Migration vers l'image bitnami/openldap + documentation + prise en compte de plusieurs schemas dès l'installation
This commit is contained in:
parent
33c065880e
commit
97a834a3d5
7 changed files with 320 additions and 91 deletions
227
README.md
227
README.md
|
|
@ -3,7 +3,7 @@
|
||||||
|
|
||||||
## Services fournis
|
## Services fournis
|
||||||
|
|
||||||
Installation de openldap sur un serveur docker_host
|
Installation de l'image bitnami openldap sur un serveur docker_host avec schemas rfc2307bis, owncloud (pour quotas) et postfix-book.
|
||||||
|
|
||||||
|
|
||||||
## Variables
|
## Variables
|
||||||
|
|
@ -12,72 +12,85 @@ Fournir les variables suivantes. Par exemple :
|
||||||
|
|
||||||
```yaml
|
```yaml
|
||||||
docker_openldap_data_dir: /data1
|
docker_openldap_data_dir: /data1
|
||||||
docker_openldap_service_id: openldap
|
docker_openldap_service_id: ldap_example_com
|
||||||
|
docker_openldap_version: latest
|
||||||
|
docker_openldap_rootdn: "dc=example,dc=com"
|
||||||
|
docker_openldap_admin_password: "pwdAdmin"
|
||||||
|
docker_openldap_config_password: "pwdConfig"
|
||||||
```
|
```
|
||||||
|
|
||||||
| Option | Valeur par défaut | Description |
|
| Option | Valeur par défaut | Description |
|
||||||
|--------------------------------|-------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|
|
|----------------------------------------|-------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||||
| docker_openldap_data_dir | | L'emplacement dans lequel se trouvent les volumes de donnees docker pour le service |
|
| docker_openldap_data_dir | | L'emplacement dans lequel se trouvent les volumes de donnees docker pour le service |
|
||||||
| docker_openldap_service_id | | Le nom de service souhaité : conditionne le nommage des volumes |
|
| docker_openldap_service_id | | Le nom de service souhaité : conditionne le nommage des volumes |
|
||||||
| docker_openldap_port | 389 | Le numero de port local pour la connexion à openldap |
|
|
||||||
| docker_openldap_version | | Version du conteneur docker souhaité |
|
| docker_openldap_version | | Version du conteneur docker souhaité |
|
||||||
|
| docker_openldap_port | 389 | Le numero de port local pour la connexion à openldap non chiffré |
|
||||||
|
| docker_openldap_port_tls | 636 | Le numero de port local pour la connexion à openldap via tls |
|
||||||
| docker_openldap_rootdn | | dn de la racine de l'annuaire (par exemple: dc=example,dc=com) |
|
| docker_openldap_rootdn | | dn de la racine de l'annuaire (par exemple: dc=example,dc=com) |
|
||||||
|
| docker_openldap_admin_username | ldapadmin | Nom de l'administrateur de l'annuaire |
|
||||||
| docker_openldap_admin_password | | Mot de passe administrateur de l'annuaire ; le dn de l'administrateur est cn=admin suivi du rootdn, par exemple : cn=admin,dc=example,dc=com) |
|
| docker_openldap_admin_password | | Mot de passe administrateur de l'annuaire ; le dn de l'administrateur est cn=admin suivi du rootdn, par exemple : cn=admin,dc=example,dc=com) |
|
||||||
| docker_openldap_organization | | Le nom de l'organisation pour cet annuaire (attribut o de la racine) |
|
| docker_openldap_config_username | configadmin | Nom de l'administrateur de configuration de l'annuaire |
|
||||||
|
| docker_openldap_config_password | | Mot de passe administrateur de configuration de l'annuaire ; le dn de l'administrateur est cn=admin suivi du rootdn, par exemple : cn=admin,dc=example,dc=com) |
|
||||||
|
| docker_openldap_configure_ppolicy | yes | Permet d'activer la configuration du module openldap ppolicy permettant de définir un stratégie applicable aux mots de passe |
|
||||||
|
| docker_openldap_ppolicy_hash_cleartext | yes | Si le module ppolicy est activé, configure le hachage des mots de passe si ces derniers sont définis par le client en clair |
|
||||||
|
| docker_openldap_enable_tls | no | Permet d'activer la configuration de tls. Lire la section TLS ci-dessous. |
|
||||||
|
| docker_openldap_require_tls | no | Permet d'exiger tls même sur le port non chiffré |
|
||||||
|
| docker_openldap_allow_anon_binding: | no | Permet d'exiger une authentification pour se connecter à l'annuaire |
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
## Configuration TLS
|
||||||
|
|
||||||
|
Si la configuration TLS est activée, le dossier certs, présent dans le même dossier que docker-compose.yml, devra contenir :
|
||||||
|
- pubcert.pem : le certificat présenté par le serveur
|
||||||
|
- privkey.pem : la clé privée relative à la clé publique du certificat ci-dessus
|
||||||
|
- chain.pem : la chaine de certification permettant aux clients de vérifier la validité du certificat présenté.
