Keycloak Username change in Opencloud Ldap

[suse-coder]

I have setup auto provisioning mode (external keyclaok with users), and have ldap configured in opencloud. Now when i login (with my oidc claim: sub) into opencloud. Is opencloud then also using that sub or username in ldap? What will happen if the keycloak username would change and the sub would be still the same. Would opencloud still let me login?
Would this work (or do i need to have PROXY_USER_CS3_CLAIM as username ?
- name: PROXY_USER_OIDC_CLAIM
value: "sub"
- name: PROXY_USER_CS3_CLAIM
value: "sub"

https://docs.opencloud.eu/docs/admin/configuration/authentication-and-user-management/keycloak

[rhafer]

It works if you use the configuration described here:
https://docs.opencloud.eu/docs/admin/configuration/authentication-and-user-management/keycloak/#configuration-for-autoprovisioning-mode

There are a few more details about the inner workings available here: https://github.com/opencloud-eu/opencloud/tree/main/services/proxy#configuration

In short: it should work if you have

PROXY_USER_OIDC_CLAIM=sub
PROXY_USER_CS3_CLAIM=username
PROXY_AUTOPROVISION_CLAIM_USERNAME=sub

[suse-coder]

Do you know if ldap is even needed? Why cant I just use only keycloak for all? Why does it need to get the sub id from keycloak and then lookup its own ldap?

[micbar]

OpenCloud has no relational database. We need to store user and user information though. Like described in the official docs, we have different scenarios where openCloud can or cannot read to an existing LDAP. (Shared Directory or Autoprovisioning)

In both scenarios, OpenCloud is consuming the information from LDAP.