initial commit
This commit is contained in:
commit
e7aaed3b33
5 changed files with 203 additions and 0 deletions
162
README.md
Normal file
162
README.md
Normal file
|
|
@ -0,0 +1,162 @@
|
||||||
|
# Role : docker_openldap
|
||||||
|
|
||||||
|
|
||||||
|
## Services fournis
|
||||||
|
|
||||||
|
Installation de openldap sur un serveur docker_host
|
||||||
|
|
||||||
|
|
||||||
|
## Variables
|
||||||
|
|
||||||
|
Fournir les variables suivantes. Par exemple :
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
docker_openldap_data_dir: /data1
|
||||||
|
docker_openldap_service_id: openldap
|
||||||
|
```
|
||||||
|
|
||||||
|
| Option | Valeur par défaut | Description |
|
||||||
|
|--------------------------------|-------------------|-----------------------------------------------------------------------------------------------------------------------------------------------|
|
||||||
|
| docker_openldap_data_dir | | L'emplacement dans lequel se trouvent les volumes de donnees docker pour le service |
|
||||||
|
| docker_openldap_service_id | | Le nom de service souhaité : conditionne le nommage des volumes |
|
||||||
|
| docker_openldap_port | 389 | Le numero de port local pour la connexion à openldap |
|
||||||
|
| docker_openldap_version | | Version du conteneur docker souhaité |
|
||||||
|
| docker_openldap_rootdn | | dn de la racine de l'annuaire (par exemple: dc=example,dc=com) |
|
||||||
|
| docker_openldap_admin_password | | Mot de passe administrateur de l'annuaire ; le dn de l'administrateur est cn=admin suivi du rootdn, par exemple : cn=admin,dc=example,dc=com) |
|
||||||
|
| docker_openldap_organization | | Le nom de l'organisation pour cet annuaire (attribut o de la racine) |
|
||||||
|
|
||||||
|
|
||||||
|
# Poursuite de l'installation du serveur openldap
|
||||||
|
|
||||||
|
## Configuration de la strategie de mot de passe avec le module ppolicy
|
||||||
|
|
||||||
|
### Activation du module ppolicy
|
||||||
|
|
||||||
|
```
|
||||||
|
# docker exec -ti -u openldap 7520847e9e47 bash
|
||||||
|
openldap@7520847e9e47:/$ cd /tmp
|
||||||
|
|
||||||
|
openldap@7520847e9e47:/tmp$ slapcat -n 0 | grep olcModuleLoad | grep ppolicy
|
||||||
|
|
||||||
|
openldap@7520847e9e47:/tmp$ cat > ppolicy-module.ldif
|
||||||
|
dn: cn=module,cn=config
|
||||||
|
objectClass: olcModuleList
|
||||||
|
cn: module
|
||||||
|
olcModuleLoad: ppolicy
|
||||||
|
^D
|
||||||
|
|
||||||
|
openldap@7520847e9e47:/tmp$ slapadd -n0 -l ppolicy-module.ldif
|
||||||
|
_#################### 100.00% eta none elapsed none fast!
|
||||||
|
Closing DB...