|
||||||
|
|
||||||
|
|
||||||
# Poursuite de l'installation du serveur openldap
|
# Poursuite de l'installation du serveur openldap
|
||||||
|
|
||||||
|
## Vérification de la bonne connexion à l'annuaire
|
||||||
|
|
||||||
|
* Connexion à l'annuaire en tant qu'administrateur
|
||||||
|
```
|
||||||
|
ldapvi -h ldap://fqdn:389 -b "dc=example,dc=org" -D cn=ldapadmin,dc=example,dc=org
|
||||||
|
```
|
||||||
|
|
||||||
|
* Connexion à l'annuaire en tant qu'administrateur de configuration (pour modification des acl ou autre)
|
||||||
|
```
|
||||||
|
ldapvi -h ldap://fqdn:389 -b "cn=config" -D cn=configadmin,cn=config
|
||||||
|
```
|
||||||
|
|
||||||
|
- dn de base : cn=config => pour configurer le serveur openldap
|
||||||
|
- dn de base : cn=schema,cn=config => pour consulter les schemas connus par openldap
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
## Configuration de la strategie de mot de passe avec le module ppolicy
|
## Configuration de la strategie de mot de passe avec le module ppolicy
|
||||||
|
|
||||||
### Activation du module ppolicy
|
### Vérification que le module ppolicy est bien activé
|
||||||
|
|
||||||
```
|
```
|
||||||
# docker exec -ti -u openldap 7520847e9e47 bash
|
# docker compose exec -i openldap slapcat -n 0 -F /bitnami/openldap/slapd.d/ | grep olcModuleLoad | grep ppolicy
|
||||||
openldap@7520847e9e47:/$ cd /tmp
|
olcModuleLoad: {0}ppolicy.so
|
||||||
|
|
||||||
openldap@7520847e9e47:/tmp$ slapcat -n 0 | grep olcModuleLoad | grep ppolicy
|
|
||||||
|
|
||||||
openldap@7520847e9e47:/tmp$ cat > ppolicy-module.ldif
|
|
||||||
dn: cn=module,cn=config
|
|
||||||
objectClass: olcModuleList
|
|
||||||
cn: module
|
|
||||||
olcModuleLoad: ppolicy
|
|
||||||
^D
|
|
||||||
|
|
||||||
openldap@7520847e9e47:/tmp$ slapadd -n0 -l ppolicy-module.ldif
|
|
||||||
_#################### 100.00% eta none elapsed none fast!
|
|
||||||
Closing DB...
|
|
||||||
|
|
||||||
openldap@7520847e9e47:/tmp$ slapcat -n 0 | grep olcModuleLoad | grep ppolicy
|
|
||||||
olcModuleLoad: {0}ppolicy
|
|
||||||
```
|
```
|
||||||
|
|
||||||
et redémarrer le conteneur
|
### Configuration du module ppolicy
|
||||||
|
|
||||||
### Ajout de la configuration du module ppolicy
|
Repérer l'overlay ppolicy et le modifier comme suit :
|
||||||
|
|
||||||
```
|
```
|
||||||
# docker exec -ti d7f2803e5cfb bash
|
# ldapvi -h ldap://fqdn:389 -b "cn=config" -D cn=configadmin,cn=config
|
||||||
root@d7f2803e5cfb:/# cd /tmp/
|
[...]
|
||||||
|
dn: olcOverlay={0}ppolicy,olcDatabase={2}mdb,cn=config
|
||||||
root@d7f2803e5cfb:/tmp# cat > ppolicyoverlay.ldif
|
|
||||||
dn: olcOverlay={2}ppolicy,olcDatabase={1}mdb,cn=config
|
|
||||||
changetype: add
|
|
||||||
objectClass: olcPPolicyConfig
|
objectClass: olcPPolicyConfig
|
||||||
objectClass: olcOverlayConfig
|
objectClass: olcOverlayConfig
|
||||||
olcOverlay: {2}ppolicy
|
olcOverlay: {0}ppolicy
|
||||||
olcPPolicyDefault: cn=defaultPasswordPolicy,ou=policies,dc=libretic,dc=fr
|
olcPPolicyDefault: cn=defaultPasswordPolicy,ou=policies,dc=example,dc=org
|
||||||
olcPPolicyForwardUpdates: TRUE
|
olcPPolicyForwardUpdates: TRUE
|
||||||
olcPPolicyHashCleartext: TRUE
|
olcPPolicyHashCleartext: TRUE
|
||||||
olcPPolicyUseLockout: TRUE
|
olcPPolicyUseLockout: TRUE
|
||||||
^D
|
[...]
|
||||||
|
|
||||||
root@d7f2803e5cfb:/tmp# ldapadd -Y EXTERNAL -H ldapi:// -f ppolicyoverlay.ldif
|
|
||||||
SASL/EXTERNAL authentication started
|
|
||||||
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
|
|
||||||
SASL SSF: 0
|
|
||||||
adding new entry "olcOverlay={2}ppolicy,olcDatabase={1}mdb,cn=config"
|
|
||||||
```
|
```
|
||||||
|
|
||||||
### Ajout d'une stratégie de mot de passe par défaut
|
### Ajout d'une stratégie de mot de passe par défaut
|
||||||
|
|
@ -85,12 +98,13 @@ adding new entry "olcOverlay={2}ppolicy,olcDatabase={1}mdb,cn=config"
|
||||||
Valeurs à adapter en fonction du besoin.
