/idp/_index.md" >}}) and the [oCIS storage driver]({{< ref "../../extensions/storage/storages.md#storage-drivers" >}})
 
 ## Server Deployment
 

docs/ocis/development/debugging.md

@@ -39,7 +39,7 @@ Run the debug binary with `OCIS_LOG_LEVEL=debug bin/ocis-debug server` and then
 12920 pts/1    Sl     0:00 bin/ocis-debug reva-users
 12929 pts/1    Sl     0:00 bin/ocis-debug glauth
 12940 pts/1    Sl     0:00 bin/ocis-debug reva-storage-home-data
-12948 pts/1    Sl     0:00 bin/ocis-debug konnectd
+12948 pts/1    Sl     0:00 bin/ocis-debug idp
 12952 pts/1    Sl     0:00 bin/ocis-debug proxy
 12961 pts/1    Sl     0:00 bin/ocis-debug thumbnails
 12971 pts/1    Sl     0:00 bin/ocis-debug reva-storage-oc
@@ -81,7 +81,7 @@ bin/ocis --log-level=$LOG_LEVEL glauth &
 bin/ocis --log-level=$LOG_LEVEL graph-explorer &
 bin/ocis --log-level=$LOG_LEVEL graph &
 #bin/ocis --log-level=$LOG_LEVEL hello &
-bin/ocis --log-level=$LOG_LEVEL konnectd &
+bin/ocis --log-level=$LOG_LEVEL idp &
 #bin/ocis --log-level=$LOG_LEVEL ocs &
 bin/ocis --log-level=$LOG_LEVEL web &
 bin/ocis --log-level=$LOG_LEVEL reva-auth-basic &
@@ -118,7 +118,7 @@ bin/ocis --log-level=$LOG_LEVEL proxy &
 12920 pts/1    Sl     0:00 bin/ocis-debug reva-users
 12929 pts/1    Sl     0:00 bin/ocis-debug glauth
 12940 pts/1    Sl     0:00 bin/ocis-debug reva-storage-home-data
-12948 pts/1    Sl     0:00 bin/ocis-debug konnectd
+12948 pts/1    Sl     0:00 bin/ocis-debug idp
 12952 pts/1    Sl     0:00 bin/ocis-debug proxy
 12961 pts/1    Sl     0:00 bin/ocis-debug thumbnails
 12971 pts/1    Sl     0:00 bin/ocis-debug reva-storage-oc

docs/ocis/flow-docs/login-flow.md

@@ -44,7 +44,7 @@ sequenceDiagram
         Note over client, idp: GET /authorize?<br>response_type=code<br>&scope=openid%20profile%20email<br>&client_id=s6BhdRkqt3<br>&state=af0ifjsldkj<br>&redirect_uri=https%3A%2F%2Fclient.example.org%2Fcb HTTP/1.1<br>Host: server.example.com
         Note over user, idp: 3. Authorization Server Authenticates the End-User.
         Note over idp,ldap: Either an IdP already exists or a new one is introduced. Since we are not yet using oidc discovery we can only use one IdP.
-        alt all users managed by konnectd/ocis
+        alt all users managed by idp/ocis
             idp->>+glauth: LDAP query/bind
             glauth->>+graph: GET user with Basic Auth<br>GraphAPI
             graph->>+accounts: internal GRPC

docs/ocis/flow-docs/request-flow.md

@@ -28,7 +28,7 @@ sequenceDiagram
         Note over client,proxy: What is in a bearer token? <br> The spec recommends opaque tokens. <br> Treat it as random byte noise.
         Note over client,proxy: the proxy MUST authenticate users <br> using ocis-accounts because it needs <br> to decide where to send the request
         %% Mention introspection endpoint for opaque tokens
-        %% konnectd uses jwt, so we can save a request
+        %% idp uses jwt, so we can save a request
         %% either way the token can be used to look up the sub and iss of the user
 
             %% or is token check enough?