|
||||||
|
|
||||||
|
openldap@7520847e9e47:/tmp$ slapcat -n 0 | grep olcModuleLoad | grep ppolicy
|
||||||
|
olcModuleLoad: {0}ppolicy
|
||||||
|
```
|
||||||
|
|
||||||
|
et redémarrer le conteneur
|
||||||
|
|
||||||
|
### Ajout de la configuration du module ppolicy
|
||||||
|
|
||||||
|
```
|
||||||
|
# docker exec -ti d7f2803e5cfb bash
|
||||||
|
root@d7f2803e5cfb:/# cd /tmp/
|
||||||
|
|
||||||
|
root@d7f2803e5cfb:/tmp# cat > ppolicyoverlay.ldif
|
||||||
|
dn: olcOverlay={2}ppolicy,olcDatabase={1}mdb,cn=config
|
||||||
|
changetype: add
|
||||||
|
objectClass: olcPPolicyConfig
|
||||||
|
objectClass: olcOverlayConfig
|
||||||
|
olcOverlay: {2}ppolicy
|
||||||
|
olcPPolicyDefault: cn=defaultPasswordPolicy,ou=policies,dc=libretic,dc=fr
|
||||||
|
olcPPolicyForwardUpdates: TRUE
|
||||||
|
olcPPolicyHashCleartext: TRUE
|
||||||
|
olcPPolicyUseLockout: TRUE
|
||||||
|
^D
|
||||||
|
|
||||||
|
root@d7f2803e5cfb:/tmp# ldapadd -Y EXTERNAL -H ldapi:// -f ppolicyoverlay.ldif
|
||||||
|
SASL/EXTERNAL authentication started
|
||||||
|
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
|
||||||
|
SASL SSF: 0
|
||||||
|
adding new entry "olcOverlay={2}ppolicy,olcDatabase={1}mdb,cn=config"
|
||||||
|
```
|
||||||
|
|
||||||
|
### Ajout d'une stratégie de mot de passe par défaut
|
||||||
|
|
||||||
|
Valeurs à adapter en fonction du besoin.
|
||||||
|
|
||||||
|
```
|
||||||
|
root@d7f2803e5cfb:/tmp# cat > defaultppolicy.ldif
|
||||||
|
dn: ou=policies,dc=libretic,dc=fr
|
||||||
|
objectClass: organizationalUnit
|
||||||
|
ou: policies
|
||||||
|
|
||||||
|
dn: cn=defaultPasswordPolicy,ou=policies,dc=libretic,dc=fr
|
||||||
|
objectClass: top
|
||||||
|
objectClass: device
|
||||||
|
objectClass: pwdPolicyChecker
|
||||||
|
objectClass: pwdPolicy
|
||||||
|
cn: defaultPasswordPolicy
|
||||||
|
pwdAttribute: userPassword
|
||||||
|
pwdInHistory: 3
|
||||||
|
pwdMinLength: 8
|
||||||
|
pwdMaxFailure: 5
|
||||||
|
pwdFailureCountInterval: 600
|
||||||
|
pwdCheckQuality: 0
|
||||||
|
pwdMustChange: FALSE
|
||||||
|
pwdGraceAuthNLimit: 0
|
||||||
|
pwdMaxAge: 0
|
||||||
|
pwdExpireWarning: 1209600
|
||||||
|
pwdLockoutDuration: 900
|
||||||
|
pwdLockout: TRUE
|
||||||
|
root@d7f2803e5cfb:/tmp# ldapadd -Y EXTERNAL -H ldapi:// -f defaultppolicy.ldif
|
||||||
|
SASL/EXTERNAL authentication started
|
||||||
|
SASL username: gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth
|
||||||
|
SASL SSF: 0
|
||||||
|
adding new entry "ou=policies,dc=libretic,dc=fr"
|
||||||
|
|
||||||
|
adding new entry "cn=defaultPasswordPolicy,ou=policies,dc=libretic,dc=fr"
|
||||||
|
```
|
||||||
|
|
||||||
|
|
||||||
|
## Accès à l'annuaire en tant qu'administrateur de config
|
||||||
|
|
||||||
|
Permet par exemple une modification des acl pour une modification avec apache directory studio (pratique).
