Skip to content

Commit 6aad6e2

Browse files
BertrandGounyBertrandGouny
committed
add explicit template variables, add readonly user script
1 parent 672a80d commit 6aad6e2

File tree

9 files changed

+85
-33
lines changed

9 files changed

+85
-33
lines changed

‎README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -177,7 +177,7 @@ TLS options :
177177
Replication options :
178178
- **LDAP_REPLICATION**: Add openldap replication capabilities. Defaults to `false`
179179
- **LDAP_REPLICATION_CONFIG_SYNCPROV**: olcSyncRepl options used for the config database. Without **rid** and **provider** which are automaticaly added based on LDAP_REPLICATION_HOSTS. Defaults to `binddn="cn=admin,cn=config" bindmethod=simple credentials=$LDAP_CONFIG_PASSWORD searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 starttls=critical`
180-
- **LDAP_REPLICATION_HDB_SYNCPROV**: olcSyncRepl options used for the HDB database. Without **rid** and **provider** which are automaticaly added based on LDAP_REPLICATION_HOSTS. Defaults to `binddn="cn=admin,$BASE_DN" bindmethod=simple credentials=$LDAP_ADMIN_PASSWORD searchbase="$BASE_DN" type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 5" timeout=1 starttls=critical`
180+
- **LDAP_REPLICATION_HDB_SYNCPROV**: olcSyncRepl options used for the HDB database. Without **rid** and **provider** which are automaticaly added based on LDAP_REPLICATION_HOSTS. Defaults to `binddn="cn=admin,$LDAP_BASE_DN" bindmethod=simple credentials=$LDAP_ADMIN_PASSWORD searchbase="$LDAP_BASE_DN" type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 5" timeout=1 starttls=critical`
181181
- **LDAP_REPLICATION_HOSTS**: list of replication hosts, must contains the current container hostname set by -h on docker run command. Defaults to `['ldap://ldap.example.org', 'ldap://ldap2.example.org']`
182182

183183
### Set environment variables at run time :

‎image/env.yaml‎

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,29 @@
1+
# general container configuration
2+
# see table 5.1 in http://www.openldap.org/doc/admin24/slapdconf2.html for the available log levels.
3+
LDAP_LOG_LEVEL: 256
4+
5+
# required and used for new ldap server only
16
LDAP_ORGANISATION: Example Inc.
27
LDAP_DOMAIN: example.org
38
LDAP_ADMIN_PASSWORD: admin
49
LDAP_CONFIG_PASSWORD: config
510

6-
#See table 5.1 in http://www.openldap.org/doc/admin24/slapdconf2.html for the available log levels.
7-
LDAP_LOG_LEVEL: 256
8-
11+
# TLS
912
LDAP_TLS: true
1013
LDAP_TLS_CRT_FILENAME: ldap.crt
1114
LDAP_TLS_KEY_FILENAME: ldap.key
1215
LDAP_TLS_CA_CRT_FILENAME: ca.crt
1316

14-
17+
# replication
1518
LDAP_REPLICATION: false
16-
# variables $BASE_DN, $LDAP_ADMIN_PASSWORD, $LDAP_CONFIG_PASSWORD
19+
# variables $LDAP_BASE_DN, $LDAP_ADMIN_PASSWORD, $LDAP_CONFIG_PASSWORD
1720
# are automaticaly replaced at run time
1821

1922
# if you want to add replication to an existing ldap
2023
# adapt LDAP_REPLICATION_CONFIG_SYNCPROV and LDAP_REPLICATION_HDB_SYNCPROV to your configuration
21-
# avoid using $BASE_DN, $LDAP_ADMIN_PASSWORD and $LDAP_CONFIG_PASSWORD variables
24+
# avoid using $LDAP_BASE_DN, $LDAP_ADMIN_PASSWORD and $LDAP_CONFIG_PASSWORD variables
2225
LDAP_REPLICATION_CONFIG_SYNCPROV: binddn="cn=admin,cn=config" bindmethod=simple credentials=$LDAP_CONFIG_PASSWORD searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1 starttls=critical
23-
LDAP_REPLICATION_HDB_SYNCPROV: binddn="cn=admin,$BASE_DN" bindmethod=simple credentials=$LDAP_ADMIN_PASSWORD searchbase="$BASE_DN" type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 5" timeout=1 starttls=critical
26+
LDAP_REPLICATION_HDB_SYNCPROV: binddn="cn=admin,$LDAP_BASE_DN" bindmethod=simple credentials=$LDAP_ADMIN_PASSWORD searchbase="$LDAP_BASE_DN" type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 5" timeout=1 starttls=critical
2427
LDAP_REPLICATION_HOSTS:
2528
- ldap://ldap.example.org # The order must be the same on all ldap servers
2629
- ldap://ldap2.example.org

