Cloudron to Cloudron user directory partial sync possible?

[Neiluj]

Hi,

Let's consider this:

• Cloudron Server A is the IdP, home to the user directory, the Directory Server
• Cloudron Server B is syncing the user directory with Cloudron Server A via the External Directory Connector.

Question: Is there a way to sync only part of the user directory such as only users of a certain group? Maybe by adding some arguments to the Server URL?

While not massively critical, this would:

• reduce maintenance (unnecessary overhead of deleting old users etc..)
• reduce vector of potential attack on cloudron server B

Thanks a lot!

[robi]

This is a great idea, as it would help with customers who need to expand to another cloudron or have an large app necessitating a separate instance.

Syncing only a subtree like a group or user would totally be a great use case.

[james]

Hello @Neiluj
This is indeed a good idea.
I am moving this topic to @feature-requests

[girish]

Think the use case is valid, but moving forward we will be focusing on OIDC integration. I think your feature request can be reworded to say: Cloudron A is the OIDC provider and Cloudron B is configured to login with Cloudron A as the identity provider. Further, Cloudron B can have rules specifying who can login (by some policy specification).

OIDC is more secure and auditable but this is also driven by the fact that the only ldap module for nodejs got deprecated - https://github.com/ldapjs/node-ldapjs .

[Neiluj]

@girish This sounds very good, but rather like a major change/update (or maybe not?) - Only question remains, and I know that this might be challenging, especially having v9 just out: when is the Cloudron team likely to look into this ? Is this something planned for a specific Cloudron version?

No worries if you cannot give an indications - I can also easily understand.

[girish]

@Neiluj sometime soon but yeah, I don't have a timeline yet .

Also, a note about your initial post, if you mark users as inactive in Cloudron A, they won't sync to Cloudron B. Of course, they can't login to Cloudron A either.