Shelf

# Local Shibboleth v5 test IdP for the Shelf Supabase SAML SSO integration.
# See README.md for the full runbook (up/down, test users, attribute-release
# verification via aacli.sh, metadata export).
#
# NOTE ON IMAGE CHOICE: the original brief suggested vegardit/openldap, but its
# actual bootstrap env vars (LDAP_INIT_ORG_DN, LDAP_INIT_ROOT_USER_DN, etc.) are
# a different shape entirely from what was assumed. osixia/openldap turned out
# to be genuinely multi-arch (arm64/v8 manifest verified + booted natively on
# this arm64 Mac) and matches the LDAP_ORGANISATION/LDAP_DOMAIN/LDAP_ADMIN_PASSWORD
# + --copy-service + custom-LDIF-bootstrap-path conventions the brief described,
# so it's used here instead (verified working, not merely assumed).
services:
  ldap:
    image: osixia/openldap:1.5.0
    environment:
      LDAP_ORGANISATION: "IdP Test Bed"
      LDAP_DOMAIN: "idptestbed"
      # Matches the idp.authn.LDAP.bindDNCredential baked into the Shibboleth
      # image's credentials/secrets.properties (see idp-home/conf/ldap.properties
      # for why we don't override that property from conf/ instead).
# ...