|
Valeurs à adapter en fonction du besoin.
|
||||||
|
|
||||||
```
|
```
|
||||||
root@d7f2803e5cfb:/tmp# cat > defaultppolicy.ldif
|
# ldapvi -h ldap://fqdn:389 -b "dc=example,dc=org" -D cn=ldapadmin,dc=example,org
|
||||||
dn: ou=policies,dc=libretic,dc=fr
|
[...]
|
||||||
|
add: ou=policies,dc=example,dc=org
|
||||||
objectClass: organizationalUnit
|
objectClass: organizationalUnit
|
||||||
ou: policies
|
ou: policies
|
||||||
|
|
||||||
dn: cn=defaultPasswordPolicy,ou=policies,dc=libretic,dc=fr
|
add: cn=defaultPasswordPolicy,ou=policies,dc=example,dc=org
|
||||||
objectClass: top
|
objectClass: top
|
||||||
objectClass: device
|
objectClass: device
|
||||||
objectClass: pwdPolicyChecker
|
objectClass: pwdPolicyChecker
|
||||||
|
|
@ -108,55 +122,120 @@ pwdMaxAge: 0
|
||||||
pwdExpireWarning: 1209600
|
pwdExpireWarning: 1209600
|
||||||
pwdLockoutDuration: 900
|
pwdLockoutDuration: 900
|
||||||
pwdLockout: TRUE
|
pwdLockout: TRUE
|
||||||
root@d7f2803e5cfb:/tmp# ldapadd -Y EXTERNAL -H ldapi:// -f defaultppolicy.ldif
|
[...]
|
||||||
SASL/EXTERNAL authentication started
|
|
||||||
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
|
|
||||||
SASL SSF: 0
|
|
||||||
adding new entry "ou=policies,dc=libretic,dc=fr"
|
|
||||||
|
|
||||||
adding new entry "cn=defaultPasswordPolicy,ou=policies,dc=libretic,dc=fr"
|
|
||||||
```
|
```
|
||||||
|
|
||||||
|
|
||||||
## Accès à l'annuaire en tant qu'administrateur de config
|
## Ajout des overlays memberOf et refint
|
||||||
|
|
||||||
Permet par exemple une modification des acl pour une modification avec apache directory studio (pratique).
|
Ces overlays permettent d'avoir des attributs "virtuels" memberof dans les utilisateurs qui contiennent les groupes auxquels un utilisateur appartient.
|
||||||
|
|
||||||
|
Adapter les valeurs si besoin.
|
||||||
|
|
||||||
### Modifier le mdp de l'administrateur de config
|
Ne s'applique qu'aux groupes créés postérieurement à la configuration.
|
||||||
|
|
||||||
#### Créer la valeur chiffrée du mdp
|
|
||||||
```
|
```
|
||||||
root@docker-host:/# docker exec -ti 04a84d35f749 bash
|
# ldapvi -h ldap://fqdn:389 -b "cn=config" -D cn=configadmin,cn=config
|
||||||
|
[...]
|
||||||
|
add cn=module{2},cn=config
|
||||||
|
objectClass: olcModuleList
|
||||||
|
cn: module{2}
|
||||||
|
olcModulePath: /opt/bitnami/openldap/lib/openldap
|
||||||
|
olcModuleLoad: {0}memberof.so
|
||||||
|
|
||||||
root@04a84d35f749:/# slappasswd
|
add cn=module{3},cn=config
|
||||||
|
objectClass: olcModuleList
|
||||||
|
cn: module{3}
|
||||||
|
olcModulePath: /opt/bitnami/openldap/lib/openldap
|
||||||
|
olcModuleLoad: {0}refint.so
|
||||||
|
|
||||||
|
add olcOverlay={0}memberof,olcDatabase={2}mdb,cn=config
|
||||||
|
objectClass: olcConfig
|
||||||
|
objectClass: olcMemberOfConfig
|
||||||
|
objectClass: olcOverlayConfig
|
||||||
|
objectClass: top
|
||||||
|
olcOverlay: {0}memberof
|
||||||
|
olcMemberOfDangling: ignore
|
||||||
|
olcMemberOfRefInt: TRUE
|
||||||
|
olcMemberOfGroupOC: groupOfUniqueNames
|
||||||
|
olcMemberOfMemberAD: uniqueMember
|
||||||
|
olcMemberOfMemberOfAD: memberOf
|
||||||
|
|
||||||
|
add olcOverlay={1}refint,olcDatabase={2}mdb,cn=config
|
||||||
|
objectClass: olcConfig
|
||||||
|
objectClass: olcOverlayConfig
|
||||||
|
objectClass: olcRefintConfig
|
||||||
|
objectClass: top
|
||||||
|
olcOverlay: {1}refint
|
||||||
|
olcRefintAttribute: manager
|
||||||
|
olcRefintAttribute: member
|
||||||
|
olcRefintAttribute: memberof
|
||||||
|
olcRefintAttribute: owner
|
||||||
|
olcRefintAttribute: uniqueMember
|
||||||
|
[...]
