Skip to content

Commit 7a869f7

Browse files
BertrandGounyBertrandGouny
committed
replication
1 parent 47f87b6 commit 7a869f7

File tree

2 files changed

+26
-155
lines changed

2 files changed

+26
-155
lines changed

‎image/env.yml‎

Lines changed: 11 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -11,50 +11,16 @@ SSL_CRT_FILENAME: ldap.crt
1111
SSL_KEY_FILENAME: ldap.key
1212
SSL_CA_CRT_FILENAME: ca.crt
1313

14-
USE_REPLICATION: false
14+
USE_REPLICATION: true
1515

16+
# variables $BASE_DN, $LDAP_ADMIN_PASSWORD and $LDAP_CONFIG_PASSWORD
17+
# are automaticaly replaced at run time
18+
19+
# if you want to add replication to an existing ldap
20+
# adapt REPLICATION_CONFIG_SYNCPROV and REPLICATION_HDB_CONFIG to your configuration
21+
# avoid using $BASE_DN, $LDAP_ADMIN_PASSWORD and $LDAP_CONFIG_PASSWORD variables
22+
REPLICATION_CONFIG_SYNCPROV: binddn="cn=admin,cn=config" bindmethod=simple credentials=$LDAP_CONFIG_PASSWORD searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1
23+
REPLICATION_HDB_CONFIG: binddn="cn=admin,$BASE_DN" bindmethod=simple credentials=$LDAP_ADMIN_PASSWORD searchbase="$BASE_DN" type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 5" timeout=1
1624
REPLICATION_HOSTS:
17-
- ldap://ldap.example.org:
18-
- server_id: 1
19-
- syncprov_config:
20-
- binddn: cn=admin,cn=config
21-
- bindmethod: simple
22-
- credentials: config
23-
- searchbase: cn=config
24-
- type: refreshAndPersist
25-
- retry: 5 5 300 5
26-
- timeout: 1
27-
- starttls: critical
28-
- tls_reqcert: demand
29-
- syncprov_hdb:
30-
- binddn: cn=admin,dc=example,dc=org
31-
- bindmethod: simple
32-
- credentials: test
33-
- searchbase: dc=example,dc=org
34-
- type: refreshAndPersist
35-
- retry: 5 5 300 5
36-
- timeout: 1
37-
- starttls: critical
38-
- tls_reqcert: demand
39-
- ldap://ldap2.example.org:
40-
- server_id: 1
41-
- syncprov_config:
42-
- binddn: cn=admin,cn=config
43-
- bindmethod: simple
44-
- credentials: config
45-
- searchbase: cn=config
46-
- type: refreshAndPersist
47-
- retry: 5 5 300 5
48-
- timeout: 1
49-
- starttls: critical
50-
- tls_reqcert: demand
51-
- syncprov_hdb:
52-
- binddn: cn=admin,dc=example,dc=org
53-
- bindmethod: simple
54-
- credentials: test
55-
- searchbase: dc=example,dc=org
56-
- type: refreshAndPersist
57-
- retry: 5 5 300 5
58-
- timeout: 1
59-
- starttls: critical
60-
- tls_reqcert: demand
25+
- ldap://ldap.example.org # The order must be the same on all ldap servers
26+
- ldap://ldap2.example.org

‎image/service/slapd/container-start.sh‎

Lines changed: 15 additions & 110 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
FIRST_START_DONE="/etc/docker-openldap-first-start-done"
44
WAS_STARTED_WITH_TLS="/etc/ldap/slapd.d/docker-openldap-was-started-with-tls"
5+
WAS_STARTED_WITH_REPLICATION="/etc/ldap/slapd.d/docker-openldap-was-started-with-replication"
56

67
# Reduce maximum number of number of open file descriptors to 1024
78
# otherwise slapd consumes two orders of magnitude more of RAM
@@ -174,10 +175,6 @@ EOF
174175
echo "export PREVIOUS_SSL_KEY_FILENAME=${SSL_KEY_FILENAME}" >> $WAS_STARTED_WITH_TLS
175176
chmod +x $WAS_STARTED_WITH_TLS
176177

