Skip to content

Commit 337d184

Browse files
bjoribjori
committed
PHPC-103: Virtualize OpenLDAP server using CentOS
1 parent 01d4f92 commit 337d184

File tree

11 files changed

+331
-0
lines changed

11 files changed

+331
-0
lines changed

‎Vagrantfile

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,8 +23,18 @@ Vagrant.configure(2) do |config|
2323
mo.vm.provision "shell", path: "scripts/ubuntu/mongo-orchestration.sh"
2424
end
2525

26+
config.vm.define "ldap", autostart: false do |ldap|
27+
ldap.vm.network "private_network", ip: "192.168.112.20"
2628

29+
ldap.vm.box = "http://puppet-vagrant-boxes.puppetlabs.com/centos-64-x64-vbox4210-nocm.box"
30+
ldap.vm.provider "vmware_workstation" do |vmware, override|
31+
override.vm.box_url = "https://dl.dropbox.com/u/5721940/vagrant-boxes/vagrant-centos-6.4-x86_64-vmware_fusion.box"
32+
end
2733

34+
ldap.vm.provision "shell", path: "scripts/centos/essentials.sh"
35+
#ldap.vm.provision "shell", path: "scripts/centos/mongo-orchestration.sh"
36+
ldap.vm.provision "shell", path: "scripts/centos/ldap/install.sh"
37+
end
2838

2939
end
3040

‎scripts/centos/essentials.sh

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
# Tools you can't live without
2+
sudo yum install -y git vim
3+
4+
5+
# I can't stand emacs
6+
echo 'set -o vi' | sudo tee /etc/profile.d/vishell.sh
7+
8+
# Who knows how to configure RHEL at all anyway?
9+
sudo service iptables stop
10+
sudo chkconfig iptables off

‎scripts/centos/ldap/Domain.ldif

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
dn: dc=10gen,dc=me
2+
objectClass: dcObject
3+
objectClass: organization
4+
dc: 10gen
5+
o : 10gen

‎scripts/centos/ldap/Users.ldif

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
dn: ou=Users,dc=10gen,dc=me
2+
ou: Users
3+
objectClass: organizationalUnit

‎scripts/centos/ldap/basics.ldif

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
dn: dc=10gen,dc=me
2+
objectclass: dcObject
3+
objectclass: organization
4+
o: MongoDB
5+
dc: 10gen
6+
7+
dn: cn=Manager,dc=10gen,dc=me
8+
objectclass: organizationalRole
9+
cn: Manager
10+

‎scripts/centos/ldap/install.sh

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
yum -y update
2+
yum -y install epel-release
3+
yum -y install openldap-servers openldap-clients openldap-devel python-devel gcc cyrus-sasl-plain xfsprogs net-snmp ps-misc wget python-pip python-ldap
4+
5+
service slapd stop
6+
service slapd start
7+
#just in case
8+
sleep 10
9+
10+
ldapadd -Y EXTERNAL -H ldapi:/// -f /phongo/scripts/centos/ldap/pw.ldif
11+
# Add our specifics
12+
ldapadd -x -D "cn=Manager,dc=10gen,dc=me" -w password -f /phongo/scripts/centos/ldap/Domain.ldif
13+
ldapadd -x -D "cn=Manager,dc=10gen,dc=me" -w password -f /phongo/scripts/centos/ldap/Users.ldif
14+
15+
# Add the users
16+
python /phongo/scripts/centos/ldap/ldapconfig.py -f /phongo/scripts/centos/ldap/users
17+
18+
# setup saslauthd
19+
#sed -i 's/MECH=pam/MECH=ldap/' /etc/sysconfig/saslauthd
20+
#cp /phongo/scripts/centos/ldap/saslauthd.conf /etc/
21+
#service saslauthd start
22+
23+
testsaslauthd -u bugs -p password -s mongod -f /var/run/saslauthd/mux
24+
#Show your work!
25+
ldapsearch -x -LLL -b dc=10gen,dc=me
26+
ldapsearch -x -b '' -s base '(objectclass=*)' namingContexts
27+
28+
#Set up mongod.conf
29+
#echo "auth=true" >> /home/phongo/scripts/centos/ldap/mongod.conf
30+
#echo "setParameter=saslauthdPath=/var/run/saslauthd/mux" >> /home/phongo/scripts/centos/ldap/mongod.conf
31+
#echo "setParameter=authenticationMechanisms=PLAIN" >> /home/phongo/scripts/centos/ldap/mongod.conf

