Have mailcow auto-import keycloak users

[m]

this is mostly a tracking ticket with a better-named title, fixes/related: #873, #732

mailcow says this is possible: ​https://docs.mailcow.email/manual-guides/mailcow-UI/u_e-mailcow_ui-keycloak/#automatic-user-provisioning

​https://mail.devhack.net/admin/dashboard > logs > crontasks reports issues on imports (although the last ones were in september, 1.5 months ago)

​https://mail.devhack.net/admin/system > access > identity providers does have import users / periodic full sync on a 15min interval

[m]

​https://community.mailcow.email/d/1841-manage-users-sogo-set-forwarding-settings

[m]

looks like the keycloak sync ofelia cronjobs are getting stuck somehow?

[m]

​https://mailcow.email/posts/2023/mailcow-idp/#ldap

[m]

okay so I'm getting a bit off-track, there was a successful hardcoded claim mapping mailcow_template to default, although mailcow wasn't setting that to any templates within itself

I've created a new claim mapping though to try to take advantage of groups: ​https://idp.devhack.net/admin/devhack/console/#/devhack/clients/7ed75e28-faad-478b-a3be-beefbe38c414/clientScopes/dedicated/mappers/a52b1b92-cb15-4bf2-ae80-8ce020efb206/edit

scopes for mailcow-dedicated: ​https://idp.devhack.net/admin/devhack/console/#/devhack/clients/7ed75e28-faad-478b-a3be-beefbe38c414/clientScopes/dedicated

it doesn't seem to be sticking though, I even created a mailcow_template user attribute: ​https://idp.devhack.net/admin/devhack/console/#/devhack/realm-settings/user-profile/attributes/mailcow_template/edit-attribute

[m]

keycloak says groups are inherited: ​https://docs.redhat.com/en/documentation/red_hat_build_of_keycloak/22.0/html/server_administration_guide/assigning_permissions_using_roles_and_groups#proc-managing-groups_server_administration_guide

​https://groups.google.com/g/keycloak-user/c/MGKY3rI--E4

[m]

okay I don't think the claim mapping scopes are actually doing anything. I've modified keycloak-sync.php to print things out with:

    $user_template = $user['attributes']['mailcow_template'][0];
    foreach ($user['attributes'] as $key => $value) {
        echo "$key: ";
       
        if (is_array($value)) {
            echo implode(", ", $value);
        } else {
            echo $value;
        }
                                           
        echo "\n";                                                            
    }

and yeah it's only giving me this over and over again:

mailcow_email: zack_testuser@devhack.net
LDAP_ENTRY_DN: uid=zack_testuser,cn=users,cn=accounts,dc=devhack,dc=net
createTimestamp: 20240816181407Z
modifyTimestamp: 20240816182000Z
LDAP_ID: 5428c78c-5bfb-11ef-8836-bc2411a1700c

so yeah somehow mailcow_email is getting added to the attributes but literally nothing else. and it's pulling the email from the account again without our patches

[m]

yeah, it looks like mailcow is pulling straight from keycloak api and not through oidc stuff. and not pulling from group attributes. might require a patch.