Skip to content

Commit c3f1e6d

Browse files
BertrandGounyBertrandGouny
committed
replication
1 parent 2943fc6 commit c3f1e6d

File tree

8 files changed

+220
-100
lines changed

8 files changed

+220
-100
lines changed

‎image/env.yml‎

Lines changed: 45 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,7 @@
11
LDAP_ORGANISATION: Example Inc.
22
LDAP_DOMAIN: example.org
33
LDAP_ADMIN_PASSWORD: admin
4+
LDAP_CONFIG_PASSWORD: config
45

56
#See table 5.1 in http://www.openldap.org/doc/admin24/slapdconf2.html for the available log levels.
67
LDAP_LOG_LEVEL: -1
@@ -12,16 +13,49 @@ SSL_CRT_FILENAME: ldap.crt
1213
SSL_KEY_FILENAME: ldap.key
1314
SSL_CA_CRT_FILENAME: ca.crt
1415

15-
USE_REPLICATION: false
16-
REPLICATION_SERVER_ID: 1
17-
REPLICATOR_DN: cn=replicator,dc=example,dc=org
18-
REPLICATOR_PASSWORD: replicator
19-
16+
USE_REPLICATION: true
2017
REPLICATION_HOSTS:
18+
- ldap://ldap.example.org:
19+
- server_id: 1
20+
- syncprov_config:
21+
- binddn: cn=admin,cn=config
22+
- bindmethod: simple
23+
- credentials: config
24+
- searchbase: cn=config
25+
- type: refreshAndPersist
26+
- retry: 5 5 300 5
27+
- timeout: 1
28+
- starttls: critical
29+
- tls_reqcert: demand
30+
- syncprov_hdb:
31+
- binddn: cn=admin,dc=example,dc=org
32+
- bindmethod: simple
33+
- credentials: test
34+
- searchbase: dc=example,dc=org
35+
- type: refreshAndPersist
36+
- retry: 5 5 300 5
37+
- timeout: 1
38+
- starttls: critical
39+
- tls_reqcert: demand
2140
- ldap://ldap2.example.org:
22-
- server_id: 2
23-
- syncprov:
24-
- binddn: cn=replicator,dc=example,dc=org
25-
- credentials: replicator
26-
- starttls: yes
27-
- tls_reqcert: never
41+
- server_id: 1
42+
- syncprov_config:
43+
- binddn: cn=admin,cn=config
44+
- bindmethod: simple
45+
- credentials: config
46+
- searchbase: cn=config
47+
- type: refreshAndPersist
48+
- retry: 5 5 300 5
49+
- timeout: 1
50+
- starttls: critical
51+
- tls_reqcert: demand
52+
- syncprov_hdb:
53+
- binddn: cn=admin,dc=example,dc=org
54+
- bindmethod: simple
55+
- credentials: test
56+
- searchbase: dc=example,dc=org
57+
- type: refreshAndPersist
58+
- retry: 5 5 300 5
59+
- timeout: 1
60+
- starttls: critical
61+
- tls_reqcert: demand

‎image/service/slapd/assets/config/bootstrap/ldif/config-password.ldif‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# Set config password
2+
dn: cn=config
3+
changeType: modify
4+
5+
dn: olcDatabase={0}config,cn=config
6+
add: olcRootPW
7+
olcRootPW: {{ CONFIG_PASSWORD_ENCRYPTED }}

‎image/service/slapd/assets/config/bootstrap/ldif/index.ldif‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1+
# Add indexes
12
dn: olcDatabase={1}hdb,cn=config
23
changetype: modify
34
replace: olcDbIndex

