feat(open-xchange): add mail filter properties and Keycloak sync via … - #101
Open
MAVRICK-1 wants to merge 6 commits into
Open
feat(open-xchange): add mail filter properties and Keycloak sync via …#101MAVRICK-1 wants to merge 6 commits into
MAVRICK-1 wants to merge 6 commits into
Conversation
MAVRICK-1
marked this pull request as draft
July 17, 2026 17:59
MAVRICK-1
marked this pull request as ready for review
July 18, 2026 18:53
MAVRICK-1
force-pushed
the
feat/open-xchange-mail-filter-properties
branch
2 times, most recently
from
July 22, 2026 05:09
475f744 to
525d894
Compare
ashish1099
reviewed
Jul 23, 2026
| case "$EMAIL" in | ||
| *@{{ required "appsuite.keycloakSync.emailDomain is required" $sync.emailDomain }}) ;; | ||
| *) continue ;; | ||
| esac |
Member
There was a problem hiding this comment.
this does not seems like a good way ?
Member
Author
There was a problem hiding this comment.
updated it , now it only updates names, not email
…SOAP admin API Adds mail filter (Sieve) property placeholders, enabling Settings > Mail > Filter Rules in the App Suite UI. Templatizes the Keycloak user sync + mail provisioning CronJob into the chart itself (previously lived as raw manifests in the config repo). Auth is via the OIDC client's own secret (client_credentials grant) — OX has no JIT auto-provisioning on login, so this CronJob is the actual mechanism keeping OX accounts and Dovecot mailboxes in sync with Keycloak. User provisioning goes through OX's own SOAP admin API (OXUserService, see docs linked inline), not kubectl exec + CLI tools — verified live against a real cluster: wiped all existing accounts and re-ran the sync fresh, all users recreated cleanly via SOAP with zero failures. Mail provisioning still uses kubectl exec since Dovecot has no SOAP/REST equivalent. Signed-off-by: Rishi <rishi@obmondo.com>
…accounts Every account created by the Keycloak-sync CronJob got its OX password hardcoded to the literal string 'admin' in the SOAP create request. Real login always goes through OIDC, so this password is never used as a login credential directly - but shipping a chart where every account gets a guessable, shared literal baked in is still a real security smell, not something to leave as-is. Adds keycloakSync.userPassword (required, no default) - set to something random per deployment instead. Signed-off-by: Rishi <rishi@obmondo.com>
Switches userPassword from a plain values-driven env var to userPasswordExistingSecret/userPasswordSecretKey, sourced via secretKeyRef - same convention as oidcExistingSecret. Keeps the actual password value out of values files entirely. Signed-off-by: Rishi <rishi@obmondo.com>
Signed-off-by: Rishi <rishi@obmondo.com>
… every run The change SOAP call (runs every 15 min, for existing accounts) was unconditionally resetting primaryEmail/email1 back to Keycloak's email on every sync - silently undoing any account customized to use a different mail identity than the Keycloak login domain (hit this in production: kept reverting kubeaid.io swaps back to obmondo.com every 15 minutes, had to suspend the CronJob entirely to stop it). change now only touches name fields (given_name/sur_name/display_name) - its actual job, keeping display names in sync. create (for genuinely new accounts) still sets primaryEmail/email1 once, unaffected. Signed-off-by: Rishi <rishi@obmondo.com>
ServiceAccount/Role/RoleBinding were bundled into keycloak-sync-cronjob.yaml alongside the ConfigMap+CronJob, which is odd for a file named "cronjob". Moved RBAC out to keycloak-sync-rbac.yaml, no logic change. Signed-off-by: Rishi <rishi@obmondo.com>
MAVRICK-1
force-pushed
the
feat/open-xchange-mail-filter-properties
branch
from
July 26, 2026 13:55
1823c17 to
a04af32
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds two things to the open-xchange chart:
Mail filter (Sieve) properties - enables Settings > Mail > Filter Rules in the App Suite UI. Points at your IMAP server's ManageSieve port; blank by default until wired to a real mail backend.
Keycloak → OX user sync CronJob - OX's OIDC login has no JIT auto-provisioning; a login for a Keycloak user with no matching OX account just fails (USR-0015), it doesn't create one. This CronJob is the actual mechanism keeping OX accounts (and optionally Dovecot mailboxes) in sync with Keycloak, so new hires get an account without a manual
createuserper person.kubectl execfor Dovecot, since there's no SOAP/REST equivalent for that.