ocis: Document Identity Management in an own section

Migrated from owncloud/docs-ocis#535 — opened by @mmattel on 2023-06-13.
Original: https://github.com/owncloud/docs-ocis/issues/535

As discussed with @rhafer
Should be done with higher prio as many things depend on that info.

Complexity: 5

Topics

• User and Groups
• Authentifizierung
• Internal only
• External only
• Combinations of both

Original comments

@mmattel — 2023-06-15

I have the feeling that https://github.com/owncloud/docs-ocis/issues/518 (migrated: #69) can be part of this...

@micbar — 2023-06-27

@rhafer Did you have some special topics in mind?

IMO "Identity Management" Is a very broad topic. We need to identify actionable items which can be improved.

@rhafer — 2023-06-27

• I guess we need some form of overview. i.e. how the different service (idm, idp, graph, users, groups) interact which each other
• document the restrictions of the builtin IDP and IDM services
• We need some better documentation about how to integrate with existing directories (for replacing the idm) and OpenID Connect Providers (for replacing the IDP). Especially what requirements we have on those external services and what options exist (e.g. how to pick a proper LDAP attribute for the userid, or what requirements we have for the OIDC base roles assignement, how to properly setup backchannel logout). BTW, I am NOT looking for a detailed step by step guide for specific IDPs or LDAP implementations here, just generic information to help folks with whatever thing they want to connect to.
• we need more documentation about the user-management capabilities of the graph API (i.e. if you want to manage user and groups through our WebUI, we have some pretty specific requirements on the used LDAP schema),

No file, test, or entry point is named. Start by reviewing the related issue #69 and the requested topics, then define actionable documentation sections for service interactions, built-in IDP and IDM restrictions, external directory and OIDC integration requirements, and Graph API user and group management. Done means these areas are documented with generic integration guidance rather than provider-specific procedures.