feat: remove Dex and use Synapse LDAP (#26)

Simplify the stack and ease integration with other modules like NethVoice.

Changes:
* Add synapse ldap config and remove dex
* Fix element template
* Remove dex from README

Author: mrmarkuz

README.md

@@ -7,15 +7,13 @@ This module is in early development and should be used for testing purposes only
 A NethServer 8 module for [Matrix](https://matrix.org/) chat service integration with LDAP authentication via OpenID Connect.
 
 This module provides a complete Matrix chat solution including:
-- **Dex** (OpenID Connect Provider) - Connects to NethServer LDAP for user authentication
 - **Synapse** (Matrix Homeserver) - Core Matrix server with OIDC authentication
 - **Element Web** (Web Client) - Web interface for Matrix chat
 - **Cinny** (Web Client) - Alternative web interface for Matrix chat
 
 ## Features
 
 - Seamless integration with NethServer 8 LDAP user directory
-- OpenID Connect authentication through Dex
 - Configurable domain names for both Matrix server and Element web client
 - Automatic SSL/TLS certificate management via Traefik
 - Matrix Federation support
@@ -42,16 +40,15 @@ Launch `configure-module`, by setting the following parameters:
 - `element_domain_name`: The fully qualified domain name for the Element web client (e.g., `chat.example.com`)
 - `cinny_domain_name`: The fully qualified domain name for the Cinny client (e.g., `cinny.example.com`)
 - `lets_encrypt`: Set to `true` to enable automatic SSL certificate generation via Let's Encrypt for both domains.
-- `dex_ldap_domain`: The LDAP domain name to be used by Dex for authentication. If not provided, the default LDAP domain will be used.
+- `ldap_domain`: The LDAP domain name to be used for authentication.
 - `mail_from`: The mail sender address for notification mails
 
 Example:
 
-    api-cli run module/matrix1/configure-module --data '{"synapse_domain_name": "matrix.example.com", "element_domain_name": "chat.example.com", "cinny_domain_name": "cinny.example.com", "lets_encrypt": true, "dex_ldap_domain": "users.example.com", "mail_from": "noreply@example.com"}'
+    api-cli run module/matrix1/configure-module --data '{"synapse_domain_name": "matrix.example.com", "element_domain_name": "chat.example.com", "cinny_domain_name": "cinny.example.com", "lets_encrypt": true, "ldap_domain": "users.example.com", "mail_from": "noreply@example.com"}'
 
 The above command will:
-- Configure Dex as OpenID Connect provider with LDAP/AD backend
-- Start and configure the Synapse Matrix homeserver with OIDC authentication
+- Start and configure the Synapse Matrix homeserver with LDAP authentication
 - Deploy Element Web client and Cinny client configured to connect to the local Synapse instance
 - Set up Traefik routes for both domains with automatic SSL certificates
 
@@ -108,11 +105,11 @@ The Element client supports customized themes, examples are added to the configu
 
 ### Cinny Client
 
-Cinny is an alternative web client for Matrix chat, included in this module to provide users with a modern, lightweight interface. It can be accessed via a web browser and supports essential Matrix features such as messaging, rooms, and user authentication via OpenID Connect. Cinny is pre-configured to work with the Synapse server and Dex for seamless integration with NethServer 8 LDAP.
+Cinny is an alternative web client for Matrix chat, included in this module to provide users with a modern, lightweight interface. It can be accessed via a web browser and supports essential Matrix features such as messaging, rooms, and user authentication via OpenID Connect. Cinny is pre-configured to work with the Synapse server for seamless integration with NethServer 8 LDAP.
 ## LDAP Integration
 
 The module automatically discovers LDAP settings from the NethServer 8 configuration. 
-Dex is configured to connect to the NS8 LDAP proxy to authenticate users against 
+Synapse is configured to connect to the NS8 LDAP proxy to authenticate users against 
 the centralized user directory.
 