‎image/service/slapd/assets/add-readonly-user.sh‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
#!/bin/bash -e
2+
3+
# Usage :
4+
# ./add-readonly-user.sh LDAP_DOMAIN LDAP_ADMIN_PASSWORD LDAP_READONLY_USERNAME LDAP_READONLY_PASSWORD
5+
6+
# Example :
7+
# ./add-readonly-user.sh example.org admin readonly readonly-password
8+
9+
LDAP_DOMAIN=$1
10+
LDAP_ADMIN_PASSWORD=$2
11+
LDAP_READONLY_USERNAME=$3
12+
LDAP_READONLY_PASSWORD=$4
13+
14+
function get_ldap_base_dn() {
15+
LDAP_BASE_DN=""
16+
IFS='.' read -ra LDAP_BASE_DN_TABLE <<< "$LDAP_DOMAIN"
17+
for i in "${LDAP_BASE_DN_TABLE[@]}"; do
18+
EXT="dc=$i,"
19+
LDAP_BASE_DN=$LDAP_BASE_DN$EXT
20+
done
21+
22+
LDAP_BASE_DN=${LDAP_BASE_DN::-1}
23+
}
24+
25+
get_ldap_base_dn
26+
LDAP_READONLY_PASSWORD_ENCRYPTED=$(slappasswd -s $LDAP_READONLY_PASSWORD)
27+
sed -i "s|{{ LDAP_READONLY_USERNAME }}|${LDAP_READONLY_USERNAME}|g" /container/service/slapd/assets/config/readonly-user/readonly-user.ldif
28+
sed -i "s|{{ LDAP_READONLY_PASSWORD_ENCRYPTED }}|${LDAP_READONLY_PASSWORD_ENCRYPTED}|g" /container/service/slapd/assets/config/readonly-user/readonly-user.ldif
29+
sed -i "s|{{ LDAP_BASE_DN }}|${LDAP_BASE_DN}|g" /container/service/slapd/assets/config/readonly-user/readonly-user.ldif
30+
31+
sed -i "s|{{ LDAP_READONLY_USERNAME }}|${LDAP_READONLY_USERNAME}|g" /container/service/slapd/assets/config/readonly-user/readonly-user-acl.ldif
32+
sed -i "s|{{ LDAP_BASE_DN }}|${LDAP_BASE_DN}|g" /container/service/slapd/assets/config/readonly-user/readonly-user-acl.ldif
33+
34+
ldapmodify -h localhost -p 389 -D cn=admin,$LDAP_BASE_DN -w $LDAP_ADMIN_PASSWORD -f /container/service/slapd/assets/config/readonly-user/readonly-user.ldif
35+
ldapmodify -Y EXTERNAL -Q -H ldapi:/// -f /container/service/slapd/assets/config/readonly-user/readonly-user-acl.ldif

‎image/service/slapd/assets/config/bootstrap/ldif/01-config-password.ldif‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,4 +4,4 @@ changeType: modify
44

55
dn: olcDatabase={0}config,cn=config
66
add: olcRootPW
7-
olcRootPW: {{ CONFIG_PASSWORD_ENCRYPTED }}
7+
olcRootPW: {{ LDAP_CONFIG_PASSWORD_ENCRYPTED }}

