Add support for resetting IDM service user passwords

[yihanwu1024]

Is your feature request related to a problem? Please describe.

I would like to rotate the IDM service user passwords more easily.

Describe the solution you'd like

It should ideally be done through ocis idm resetpassword. The current implementation of this command wraps any username in the template uid={},ou=users,o=libregraph-idm. This makes it impossible to specify service users, which have the template uid={},ou=sysusers,o=libregraph-idm. There should be an option for me to specify service users, by changing the wrapping template, or supplying the full DN.

[yihanwu1024]

According to https://doc.owncloud.com/ocis/next/deployment/services/s-list/idm.html, there are environment variables for these passwords, but they appear to be only used for initialization, not any subsequent startup (my experiment.) This may be a bug. If I am correct about the oCIS architecture, the service user passwords should not even appear in the persistent IDM database.

[paul43210]

PR #12118 adds a --service-user flag to ocis idm resetpassword so you can target service accounts in ou=sysusers:

ocis idm resetpassword -u reva --service-user

Regarding your comment about env vars (IDM_SVC_PASSWORD, etc.) only being used at init — that's correct. They're consumed during the initial bootstrap in server.go to populate the LDAP database, but on subsequent starts the IDM service reads credentials from the BoltDB database directly. This is by design since IDM is the LDAP store itself, but it does mean password rotation requires either this CLI tool or direct LDAP operations.

[yihanwu1024]

The inconsistency I pointed out is: no other service persists its service accounts.

Is there a plan to address this inconsistency?