‎scripts/centos/ldap/ldapconfig.py

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
#!/usr/bin/python
2+
3+
import optparse
4+
import ldap
5+
import ldap.modlist as modlist
6+
7+
def main():
8+
parser = optparse.OptionParser(usage="""\
9+
%prog [options]
10+
Add users to LDAP """)
11+
12+
# add in command line options. Add mongo host/port combo later
13+
parser.add_option("-f", "--filename", dest="fname",
14+
help="name of file with user names",
15+
default=None)
16+
17+
(options, args) = parser.parse_args()
18+
19+
if options.fname is None:
20+
print "\nERROR: Must specify name of file to import\n"
21+
sys.exit(-1)
22+
23+
# Open a connection
24+
l = ldap.initialize("ldap://localhost")
25+
26+
# Bind/authenticate with a user with apropriate rights to add objects
27+
l.simple_bind_s("cn=Manager,dc=10gen,dc=me","password")
28+
29+
for uname in open(options.fname, 'r'):
30+
try:
31+
# The dn of our new entry/object
32+
print "adding ", uname
33+
dn= 'uid=' + uname.lower() + ',ou=Users,dc=10gen,dc=me'
34+
35+
ldif = configUser(uname.rstrip('\r\n'))
36+
37+
# Do the actual synchronous add-operation to the ldapserver
38+
l.add_s(dn,ldif)
39+
except ldap.LDAPError, e:
40+
print e.message['info']
41+
42+
# Its nice to the server to disconnect and free resources when done
43+
l.unbind_s()
44+
45+
# Do the tld configuration for the ldap tree
46+
def configDC():
47+
# A dict to help build the "body" of the object
48+
attrs = {}
49+
attrs['objectclass'] = ['organization','dcObject']
50+
attrs['dn'] = 'dc=10gen,dc=me'
51+
attrs['dc'] = '10gen'
52+
attrs['o'] = '10gen'
53+
# Convert our dict to nice syntax for the add-function using modlist
54+
ldif = modlist.addModlist(attrs)
55+
56+
def configOU():
57+
# A dict to help build the "body" of the object
58+
attrs = {}
59+
attrs['dn'] = 'dc=10gen,dc=me'
60+
attrs['objectclass'] = ['organiationalUnit']
61+
attrs['ou'] = 'Users'
62+
ldif = modlist.addModlist(attrs)
63+
64+
def configUser( uname ):
65+
attrs = {}
66+
# attrs['dn'] = ['cn=' + uname + 'ou=Users,dc=10gen,dc=me']
67+
attrs['cn'] = [uname]
68+
# attrs['uid'] = [uname]
69+
attrs['sn'] = 'TestUser'
70+
attrs['objectclass'] = ['inetOrgPerson']
71+
attrs['userPassword'] = 'password'
72+
return modlist.addModlist(attrs)
73+
74+
if __name__ == "__main__":
75+
main()