‎image/service/slapd/assets/config/replication/backup/replication-enable.ldif‎

Lines changed: 0 additions & 69 deletions
Original file line numberDiff line numberDiff line change
@@ -1,72 +1,3 @@
1-
# Load syncprov module
2-
dn: cn=module{0},cn=config
3-
changetype: modify
4-
add: olcModuleLoad
5-
olcModuleLoad: syncprov
6-
7-
# Set server ID
8-
dn: cn=config
9-
changeType: modify
10-
add: olcServerID
11-
olcServerID: {{ SERVER_ID }}
12-
13-
# Set config password
14-
dn: cn=config
15-
changeType: modify
16-
17-
dn: olcDatabase={0}config,cn=config
18-
add: olcRootPW
19-
olcRootPW: {{ CONFIG_PASSWORD_ENCRYPTED }}
20-
21-
# Add config replication
22-
dn: cn=config
23-
changetype: modify
24-
replace: olcServerID
25-
olcServerID: 1 ldap://ldap1.gremaud.local
26-
olcServerID: 2 ldap://ldap2.gremaud.local
27-
olcServerID: 3 ldap://ldap3.gremaud.local
28-
{{ REPLICATION_SERVERS }}
29-
30-
# Add syncprov on config
31-
dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config
32-
changetype: add
33-
objectClass: olcOverlayConfig
34-
objectClass: olcSyncProvConfig
35-
olcOverlay: syncprov
36-
37-
# Add sync replication on config
38-
dn: olcDatabase={0}config,cn=config
39-
changetype: modify
40-
add: olcSyncRepl
41-
olcSyncRepl: rid=001 provider=ldap://ldap1.gremaud.local binddn="cn=admin,cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1
42-
olcSyncRepl: rid=002 provider=ldap://ldap2.gremaud.local binddn="cn=admin,cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1
43-
olcSyncRepl: rid=003 provider=ldap://ldap3.gremaud.local binddn="cn=admin,cn=config" bindmethod=simple credentials=secret searchbase="cn=config" type=refreshAndPersist retry="5 5 300 5" timeout=1
44-
{{ REPLICATION_SERVERS_CONFIG_SYNC_REPL }}
45-
-
46-
add: olcMirrorMode
47-
olcMirrorMode: TRUE
48-
49-
# Add syncprov on hdb
50-
dn: olcOverlay=syncprov,olcDatabase={1}hdb,cn=config
51-
changetype: add
52-
objectClass: olcOverlayConfig
53-
objectClass: olcSyncProvConfig
54-
olcOverlay: syncprov
55-
56-
# Add sync replication on hdb
57-
dn: olcDatabase={1}hdb,cn=config
58-
changetype: modify
59-
add: olcSyncRepl
60-
olcSyncRepl: rid=101 provider=ldap://ldap1.gremaud.local binddn="cn=admin,dc=gremaud,dc=local" bindmethod=simple credentials=secret searchbase="dc=gremaud,dc=local" type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 5" timeout=1
61-
olcSyncRepl: rid=102 provider=ldap://ldap2.gremaud.local binddn="cn=admin,dc=gremaud,dc=local" bindmethod=simple credentials=secret searchbase="dc=gremaud,dc=local" type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 5" timeout=1
62-
olcSyncRepl: rid=103 provider=ldap://ldap3.gremaud.local binddn="cn=admin,dc=gremaud,dc=local" bindmethod=simple credentials=secret searchbase="dc=gremaud,dc=local" type=refreshAndPersist interval=00:00:00:10 retry="5 5 300 5" timeout=1
63-
{{ REPLICATION_SERVERS_HDB_SYNC_REPL }}
64-
65-
# Add olcMirrorMode
66-
dn: olcDatabase={1}hdb,cn=config
67-
changetype: modify
68-
add: olcMirrorMode
69-
olcMirrorMode: TRUE
701

712
# Add indexes
723
dn: olcDatabase={1}hdb,cn=config

‎image/service/slapd/assets/config/replication/repl-enable.ldif‎

Lines changed: 0 additions & 15 deletions
This file was deleted.