177-
# add localhost route to certificate cn (need docker 1.5.0)
178-
cn=$(openssl x509 -in /osixia/slapd/assets/ssl/$SSL_CRT_FILENAME -subject -noout | sed -n 's/.*CN=\(.*\)\/*\(.*\)/\1/p')
179-
echo "127.0.0.1 $cn" >> /etc/hosts
180-
181178
# local ldap tls client config
182179
sed -i "s,TLS_CACERT.*,TLS_CACERT /osixia/slapd/assets/ssl/${SSL_CA_CRT_FILENAME},g" /etc/ldap/ldap.conf
183180

@@ -194,135 +191,43 @@ EOF
194191
# replication config
195192
if [ "${USE_REPLICATION,,}" == "true" ]; then
196193

197-
echo "Set replication"
194+
echo "Use replication"
198195

199196
# copy template file
200197
cp /osixia/slapd/assets/config/replication/replication-enable-template.ldif /osixia/slapd/assets/config/replication/replication-enable.ldif
201198

202-
function addReplicationSyncRepl() {
203-
204-
local TYPE=$1
205-
local HOST=$2
206-
local INFOS=(${3})
207-
208-
olcSyncReplLine="olcSyncRepl:"
209-
210-
if [ "$TYPE" == "CONFIG" ]; then
211-
olcSyncReplLine="$olcSyncReplLine rid=00$i"
212-
else
213-
olcSyncReplLine="$olcSyncReplLine rid=10$i"
214-
fi
215-
216-
olcSyncReplLine="$olcSyncReplLine provider=$HOST"
217-
218-
for info in "${INFOS[@]}"
219-
do
220-
221-
info=($info)
222-
local key_value_pair=(${!info[0]})
223-
local key=${!key_value_pair[0]}
224-
local value=${!key_value_pair[1]}
225-
226-
olcSyncReplLine="$olcSyncReplLine $key=\"$value\""
227-
228-
done
229-
230-
if [ "$TYPE" == "CONFIG" ]; then
231-
sed -i "s|{{ REPLICATION_HOSTS_CONFIG_SYNC_REPL }}|$olcSyncReplLine\n{{ REPLICATION_HOSTS_CONFIG_SYNC_REPL }}|g" /osixia/slapd/assets/config/replication/replication-enable.ldif
232-
else
233-
sed -i "s|{{ REPLICATION_HOSTS_HDB_SYNC_REPL }}|$olcSyncReplLine\n{{ REPLICATION_HOSTS_HDB_SYNC_REPL }}|g" /osixia/slapd/assets/config/replication/replication-enable.ldif
234-
fi
235-
}
236-
237-
238-
# replication hosts config
239-
function addReplicationHost() {
240-
241-
local HOST=$1
242-
local INFOS=(${!2})
243-
244-
local SERVER_ID_FOUND=false
245-
local SYNCPROV_CONFIG_OBJECT_FOUND=false
246-
local SYNCPROV_HDB_OBJECT_FOUND=false
247-
248-
for info in "${INFOS[@]}"
249-
do
250-
info=($info)
251-
local key_value_pair=(${!info[0]})
252-
local key=${!key_value_pair[0]}
253-
local value=${!key_value_pair[1]}
254-
255-
# olcServerID
256-
if [ "$key" == "server_id" ]; then
257-
sed -i "s|{{ REPLICATION_HOSTS }}|olcServerID: $value $HOST\n{{ REPLICATION_HOSTS }}|g" /osixia/slapd/assets/config/replication/replication-enable.ldif
258-
SERVER_ID_FOUND=true
259-
260-
# olcSyncRepl for config and hdb
261-
elif [ "$key" == "syncprov_config" ]; then
262-
addReplicationSyncRepl CONFIG $HOST "$value"
263-
SYNCPROV_CONFIG_OBJECT_FOUND=true
264-
265-
elif [ "$key" == "syncprov_hdb" ]; then
266-
addReplicationSyncRepl HDB $HOST "$value"
267-
SYNCPROV_HDB_OBJECT_FOUND=true
268-
269-
fi
270-
done
271-
272-
if ! $SERVER_ID_FOUND; then
273-
echo "Error: Replication host ${HOST} must define a server_id"
274-
exit 1
275-
fi
276-
277-
if ! $SYNCPROV_CONFIG_OBJECT_FOUND; then
278-
echo "Error: Replication host ${HOST} must define a syncprov_config object"
279-
exit 1
280-
fi
281-
282-
if ! $SYNCPROV_HDB_OBJECT_FOUND; then
283-
echo "Error: Replication host ${HOST} must define a syncprov_hdb object"
284-
exit 1
285-
fi
286-
}
287-
288199
REPLICATION_HOSTS=($REPLICATION_HOSTS)
289200
i=1
290201
for host in "${REPLICATION_HOSTS[@]}"
291202
do
292203