glauth/go.sum

@@ -224,6 +224,8 @@ github.com/cs3org/reva v1.2.2-0.20200924071957-e6676516e61e h1:khITGSnfDXtByQsLe
 github.com/cs3org/reva v1.2.2-0.20200924071957-e6676516e61e/go.mod h1:DOV5SjpOBKN+aWfOHLdA4KiLQkpyC786PQaXEdRAZ0M=
 github.com/cs3org/reva v1.4.1-0.20210111080247-f2b63bfd6825 h1:U6pAVGTjesstz+EXd8+YpIG1xwKH1ovOXdWrMCvnopw=
 github.com/cs3org/reva v1.4.1-0.20210111080247-f2b63bfd6825/go.mod h1:abC1Lo0ZKwkKloomTPZWunV/lUJvewkty1pI41zn2Ic=
+github.com/cs3org/reva v1.5.1 h1:GebunCjhHfA3lFLXjQT+3jOUjEXUubk9sr3otOIDGac=
+github.com/cs3org/reva v1.5.1/go.mod h1:abC1Lo0ZKwkKloomTPZWunV/lUJvewkty1pI41zn2Ic=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=

konnectd/Makefile → idp/Makefile

@@ -1,5 +1,5 @@
 SHELL := bash
-NAME := konnectd
+NAME := idp
 IMPORT := github.com/owncloud/ocis/$(NAME)
 BIN := bin
 DIST := dist

konnectd/cmd/konnectd/main.go → idp/cmd/konnectd/main.go

@@ -3,7 +3,7 @@ package main
 import (
 	"os"
 
-	"github.com/owncloud/ocis/konnectd/pkg/command"
+	"github.com/owncloud/ocis/idp/pkg/command"
 )
 
 func main() {

konnectd/config/example.json → idp/config/example.json

@@ -15,6 +15,6 @@
     "type": "jaeger",
     "endpoint": "localhost:6831",
     "collector": "http://localhost:14268/api/traces",
-    "service": "konnectd"
+    "service": "idp"
   }
 }

konnectd/config/example.yml → idp/config/example.yml

@@ -14,6 +14,6 @@ tracing:
   type: jaeger
   endpoint: localhost:6831
   collector: http://localhost:14268/api/traces
-  service: konnectd
+  service: idp
 
 ...

konnectd/docker/Dockerfile.linux.amd64 → idp/docker/Dockerfile.linux.amd64

@@ -13,7 +13,7 @@ LABEL maintainer="ownCloud GmbH <devops@owncloud.com>" \
 
 EXPOSE 9130 9134
 
-ENTRYPOINT ["/usr/bin/ocis-konnectd"]
+ENTRYPOINT ["/usr/bin/ocis-idp"]
 CMD ["server"]
 
-COPY bin/ocis-konnectd /usr/bin/ocis-konnectd
+COPY bin/ocis-idp /usr/bin/ocis-idp

konnectd/docker/Dockerfile.linux.arm → idp/docker/Dockerfile.linux.arm

@@ -13,7 +13,7 @@ LABEL maintainer="ownCloud GmbH <devops@owncloud.com>" \
 
 EXPOSE 9130 9134
 
-ENTRYPOINT ["/usr/bin/ocis-konnectd"]
+ENTRYPOINT ["/usr/bin/ocis-idp"]
 CMD ["server"]
 
-COPY bin/ocis-konnectd /usr/bin/ocis-konnectd
+COPY bin/ocis-idp /usr/bin/ocis-idp

konnectd/docker/Dockerfile.linux.arm64 → idp/docker/Dockerfile.linux.arm64

@@ -13,7 +13,7 @@ LABEL maintainer="ownCloud GmbH <devops@owncloud.com>" \
 
 EXPOSE 9130 9134
 
-ENTRYPOINT ["/usr/bin/ocis-konnectd"]
+ENTRYPOINT ["/usr/bin/ocis-idp"]
 CMD ["server"]
 
-COPY bin/ocis-konnectd /usr/bin/ocis-konnectd
+COPY bin/ocis-idp /usr/bin/ocis-idp