‎image/service/slapd/assets/config/replication/replication-enable-template.ldif‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
# Load syncprov module
2+
dn: cn=module{0},cn=config
3+
changetype: modify
4+
add: olcModuleLoad
5+
olcModuleLoad: syncprov
6+
7+
# Set server ID
8+
dn: cn=config
9+
changeType: modify
10+
add: olcServerID
11+
{{ REPLICATION_HOSTS }}
12+
13+
# Add syncprov on config
14+
dn: olcOverlay=syncprov,olcDatabase={0}config,cn=config
15+
changetype: add
16+
objectClass: olcOverlayConfig
17+
objectClass: olcSyncProvConfig
18+
olcOverlay: syncprov
19+
20+
# Add sync replication on config
21+
dn: olcDatabase={0}config,cn=config
22+
changetype: modify
23+
add: olcSyncRepl
24+
{{ REPLICATION_HOSTS_CONFIG_SYNC_REPL }}
25+
-
26+
add: olcMirrorMode
27+
olcMirrorMode: TRUE
28+
29+
# Add syncprov on hdb
30+
dn: olcOverlay=syncprov,olcDatabase={1}hdb,cn=config
31+
changetype: add
32+
objectClass: olcOverlayConfig
33+
objectClass: olcSyncProvConfig
34+
olcOverlay: syncprov
35+
36+
# Add sync replication on hdb
37+
dn: olcDatabase={1}hdb,cn=config
38+
changetype: modify
39+
add: olcSyncRepl
40+
{{ REPLICATION_HOSTS_HDB_SYNC_REPL }}
41+
-
42+
add: olcMirrorMode
43+
olcMirrorMode: TRUE

‎image/service/slapd/container-start.sh‎

Lines changed: 123 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -137,12 +137,16 @@ EOF
137137
fi
138138
done
139139

140+
# adapt config password
141+
CONFIG_PASSWORD_ENCRYPTED=$(slappasswd -s $LDAP_CONFIG_PASSWORD)
142+
sed -i "s|{{ CONFIG_PASSWORD_ENCRYPTED }}|$CONFIG_PASSWORD_ENCRYPTED|g" /osixia/slapd/config/bootstrap/ldif/config-password.ldif
143+
140144
# adapt security config file
141145
get_base_dn
142-
sed -i "s|dc=example,dc=org|$BASE_DN|g" /osixia/slapd/config/bootstrap/security.ldif
146+
sed -i "s|dc=example,dc=org|$BASE_DN|g" /osixia/slapd/config/bootstrap/ldif/security.ldif
143147

144148
# process config files
145-
for f in $(find /osixia/slapd/config/bootstrap -path /osixia/slapd/config/bootstrap/schema -prune -name \*.ldif -type f); do
149+
for f in $(find /osixia/slapd/config/bootstrap/ldif -name \*.ldif -type f); do
146150
echo "Processing file ${f}"
147151
ldapmodify -Y EXTERNAL -Q -H ldapi:/// -f $f
148152
done
@@ -192,8 +196,123 @@ EOF
192196