‎image/service/slapd/assets/config/bootstrap/ldif/02-security.ldif‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,10 @@
1-
dn: olcDatabase={1}hdb,cn=config
1+
dn: olcDatabase={1}hdb,cn=config
22
changetype: modify
33
delete: olcAccess
44
-
55
add: olcAccess
6-
olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by anonymous auth by dn="cn=admin,dc=example,dc=org" write by * none
6+
olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by dn="cn=admin,{{ LDAP_BASE_DN }}" write by anonymous auth by * none
77
-
88
add: olcAccess
9-
olcAccess: {1}to dn.base="" by * read
9+
olcAccess: {1}to * by self write by dn="cn=admin,{{ LDAP_BASE_DN }}" write by * none
1010
-
11-
add: olcAccess
12-
olcAccess: {2}to * by self write by dn="cn=admin,dc=example,dc=org" write by * none
13-
-

‎image/service/slapd/assets/config/readonly-user/readonly-user-acl.ldif‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
dn: olcDatabase={1}hdb,cn=config
2+
changetype: modify
3+
delete: olcAccess
4+
-
5+
add: olcAccess
6+
olcAccess: {0}to attrs=userPassword,shadowLastChange by self write by dn="cn=admin,{{ LDAP_BASE_DN }}" write by anonymous auth by * none
7+
-
8+
add: olcAccess
9+
olcAccess: {1}to * by self write by dn="cn=admin,{{ LDAP_BASE_DN }}" write by dn="cn={{ LDAP_READONLY_USERNAME }},{{ LDAP_BASE_DN }}" read by * none
10+
-

‎image/service/slapd/assets/config/readonly-user/readonly-user.ldif‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
dn: cn={{ LDAP_READONLY_USERNAME }},{{ LDAP_BASE_DN }}
2+
changetype: add
3+
cn: {{ LDAP_READONLY_USERNAME }}
4+
objectClass: simpleSecurityObject
5+
objectClass: organizationalRole
6+
userPassword: {{ LDAP_READONLY_PASSWORD_ENCRYPTED }}
7+
description: LDAP read only user

‎image/service/slapd/assets/config/tls/tls-enable.ldif‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,13 @@ replace: olcTLSCipherSuite
44
olcTLSCipherSuite: SECURE256:-VERS-SSL3.0
55
-
66
replace: olcTLSCACertificateFile
7-
olcTLSCACertificateFile: /container/service/slapd/assets/certs/ca.crt
7+
olcTLSCACertificateFile: /container/service/slapd/assets/certs/{{ LDAP_TLS_CA_CRT_FILENAME }}
88
-
99
replace: olcTLSCertificateFile
10-
olcTLSCertificateFile: /container/service/slapd/assets/certs/ldap.crt
10+
olcTLSCertificateFile: /container/service/slapd/assets/certs/{{ LDAP_TLS_CRT_FILENAME }}
1111
-
1212
replace: olcTLSCertificateKeyFile
13-
olcTLSCertificateKeyFile: /container/service/slapd/assets/certs/ldap.key
13+
olcTLSCertificateKeyFile: /container/service/slapd/assets/certs/{{ LDAP_TLS_KEY_FILENAME }}
1414
-
1515
replace: olcTLSDHParamFile
1616
olcTLSDHParamFile: /container/service/slapd/assets/certs/dhparam.pem

‎image/service/slapd/container-start.sh‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -17,15 +17,15 @@ chown -R openldap:openldap /container/service/slapd
1717
# container first start
1818
if [ ! -e "$FIRST_START_DONE" ]; then
1919

20-
function get_base_dn() {
21-
BASE_DN=""
22-
IFS='.' read -ra BASE_DN_TABLE <<< "$LDAP_DOMAIN"
23-
for i in "${BASE_DN_TABLE[@]}"; do
20+
function get_ldap_base_dn() {
21+
LDAP_BASE_DN=""
22+
IFS='.' read -ra LDAP_BASE_DN_TABLE <<< "$LDAP_DOMAIN"
23+
for i in "${LDAP_BASE_DN_TABLE[@]}"; do
2424
EXT="dc=$i,"
25-
BASE_DN=$BASE_DN$EXT
25+
LDAP_BASE_DN=$LDAP_BASE_DN$EXT
2626
done
2727