|
||||||
|
```
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
## Changer un mot de passe admin
|
||||||
|
|
||||||
|
* Obtenir le mot de passe chiffré
|
||||||
|
```
|
||||||
|
# docker compose exec -i openldap slappasswd
|
||||||
New password:
|
New password:
|
||||||
Re-enter new password:
|
Re-enter new password:
|
||||||
{SSHA}FqKYv/azMmj/tp2LTSWzOzJf65h/nRKp
|
{SSHA}FqKYv/azMmj/tp2LTSWzOzJf65h/nRKp
|
||||||
```
|
```
|
||||||
|
|
||||||
#### Créer un fichier modify.ldif pour
|
* Se connecter avec le compte administrateur approprié et editer l'attribut userPassword pour remplacer l'ancien mot de passe chiffré par le nouveau
|
||||||
|
|
||||||
|
|
||||||
|
## Configuration TLS
|
||||||
|
|
||||||
|
Le conteneur prend en charge la configuration de TLS dans OpenLDAP si cette configuration est présente dans les variables d'environnement lors du premier démarrage. Il est donc préférable de disposer des certificats avant le premier démarrage.
|
||||||
|
|
||||||
|
Dans le cas contraire, l'ajout des directives *TLS* dans la configuration sera sans effet. Pour configurer TLS à posteriori :
|
||||||
|
|
||||||
|
```
|
||||||
|
# ldapvi -h ldap://fqdn:389 -b "cn=config" -D cn=configadmin,cn=config
|
||||||
|
0 cn=config
|
||||||
|
objectClass: olcGlobal
|
||||||
|
cn: config
|
||||||
|
[...]
|
||||||
|
olcTLSCACertificateFile: /bitnami/certs/chain.pem
|
||||||
|
olcTLSCertificateFile: /bitnami/certs/pubcert.pem
|
||||||
|
olcTLSCertificateKeyFile: /bitnami/certs/privkey.pem
|
||||||
|
olcTLSVerifyClient: never
|
||||||
|
[...]
|
||||||
```
|
```
|
||||||
root@04a84d35f749:/# cd /tmp/
|
|
||||||
|
|
||||||
root@04a84d35f749:/tmp# cat > modify.ldif
|
Pour tester et deboguer :
|
||||||
dn: olcDatabase={0}config,cn=config
|
```
|
||||||
changetype: modify
|
ldapsearch -d 1 -LLL -H ldaps://fqdn:636 -x "dc=example,dc=org" -D cn=ldapadmin,dc=example,org
|
||||||
delete: olcRootPW
|
```
|
||||||
-
|
|
||||||
add: olcRootPW
|
|
||||||
olcRootPW: {SSHA}FqKYv/azMmj/tp2LTSWzOzJf65h/nRKp
|
|
||||||
^D
|
|
||||||
|
|
||||||
root@04a84d35f749:/tmp# ldapmodify -Y EXTERNAL -H ldapi:// -f modify.ldif
|
Pour tester la chaine de certification :
|
||||||
|
```
|
||||||
|
openssl s_client -connect fqdn:636 -msg -verify 1
|
||||||
|
```
|
||||||
|
|
||||||
|
Et en, cas de problème tel que :
|
||||||
|
```
|
||||||
|
ldap_sasl_bind(SIMPLE): Can't contact LDAP server (-1)
|
||||||
|
```
|
||||||
|
|
||||||
|
vérifier que le fichier de configuration du client LDAP contient bien un trousseau de certificats contenant la racine, par exemple :
|
||||||
|
```
|
||||||
|
# cat /etc/ldap/ldap.conf
|
||||||
|
TLS_CACERTDIR /etc/ssl/certs/
|
||||||
```
|
```
|
||||||
|
|
||||||
|
|
||||||
## Connection depuis apache directory studio
|
## Ajout de schemas supplémentaires
|
||||||
|
|
||||||
Configurer ADS avec :
|
Si des schémas supplémentaires sont présents dans le dossier custom-schemas avant le premier démarrage, ils seront intégrés à l'annuaire. Dans le cas contraire, pour en ajouter, placer le fichier ldif du schema à ajouter dans le dossier custom-schemas puis faire :
|
||||||
- compte : cn=admin,cn=config
|
|
||||||
- mdp : celui utilisé avec slappasswd
|
```
|
||||||
- dn de base : olcDatabase={1}mdb,cn=config => pour configurer le serveur openldap
|
ldapadd -H ldap://fqdn:389 -x -W -D "cn=configadmin,cn=config" -f custom-schemas/monschema.ldif
|
||||||
- dn de base : cn=schema,cn=config => pour consulter les schemas connus par openldap
|
```
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1 +1,10 @@
|
||||||
docker_openldap_port: "389"
|
docker_openldap_port: "389"
|
||||||
|
docker_openldap_port_tls: "636"
|
||||||
|
docker_openldap_admin_username: ldapadmin
|
||||||
|
docker_openldap_config_username: configadmin
|
||||||
|
docker_openldap_configure_ppolicy: "yes"
|
||||||
|
docker_openldap_ppolicy_hash_cleartext: "yes"
|
||||||
|
docker_openldap_enable_tls: "no"
|
||||||
|
docker_openldap_require_tls: "no"
|
||||||
|
docker_openldap_allow_anon_binding: "no"
