Fix ldap root

Author: EugenMayer

Dockerfile

@@ -3,11 +3,13 @@ FROM bitnami/openldap:2.6
 ARG TEMPLATE_PATH=./data-template-type1-static.ldif
 ARG CERTS_PATH=./tls/certs
 
-ARG $LDAP_ROOT=example.org
+ARG LDAP_ROOT=example.org
 
 ENV LDAP_ADMIN_PASSWORD="admin"
 ENV LDAP_ROOT=$LDAP_ROOT
 ENV BITNAMI_DEBUG=true
+ENV LDAP_ADMIN_USER=admin
+ENV LDAP_ADMIN_PASSWORD=admin
 
 # TLS setup
 ENV LDAP_ENABLE_TLS=yes
@@ -21,5 +23,15 @@ COPY $CERTS_PATH/tls.key /opt/bitnami/openldap/certs/openldap.key
 COPY $CERTS_PATH/ca.crt /opt/bitnami/openldap/certs/openldapCA.crt
 
 # bootstrap setup
-COPY $TEMPLATE_PATH /ldifs/50-bootstrap.ldif
-COPY ./ldif/schema/bitnami/memberOf.ldif /schemas/memberOf.ldif
+COPY $TEMPLATE_PATH /ldifs/01-bootstrap.ldif
+COPY ./ldif/schema/bitnami/memberOf.ldif /schemas/60-memberOf.ldif
+
+USER root
+RUN chown 1001:1001 \
+   /opt/bitnami/openldap/certs/openldapCA.crt \
+   /opt/bitnami/openldap/certs/openldap.key \
+   /opt/bitnami/openldap/certs/openldap.crt \
+   /ldifs/01-bootstrap.ldif \
+   /schemas/60-memberOf.ldif \
+   && chmod 400 /opt/bitnami/openldap/certs/openldap.key
+USER 1001

docker-compose.yml

@@ -39,6 +39,7 @@ services:
       LDAP_USERS: 'readonly'
       LDAP_PASSWORDS: 'readonly'
       LDAP_CONFIG_ADMIN_ENABLED: "yes"
+      BITNAMI_DEBUG: true
 #      LDAP_ENABLE_PROXYPROTO: "yes"
 #      LDAP_PROXYPROTO_PORT_NUMBER: 30389
 #      LDAP_PROXYPROTO_LDAPS_PORT_NUMBER: 30636
@@ -77,6 +78,7 @@ services:
       LDAP_TLS_CERT_FILE: /opt/bitnami/openldap/certs/openldap.crt
       LDAP_TLS_KEY_FILE: /opt/bitnami/openldap/certs/openldap.key
       LDAP_TLS_CA_FILE: /opt/bitnami/openldap/certs/openldapCA.crt
+      BITNAMI_DEBUG: true
   ######### LEGACY ############
   osixia_ldap1:
     image: osixia/openldap:1.5.0

tls/generate-certs.sh

@@ -28,7 +28,9 @@ [email protected]
 
 # Create our SSL directory
 # in case it doesn't exist
-sudo rm certs -fr
+if [ $DO_CHANGEOWN == "yes" ]; then
+  sudo rm certs -fr
+fi
 mkdir -p "$SSL_DIR"
 
 # Generate our Private Key, CSR and Certificate
@@ -40,8 +42,8 @@ openssl x509 -req -days 1825 -in ${SSL_DIR}/cert.csr -CA ${SSL_DIR}/ca.crt -CAke
 
 # this is the user the container runs openldap as
 if [ $DO_CHANGEOWN == "yes" ]; then
-  chown 1001:1001 $SSL_DIR/*
-  chmod 400 $SSL_DIR/tls.key
+  sudo chown 1001:1001 $SSL_DIR/*
+  sudo chmod 400 $SSL_DIR/tls.key
 fi