Skip to content

Update README with LDAP certificate details #2759

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dragonchaser merged 2 commits into from
May 13, 2026
+12 −0
Merged

Update README with LDAP certificate details #2759

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
dca5418
Update README with LDAP certificate details
Svanvith May 13, 2026
0b05f34
Update README with correct Libregraph idm link
Svanvith May 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions services/idm/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,4 +6,16 @@

IDM listens on port 9235 by default. In the default configuration it only accepts TLS-protected connections (LDAPS). The BaseDN of the LDAP tree is `o=libregraph-idm`. IDM gives LDAP write permissions to a single user (DN: `uid=libregraph,ou=sysusers,o=libregraph-idm`). Any other authenticated user has read-only access. IDM stores its data in a boltdb file `idm/idm.boltdb` inside the OpenCloud base data directory.

The internal LDAP certificate and key are stored as `ldap.crt` and `ldap.key` in the IDM data directory. By default, these certificates expire after 12 months. When the certificate has expired, IDM can no longer establish valid TLS connections and requests that depend on LDAP may fail with `500 Internal Server Error`.

Check notice on line 9 in services/idm/README.md

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

services/idm/README.md#L9 

Expected: 80; Actual: 319

To renew the internal LDAP certificate, stop or restart the OpenCloud container after deleting the expired certificate and key:

Check notice on line 11 in services/idm/README.md

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

services/idm/README.md#L11 

Expected: 80; Actual: 127

```bash
cd .opencloud/idm
rm ldap.crt ldap.key
docker compose restart
```

The certificate and key are automatically regenerated when the container starts again. For more details, see [Internal LibreIDM cert expires](https://docs.opencloud.eu/docs/admin/resources/common-issues/#internal-libreidm-cert-expires).

Check notice on line 19 in services/idm/README.md

View check run for this annotation

Codacy Production / Codacy Static Code Analysis

services/idm/README.md#L19 

Expected: 80; Actual: 236

Note: IDM is limited in its functionality. It only supports a subset of the LDAP operations (namely `BIND`, `SEARCH`, `ADD`, `MODIFY`, `DELETE`). Also, IDM currently does not do any schema verification (like. structural vs. auxiliary object classes, require and option attributes, syntax checks, …). Therefore it is not meant as a general purpose LDAP server.