‎scripts/centos/ldap/mongod.ldif

Lines changed: 158 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,158 @@
1+
#
2+
# See slapd-config(5) for details on configuration options.
3+
# This file should NOT be world readable.
4+
#
5+
6+
dn: cn=config
7+
objectClass: olcGlobal
8+
cn: config
9+
olcArgsFile: /var/run/openldap/slapd.args
10+
olcPidFile: /var/run/openldap/slapd.pid
11+
#
12+
# TLS settings
13+
#
14+
olcTLSCACertificatePath: /etc/openldap/certs
15+
olcTLSCertificateFile: "OpenLDAP Server"
16+
olcTLSCertificateKeyFile: /etc/openldap/certs/password
17+
#
18+
# Do not enable referrals until AFTER you have a working directory
19+
# service AND an understanding of referrals.
20+
#
21+
#olcReferral: ldap://root.openldap.org
22+
#
23+
# Sample security restrictions
24+
# Require integrity protection (prevent hijacking)
25+
# Require 112-bit (3DES or better) encryption for updates
26+
# Require 64-bit encryption for simple bind
27+
#
28+
#olcSecurity: ssf=1 update_ssf=112 simple_bind=64
29+
30+
31+
#
32+
# Load dynamic backend modules:
33+
# - modulepath is architecture dependent value (32/64-bit system)
34+
# - back_sql.la backend requires openldap-servers-sql package
35+
# - dyngroup.la and dynlist.la cannot be used at the same time
36+
#
37+
38+
#dn: cn=module,cn=config
39+
#objectClass: olcModuleList
40+
#cn: module
41+
#olcModulepath: /usr/lib/openldap
42+
#olcModulepath: /usr/lib64/openldap
43+
#olcModuleload: accesslog.la
44+
#olcModuleload: auditlog.la
45+
#olcModuleload: back_dnssrv.la
46+
#olcModuleload: back_ldap.la
47+
#olcModuleload: back_mdb.la
48+
#olcModuleload: back_meta.la
49+
#olcModuleload: back_null.la
50+
#olcModuleload: back_passwd.la
51+
#olcModuleload: back_relay.la
52+
#olcModuleload: back_shell.la
53+
#olcModuleload: back_sock.la
54+
#olcModuleload: collect.la
55+
#olcModuleload: constraint.la
56+
#olcModuleload: dds.la
57+
#olcModuleload: deref.la
58+
#olcModuleload: dyngroup.la
59+
#olcModuleload: dynlist.la
60+
#olcModuleload: memberof.la
61+
#olcModuleload: pcache.la
62+
#olcModuleload: ppolicy.la
63+
#olcModuleload: refint.la
64+
#olcModuleload: retcode.la
65+
#olcModuleload: rwm.la
66+
#olcModuleload: seqmod.la
67+
#olcModuleload: smbk5pwd.la
68+
#olcModuleload: sssvlv.la
69+
#olcModuleload: syncprov.la
70+
#olcModuleload: translucent.la
71+
#olcModuleload: unique.la
72+
#olcModuleload: valsort.la
73+
74+
75+
#
76+
# Schema settings
77+
#
78+
79+
dn: cn=schema,cn=config
80+
objectClass: olcSchemaConfig
81+
cn: schema
82+
83+
include: file:///etc/openldap/schema/core.ldif
84+
include: file:///etc/openldap/schema/corba.schema
85+
include: file:///etc/openldap/schema/cosine.ldif
86+
include: file:///etc/openldap/schema/duaconf.schema
87+
include: file:///etc/openldap/schema/dyngroup.schema
88+
include: file:///etc/openldap/schema/inetorgperson.ldif
89+
include: file:///etc/openldap/schema/java.schema
90+
include: file:///etc/openldap/schema/misc.schema
91+
include: file:///etc/openldap/schema/nis.ldif
92+
include: file:///etc/openldap/schema/openldap.ldif
93+
include: file:///etc/openldap/schema/ppolicy.schema
94+
include: file:///etc/openldap/schema/collective.schema
95+
#
96+
# Frontend settings
97+
#
98+
99+
dn: olcDatabase=frontend,cn=config
100+
objectClass: olcDatabaseConfig
101+
olcDatabase: frontend
102+
#
103+
# Sample global access control policy:
104+
# Root DSE: allow anyone to read it
105+
# Subschema (sub)entry DSE: allow anyone to read it
106+
# Other DSEs:
107+
# Allow self write access
108+
# Allow authenticated users read access
109+
# Allow anonymous users to authenticate
110+
#
111+
#olcAccess: to dn.base="" by * read
112+
#olcAccess: to dn.base="cn=Subschema" by * read
113+
#olcAccess: to *
114+
# by self write
115+
# by users read
116+
# by anonymous auth
117+
#
118+
# if no access controls are present, the default policy
119+
# allows anyone and everyone to read anything but restricts
120+
# updates to rootdn. (e.g., "access to * by * read")
121+
#
122+
# rootdn can always read and write EVERYTHING!
123+
#
124+
125+
#
126+
# Configuration database
127+
#
128+
129+
dn: olcDatabase=config,cn=config
130+
objectClass: olcDatabaseConfig
131+
olcDatabase: config
132+
olcAccess: to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,c
133+
n=auth" manage by * none
134+
135+
#
136+
# Server status monitoring
137+
#
138+
139+
dn: olcDatabase=monitor,cn=config
140+
objectClass: olcDatabaseConfig
141+
olcDatabase: monitor
142+
olcAccess: to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,c
143+
n=auth" read by dn.base="cn=Manager,dc=10gen,dc=me" read by * none
144+
145+
#
146+
# Backend database definitions
147+
#
148+
149+
dn: olcDatabase=hdb,cn=config
150+
objectClass: olcDatabaseConfig
151+
objectClass: olcHdbConfig
152+
olcDatabase: hdb
153+
olcSuffix: dc=10gen,dc=me
154+
olcRootDN: cn=Manager,dc=10gen,dc=me
155+
olcRootPW: {SSHA}t3hTZGC4FTOS6AnTa76aX7HRtt1IDqFM
156+
olcDbDirectory: /var/lib/ldap
157+
olcDbIndex: objectClass eq,pres
158+
olcDbIndex: ou,cn,mail,surname,givenname eq,pres,sub

‎scripts/centos/ldap/pw.ldif

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
dn: olcDatabase={0}config,cn=config
2+
changetype: modify
3+
replace: olcRootPW
4+
olcRootPW: {SSHA}t3hTZGC4FTOS6AnTa76aX7HRtt1IDqFM
5+
-
6+
replace: olcRootDN
7+
olcRootDN: cn=Manager,dc=10gen,dc=me
8+
9+
dn: olcDatabase={2}bdb,cn=config
10+
changetype: modify
11+
replace: olcRootPW
12+
olcRootPW: {SSHA}t3hTZGC4FTOS6AnTa76aX7HRtt1IDqFM
13+
-
14+
replace: olcSuffix
15+
olcSuffix: dc=10gen,dc=me
16+
-
17+
replace: olcRootDN
18+
olcRootDN: cn=Manager,dc=10gen,dc=me
19+
20+
dn: olcDatabase={1}monitor,cn=config
21+
changetype: modify
22+
replace: olcAccess
23+
olcAccess: {0}to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read by dn.base="cn=Manager,dc=10gen,dc=me" read by * none

‎scripts/centos/ldap/saslauthd.conf

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
ldap_servers: ldap://localhost:389
2+
ldap_search_base: ou=Users,dc=10gen,dc=me
3+
ldap_filter: (uid=%u)

0 commit comments

Comments
 (0)