 The LDAP discovery happens every time the services start through the `bin/discover-ldap` 
@@ -159,29 +156,22 @@ To setup the translation process:
 
 Stack explanation:
 - [Synapse](https://element-hq.github.io/synapse/latest/setup/installation.html) is the standard de-fact Matrix homeserver implementation
-- Dex is used as OpenID Connect Provider to authenticate users against LDAP, it's not strictly required unless MAS (Matrix Authentication Service) is used (currently MAS is not implemented in this module)
 - Element web is the official Matrix web client, it can be replaced with other web client clients like [Cinny](https://cinny.in/)
 
 Alternative stacks:
-- Remove Dex, use old LDAP integration [matrix-synapse-ldap3](https://github.com/matrix-org/matrix-synapse-ldap3) (currently deprecated
-)
 - Use [MAS](https://element-hq.github.io/matrix-authentication-service/) to add more authentication methods (SAML, OIDC, LDAP, etc.) and integrate with [authentik](https://goauthentik.io/) [1](https://integrations.goauthentik.io/chat-communication-collaboration/matrix-synapse/) [2](https://element-hq.github.io/matrix-authentication-service/setup/sso.html#authentik)
 
 ### To be done
 
 If the current stack will be used, the following must be made.
 
-Dex:
-- export preferred user name from LDAP to synapse (currently Dex exports only email and username)
-- add support for LDAP groups (currently Dex exports only users)
-
 NethVoice CTI integration:
 - test current available client integrations
   - [Chatterbox](https://github.com/element-hq/chatterbox)
   - [Cactus](https://cactus.chat/)
   - Plain [Javascript SDK](https://github.com/matrix-org/matrix-js-sdk)
 - implement authentication, there 2 possible ways:
-  - add support for OIDC ID inside [CTI middleware](https://github.com/nethesis/nethcti-middleware): the user authenticate against the Oauth 2 provider (like Dex or authentik, if 2FA is required) and the middleware uses the ID token to authenticate against Synapse with the obtained token
+  - add support for OIDC ID inside [CTI middleware](https://github.com/nethesis/nethcti-middleware): the user authenticate against the Oauth 2 provider (like authentik, if 2FA is required) and the middleware uses the ID token to authenticate against Synapse with the obtained token
   - use normal LDAP auhtentication: the CTI middleware takes care also to authenticate against Synapse using LDAP credentials
 
 ### Future improvements

build-images.sh

@@ -37,10 +37,10 @@ buildah add "${container}" ui/dist /ui
 # Setup the entrypoint, ask to reserve three TCP ports and set a rootless container
 buildah config --entrypoint=/ \
     --label="org.nethserver.authorizations=traefik@node:routeadm cluster:accountconsumer" \
-    --label="org.nethserver.tcp-ports-demand=5" \
+    --label="org.nethserver.tcp-ports-demand=4" \
     --label="org.nethserver.rootfull=0" \
     --label="org.nethserver.max-per-node=1" \
-    --label="org.nethserver.images=ghcr.io/dexidp/dex:v2.44.0-alpine docker.io/postgres:14.19-alpine ghcr.io/element-hq/synapse:v1.138.2 ghcr.io/element-hq/element-web:v1.12.0 ghcr.io/cinnyapp/cinny:v4.10.2" \
+    --label="org.nethserver.images=docker.io/postgres:14.19-alpine ghcr.io/element-hq/synapse:v1.138.2 ghcr.io/element-hq/element-web:v1.12.0 ghcr.io/cinnyapp/cinny:v4.10.2" \
     "${container}"
 # Commit the image
 buildah commit "${container}" "${repobase}/${reponame}"

imageroot/actions/configure-module/20configure

@@ -18,7 +18,7 @@ synapse_domain_name = request.get('synapse_domain_name', '')
 element_domain_name = request.get('element_domain_name', '')
 cinny_domain_name = request.get('cinny_domain_name', '')
 lets_encrypt = request.get('lets_encrypt', False)
-dex_ldap_domain = request.get('dex_ldap_domain', '')
+ldap_domain = request.get('ldap_domain', '')
 mail_from = request.get('mail_from', '')
 
 if not synapse_domain_name:
@@ -35,19 +35,18 @@ else:
 env_vars['SYNAPSE_DOMAIN_NAME'] = synapse_domain_name
 env_vars['ELEMENT_DOMAIN_NAME'] = element_domain_name
 env_vars['CINNY_DOMAIN_NAME'] = cinny_domain_name
-env_vars['DEX_LDAP_DOMAIN'] = dex_ldap_domain
+env_vars['LDAP_DOMAIN'] = ldap_domain
 env_vars['MAIL_FROM'] = mail_from
 env_vars['LETS_ENCRYPT'] = '1' if lets_encrypt else '0'
 