|
||||||
|
|
||||||
|
|
|
||||||
33
files/owncloud.ldif
Normal file
33
files/owncloud.ldif
Normal file
|
|
@ -0,0 +1,33 @@
|
||||||
|
#
|
||||||
|
# SCHEMA 'ownCloud' for OpenLDAP OLC (cn=config)
|
||||||
|
#
|
||||||
|
# From http://doc.owncloud.org/server/6.0/admin_manual/configuration/auth_ldap.html
|
||||||
|
#
|
||||||
|
# Quota Field:
|
||||||
|
# ownCloud can read an LDAP attribute and set the user quota according to its value.
|
||||||
|
# Specify the attribute here, otherwise keep it empty. The attribute shall return
|
||||||
|
# human readable values, e.g. "2 GB".
|
||||||
|
#
|
||||||
|
# INSTALLATION:
|
||||||
|
# sudo ldapadd -Y EXTERNAL -H ldapi:/// -f owncloud.ldif
|
||||||
|
#
|
||||||
|
# SOURCE:
|
||||||
|
# https://github.com/valerytschopp/owncloud-ldap-schema
|
||||||
|
#
|
||||||
|
# WARNING: the spaces ' ' in the definitions are very important!!!
|
||||||
|
|
||||||
|
dn: cn=owncloud,cn=schema,cn=config
|
||||||
|
objectClass: olcSchemaConfig
|
||||||
|
cn: owncloud
|
||||||
|
olcAttributeTypes: ( 1.3.6.1.4.1.39430.1.1.1
|
||||||
|
NAME 'ownCloudQuota'
|
||||||
|
DESC 'User Quota (e.g. 2 GB)'
|
||||||
|
EQUALITY caseExactMatch
|
||||||
|
SUBSTR caseIgnoreSubstringsMatch
|
||||||
|
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
|
||||||
|
SINGLE-VALUE )
|
||||||
|
olcObjectClasses: ( 1.3.6.1.4.1.39430.1.2.1
|
||||||
|
NAME 'ownCloud'
|
||||||
|
DESC 'ownCloud LDAP Schema'
|
||||||
|
AUXILIARY
|
||||||
|
MAY ( ownCloudQuota ) )
|
||||||
23
files/postfix-book.ldif
Normal file
23
files/postfix-book.ldif
Normal file
|
|
@ -0,0 +1,23 @@
|
||||||
|
#
|
||||||
|
# SCHEMA 'postfix-book' for OpenLDAP OLC (cn=config)
|
||||||
|
#
|
||||||
|
# Fait depuis https://github.com/variablenix/ldap-mail-schema/blob/master/postfix-book.schema
|
||||||
|
#
|
||||||
|
# INSTALLATION:
|
||||||
|
# sudo ldapadd -Y EXTERNAL -H ldapi:/// -f postfix-book.ldif
|
||||||
|
#
|
||||||
|
dn: cn=postfix-book,cn=schema,cn=config
|
||||||
|
objectClass: olcSchemaConfig
|
||||||
|
cn: postfix-book
|
||||||
|
olcAttributeTypes: ( 1.3.6.1.4.1.29426.1.10.1 NAME 'mailHomeDirectory' DESC 'The absolute path to the mail user home directory' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: ( 1.3.6.1.4.1.29426.1.10.2 NAME 'mailAlias' DESC 'RFC822 Mailbox - mail alias' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
|
||||||
|
olcAttributeTypes: ( 1.3.6.1.4.1.29426.1.10.3 NAME 'mailUidNumber' DESC 'UID required to access the mailbox' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: ( 1.3.6.1.4.1.29426.1.10.4 NAME 'mailGidNumber' DESC 'GID required to access the mailbox' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: ( 1.3.6.1.4.1.29426.1.10.5 NAME 'mailEnabled' DESC 'TRUE to enable, FALSE to disable account' EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: ( 1.3.6.1.4.1.29426.1.10.6 NAME 'mailGroupMember' DESC 'Name of a mail distribution list' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||||
|
olcAttributeTypes: ( 1.3.6.1.4.1.29426.1.10.7 NAME 'mailQuota' DESC 'Mail quota limit in kilobytes' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||||
|
olcAttributeTypes: ( 1.3.6.1.4.1.29426.1.10.8 NAME 'mailStorageDirectory' DESC 'The absolute path to the mail users mailbox' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: ( 1.3.6.1.4.1.29426.1.10.9 NAME 'mailSieveRuleSource' DESC 'Sun ONE Messaging Server defined attribute' SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 X-ORIGIN 'Sun ONE Messaging Server' )
|
||||||
|
olcAttributeTypes: ( 1.3.6.1.4.1.29426.1.10.10 NAME 'mailForwardingAddress' DESC 'Address(es) to forward all incoming messages to.' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{320} )
|
||||||
|
olcObjectClasses: ( 1.3.6.1.4.1.29426.1.2.2.1 NAME 'PostfixBookMailAccount' DESC 'Mail account used in Postfix Book' SUP top AUXILIARY MUST mail MAY ( mailHomeDirectory $ mailAlias $ mailGroupMember $ mailUidNumber $ mailGidNumber $ mailEnabled $ mailQuota $ mailStorageDirectory $ mailSieveRuleSource ) )