|
||||||
|
|
||||||
|
|
||||||
|
### Modifier le mdp de l'administrateur de config
|
||||||
|
|
||||||
|
#### Créer la valeur chiffrée du mdp
|
||||||
|
```
|
||||||
|
root@docker-host:/# docker exec -ti 04a84d35f749 bash
|
||||||
|
|
||||||
|
root@04a84d35f749:/# slappasswd
|
||||||
|
New password:
|
||||||
|
Re-enter new password:
|
||||||
|
{SSHA}FqKYv/azMmj/tp2LTSWzOzJf65h/nRKp
|
||||||
|
```
|
||||||
|
|
||||||
|
#### Créer un fichier modify.ldif pour
|
||||||
|
```
|
||||||
|
root@04a84d35f749:/# cd /tmp/
|
||||||
|
|
||||||
|
root@04a84d35f749:/tmp# cat > modify.ldif
|
||||||
|
dn: olcDatabase={0}config,cn=config
|
||||||
|
changetype: modify
|
||||||
|
delete: olcRootPW
|
||||||
|
-
|
||||||
|
add: olcRootPW
|
||||||
|
olcRootPW: {SSHA}FqKYv/azMmj/tp2LTSWzOzJf65h/nRKp
|
||||||
|
^D
|
||||||
|
|
||||||
|
root@04a84d35f749:/tmp# ldapmodify -Y EXTERNAL -H ldapi:// -f modify.ldif
|
||||||
|
```
|
||||||
|
|
||||||
|
|
||||||
|
## Connection depuis apache directory studio
|
||||||
|
|
||||||
|
Configurer ADS avec :
|
||||||
|
- compte : cn=admin,cn=config
|
||||||
|
- mdp : celui utilisé avec slappasswd
|
||||||
|
- dn de base : olcDatabase={1}mdb,cn=config => pour configurer le serveur openldap
|
||||||
|
- dn de base : cn=schema,cn=config => pour consulter les schemas connus par openldap
|
||||||
|
|
||||||
1
defaults/main.yml
Normal file
1
defaults/main.yml
Normal file
|
|
@ -0,0 +1 @@
|
||||||
|
docker_openldap_port: "389"
|
||||||
5
handlers/main.yml
Normal file
5
handlers/main.yml
Normal file
|
|
@ -0,0 +1,5 @@
|
||||||
|
- name: docker-compose-up
|
||||||
|
shell: |
|
||||||
|
docker-compose up -d
|
||||||
|
args:
|
||||||
|
chdir: /opt/{{ docker_openldap_service_id }}/
|
||||||
14
tasks/main.yml
Normal file
14
tasks/main.yml
Normal file
|
|
@ -0,0 +1,14 @@
|
||||||
|
- name: docker directory
|
||||||
|
file:
|
||||||
|
path: /opt/{{ docker_openldap_service_id }}/
|
||||||
|
state: directory
|
||||||
|
|
||||||
|
- name: prepare docker-compose.yml
|
||||||
|
template:
|
||||||
|
src: "{{ item }}"
|
||||||
|
dest: /opt/{{ docker_openldap_service_id }}/
|
||||||
|
with_items:
|
||||||
|
- docker-compose.yml
|
||||||
|
notify: docker-compose-up
|
||||||
|
|
||||||
|
|
||||||
21
templates/docker-compose.yml
Normal file
21
templates/docker-compose.yml
Normal file
|
|
@ -0,0 +1,21 @@
|
||||||
|
# {{ ansible_managed }}
|
||||||
|
version: '3.1'
|
||||||
|
|
||||||
|
services:
|
||||||
|
openldap:
|
||||||
|
image: osixia/openldap:{{ docker_openldap_version }}
|
||||||
|
environment:
|
||||||
|
- LDAP_ORGANISATION={{ docker_openldap_organization }}
|
||||||
|
- LDAP_DOMAIN={{ docker_openldap_rootdn }}
|
||||||
|
- LDAP_ADMIN_PASSWORD={{ docker_openldap_admin_password }}
|
||||||
|
- LDAP_TLS=false
|
||||||
|
- LDAP_RFC2307BIS_SCHEMA=true
|
||||||
|
restart: always
|
||||||
|
volumes:
|
||||||
|
- {{ docker_openldap_data_dir }}/{{ docker_openldap_service_id }}/ldap:/var/lib/ldap
|
||||||
|
- {{ docker_openldap_data_dir }}/{{ docker_openldap_service_id }}/slapd.d:/etc/ldap/slapd.d
|
||||||
|
- /etc/timezone:/etc/timezone:ro
|
||||||
|
- /etc/localtime:/etc/localtime:ro
|
||||||
|
ports:
|
||||||
|
- {{ docker_openldap_port }}:389
|
||||||
|
|
||||||
Loading…
Reference in a new issue