193197
echo "Set replication"
194198

195-
#cp /var/lib/ldap/DB_CONFIG /var/lib/ldap/accesslog
196-
#chown openldap:openldap /var/lib/ldap/accesslog
199+
# copy template file
200+
cp /osixia/slapd/config/replication/replication-enable-template.ldif /osixia/slapd/config/replication/replication-enable.ldif
201+
202+
function addReplicationSyncRepl() {
203+
204+
local TYPE=$1
205+
local HOST=$2
206+
local INFOS=(${3})
207+
208+
olcSyncReplLine="olcSyncRepl:"
209+
210+
if [ "$TYPE" == "CONFIG" ]; then
211+
olcSyncReplLine="$olcSyncReplLine rid=00$i"
212+
else
213+
olcSyncReplLine="$olcSyncReplLine rid=10$i"
214+
fi
215+
216+
olcSyncReplLine="$olcSyncReplLine provider=$HOST"
217+
218+
for info in "${INFOS[@]}"
219+
do
220+
221+
info=($info)
222+
local key_value_pair=(${!info[0]})
223+
local key=${!key_value_pair[0]}
224+
local value=${!key_value_pair[1]}
225+
226+
olcSyncReplLine="$olcSyncReplLine $key=\"$value\""
227+
228+
done
229+
230+
if [ "$TYPE" == "CONFIG" ]; then
231+
sed -i "s|{{ REPLICATION_HOSTS_CONFIG_SYNC_REPL }}|$olcSyncReplLine\n{{ REPLICATION_HOSTS_CONFIG_SYNC_REPL }}|g" /osixia/slapd/config/replication/replication-enable.ldif
232+
else
233+
sed -i "s|{{ REPLICATION_HOSTS_HDB_SYNC_REPL }}|$olcSyncReplLine\n{{ REPLICATION_HOSTS_HDB_SYNC_REPL }}|g" /osixia/slapd/config/replication/replication-enable.ldif
234+
fi
235+
}
236+
237+
238+
# replication hosts config
239+
function addReplicationHost() {
240+
241+
local HOST=$1
242+
local INFOS=(${!2})
243+
244+
local SERVER_ID_FOUND=false
245+
local SYNCPROV_CONFIG_OBJECT_FOUND=false
246+
local SYNCPROV_HDB_OBJECT_FOUND=false
247+
248+
for info in "${INFOS[@]}"
249+
do
250+
info=($info)
251+
local key_value_pair=(${!info[0]})
252+
local key=${!key_value_pair[0]}
253+
local value=${!key_value_pair[1]}
254+
255+
# olcServerID
256+
if [ "$key" == "server_id" ]; then
257+
sed -i "s|{{ REPLICATION_HOSTS }}|olcServerID: $value $HOST\n{{ REPLICATION_HOSTS }}|g" /osixia/slapd/config/replication/replication-enable.ldif
258+
SERVER_ID_FOUND=true
259+
260+
# olcSyncRepl for config and hdb
261+
elif [ "$key" == "syncprov_config" ]; then
262+
addReplicationSyncRepl CONFIG $HOST "$value"
263+
SYNCPROV_CONFIG_OBJECT_FOUND=true
264+
265+
elif [ "$key" == "syncprov_hdb" ]; then
266+
addReplicationSyncRepl HDB $HOST "$value"
267+
SYNCPROV_HDB_OBJECT_FOUND=true
268+
269+
fi
270+
done
271+
272+
if ! $SERVER_ID_FOUND; then
273+
echo "Error: Replication host ${HOST} must define a server_id"
274+
exit 1
275+
fi
276+
277+
if ! $SYNCPROV_CONFIG_OBJECT_FOUND; then
278+
echo "Error: Replication host ${HOST} must define a syncprov_config object"
279+
exit 1
280+
fi
281+
282+
if ! $SYNCPROV_HDB_OBJECT_FOUND; then
283+
echo "Error: Replication host ${HOST} must define a syncprov_hdb object"
284+
exit 1
285+
fi
286+
}
287+
288+
REPLICATION_HOSTS=($REPLICATION_HOSTS)
289+
i=1
290+
for host in "${REPLICATION_HOSTS[@]}"
291+
do
292+
293+
#host var contain a variable name, we access to the variable value and cast it to a table
294+
infos=(${!host})
295+
296+
# it's a table of infos
297+
if [ "${#infos[@]}" -gt "1" ]; then
298+
299+
addReplicationHost ${!infos[0]} ${infos[1]}
300+
301+
else
302+
echo "Error: Replication host ${!host} must define a server_id, syncprov_config and syncprov_hdb object"
303+
exit 1
304+
fi
305+
306+
((i++))
307+
done
308+
309+
310+
sed -i "/{{ REPLICATION_HOSTS }}/d" /osixia/slapd/config/replication/replication-enable.ldif
311+
sed -i "/{{ REPLICATION_HOSTS_CONFIG_SYNC_REPL }}/d" /osixia/slapd/config/replication/replication-enable.ldif
312+
sed -i "/{{ REPLICATION_HOSTS_HDB_SYNC_REPL }}/d" /osixia/slapd/config/replication/replication-enable.ldif
313+
314+
cat /osixia/slapd/config/replication/replication-enable.ldif
315+
ldapmodify -c -Y EXTERNAL -Q -H ldapi:/// -f /osixia/slapd/config/replication/replication-enable.ldif -v -d -1
197316

198317
else
199318

‎image/service/slapd/daemon.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,4 +5,4 @@
55
# see https://github.com/docker/docker/issues/8231
66
ulimit -n 1024
77

8-
exec /usr/sbin/slapd -h "ldap:/// ldaps:/// ldapi:///" -u openldap -g openldap -d "$LDAP_LOG_LEVEL"
8+
exec /usr/sbin/slapd -h "ldap://$SERVER_NAME ldaps://$SERVER_NAME ldapi:///" -u openldap -g openldap -d "$LDAP_LOG_LEVEL"

0 commit comments

Comments
 (0)