|
||||||
|
olcObjectClasses: ( 1.3.6.1.4.1.29426.1.2.2.2 NAME 'PostfixBookMailForward' DESC 'Mail forward used in Postfix Book' SUP top AUXILIARY MUST ( mail $ mailAlias ) MAY mailForwardingAddress )
|
||||||
52
files/rfc2307bis.ldif
Normal file
52
files/rfc2307bis.ldif
Normal file
|
|
@ -0,0 +1,52 @@
|
||||||
|
dn: cn=rfc2307bis,cn=schema,cn=config
|
||||||
|
objectClass: olcSchemaConfig
|
||||||
|
cn: rfc2307bis
|
||||||
|
olcAttributeTypes: ( 1.3.6.1.1.1.1.2 NAME 'gecos' DESC 'The GECOS field; the common name' EQUALITY caseIgnoreIA5Match SUBSTR caseIgnoreIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: ( 1.3.6.1.1.1.1.3 NAME 'homeDirectory' DESC 'The absolute path to the home directory' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: ( 1.3.6.1.1.1.1.4 NAME 'loginShell' DESC 'The path to the login shell' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: ( 1.3.6.1.1.1.1.5 NAME 'shadowLastChange' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: ( 1.3.6.1.1.1.1.6 NAME 'shadowMin' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: ( 1.3.6.1.1.1.1.7 NAME 'shadowMax' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: ( 1.3.6.1.1.1.1.8 NAME 'shadowWarning' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: ( 1.3.6.1.1.1.1.9 NAME 'shadowInactive' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: ( 1.3.6.1.1.1.1.10 NAME 'shadowExpire' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: ( 1.3.6.1.1.1.1.11 NAME 'shadowFlag' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: ( 1.3.6.1.1.1.1.12 NAME 'memberUid' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||||
|
olcAttributeTypes: ( 1.3.6.1.1.1.1.13 NAME 'memberNisNetgroup' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||||
|
olcAttributeTypes: ( 1.3.6.1.1.1.1.14 NAME 'nisNetgroupTriple' DESC 'Netgroup triple' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||||
|
olcAttributeTypes: ( 1.3.6.1.1.1.1.15 NAME 'ipServicePort' DESC 'Service port number' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: ( 1.3.6.1.1.1.1.16 NAME 'ipServiceProtocol' DESC 'Service protocol name' SUP name )
|
||||||
|
olcAttributeTypes: ( 1.3.6.1.1.1.1.17 NAME 'ipProtocolNumber' DESC 'IP protocol number' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: ( 1.3.6.1.1.1.1.18 NAME 'oncRpcNumber' DESC 'ONC RPC number' EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: ( 1.3.6.1.1.1.1.19 NAME 'ipHostNumber' DESC 'IPv4 addresses as a dotted decimal omitting leading zeros or IPv6 addresses as defined in RFC2373' SUP name )
|
||||||
|
olcAttributeTypes: ( 1.3.6.1.1.1.1.20 NAME 'ipNetworkNumber' DESC 'IP network as a dotted decimal, eg. 192.168, omitting leading zeros' SUP name SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: ( 1.3.6.1.1.1.1.21 NAME 'ipNetmaskNumber' DESC 'IP netmask as a dotted decimal, eg. 255.255.255.0, omitting leading zeros' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: ( 1.3.6.1.1.1.1.22 NAME 'macAddress' DESC 'MAC address in maximal, colon separated hex notation, eg. 00:00:92:90:ee:e2' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||||
|
olcAttributeTypes: ( 1.3.6.1.1.1.1.23 NAME 'bootParameter' DESC 'rpc.bootparamd parameter' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||||
|
olcAttributeTypes: ( 1.3.6.1.1.1.1.24 NAME 'bootFile' DESC 'Boot image name' EQUALITY caseExactIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||||
|
olcAttributeTypes: ( 1.3.6.1.1.1.1.26 NAME 'nisMapName' DESC 'Name of a A generic NIS map' SUP name )
|
||||||
|
olcAttributeTypes: ( 1.3.6.1.1.1.1.27 NAME 'nisMapEntry' DESC 'A generic NIS entry' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: ( 1.3.6.1.1.1.1.28 NAME 'nisPublicKey' DESC 'NIS public key' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: ( 1.3.6.1.1.1.1.29 NAME 'nisSecretKey' DESC 'NIS secret key' EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: ( 1.3.6.1.1.1.1.30 NAME 'nisDomain' DESC 'NIS domain' EQUALITY caseIgnoreIA5Match SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
