Functional configuration

This document addresses the available functional configuration options of an openDesk deployment.

Supported functional configuration

While the openDesk applications allow a wide range of configuration options, only a small subset of them are supported by openDesk. This subset can be found in helmfile/environments/default/functional.yaml.gotmpl

The following categories are available. Each category contains a set of options to tailor your openDesk deployment to your needs. Please find the actual options including inline documentation in functional.yaml.gotmpl itself.

• Administrative options (functional.admin.*): Options affecting the IAM administrator role (users that are member of the LDAP group Domain Admins) of openDesk.
• Authentication options (functional.authentication.*): Authentication related settings, e.g. define additional OIDC clients or scopes.
• External Services options (functional.externalServices.*): Settings controlling externally available services like APIs.
• Filestore options (functional.filestore.*): Configuration options for the filestore component of openDesk, like default storage quota or file sharing options.
• Data Protection options (functional.dataProtection.*): Data protection related settings.
• Portal options (functional.portal.*): Options to customize the openDesk portal, e.g. if the login dialog should be enforced.
• Chat options (functional.chat.*): Configuration options for the chat component of openDesk.
• Migration options (functional.migration.*): Helpful setting(s) for migration scenarios.
• Groupware options (functional.groupware.*): Options to customize Open-Xchange and mail settings, e.g. mail quota.

Individual user quotas

The default quotas in functional.groupware.quota and functional.filestore.quota apply to all users without an individual quota. Administrators can set an individual quota per user in the IAM on the user’s openDesk tab:

Clearing a field returns the user to the default quota. Changes become effective:

• Mail: with the user’s next login and mail delivery once Dovecot’s authentication cache expired (TTL equals functional.authentication.realmSettings.accessTokenLifespan). Run doveadm auth cache flush in the Dovecot Pod to apply them immediately.
• Files: for users Nextcloud does not know yet, with their first login, as Nextcloud reads their LDAP attributes at that point. For users Nextcloud already knows, with its next LDAP background sync, which Nextcloud schedules every 30 minutes up to every 12 hours depending on the number of users; a login does not re-read the quota of a known user. Run occ ldap:check-user --update <user> in the Nextcloud Pod to apply it immediately, <user> being the user’s univentionObjectIdentifier.

Customization of functional options

In case the options from functional.yaml.gotmpl are not sufficient, you might want to look into customization.yaml.gotmpl. The customizations give you control over all templating that is being done in openDesk, but be aware it is an unsupported approach, so in case you have a strong need for customizations, please let us know by opening a ticket. We will check if it is a use case that can be supported by implementing it as part of the aforementioned functional.yaml.gotmpl.