28-
BASE_DN=${BASE_DN::-1}
28+
LDAP_BASE_DN=${LDAP_BASE_DN::-1}
2929
}
3030

3131
function is_new_schema() {
@@ -134,12 +134,12 @@ EOF
134134
done
135135

136136
# set config password
137-
CONFIG_PASSWORD_ENCRYPTED=$(slappasswd -s $LDAP_CONFIG_PASSWORD)
138-
sed -i "s|{{ CONFIG_PASSWORD_ENCRYPTED }}|$CONFIG_PASSWORD_ENCRYPTED|g" /container/service/slapd/assets/config/bootstrap/ldif/01-config-password.ldif
137+
LDAP_CONFIG_PASSWORD_ENCRYPTED=$(slappasswd -s $LDAP_CONFIG_PASSWORD)
138+
sed -i "s|{{ LDAP_CONFIG_PASSWORD_ENCRYPTED }}|${LDAP_CONFIG_PASSWORD_ENCRYPTED}|g" /container/service/slapd/assets/config/bootstrap/ldif/01-config-password.ldif
139139

140140
# adapt security config file
141-
get_base_dn
142-
sed -i "s|dc=example,dc=org|$BASE_DN|g" /container/service/slapd/assets/config/bootstrap/ldif/02-security.ldif
141+
get_ldap_base_dn
142+
sed -i "s|{{ LDAP_BASE_DN }}|${LDAP_BASE_DN}|g" /container/service/slapd/assets/config/bootstrap/ldif/02-security.ldif
143143

144144
# process config files
145145
for f in $(find /container/service/slapd/assets/config/bootstrap/ldif -name \*.ldif -type f | sort); do
@@ -157,9 +157,9 @@ EOF
157157
check_tls_files $LDAP_TLS_CA_CRT_FILENAME $LDAP_TLS_CRT_FILENAME $LDAP_TLS_KEY_FILENAME
158158

159159
# adapt tls ldif
160-
sed -i "s,/container/service/slapd/assets/certs/ca.crt,/container/service/slapd/assets/certs/${LDAP_TLS_CA_CRT_FILENAME},g" /container/service/slapd/assets/config/tls/tls-enable.ldif
161-
sed -i "s,/container/service/slapd/assets/certs/ldap.crt,/container/service/slapd/assets/certs/${LDAP_TLS_CRT_FILENAME},g" /container/service/slapd/assets/config/tls/tls-enable.ldif
162-
sed -i "s,/container/service/slapd/assets/certs/ldap.key,/container/service/slapd/assets/certs/${LDAP_TLS_KEY_FILENAME},g" /container/service/slapd/assets/config/tls/tls-enable.ldif
160+
sed -i "s|{{ LDAP_TLS_CA_CRT_FILENAME }}|${LDAP_TLS_CA_CRT_FILENAME}|g" /container/service/slapd/assets/config/tls/tls-enable.ldif
161+
sed -i "s|{{ LDAP_TLS_CRT_FILENAME }}|${LDAP_TLS_CRT_FILENAME}|g" /container/service/slapd/assets/config/tls/tls-enable.ldif
162+
sed -i "s|{{ LDAP_TLS_KEY_FILENAME }}|${LDAP_TLS_KEY_FILENAME}|g" /container/service/slapd/assets/config/tls/tls-enable.ldif
163163

164164
ldapmodify -Y EXTERNAL -Q -H ldapi:/// -f /container/service/slapd/assets/config/tls/tls-enable.ldif
165165

@@ -212,8 +212,8 @@ EOF
212212
((i++))
213213
done
214214

215-
get_base_dn
216-
sed -i "s|\$BASE_DN|$BASE_DN|g" /container/service/slapd/assets/config/replication/replication-enable.ldif
215+
get_ldap_base_dn
216+
sed -i "s|\$LDAP_BASE_DN|$LDAP_BASE_DN|g" /container/service/slapd/assets/config/replication/replication-enable.ldif
217217
sed -i "s|\$LDAP_ADMIN_PASSWORD|$LDAP_ADMIN_PASSWORD|g" /container/service/slapd/assets/config/replication/replication-enable.ldif
218218
sed -i "s|\$LDAP_CONFIG_PASSWORD|$LDAP_CONFIG_PASSWORD|g" /container/service/slapd/assets/config/replication/replication-enable.ldif
219219

0 commit comments

Comments
 (0)