|
||||||
|
olcAttributeTypes: ( 1.3.6.1.1.1.1.31 NAME 'automountMapName' DESC 'automount Map Name' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: ( 1.3.6.1.1.1.1.32 NAME 'automountKey' DESC 'Automount Key value' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||||
|
olcAttributeTypes: ( 1.3.6.1.1.1.1.33 NAME 'automountInformation' DESC 'Automount information' EQUALITY caseExactIA5Match SUBSTR caseExactIA5SubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
|
||||||
|
olcObjectClasses: ( 1.3.6.1.1.1.2.0 NAME 'posixAccount' DESC 'Abstraction of an account with POSIX attributes' SUP top AUXILIARY MUST ( cn $ uid $ uidNumber $ gidNumber $ homeDirectory ) MAY ( userPassword $ loginShell $ gecos $ description ) )
|
||||||
|
olcObjectClasses: ( 1.3.6.1.1.1.2.1 NAME 'shadowAccount' DESC 'Additional attributes for shadow passwords' SUP top AUXILIARY MUST uid MAY ( userPassword $ description $ shadowLastChange $ shadowMin $ shadowMax $ shadowWarning $ shadowInactive $ shadowExpire $ shadowFlag ) )
|
||||||
|
olcObjectClasses: ( 1.3.6.1.1.1.2.2 NAME 'posixGroup' DESC 'Abstraction of a group of accounts' SUP top AUXILIARY MUST gidNumber MAY ( userPassword $ memberUid $ description ) )
|
||||||
|
olcObjectClasses: ( 1.3.6.1.1.1.2.3 NAME 'ipService' DESC 'Abstraction an Internet Protocol service. Maps an IP port and protocol (such as tcp or udp) to one or more names; the distinguished value of the cn attribute denotes the services canonical name' SUP top STRUCTURAL MUST ( cn $ ipServicePort $ ipServiceProtocol ) MAY description )
|
||||||
|
olcObjectClasses: ( 1.3.6.1.1.1.2.4 NAME 'ipProtocol' DESC 'Abstraction of an IP protocol. Maps a protocol number to one or more names. The distinguished value of the cn attribute denotes the protocols canonical name' SUP top STRUCTURAL MUST ( cn $ ipProtocolNumber ) MAY description )
|
||||||
|
olcObjectClasses: ( 1.3.6.1.1.1.2.5 NAME 'oncRpc' DESC 'Abstraction of an Open Network Computing (ONC) [RFC1057] Remote Procedure Call (RPC) binding. This class maps an ONC RPC number to a name. The distinguished value of the cn attribute denotes the RPC services canonical name' SUP top STRUCTURAL MUST ( cn $ oncRpcNumber ) MAY description )
|
||||||
|
olcObjectClasses: ( 1.3.6.1.1.1.2.6 NAME 'ipHost' DESC 'Abstraction of a host, an IP device. The distinguished value of the cn attribute denotes the hosts canonical name. Device SHOULD be used as a structural class' SUP top AUXILIARY MUST ( cn $ ipHostNumber ) MAY ( userPassword $ l $ description $ manager ) )
|
||||||
|
olcObjectClasses: ( 1.3.6.1.1.1.2.7 NAME 'ipNetwork' DESC 'Abstraction of a network. The distinguished value of the cn attribute denotes the networks canonical name' SUP top STRUCTURAL MUST ipNetworkNumber MAY ( cn $ ipNetmaskNumber $ l $ description $ manager ) )
|
||||||
|
olcObjectClasses: ( 1.3.6.1.1.1.2.8 NAME 'nisNetgroup' DESC 'Abstraction of a netgroup. May refer to other netgroups' SUP top STRUCTURAL MUST cn MAY ( nisNetgroupTriple $ memberNisNetgroup $ description ) )
|
||||||
|
olcObjectClasses: ( 1.3.6.1.1.1.2.9 NAME 'nisMap' DESC 'A generic abstraction of a NIS map' SUP top STRUCTURAL MUST nisMapName MAY description )
|
||||||
|
olcObjectClasses: ( 1.3.6.1.1.1.2.10 NAME 'nisObject' DESC 'An entry in a NIS map' SUP top STRUCTURAL MUST ( cn $ nisMapEntry $ nisMapName ) MAY description )
|
||||||
|
olcObjectClasses: ( 1.3.6.1.1.1.2.11 NAME 'ieee802Device' DESC 'A device with a MAC address; device SHOULD be used as a structural class' SUP top AUXILIARY MAY macAddress )
|
||||||
|
olcObjectClasses: ( 1.3.6.1.1.1.2.12 NAME 'bootableDevice' DESC 'A device with boot parameters; device SHOULD be used as a structural class' SUP top AUXILIARY MAY ( bootFile $ bootParameter ) )
|
||||||
|
olcObjectClasses: ( 1.3.6.1.1.1.2.14 NAME 'nisKeyObject' DESC 'An object with a public and secret key' SUP top AUXILIARY MUST ( cn $ nisPublicKey $ nisSecretKey ) MAY ( uidNumber $ description ) )