 # Get allocated TCP ports from environment - NS8 allocates sequential ports
 tcp_ports = os.environ.get('TCP_PORTS', '20001').split(',')
 
 # Assign ports to services
-env_vars['DEX_PORT'] = tcp_ports[0]
-env_vars['SYNAPSE_PORT'] = tcp_ports[1]
-env_vars['ELEMENT_WEB_PORT'] = tcp_ports[2]
-env_vars['CINNY_PORT'] = tcp_ports[3]
-env_vars['POSTGRES_PORT'] = tcp_ports[4]
+env_vars['SYNAPSE_PORT'] = tcp_ports[0]
+env_vars['ELEMENT_WEB_PORT'] = tcp_ports[1]
+env_vars['CINNY_PORT'] = tcp_ports[2]
+env_vars['POSTGRES_PORT'] = tcp_ports[3]
 
 # Write updated configuration
 agent.write_envfile("config.env", env_vars)
@@ -70,21 +69,6 @@ response = agent.tasks.run(
 )
 agent.assert_exp(response['exit_code'] == 0)
 
-# Configure Traefik routes for Dex OIDC server using Synapse domain
-response = agent.tasks.run(
-    agent_id=agent.resolve_agent_id('traefik@node'),
-    action='set-route',
-    data={
-        'instance': os.environ['MODULE_ID'] + '-dex',
-        'url': 'http://127.0.0.1:' + env_vars['DEX_PORT'] + '/dex',
-        'host': synapse_domain_name,
-        'path': '/dex',
-        'http2https': True,
-        'lets_encrypt': lets_encrypt,
-    },
-)
-agent.assert_exp(response['exit_code'] == 0)
-
 # Configure Traefik routes for Element Web client
 if element_domain_name:
     response = agent.tasks.run(
@@ -132,4 +116,4 @@ else:
     )
 
 # Bind the new domain, overriding previous values (unbind)
-agent.bind_user_domains([dex_ldap_domain])
+agent.bind_user_domains([ldap_domain])

imageroot/actions/configure-module/80start_services

@@ -16,7 +16,6 @@ source config.env
 
 # Enable Matrix services
 systemctl --user enable postgresql.service
-systemctl --user enable dex.service
 systemctl --user enable synapse.service
 
 # Enable element web client when enabled in UI
@@ -37,7 +36,6 @@ systemctl --user enable matrix.service
 
 # Restart Matrix services
 systemctl --user restart postgresql.service
-systemctl --user restart dex.service
 systemctl --user restart synapse.service
 
 # Restart element web client when enabled in UI, else stop it

imageroot/actions/configure-module/validate-input.json

@@ -9,15 +9,15 @@
             "element_domain_name": "chat.example.com",
             "cinny_domain_name": "cinny.example.com",
             "lets_encrypt": true,
-            "dex_ldap_domain": "users.example.com",
+            "ldap_domain": "users.example.com",
             "mail_from": "noreply@example.com"
         }
     ],
     "type": "object",
     "required": [
         "synapse_domain_name",
         "lets_encrypt",
-        "dex_ldap_domain"
+        "ldap_domain"
     ],
     "properties": {
         "synapse_domain_name": {
@@ -54,9 +54,9 @@
             "type": "boolean",
             "description": "Enable Let's Encrypt certificate management"
         },
-        "dex_ldap_domain": {
+        "ldap_domain": {
             "type": "string",
-            "description": "LDAP domain name for Dex authentication (optional)",
+            "description": "LDAP domain name",
             "format": "domain-name"
         },
         "mail_from": {

