Remove ldap caching and move to the Zitadel v2 API

.github/workflows/release.yml

@@ -39,7 +39,7 @@ jobs:
           gitlab_pass: ${{ secrets.GITLAB_PASS }}
 
       - name: Caching
-        uses: Swatinem/rust-cache@b8a6852b4f997182bdea832df3f9e153038b5191
+        uses: Swatinem/rust-cache@68b3cb7503c78e67dae8373749990a220eb65352
         with:
           cache-on-failure: true
           cache-all-crates: true
@@ -87,7 +87,7 @@ jobs:
           gitlab_pass: ${{ secrets.GITLAB_PASS }}
 
       - name: Caching
-        uses: Swatinem/rust-cache@b8a6852b4f997182bdea832df3f9e153038b5191
+        uses: Swatinem/rust-cache@68b3cb7503c78e67dae8373749990a220eb65352
         with:
           cache-on-failure: true
           cache-all-crates: true

Cargo.toml

@@ -9,7 +9,6 @@ publish = false
 anyhow = { version = "1.0.81", features = ["backtrace"] }
 async-trait = "0.1.82"
 base64 = "0.22.1"
-bincode = "1.3.3"
 chrono = "0.4.19"
 config = { version = "0.14.0" }
 http = "1.1.0"
@@ -27,6 +26,10 @@ zitadel-rust-client = { git = "https://github.com/famedly/zitadel-rust-client",
 wiremock = "0.6.2"
 csv = "1.3.0"
 tempfile = "3.12.0"
+futures = "0.3.31"
+ldap3 = { version = "0.11.1", default-features = false, features = ["tls-native"] }
+native-tls = "0.2.12"
+hex = "0.4.3"
 
 [dependencies.tonic]
 version = "*"

README.md

@@ -143,17 +143,14 @@ kubectl create configmap --from-file config.yaml famedly-sync --namespace ldap-s
 
 ## Quirks & Edge Cases
 
+- When Setting up SSO, note that Zitadel's ldap filter must be
+  configured to resolve the "username" as the user's email address for
+  our IDP links to work.
 - Changing a user's LDAP id (the attribute from the `user_id` setting)
   is unsupported, as this is used to identify the user on the Zitadel
   end.
 - Disabling a user on the LDAP side (with `status`) results in the
   user being deleted from Zitadel.
-- Providing multiple values for an LDAP attribute is not supported.
-- Zitadel's API is not fully atomic; if a request fails, a user may
-  not be fully created and still not be functional even if the tool is
-  re-used.
-  - In particular, the matrix localpart, the preferred user name, and
-    whether the user has permissions to use Famedly may not be synced.
 - If a user's email or phone number changes, they will only be
   prompted to verify it if the tool is configured to make users verify
   them.

sample-configs/csv-config.sample.yaml

@@ -0,0 +1,30 @@
+# Configuration for Famedly's Zitadel - has to be provided by Famedly
+zitadel:
+  # The Famedly user endpoint to sync to.
+  url: https://auth.famedly.de
+  # The Famedly-provided service user credentials.
+  key_file: /opt/famedly-sync-agent/service-user.json
+  # The organization whose users to sync.
+  organization_id: 278274756195721220
+  # The project to grant users access to.
+  project_id: 278274945274880004
+  # The identity provider ID to enable SSO login for
+  idp_id: 281430143275106308
+
+feature_flags:
+  - verify_email      # Whether to ask users to verify their email addresses post sync
+  - verify_phone      # Whether to ask users to verify their phone numbers post sync
+  # - sso_login       # Whether to enable SSO login - Please note that his has some drawbacks and limitations, see the help center article for more information
+  # - dry_run         # Disable syncing users to Zitadel - Intended to ensure syncs are working before productive deployment
+  # - deactivate_only # Only deactivate users, do not create or update them.
+
+# Configuration for the sources to sync from.
+sources:
+  # Configuration for the CSV sources
+  # Updates Zitadel to match the CSV file.
+  #! DANGER: This will delete all users that are not in the CSV file!
+  csv:
+    # Path to the CSV file to read from.
+    # Expected structure of the CSV file is as follows:
+    # email,first_name,last_name,phone
+    file_path:  ./tests/environment/files/test-users.csv

config.sample.yaml → sample-configs/ldap-config.sample.yaml

@@ -16,7 +16,7 @@ feature_flags:
   - verify_phone      # Whether to ask users to verify their phone numbers post sync
   # - sso_login       # Whether to enable SSO login - Please note that his has some drawbacks and limitations, see the help center article for more information
   # - dry_run         # Disable syncing users to Zitadel - Intended to ensure syncs are working before productive deployment
-  # - deactivate_only # Only deactivate users, do not create or update them. Keep in mind LDAP is cached and all the changes made on LDAP will be written to the cache as if they where applied. Therefore, only the deactivation changes will be applied to Zitadel but **all the other changes will be lost**.
+  # - deactivate_only # Only deactivate users, do not create or update them.
 
 # Configuration for the sources to sync from.
 sources:
@@ -87,31 +87,3 @@ sources:
       # needed with the `ldaps` scheme, as the server will already be
       # hosting TLS.
       danger_use_start_tls: false
-
-    # Path to the file that keeps track of previously synced LDAP entries.
-    # This file should be persisted, otherwise users may become out of sync.
-    cache_path: /opt/famedly-sync-agent/famedly-sync.cache
-
-  # Configuration for the UKT source - a custom endpoint provided by UKT,
-  # which gives a list of emails of users that should be deleted from Zitadel.
-  ukt:
-    # Endpoint URL to fetch the list of users from.
-    endpoint_url: https://list.example.invalid/usersync4chat/maillist
-    # OAuth2 URL to fetch the token from.
-    oauth2_url: https://list.example.invalid/token
-    # Client ID
-    client_id: mock_client_id
-    # Client Secret
-    client_secret: mock_client_secret
-    # Scope of what to fetch
-    scope: "openid read-maillist"
-    # Grant type
-    grant_type: client_credentials
-
-  # Configuration for the CSV source - reads a CSV file
-  # and creates **new** users in Famedly's Zitadel.
-  # Expected structure of the CSV file is as follows:
-  # email,first_name,last_name,phone
-  csv:
-    # Path to the CSV file to read from.
-    file_path:  ./tests/environment/files/test-users.csv