mirror/opencloud
1
0
Fork 0
mirror of https://github.com/opencloud-eu/opencloud.git synced 2026-02-05 03:30:19 -06:00
Code Issues Packages Projects Releases Wiki Activity

drop infinite scale

Browse Source 
Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
This commit is contained in:
Jörn Friedrich Dreyer
2025-01-21 15:09:07 +01:00
parent 2462b80d95
commit 7be14bf8a4
4 changed files with 19 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
deployments/examples/opencloud_full/README.md
View File

@@ -2,13 +2,13 @@
document this deployment example in: docs/ocis/deployment/opencloud_full.md
---
# Infinite Scale WOPI Deployment Example
# OpenCloud WOPI Deployment Example
This deployment example is documented in two locations for different audiences:
* In the [Admin Documentation](https://doc.owncloud.com/ocis/latest/index.html)\
Providing two variants using detailed configuration step by step guides:\
[Local Production Setup](https://doc.owncloud.com/ocis/next/depl-examples/ubuntu-compose/ubuntu-compose-prod.html) and [Deploy Infinite Scale on the Hetzner Cloud](https://doc.owncloud.com/ocis/next/depl-examples/ubuntu-compose/ubuntu-compose-hetzner.html).\
[Local Production Setup](https://doc.owncloud.com/ocis/next/depl-examples/ubuntu-compose/ubuntu-compose-prod.html) and [Deploy OpenCloud on the Hetzner Cloud](https://doc.owncloud.com/ocis/next/depl-examples/ubuntu-compose/ubuntu-compose-hetzner.html).\
Note that these examples use LetsEncrypt certificates and are intended for production use.
* In the [Developer Documentation](https://owncloud.dev/ocis/deployment/ocis_full/)\

6
services/invitations/README.md
View File

@@ -9,11 +9,11 @@ The corresponding CS3 API [user types](https://cs3org.github.io/cs3apis/#cs3.ide
## Provisioning Backends
When Infinite Scale is used via the IDM service for the user management, users are created using the `/graph/v1.0/users` endpoint via the libre graph API. For larger deployments, the Keycloak admin API can be used to provision users. In a future step, the endpoint, credentials and body might be made configurable using templates.
When OpenCloud is used via the IDM service for the user management, users are created using the `/graph/v1.0/users` endpoint via the libre graph API. For larger deployments, the Keycloak admin API can be used to provision users. In a future step, the endpoint, credentials and body might be made configurable using templates.
### Keycloak
The default and currently only available backend used to handle invitations is [Keycloak](https://www.keycloak.org/). Keycloak is an open source identity and access management (IAM) system which is also integrated by other Infinite Scale services as an authentication and authorization backend.
The default and currently only available backend used to handle invitations is [Keycloak](https://www.keycloak.org/). Keycloak is an open source identity and access management (IAM) system which is also integrated by other OpenCloud services as an authentication and authorization backend.
#### Keycloak Realm Configuration
@@ -42,4 +42,4 @@ After Keycloak has been configured, the invitation service needs to be configure
## Bridging Provisioning Delay
Consider that when a guest account has to be provisioned in an external user management, there might be a delay between creating the user and the user being available in the local Infinite Scale system.
Consider that when a guest account has to be provisioned in an external user management, there might be a delay between creating the user and the user being available in the local OpenCloud system.