imageroot/actions/get-configuration/20read

@@ -31,7 +31,7 @@ if os.path.exists("config.env"):
     config['synapse_domain_name'] = env_vars.get('SYNAPSE_DOMAIN_NAME', '')
     config['element_domain_name'] = env_vars.get('ELEMENT_DOMAIN_NAME', '')
     config['cinny_domain_name'] = env_vars.get('CINNY_DOMAIN_NAME', '')
-    config['dex_ldap_domain'] = env_vars.get('DEX_LDAP_DOMAIN', '')
+    config['ldap_domain'] = env_vars.get('LDAP_DOMAIN', '')
     config['mail_from'] = env_vars.get('MAIL_FROM', '')
     config['lets_encrypt'] = env_vars.get('LETS_ENCRYPT', '0') == '1'
     config['domains_list'] = domains
@@ -40,7 +40,7 @@ else:
     config['synapse_domain_name'] = ''
     config['element_domain_name'] = ''
     config['cinny_domain_name'] = ''
-    config['dex_ldap_domain'] = ''
+    config['ldap_domain'] = ''
     config['mail_from'] = ''
     config['lets_encrypt'] = False
     config['domains_list'] = domains

imageroot/actions/get-configuration/validate-output.json

@@ -9,7 +9,7 @@
             "element_domain_name": "chat.example.com",
             "cinny_domain_name": "cinny.example.com",
             "lets_encrypt": true,
-            "dex_ldap_domain": "users.example.com",
+            "ldap_domain": "users.example.com",
             "mail_from": "noreply@example.com"
         }
     ],
@@ -31,9 +31,9 @@
             "type": "boolean",
             "description": "Enable Let's Encrypt certificate management"
         },
-        "dex_ldap_domain": {
+        "ldap_domain": {
             "type": "string",
-            "description": "LDAP domain name for Dex authentication (optional)",
+            "description": "LDAP domain name",
             "format": "domain-name"
         },
         "mail_from": {

imageroot/bin/configure-matrix

@@ -60,21 +60,13 @@ smarthost_env = agent.read_envfile("smarthost.env")
 env_vars.update(smarthost_env)
 
 # Create configuration directories
-os.makedirs('dex-config', exist_ok=True)
 os.makedirs('synapse-config', exist_ok=True)
 os.makedirs('element-config', exist_ok=True)
 os.makedirs('cinny-config', exist_ok=True)
 
 # Template directory
 template_dir = '../templates'
 
-# Process Dex configuration
-with open(f'{template_dir}/dex-config.yaml', 'r') as f:
-    dex_config = substitute_env_vars(f.read(), env_vars)
-
-with open('dex-config/config.yaml', 'w') as f:
-    f.write(dex_config)
-
 # Process Synapse configuration
 with open(f'{template_dir}/synapse-homeserver.yaml', 'r') as f:
     synapse_config = substitute_env_vars(f.read(), env_vars)

imageroot/bin/discover-ldap

@@ -18,7 +18,7 @@ if os.path.exists("config.env"):
 else:
     config = {}
 
-udomname = config.get('DEX_LDAP_DOMAIN','')
+udomname = config.get('LDAP_DOMAIN','')
 
 try:
     odom = Ldapproxy().get_domain(udomname)
@@ -32,44 +32,34 @@ except:
         'port': 20000,
         'schema': 'rfc2307',
         'location': 'internal',
-        'base_dn': 'dc=dex,dc=invalid',
-        'bind_dn': 'cn=example,dc=dex,dc=invalid',
+        'base_dn': 'dc=synapse,dc=invalid',
+        'bind_dn': 'cn=example,dc=synapse,dc=invalid',
         'bind_password': 'invalid',
     }
 
 tmpfile = "ldap.env." + str(os.getpid())
 
