Terraform: adding new groups fail

[imyller]

Terraform: adding new groups fail

[nitnelave]

Creating groups via LDAP is not yet supported.

[nitnelave]

Hey @ibizaman ! This issue is not in my roadmap for now, and anyway I have precious little time these days (I don't spend as much time on LLDAP as I'd like!)
If you were to tackle it, it should be a nice task for a new contributor. The infrastructure is already in place, the only thing to do is to map the LDAP message to the internal group creation. And we already have something in place for users, so there's a template you can follow.

Regarding declaring the groups in a config file, I'm not convinced:

• is it only for first time setup?
• is it a complete list of groups, or just a minimum? What if one of the groups gets deleted?
• in case of a HA setup, which node does the initialization?

There are several answers to these questions, and not everyone will agree on them.

This sounds like extra logic that doesn't really belong in the LLDAP project. With the API (either the existing graphql or through LLDAP if you add it) it's easy to write a script implementing that logic. It could be part of the entry point.

That said, I'd be willing to provide in the repo a script that loads users/groups from a config file if you want to write that. The best would probably be to write it in rust, to have the same language throughout the repo, be able to share code and minimize the dependencies.

[ddiawara]

others way to do it ?

[nitnelave]

No automatic way, you would have to create the groups manually on the web interface (or script it via the graphql API)

[ibizaman]

@nitnelave is this planned or wanted? I don't have any idea when but it's something I'd be comfortable tackling. I'd also be happy to discuss any architectural considerations before implementing something like this. Btw, I'd like to be able to declare groups declaratively through the configuration file.

[ibizaman]

About loading from a config file, I was thinking about deploying code with NixOS which as you may know is declarative and have a list of groups defined in NixOS. But having a second binary talking to the API works too.

Thanks for the explanation of how to implement this. It makes sense indeed.