# =============================================================================
# Trino — LDAP Group Provider
# =============================================================================
# Grup user di-resolve dari OpenLDAP (source of truth grup). User Trino
# = preferred_username dari Keycloak (lihat config.properties principal-field).
# Nama grup yang dikembalikan = cn (mis. data-admin, data-engineer, ...),
# lalu dicocokkan dengan data.roles.<grup> di config/opa/data.json.
# =============================================================================

group-provider.name=ldap

# Alamat LDAP dari environment (LDAP_URL) supaya bisa diarahkan ke LDAP EXISTING.
# Default compose: ldap://openldap:389 (container lokal).
ldap.url=${ENV:LDAP_URL}
ldap.allow-insecure=true
# DN akun BIND (bukan harus admin): boleh akun read-only dgn hak baca ke ou=users/ou=groups.
# Diarahkan dari .env (LDAP_ADMIN_DN) supaya LDAP EXISTING dgn bind DN berbeda bisa dipakai.
# Env-nya WAJIB diteruskan ke container (lihat docker-compose.yml trino-coordinator).
ldap.admin-user=${ENV:LDAP_ADMIN_DN}
ldap.admin-password=${ENV:LDAP_ADMIN_PASSWORD}
ldap.user-base-dn=ou=users,dc=sicabe,dc=local
ldap.user-search-filter=(uid={0})
ldap.group-name-attribute=cn

# Filtering mode: cari group di ou=groups yg member-nya = DN user
ldap.use-group-filter=true
ldap.group-base-dn=ou=groups,dc=sicabe,dc=local
ldap.group-search-member-attribute=member