 if odom['schema'] == "rfc2307":
     with open(tmpfile, "w") as denv:
-        print('DEX_LDAP_ID=ldap', file=denv)
-        print('DEX_LDAP_NAME=LDAP', file=denv)
-        print('DEX_LDAP_PORT=' + str(odom['port']), file=denv)
-        print('DEX_LDAP_BIND_DN=' + odom['bind_dn'], file=denv)
-        print('DEX_LDAP_HOST=' + odom['host'], file=denv)
-        print('DEX_LDAP_BIND_PASSWORD=' + odom['bind_password'], file=denv)
-        print('DEX_LDAP_SCHEMA=' + odom['schema'], file=denv)
-        print('DEX_LDAP_BASE_DN=' + odom['base_dn'], file=denv)
-        print('DEX_LDAP_USER_FILTER=(objectClass=inetOrgPerson)', file=denv)
-        print('DEX_LDAP_USERNAME=uid', file=denv)
-        print('DEX_LDAP_ID_ATTR=uid', file=denv)
-        print('DEX_LDAP_EMAIL_ATTR=mail', file=denv)
-        print('DEX_LDAP_NAME_ATTR=cn', file=denv)
-        print('DEX_LDAP_GROUP_FILTER=(objectClass=groupOfNames)', file=denv)
+        print('LDAP_PORT=' + str(odom['port']), file=denv)
+        print('LDAP_BIND_DN=' + odom['bind_dn'], file=denv)
+        print('LDAP_HOST=' + odom['host'], file=denv)
+        print('LDAP_BIND_PASSWORD=' + odom['bind_password'], file=denv)
+        print('LDAP_SCHEMA=' + odom['schema'], file=denv)
+        print('LDAP_BASE_DN=ou=people,' + odom['base_dn'], file=denv)
+        print('LDAP_USERNAME=uid', file=denv)
+        print('LDAP_EMAIL_ATTR=mail', file=denv)
+        print('LDAP_NAME_ATTR=cn', file=denv)
 elif odom['schema'] == "ad":
     with open(tmpfile, "w") as denv:
-        print('DEX_LDAP_ID=ad', file=denv)
-        print('DEX_LDAP_NAME=ActiveDirectory', file=denv)
-        print('DEX_LDAP_PORT=' + str(odom['port']), file=denv)
-        print('DEX_LDAP_BIND_DN=' + odom['bind_dn'], file=denv)
-        print('DEX_LDAP_HOST=' + odom['host'], file=denv)
-        print('DEX_LDAP_BIND_PASSWORD=' + odom['bind_password'], file=denv)
-        print('DEX_LDAP_SCHEMA=' + odom['schema'], file=denv)
-        print('DEX_LDAP_BASE_DN=' + odom['base_dn'], file=denv)
-        print('DEX_LDAP_USER_FILTER=(objectClass=person)', file=denv)
-        print('DEX_LDAP_USERNAME=cn', file=denv)
-        print('DEX_LDAP_ID_ATTR=cn', file=denv)
-        print('DEX_LDAP_EMAIL_ATTR=mail', file=denv)
-        print('DEX_LDAP_NAME_ATTR=cn', file=denv)
-        print('DEX_LDAP_GROUP_FILTER=(objectClass=group)', file=denv)
+        print('LDAP_PORT=' + str(odom['port']), file=denv)
+        print('LDAP_BIND_DN=' + odom['bind_dn'], file=denv)
+        print('LDAP_HOST=' + odom['host'], file=denv)
+        print('LDAP_BIND_PASSWORD=' + odom['bind_password'], file=denv)
+        print('LDAP_SCHEMA=' + odom['schema'], file=denv)
+        print('LDAP_BASE_DN=cn=Users,' + odom['base_dn'], file=denv)
+        print('LDAP_USERNAME=cn', file=denv)
+        print('LDAP_EMAIL_ATTR=mail', file=denv)
+        print('LDAP_NAME_ATTR=cn', file=denv)
 
 os.replace(tmpfile, "ldap.env")

imageroot/etc/state-include.conf

@@ -2,5 +2,4 @@ state/postgresql.pg_dump
 state/database.env
 state/config.json
 
-volumes/dex-data
 volumes/synapse-data