Guided setup: connect a sign-in directory #41

Merged

jcoffey-dev merged 1 commits from feature/directory-setup into main

2026-09-28 21:59:30 +00:00

jcoffey-dev commented

2026-09-28 19:45:20 +00:00

Owner

Last first-wave guided setup from the settings-reorg spec. Needs inbuxa-server #95 (POST /api/directory/test). Based on main, independent of the other open PRs. The Settings › Overview card follows once #34/#36 land.

Offered from Directories and Authentication, with "Guided or manual?" each time.

Directory: Active Directory, OpenLDAP, FreeIPA, Keycloak, Authentik, or another OpenID Connect provider. Each preset sets the filters, attributes and group class for that directory, with example connection values. SQL stays manual.
Connection: server URL (ldaps:// is encrypted; ldap:// gets STARTTLS unless it's this machine), search base, lookup account and password, or the OIDC issuer. Accept an untrusted certificate is off, with a warning. "Save and continue" saves the directory, which changes nothing while no domain uses it; saving again updates the same one.
Test a person: via the new server endpoint. It shows whether the directory opened, whether the person was found (name, aliases, groups), and whether the password signs in, with a wrong password told apart from a broken connection. Next stays off until a person is found and any password given works.
Domains: each domain with its current directory and account count. The server default is a separate switch that's discouraged in the text. Choosing the domain you're signed in on, or the default, needs an explicit I've checked I can still sign in.
Review in plain words, with each domain's existing-account count. Then switch: the domains are updated; if making it the default is refused, the domains are put back.

Checked in Chrome against a local server built from #95 and the suite's OpenLDAP container:

the OpenLDAP preset with the fixture connection saved and found John Doe with alias and group;
a wrong password showed the directory says that password is wrong and kept Next off;
the right password showed The password signs in;
the default switch raised the lockout box and held Next until ticked;
switching ihasmail.org over (on the throwaway server) set only its directoryId, left the default null, and raised no config warnings.

Also: 4 unit tests for the directory objects the presets build, plus typecheck, lint and build. The AD and FreeIPA filter presets are from each product's usual schema and haven't been run against a real AD or IPA; the test step is there to catch a mismatch.

English only: about 70 new strings.

Last first-wave guided setup from the settings-reorg spec. **Needs inbuxa-server #95** (`POST /api/directory/test`). Based on main, independent of the other open PRs. The Settings › Overview card follows once #34/#36 land. Offered from Directories and Authentication, with "Guided or manual?" each time. 1. **Directory:** Active Directory, OpenLDAP, FreeIPA, Keycloak, Authentik, or another OpenID Connect provider. Each preset sets the filters, attributes and group class for that directory, with example connection values. SQL stays manual. 2. **Connection:** server URL (ldaps:// is encrypted; ldap:// gets STARTTLS unless it's this machine), search base, lookup account and password, or the OIDC issuer. *Accept an untrusted certificate* is off, with a warning. "Save and continue" saves the directory, which changes nothing while no domain uses it; saving again updates the same one. 3. **Test a person:** via the new server endpoint. It shows whether the directory opened, whether the person was found (name, aliases, groups), and whether the password signs in, with a wrong password told apart from a broken connection. Next stays off until a person is found and any password given works. 4. **Domains:** each domain with its current directory and account count. The server default is a separate switch that's discouraged in the text. Choosing the domain you're signed in on, or the default, needs an explicit *I've checked I can still sign in*. 5. **Review** in plain words, with each domain's existing-account count. Then **switch**: the domains are updated; if making it the default is refused, the domains are put back. **Checked** in Chrome against a local server built from #95 and the suite's OpenLDAP container: - the OpenLDAP preset with the fixture connection saved and found John Doe with alias and group; - a wrong password showed *the directory says that password is wrong* and kept Next off; - the right password showed *The password signs in*; - the default switch raised the lockout box and held Next until ticked; - switching ihasmail.org over (on the throwaway server) set only its `directoryId`, left the default null, and raised no config warnings. Also: 4 unit tests for the directory objects the presets build, plus typecheck, lint and build. The AD and FreeIPA filter presets are from each product's usual schema and haven't been run against a real AD or IPA; the test step is there to catch a mismatch. English only: about 70 new strings.

jcoffey-dev added 1 commit 2026-09-28 21:57:04 +00:00

Guided setup: connect a sign-in directory

ci / build (pull_request) Successful in 2m4s

Details

ci / publish (pull_request) Skipped

Details

0c64ff214b

Directories and Authentication offer a guide ("Guided or manual?" each
time) that:

- starts from Active Directory, OpenLDAP, FreeIPA, Keycloak, Authentik
  or another OpenID Connect provider, with filters and attributes set for
  that directory and example connection values;
- saves the directory, which changes nothing while no domain uses it,
  and tests a real person against it with the server's directory test:
  found or not (with aliases and groups), and whether a password signs
  in, a wrong password told apart from a broken connection. The guide
  won't go on until a person is found and, if given, the password works;
- then asks which domains sign in through it, with each domain's account
  count, and the server default as a separate switch. Choosing the
  domain you sign in on, or the default, needs an explicit "I've checked
  I can still sign in";
- switches the chosen domains over, putting them back if making it the
  default is refused.

Needs inbuxa-server's POST /api/directory/test.

jcoffey-dev force-pushed feature/directory-setup from 570d55550a to 0c64ff214b

2026-09-28 21:57:04 +00:00

Compare

jcoffey-dev merged commit a37ee5a7d4 into main

2026-09-28 21:59:30 +00:00

jcoffey-dev deleted branch feature/directory-setup

2026-09-28 21:59:30 +00:00

jcoffey-dev referenced this pull request

2026-09-28 22:16:37 +00:00

Settings › Overview offers the limits and directory guides too #49