Skip to content

Commit afdc5d0

Browse files
davidpil2002davidpil2002
authored
Add LDAP feature support (#16969)
Why I did it To support LDAP feature - How I did it Similar to Radius/Tacacs authentication methods, the SONiC device is the LDAP client. Installed the Debian LDAP packages related to making SONiC able to function as an LDAP client. More description in the following HLD: sonic-net/SONiC#1487 - How to verify it Do LDAP configuration according to the HLD, then connect to the SONiC switch by using a user that exists in your LDAP server.
1 parent 7129232 commit afdc5d0

File tree

7 files changed

+219
-4
lines changed

7 files changed

+219
-4
lines changed

‎files/build_templates/sonic_debian_extension.j2‎

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -284,6 +284,19 @@ sudo dpkg --root=$FILESYSTEM_ROOT -i $debs_path/sonic-device-data_*.deb || \
284284
# package for supporting password hardening
285285
sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y install libpam-pwquality
286286

287+
# Install pam-ldap, nss-ldap, ldap-utils
288+
sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y install \
289+
libnss-ldapd \
290+
libpam-ldapd \
291+
ldap-utils
292+
293+
# add networking.service dependancy to nslcd
294+
sudo LANG=C chroot $FILESYSTEM_ROOT sed -i '/# Required-Start:/ s/$/ networking.service/' /etc/init.d/nslcd
295+
296+
# nslcd disable default
297+
sudo LANG=C chroot $FILESYSTEM_ROOT systemctl stop nslcd.service
298+
sudo LANG=C chroot $FILESYSTEM_ROOT systemctl mask nslcd.service
299+
287300
# Install pam-tacplus and nss-tacplus
288301
sudo dpkg --root=$FILESYSTEM_ROOT -i $debs_path/libtac2_*.deb || \
289302
sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y install -f
@@ -297,14 +310,14 @@ sudo dpkg --root=$FILESYSTEM_ROOT -i $debs_path/bash-tacplus_*.deb || \
297310
# Install audisp-tacplus
298311
sudo dpkg --root=$FILESYSTEM_ROOT -i $debs_path/audisp-tacplus_*.deb || \
299312
sudo LANG=C DEBIAN_FRONTEND=noninteractive chroot $FILESYSTEM_ROOT apt-get -y install -f
300-
# Disable tacplus by default
313+
# Disable tacplus and LDAP by default
301314
## NOTE: this syntax of pam-auth-update is meant to be used when the package gets removed, not for specifying
302315
## some local configuration of a PAM module. Currently, there's no clean way of noninteractively specifying
303316
## whether some PAM module needs to be enabled or disabled on a system (there are hacky ways, though).
304317
##
305318
## If there is some PAM module that's installed/removed after this point, then this setting will end up having
306319
## no impact, and there may be errors/test failures related to authentication.
307-
sudo LANG=C chroot $FILESYSTEM_ROOT pam-auth-update --remove tacplus
320+
sudo LANG=C chroot $FILESYSTEM_ROOT pam-auth-update --remove tacplus ldap
308321
sudo sed -i -e '/^passwd/s/ tacplus//' $FILESYSTEM_ROOT/etc/nsswitch.conf
309322

310323
# Install pam-radius-auth and nss-radius

‎src/sonic-yang-models/setup.py‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -164,6 +164,7 @@ def run(self):
164164
'./yang-models/sonic-system-aaa.yang',
165165
'./yang-models/sonic-system-tacacs.yang',
166166
'./yang-models/sonic-system-radius.yang',
167+
'./yang-models/sonic-system-ldap.yang',
167168
'./yang-models/sonic-telemetry.yang',
168169
'./yang-models/sonic-telemetry_client.yang',
169170
'./yang-models/sonic-gnmi.yang',

‎src/sonic-yang-models/tests/files/sample_config_db.json‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1631,6 +1631,22 @@
16311631
"timeout": "5"
16321632
}
16331633
},
1634+
"LDAP": {
1635+
"global": {
1636+
"bind_dn": "test_bind",
1637+
"bind_password": "secret",
1638+
"bind_timeout": "5",
1639+
"version": "3",
1640+
"base_dn": "test_base",
1641+
"port": "389",
1642+
"timeout": "5"
1643+
}
1644+
},
1645+
"LDAP_SERVER": {
1646+
"192.168.1.1": {
1647+
"priority": "5"
1648+
}
1649+
},
16341650
"NAT_BINDINGS": {
16351651
"bind1": {
16361652
"nat_pool": "pool1",

‎src/sonic-yang-models/tests/yang_model_tests/tests/ldap.json‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
{
2+
"LDAP_TABLE": {
3+
"desc": "Configure LDAP global fields."
4+
},
5+
"LDAP_INVALID_TIMEOUT_TEST": {
6+
"desc": "LDAP global configuration with invalid timeout value in LDAP table.",
7+
"eStr": "LDAP timeout must be 1..60"
8+
},
9+
"LDAP_SERVER_TEST" : {
10+
"desc": "LDAP server configuration in LDAP_SERVER table."
11+
},
12+
"LDAP_SERVER_INVALID_PRIORITY_TEST": {
13+
"desc": "LDAP server configuration with invalid priority value in LDAP_SERVER table.",
14+
"eStr": "LDAP server priority must be 1..8"
15+
}
16+
}