293204
#host var contain a variable name, we access to the variable value and cast it to a table
294-
infos=(${!host})
205+
host=${!host}
295206

296-
# it's a table of infos
297-
if [ "${#infos[@]}" -gt "1" ]; then
298-
299-
addReplicationHost ${!infos[0]} ${infos[1]}
300-
301-
else
302-
echo "Error: Replication host ${!host} must define a server_id, syncprov_config and syncprov_hdb object"
303-
exit 1
304-
fi
207+
sed -i "s|{{ REPLICATION_HOSTS }}|olcServerID: $i ${host}\n{{ REPLICATION_HOSTS }}|g" /osixia/slapd/assets/config/replication/replication-enable.ldif
208+
sed -i "s|{{ REPLICATION_HOSTS_CONFIG_SYNC_REPL }}|olcSyncRepl: rid=00$i provider=${host} ${REPLICATION_CONFIG_SYNCPROV}\n{{ REPLICATION_HOSTS_CONFIG_SYNC_REPL }}|g" /osixia/slapd/assets/config/replication/replication-enable.ldif
209+
sed -i "s|{{ REPLICATION_HOSTS_HDB_SYNC_REPL }}|olcSyncRepl: rid=10$i provider=${host} ${REPLICATION_HDB_CONFIG}\n{{ REPLICATION_HOSTS_HDB_SYNC_REPL }}|g" /osixia/slapd/assets/config/replication/replication-enable.ldif
305210

306211
((i++))
307212
done
308213

214+
get_base_dn
215+
sed -i "s|\$BASE_DN|$BASE_DN|g" /osixia/slapd/assets/config/replication/replication-enable.ldif
216+
sed -i "s|\$LDAP_ADMIN_PASSWORD|$LDAP_ADMIN_PASSWORD|g" /osixia/slapd/assets/config/replication/replication-enable.ldif
217+
sed -i "s|\$LDAP_CONFIG_PASSWORD|$LDAP_CONFIG_PASSWORD|g" /osixia/slapd/assets/config/replication/replication-enable.ldif
309218

310219
sed -i "/{{ REPLICATION_HOSTS }}/d" /osixia/slapd/assets/config/replication/replication-enable.ldif
311220
sed -i "/{{ REPLICATION_HOSTS_CONFIG_SYNC_REPL }}/d" /osixia/slapd/assets/config/replication/replication-enable.ldif
312221
sed -i "/{{ REPLICATION_HOSTS_HDB_SYNC_REPL }}/d" /osixia/slapd/assets/config/replication/replication-enable.ldif
313222

314-
cat /osixia/slapd/assets/config/replication/replication-enable.ldif
315-
ldapmodify -c -Y EXTERNAL -Q -H ldapi:/// -f /osixia/slapd/assets/config/replication/replication-enable.ldif -v -d -1
223+
ldapmodify -c -Y EXTERNAL -Q -H ldapi:/// -f /osixia/slapd/assets/config/replication/replication-enable.ldif
224+
touch $WAS_STARTED_WITH_REPLICATION
316225

317226
else
318227

319-
echo "Don't set replication"
320-
321-
# disable replication
322-
#for f in $(find /osixia/slapd/config/replication -name \*-disable.ldif -type f); do
323-
# echo "Processing file ${f}"
324-
# ldapmodify -Y EXTERNAL -Q -H ldapi:/// -f $f
325-
# done
228+
echo "Don't use replication"
229+
[[ -f "$WAS_STARTED_WITH_REPLICATION" ]] && rm -f "$WAS_STARTED_WITH_REPLICATION"
230+
ldapmodify -c -Y EXTERNAL -Q -H ldapi:/// -f /osixia/slapd/assets/config/replication/replication-disable.ldif || true
326231

327232
fi
328233

0 commit comments

Comments
 (0)