16
services/proxy/README.md
View File

@@ -126,21 +126,21 @@ all other groups that he is currently a member of.
Groups that do not exist in the external IDP yet will be created. Note: This can be a
somewhat costly operation, especially if the user is a member of a large number of
groups. If the group memberships of a user are changed in the IDP after the
first login, it can take up to 5 minutes until the changes are reflected in Infinite Scale.
first login, it can take up to 5 minutes until the changes are reflected in OpenCloud.
### Claim Updates
OpenID Connect (OIDC) scopes are used by an application during authentication to authorize access to a user's detail, like name, email or picture information. A scope can also contain among other things groups, roles, and permissions data. Each scope returns a set of attributes, which are called claims. The scopes an application requests, depends on which attributes the application needs. Once the user authorizes the requested scopes, the claims are returned in a token.
These issued JWT tokens are immutable and integrity-protected. Which means, any change in the source requires issuing a new token containing updated claims. On the other hand side, there is no active synchronisation process between the identity provider (IDP) who issues the token and Infinite Scale. The earliest possible time that Infinite Scale will notice changes is, when the current access token has expired and a new access token is issued by the IDP, or the user logs out and relogs in.
These issued JWT tokens are immutable and integrity-protected. Which means, any change in the source requires issuing a new token containing updated claims. On the other hand side, there is no active synchronisation process between the identity provider (IDP) who issues the token and OpenCloud. The earliest possible time that OpenCloud will notice changes is, when the current access token has expired and a new access token is issued by the IDP, or the user logs out and relogs in.
**NOTES**
* For resource optimisation, Infinite Scale skips any checks and updates on groupmemberships, if the last update happened less than 5min ago.
* For resource optimisation, OpenCloud skips any checks and updates on groupmemberships, if the last update happened less than 5min ago.
* Infinite Scale can't differentiate between a group being renamed in the IDP and users being reassigned to a different group.
* OpenCloud can't differentiate between a group being renamed in the IDP and users being reassigned to a different group.
* Infinite Scale does not get aware when a group is being deleted in the IDP, a new claim will not hold any information from the deleted group. Infinite Scale does not track a claim history to compare.
* OpenCloud does not get aware when a group is being deleted in the IDP, a new claim will not hold any information from the deleted group. OpenCloud does not track a claim history to compare.
#### Impacts
@@ -180,7 +180,7 @@ When `PROXY_ROLE_ASSIGNMENT_DRIVER` is set to `oidc` the role assignment for a u
based on the values of an OpenID Connect Claim of that user. The name of the OpenID Connect Claim to
be used for the role assignment can be configured via the `PROXY_ROLE_ASSIGNMENT_OIDC_CLAIM`
environment variable. It is also possible to define a mapping of claim values to role names defined
in Infinite Scale via a `yaml` configuration. See the following `proxy.yaml` snippet for an example.
in OpenCloud via a `yaml` configuration. See the following `proxy.yaml` snippet for an example.
```yaml
role_assignment:
@@ -233,9 +233,9 @@ In a production deployment, you want to have basic authentication (`PROXY_ENABLE
### Content Security Policy
For Infinite Scale, external resources like an IDP (e.g. Keycloak) or when using web office documents or web apps, require defining a CSP. If not defined, the referenced services will not work.
For OpenCloud, external resources like an IDP (e.g. Keycloak) or when using web office documents or web apps, require defining a CSP. If not defined, the referenced services will not work.
To create a Content Security Policy (CSP), you need to create a yaml file containing the CSP definitions. To activate the settings, reference the file as value in the `PROXY_CSP_CONFIG_FILE_LOCATION` environment variable. For each change, a restart of the Infinite Scale deployment or the proxy service is required.
To create a Content Security Policy (CSP), you need to create a yaml file containing the CSP definitions. To activate the settings, reference the file as value in the `PROXY_CSP_CONFIG_FILE_LOCATION` environment variable. For each change, a restart of the OpenCloud deployment or the proxy service is required.
A working example for a CSP can be found in a sub path of the `config` directory of the [opencloud_full](https://github.com/opencloud-eu/opencloud/tree/master/deployments/examples/opencloud_full/config) deployment example.

12
services/web/README.md
View File

@@ -45,7 +45,7 @@ and does not support injection of dynamic web applications (custom dynamic backe
### Loading Themes
Web themes are loaded, if added in the Infinite Scale source code, at build-time from
Web themes are loaded, if added in the OpenCloud source code, at build-time from
`<opencloud_repo>/services/web/assets/themes`.
This cannot be manipulated at runtime.
@@ -67,19 +67,19 @@ Such mandatory keys are injected automatically at runtime if not provided.
### Loading Applications
Web applications are loaded, if added in the Infinite Scale source code, at build-time from
Web applications are loaded, if added in the OpenCloud source code, at build-time from
`<opencloud_repo>/services/web/assets/apps`. This cannot be manipulated at runtime.
Additionally, the administrator can provide custom applications by storing them in the path defined by the environment
variable `WEB_ASSET_APPS_PATH`.
This environment variable defaults to the Infinite Scale base data directory `$OC_BASE_DATA_PATH/web/assets/apps`,
This environment variable defaults to the OpenCloud base data directory `$OC_BASE_DATA_PATH/web/assets/apps`,
but can be redefined with any path set manually.
The final list of available applications is composed of the built-in and the custom applications provided by the
administrator via `WEB_ASSET_APPS_PATH`.
For example, if Infinite Scale contains a built-in extension named `image-viewer-dfx` and the administrator provides a custom application named `image-viewer-obj` via the `WEB_ASSET_APPS_PATH` directory, the user will be able to access both
For example, if OpenCloud contains a built-in extension named `image-viewer-dfx` and the administrator provides a custom application named `image-viewer-obj` via the `WEB_ASSET_APPS_PATH` directory, the user will be able to access both
applications from the WebUI.
### Application Structure
@@ -164,7 +164,7 @@ Besides the configuration and application registration, in the process of loadin
This is useful for cases where just a single asset should be overwritten, like a logo or similar.
Consider the following: Infinite Scale is shipped with a default web app named `image-viewer-dfx` which contains a logo,
Consider the following: OpenCloud is shipped with a default web app named `image-viewer-dfx` which contains a logo,
but the administrator wants to provide a custom logo for that application.
This can be achieved using the path defined via `WEB_ASSET_APPS_PATH` and adding a custom structure like `WEB_ASSET_APPS_PATH/image-viewer-dfx/`. Here you can add all custom assets to load like `logo.png`. On loading the web app, custom assets defined overwrite default ones.
@@ -173,4 +173,4 @@ This also applies for the `manifest.json` file, if the administrator wants to pr
## Miscellaneous
Please note that Infinite Scale, in particular the web service, needs a restart to load new applications or changes to the `apps.yaml` file.
Please note that OpenCloud, in particular the web service, needs a restart to load new applications or changes to the `apps.yaml` file.