‎src/sonic-yang-models/tests/yang_model_tests/tests_config/ldap.json‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
{
2+
"LDAP_TABLE": {
3+
"sonic-system-ldap:sonic-system-ldap": {
4+
"sonic-system-ldap:LDAP": {
5+
"global":{
6+
"bind_dn": "test_bind",
7+
"bind_password": "secret",
8+
"bind_timeout": "5",
9+
"version": "3",
10+
"base_dn": "test_base",
11+
"port": "389",
12+
"timeout": "5"
13+
}
14+
}
15+
}
16+
},
17+
"LDAP_INVALID_TIMEOUT_TEST": {
18+
"sonic-system-ldap:sonic-system-ldap": {
19+
"sonic-system-ldap:LDAP": {
20+
"global": {
21+
"bind_dn": "test_bind",
22+
"bind_password": "secret",
23+
"bind_timeout": "5",
24+
"version": "3",
25+
"base_dn": "test_base",
26+
"port": "389",
27+
"timeout": 150
28+
}
29+
}
30+
}
31+
},
32+
"LDAP_SERVER_TEST": {
33+
"sonic-system-ldap:sonic-system-ldap": {
34+
"sonic-system-ldap:LDAP_SERVER": {
35+
"LDAP_SERVER_LIST": [
36+
{
37+
"hostname": "192.168.1.1",
38+
"priority": 1
39+
},
40+
{
41+
"hostname": "ldap_server_1",
42+
"priority": 2
43+
}
44+
]
45+
}
46+
}
47+
},
48+
49+
"LDAP_SERVER_INVALID_PRIORITY_TEST": {
50+
"sonic-system-ldap:sonic-system-ldap": {
51+
"sonic-system-ldap:LDAP_SERVER": {
52+
"LDAP_SERVER_LIST": [
53+
{
54+
"hostname": "192.168.1.1",
55+
"priority": 70
56+
}
57+
]
58+
}
59+
}
60+
}
61+
}

‎src/sonic-yang-models/yang-models/sonic-system-aaa.yang‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,11 +35,11 @@ module sonic-system-aaa {
3535

3636
leaf login {
3737
type string {
38-
pattern '((tacacs\+|local|radius|default),)*(tacacs\+|local|radius|default)' {
38+
pattern '((ldap|tacacs\+|local|radius|default),)*(ldap|tacacs\+|local|radius|default)' {
3939
error-message "Invalid login choice";
4040
}
4141
}
42-
description "AAA authentication/authorization/accounting methods - radius/tacacs+/local/default";
42+
description "AAA authentication/authorization/accounting methods - radius/tacacs+/ldap|local/default";
4343
default "local";
4444
}
4545

‎src/sonic-yang-models/yang-models/sonic-system-ldap.yang‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
module sonic-system-ldap {
2+
yang-version 1.1;
3+
namespace "http://github.com/Azure/sonic-system-ldap";
4+
prefix ssys-ldap;
5+
6+
import ietf-inet-types {
7+
prefix inet;
8+
}
9+
10+
description "LDAP YANG Module for SONiC OS";
11+
12+
revision 2023-10-01 {
13+
description "First Revision";
14+
}
15+
16+
container sonic-system-ldap {
17+
18+
container LDAP_SERVER {
19+
list LDAP_SERVER_LIST {
20+
max-elements 8;
21+
key "hostname";
22+
23+
leaf hostname {
24+
type inet:host;
25+
description
26+
"LDAP server's Domain name or IP address (IPv4 or IPv6)";
27+
}
28+
29+
leaf priority {
30+
default 1;
31+
type uint8 {
32+
range "1..8" {
33+
error-message "LDAP server priority must be 1..8";
34+
}
35+
}
36+
description "Server priority";
37+
}
38+
}
39+
}
40+
41+
container LDAP {
42+
43+
container global {
44+
45+
46+
leaf bind_dn {
47+
type string {
48+
length "1..65";
49+
}
50+
description
51+
'LDAP global bind dn';
52+
}
53+
54+
leaf bind_password {
55+
type string {
56+
length "1..65";
57+
pattern "[^ #,]*" {
58+
error-message 'LDAP shared secret (Valid chars are ASCII printable except SPACE, "#", and ",")';
59+
}
60+
}
61+
description "Shared secret used for encrypting the communication";
62+
}
63+
64+
leaf bind_timeout {
65+
default 5;
66+
type uint16 {
67+
range "1..120" {
68+
error-message "Ldap bind timeout must be 1..120";
69+
}
70+
}
71+
description "Ldap bind timeout";
72+
}
73+
74+
leaf version {
75+
default 3;
76+
type uint16 {
77+
range "1..3" {
78+
error-message "Ldap version must be 1..3";
79+
}
80+
}
81+
description "Ldap version";
82+
}
83+
84+
leaf base_dn {
85+
type string {
86+
length "1..65";
87+
}
88+
description "Ldap user base dn";
89+
}
90+
91+
leaf port {
92+
type inet:port-number;
93+
default 389;
94+
description "TCP port to communicate with LDAP server";
95+
}
96+
97+
leaf timeout {
98+
description "Ldap timeout duration in sec";
99+
type uint16 {
100+
range "1..60" {
101+
error-message "LDAP timeout must be 1..60";
102+
}
103+
}
104+
}
105+
} /* container global */
106+
} /* container LDAP */
107+
}/* container sonic-system-ldap */
108+
}/* end of module sonic-system-ldap */

0 commit comments

Comments
 (0)