|
||||||
|
olcObjectClasses: ( 1.3.6.1.1.1.2.15 NAME 'nisDomainObject' DESC 'Associates a NIS domain with a naming context' SUP top AUXILIARY MUST nisDomain )
|
||||||
|
olcObjectClasses: ( 1.3.6.1.1.1.2.16 NAME 'automountMap' SUP top STRUCTURAL MUST automountMapName MAY description )
|
||||||
|
olcObjectClasses: ( 1.3.6.1.1.1.2.17 NAME 'automount' DESC 'Automount information' SUP top STRUCTURAL MUST ( automountKey $ automountInformation ) MAY description )
|
||||||
|
olcObjectClasses: ( 1.3.6.1.4.1.5322.13.1.1 NAME 'namedObject' SUP top STRUCTURAL MAY cn )
|
||||||
|
|
@ -3,6 +3,25 @@
|
||||||
path: /opt/{{ docker_openldap_service_id }}/
|
path: /opt/{{ docker_openldap_service_id }}/
|
||||||
state: directory
|
state: directory
|
||||||
|
|
||||||
|
- name: custom schemas directory
|
||||||
|
file:
|
||||||
|
path: /opt/{{ docker_openldap_service_id }}/custom-schemas
|
||||||
|
state: directory
|
||||||
|
|
||||||
|
- name: certificates directory
|
||||||
|
file:
|
||||||
|
path: /opt/{{ docker_openldap_service_id }}/certs
|
||||||
|
state: directory
|
||||||
|
|
||||||
|
- name: copy custom schemas
|
||||||
|
copy:
|
||||||
|
src: "{{ item }}"
|
||||||
|
dest: /opt/{{ docker_openldap_service_id }}/custom-schemas/
|
||||||
|
with_items:
|
||||||
|
- rfc2307bis.ldif
|
||||||
|
- owncloud.ldif
|
||||||
|
- postfix-book.ldif
|
||||||
|
|
||||||
- name: prepare docker-compose.yml
|
- name: prepare docker-compose.yml
|
||||||
template:
|
template:
|
||||||
src: "{{ item }}"
|
src: "{{ item }}"
|
||||||
|
|
|
||||||
|
|
@ -3,19 +3,33 @@ version: '3.1'
|
||||||
|
|
||||||
services:
|
services:
|
||||||
openldap:
|
openldap:
|
||||||
image: osixia/openldap:{{ docker_openldap_version }}
|
image: bitnami/openldap:{{ docker_openldap_version }}
|
||||||
environment:
|
environment:
|
||||||
- LDAP_ORGANISATION={{ docker_openldap_organization }}
|
LDAP_ROOT: "{{ docker_openldap_rootdn }}"
|
||||||
- LDAP_DOMAIN={{ docker_openldap_rootdn }}
|
LDAP_ADMIN_USERNAME: "{{ docker_openldap_admin_username }}"
|
||||||
- LDAP_ADMIN_PASSWORD={{ docker_openldap_admin_password }}
|
LDAP_ADMIN_PASSWORD: "{{ docker_openldap_admin_password }}"
|
||||||
- LDAP_TLS=false
|
LDAP_CONFIG_ADMIN_ENABLED: "yes"
|
||||||
- LDAP_RFC2307BIS_SCHEMA=true
|
LDAP_CONFIG_ADMIN_USERNAME: "{{ docker_openldap_config_username }}"
|
||||||
|
LDAP_CONFIG_ADMIN_PASSWORD: "{{ docker_openldap_config_password }}"
|
||||||
|
LDAP_USER_DC: users
|
||||||
|
LDAP_CONFIGURE_PPOLICY: "{{ docker_openldap_configure_ppolicy }}"
|
||||||
|
LDAP_PPOLICY_HASH_CLEARTEXT: "{{ docker_openldap_ppolicy_hash_cleartext }}"
|
||||||
|
LDAP_ENABLE_TLS: "{{ docker_openldap_enable_tls }}"
|
||||||
|
LDAP_REQUIRE_TLS: "{{ docker_openldap_require_tls }}"
|
||||||
|
LDAP_ALLOW_ANON_BINDING: "{{ docker_openldap_allow_anon_binding }}"
|
||||||
|
LDAP_CUSTOM_SCHEMA_DIR: /bitnami/custom-schemas
|
||||||
|
LDAP_EXTRA_SCHEMAS: cosine, inetorgperson
|
||||||
|
{% if docker_openldap_enable_tls == "yes" %}
|
||||||
|
LDAP_TLS_CERT_FILE: /bitnami/certs/pubcert.pem
|
||||||
|
LDAP_TLS_KEY_FILE: /bitnami/certs/privkey.pem
|
||||||
|
LDAP_TLS_CA_FILE: /bitnami/certs/chain.pem
|
||||||
|
{% endif %}
|
||||||
restart: always
|
restart: always
|
||||||
volumes:
|
volumes:
|
||||||
- {{ docker_openldap_data_dir }}/{{ docker_openldap_service_id }}/ldap:/var/lib/ldap
|
- {{ docker_openldap_data_dir }}/{{ docker_openldap_service_id }}/ldap:/bitnami/openldap
|
||||||
- {{ docker_openldap_data_dir }}/{{ docker_openldap_service_id }}/slapd.d:/etc/ldap/slapd.d
|
- ./certs:/bitnami/certs
|
||||||
- /etc/timezone:/etc/timezone:ro
|
- ./custom-schemas:/bitnami/custom-schemas
|
||||||
- /etc/localtime:/etc/localtime:ro
|
|
||||||
ports:
|
ports:
|
||||||
- {{ docker_openldap_port }}:389
|
- {{ docker_openldap_port }}:1389
|
||||||
|
- {{ docker_openldap_port_tls }}:1636
|
||||||
|
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue