Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 aitzol
|
f96af95f53 |
@@ -0,0 +1 @@
|
||||
**/*~
|
||||
@@ -2,4 +2,4 @@ LDAP_ROOTDN=cn=admin,dc=ldap,dc=lainoa,dc=eus
|
||||
LDAP_BASE_DN=cn=admin,dc=ldap,dc=lainoa,dc=eus
|
||||
LDAP_ROOTPW='sagastarri996$L'
|
||||
LDAP_READONLY_USER_USERNAME='readonly'
|
||||
LDAP_READONLY_USER_PASSWORD='Q2M7VDeL'
|
||||
LDAP_READONLY_USER_PASSWORD='Q2M7VDeL'
|
||||
@@ -22,7 +22,7 @@ ENV LDAP_DN_ATTR=uid \
|
||||
LDAP_PWD_MIN_LENGTH=8 \
|
||||
LDAP_ROOTDN= \
|
||||
LDAP_ROOTPW_HASH= \
|
||||
LDAP_ROOTPW_SECRETNAME=openldap-user-passwords \
|
||||
LDAP_ROOTPW_SECRETNAME=aldatu \
|
||||
LDAP_SUFFIX= \
|
||||
LDAP_ULIMIT=2048 \
|
||||
LDAP_USERPW_SECRETNAME=kendu
|
||||
@@ -37,6 +37,6 @@ EXPOSE 389 636
|
||||
COPY slapd.conf /root/
|
||||
COPY schema/custom.* /etc/openldap/schema/
|
||||
COPY ldif/ /root/ldif/
|
||||
COPY podman-entrypoint.sh /usr/local/bin/entrypoint.sh
|
||||
COPY entrypoint.sh /usr/local/bin/
|
||||
|
||||
ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
|
||||
@@ -0,0 +1,76 @@
|
||||
## openldap
|
||||
[](https://hub.docker.com/r/instantlinux/openldap/tags "Version badge") [](https://github.com/instantlinux/docker-tools/tree/main/images/openldap "Image badge")  [](https://gitlab.com/instantlinux/docker-tools/-/blob/main/images/openldap/Dockerfile "dockerfile") [](https://github.com/users/instantlinux/packages/container/package/openldap)
|
||||
|
||||
This is OpenLDAP in a tiny alpine container, with simple setup. All features and capabilities are supported.
|
||||
|
||||
Why this new image (in 2022), when there are others? The dinkel and osixia images fell out of maintenance, so the only current maintained alternative is the larger / more complex / single-platform bitnami.
|
||||
|
||||
### Usage
|
||||
|
||||
Set environment variables as shown below, and mount a blank storage volume as `/var/lib/openldap/openldap-data`. Optionally, put your users and groups into ldif format (see [example](https://github.com/instantlinux/docker-tools/blob/main/images/openldap/example-users.ldif)) and mount them as `/etc/openldap/prepopulate`, and/or add TLS certifates under `/etc/ssl/openldap`.
|
||||
|
||||
Example kubernetes and docker-compose resource definition files are provided here along with a helm chart. This repo has complete instructions for
|
||||
[building a kubernetes cluster](https://github.com/instantlinux/docker-tools/blob/main/k8s/README.md) where you can launch with [helm](https://github.com/instantlinux/docker-tools/tree/main/images/openldap/helm) using _make_ and customizing [Makefile.vars](https://github.com/instantlinux/docker-tools/blob/main/k8s/Makefile.vars) after cloning this repo:
|
||||
~~~
|
||||
git clone https://github.com/instantlinux/docker-tools.git
|
||||
cd docker-tools/k8s
|
||||
make openldap
|
||||
~~~
|
||||
|
||||
### Variables
|
||||
|
||||
| Variable | Default | Description |
|
||||
| -------- | ------- | ----------- |
|
||||
| SLAPD_DN_ATTR | uid | Attribute of user dn (usually `cn` or `uid`) |
|
||||
| SLAPD_FQDN | example.com | |
|
||||
| SLAPD_LOG_LEVEL | Config,Stats | See [loglevel keywords](https://www.openldap.org/doc/admin24/slapdconfig.html) |
|
||||
| SLAPD_ORGANIZATION | Example | |
|
||||
| SLAPD_OU | ou=users, | Org-unit component of DN |
|
||||
| SLAPD_PWD_ATTRIBUTE | userPassword | Attribute of hashed password |
|
||||
| SLAPD_PWD_CHECK_QUALITY | 2 | Password-modify enforcement option 0-2 |
|
||||
| SLAPD_PWD_FAILURE_COUNT_INTERVAL | 1200 | Reset failures [20 min] |
|
||||
| SLAPD_PWD_LOCKOUT_DURATION | 1200 | Clear lockout [20 min] |
|
||||
| SLAPD_PWD_MAX_FAILURE | 5 | Maximum attempts before lockout |
|
||||
| SLAPD_PWD_MIN_LENGTH | 8 | Password-modify minimum length |
|
||||
| SLAPD_ROOTDN | cn=admin,dc=(suffix) | Admin user's DN |
|
||||
| SLAPD_ROOTPW | | Plain-text admin password |
|
||||
| SLAPD_ROOTPW_HASH | | Hashed admin password |
|
||||
| SLAPD_ROOTPW_SECRETNAME | openldap-ro-password | Name of secret to hold pw |
|
||||
| SLAPD_SUFFIX | (based on `SLAPD_FQDN`) | Suffix of DN |
|
||||
| SLAPD_ULIMIT | 2048 | maximum file size |
|
||||
| SLAPD_USERPW_SECRETNAME | openldap-user-passwords | Name of secret to hold pws |
|
||||
|
||||
If overriding default root DN, it should be specified in the form `cn=admin,dc=example,dc=com`.
|
||||
|
||||
The root password must be specified in one of three ways:
|
||||
|
||||
* `SLAPD_ROOTPW` - plain text value, only for testing
|
||||
* `SLAPD_ROOTPW_HASH` - encrypted value starting with `{PBKDF2-SHA512}`
|
||||
* `openldap-ro-password` secret - most secure place to store the hash
|
||||
|
||||
You will want to override values for `SLAPD_FQDN` and `SLAPD_ORGANIZATION`. All the other default values will work for many typical use-cases.
|
||||
|
||||
User passwords are normally initialized by the administrator using `ldappasswd`, and from then on updated by the user (through the same tool or protocol). With this image, you can also define user passwords by providing their (hashed) values via a secret. Don't use `ldappasswd` to update passwords that are provided with the latter method: use it to generate a new hashed value and update the secret.
|
||||
### Volumes
|
||||
|
||||
Mount these path names to persistent storage; all are optional.
|
||||
|
||||
Path | Description
|
||||
---- | -----------
|
||||
/etc/openldap/prepopulate | Zero or more .ldif files to load upon startup
|
||||
/var/lib/openldap/openldap-data | Persistent storage for ldap database
|
||||
/etc/ssl/openldap | TLS/SSL certificate
|
||||
|
||||
### Secrets
|
||||
|
||||
Secret | Description
|
||||
------ | -----------
|
||||
openldap-rootpw | Hashed password (key name openldap-rootpw-hash)
|
||||
openldap-ssl | Certificate (cacert.pem, tls.crt, tls.key)
|
||||
openldap-user-passwords | Hashed passwords (in _user: {PBK...} hash_ form)
|
||||
|
||||
### Contributing
|
||||
|
||||
If you want to make improvements to this image, see [CONTRIBUTING](https://github.com/instantlinux/docker-tools/blob/main/CONTRIBUTING.md).
|
||||
|
||||
[](https://git.openldap.org/openldap/openldap/-/blob/master/LICENSE "License badge") [](https://git.openldap.org/openldap/openldap "Code repo")
|
||||
@@ -1,33 +0,0 @@
|
||||
[Unit]
|
||||
Description=OPENLDAP Server
|
||||
After=network-online.target ldap-network.service
|
||||
Wants=network-online.target
|
||||
|
||||
[Container]
|
||||
Image=localhost/openldap:2.6.14
|
||||
|
||||
ContainerName=ldap-server
|
||||
NetworkAlias=server
|
||||
Network=ldap.network
|
||||
|
||||
PublishPort=389:389
|
||||
PublishPort=636:636
|
||||
#- ${PORT_OPENLDAP:-389}:389
|
||||
#- ${PORT_OPENLDAP_SSL:-636}:636
|
||||
|
||||
Volume=%h/podman/ldap-pla/certs:/etc/ssl/openldap:ro
|
||||
Volume=%h/podman/ldap-pla/data:/var/lib/openldap/openldap-data
|
||||
Volume=%h/podman/ldap-pla/data/prepopulate:/etc/openldap/prepopulate:ro
|
||||
|
||||
#add ldap server host if needed
|
||||
#AddHost=ldap.example.com:x.x.x.x
|
||||
|
||||
EnvironmentFile=%h/.config/containers/systemd/ldap.env
|
||||
Secret=openldap-user-passwords
|
||||
LogDriver=journald
|
||||
|
||||
[Service]
|
||||
Restart=always
|
||||
|
||||
[Install]
|
||||
WantedBy=default.target
|
||||
@@ -1,9 +0,0 @@
|
||||
LDAP_ROOTDN=cn=admin,dc=ldap,dc=example,dc=com
|
||||
LDAP_BASE_DN=cn=admin,dc=ldap,dc=example,dc=com
|
||||
LDAP_ROOTPW=root_pwd
|
||||
LDAP_READONLY_USER=true
|
||||
LDAP_READONLY_USER_USERNAME=readonly
|
||||
LDAP_READONLY_USER_PASSWORD=readonly_pwd
|
||||
LDAP_FQDN=ldap.example.com
|
||||
LDAP_DN_ATTR=cn
|
||||
LDAP_ORGANIZATION=organization_name
|
||||
@@ -1,2 +0,0 @@
|
||||
[Network]
|
||||
Driver=bridge
|
||||
@@ -1,33 +0,0 @@
|
||||
[Unit]
|
||||
Description=PhpLdapAdmin
|
||||
After=ldap.service
|
||||
Requires=ldap.service
|
||||
|
||||
[Container]
|
||||
Image=docker.io/phpldapadmin/phpldapadmin:latest
|
||||
|
||||
ContainerName=pla
|
||||
|
||||
Network=ldap.network
|
||||
|
||||
#PublishPort=8080:8080
|
||||
PublishPort=0.0.0.0:8080:8080
|
||||
|
||||
Environment=LDAP_HOST=ldap-server
|
||||
Environment=LDAP_BASE_DN="dc=ldap,dc=lainoa,dc=eus"
|
||||
Environment=LDAP_USERNAME="cn=admin,dc=ldap,dc=lainoa,dc=eus"
|
||||
#Environment=LDAP_PASSWORD=${LDAP_ROOTPW}
|
||||
#Environment=LDAP_LOGIN_ATTR=dn
|
||||
Environment=LDAP_LOGIN_ATTR=uid
|
||||
Environment=LDAP_LOGIN_OBJECTCLASS=simpleSecurityObject
|
||||
Environment=LDAP_ALLOW_GUEST=false
|
||||
Environment=LDAP_ALERT_ROOTDN=true
|
||||
Environment=SERVER_NAME=:8080
|
||||
#EnvironmentFile=%h/.config/containers/systemd/ldap.env
|
||||
EnvironmentFile=%h/.config/containers/systemd/pla.env
|
||||
|
||||
[Service]
|
||||
Restart=always
|
||||
|
||||
[Install]
|
||||
WantedBy=default.target
|
||||
@@ -1 +0,0 @@
|
||||
LDAP_PASSWORD=ldap_admin_pwd
|
||||
@@ -0,0 +1,156 @@
|
||||
dn: cn=Ainhize Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus
|
||||
active: TRUE
|
||||
cn: Ainhize Berasategi
|
||||
devices: PC / Linux / Firefox 128.0
|
||||
fakecn: FALSE
|
||||
gidnumber: 501
|
||||
givenname: Ainhize
|
||||
homedirectory: home/user/ainhize
|
||||
ip: 192.168.2.110
|
||||
lastlogin: 20250621131028Z
|
||||
mail: aiberasategi@beasaingoikastola.eus
|
||||
objectclass: top
|
||||
objectclass: inetOrgPerson
|
||||
objectclass: posixAccount
|
||||
objectclass: accountsManagement
|
||||
secureauth: FALSE
|
||||
sn: Berasategi
|
||||
uid: ainhize
|
||||
uidnumber: 1003
|
||||
userpassword: {SSHA}ZkwccsQKfDxCx3+iYBe7WzO7GgfpP3df
|
||||
|
||||
dn: cn=Aitzol Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus
|
||||
active: TRUE
|
||||
cn: Aitzol Berasategi
|
||||
devices: PC / Linux / Firefox 115.0
|
||||
devices: PC / Linux / Firefox 128.0
|
||||
devices: iPhone / iOS 17.5.1 / Firefox iOS 133.4
|
||||
devices: PC / Linux / Firefox 140.0
|
||||
fakecn: FALSE
|
||||
gidnumber: 501
|
||||
givenname: Aitzol
|
||||
homedirectory: /home/users/aitzol
|
||||
ip: 192.168.2.110
|
||||
lastlogin: 20260421214748Z
|
||||
mail: aitzol@lainoa.eus
|
||||
objectclass: inetOrgPerson
|
||||
objectclass: posixAccount
|
||||
objectclass: top
|
||||
objectclass: accountsManagement
|
||||
secureauth: FALSE
|
||||
sn: Berasategi
|
||||
uid: aitzol
|
||||
uidnumber: 1000
|
||||
userpassword: {SSHA}ZvElYuNEKlO78Z7sNYvTFe12H7CVqGu1
|
||||
|
||||
dn:: Y249QWxvw7FhIEV0eGV6YWJhbCxjbj11c2VycyxvdT1ncm91cHMsZGM9bGRhcCxkYz1sYWl
|
||||
ub2EsZGM9ZXVz
|
||||
active: TRUE
|
||||
cn:: QWxvw7FhIEV0eGV6YWJhbA==
|
||||
fakecn: FALSE
|
||||
gidnumber: 501
|
||||
givenname:: QWxvw7Fh
|
||||
homedirectory: home/user/alona
|
||||
mail: etxezabal2@gmail.com
|
||||
objectclass: top
|
||||
objectclass: inetOrgPerson
|
||||
objectclass: posixAccount
|
||||
objectclass: accountsManagement
|
||||
secureauth: FALSE
|
||||
sn: Etxezabal
|
||||
uid:: YWxvw7Fh
|
||||
uidnumber: 1002
|
||||
userpassword: {SSHA}LJpDFOrqVyNOWlM31RJKjPLRRGr+MYZh
|
||||
|
||||
dn: cn=Araitz Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus
|
||||
active: FALSE
|
||||
cn: Araitz Berasategi
|
||||
devices: PC / Linux / Firefox 115.0
|
||||
fakecn: FALSE
|
||||
gidnumber: 501
|
||||
givenname: Araitz
|
||||
homedirectory: home/user/araitz
|
||||
ip: 192.168.2.110
|
||||
lastlogin: 20240901123138Z
|
||||
mail: aberasategi@beasaingoikastola.eus
|
||||
objectclass: top
|
||||
objectclass: inetOrgPerson
|
||||
objectclass: posixAccount
|
||||
objectclass: accountsManagement
|
||||
secureauth: FALSE
|
||||
sn: Berasategi
|
||||
uid: araitz
|
||||
uidnumber: 1001
|
||||
userpassword: {SSHA}k7P67WSQo/87fso9YeNFSLgWOb1B9KPj
|
||||
|
||||
dn: cn=Garazi Telleria,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus
|
||||
active: TRUE
|
||||
cn: Garazi Telleria
|
||||
fakecn: FALSE
|
||||
gidnumber: 501
|
||||
givenname: Garazi
|
||||
homedirectory: home/user/garazi
|
||||
mail: garazi@fakemail.com
|
||||
objectclass: top
|
||||
objectclass: inetOrgPerson
|
||||
objectclass: posixAccount
|
||||
objectclass: accountsManagement
|
||||
secureauth: FALSE
|
||||
sn: Telleria
|
||||
uid: garazi
|
||||
uidnumber: 1004
|
||||
userpassword: {SSHA}hZd/0nLphR2Mv+Q9usIHqLVzipq4fQ+J
|
||||
|
||||
dn: cn=Jose Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus
|
||||
active: TRUE
|
||||
cn: Jose Berasategi
|
||||
fakecn: FALSE
|
||||
gidnumber: 501
|
||||
givenname: Jose
|
||||
homedirectory: home/user/aitona
|
||||
mail: joxeberasategi@gmail.com
|
||||
objectclass: top
|
||||
objectclass: inetOrgPerson
|
||||
objectclass: posixAccount
|
||||
objectclass: accountsManagement
|
||||
secureauth: FALSE
|
||||
sn: Berasategi
|
||||
uid: aitona
|
||||
uidnumber: 1007
|
||||
userpassword: {SSHA}FYBXKDw95/AzFRSXs2eDE+r5Fq+9SrAk
|
||||
|
||||
dn: cn=Nekane Berasategi,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus
|
||||
active: TRUE
|
||||
cn: Nekane Berasategi
|
||||
fakecn: FALSE
|
||||
gidnumber: 501
|
||||
givenname: Nekane
|
||||
homedirectory: home/user/nekane
|
||||
mail: nekane@fakemail.com
|
||||
objectclass: top
|
||||
objectclass: inetOrgPerson
|
||||
objectclass: posixAccount
|
||||
objectclass: accountsManagement
|
||||
secureauth: FALSE
|
||||
sn: Berasategi
|
||||
uid: nekane
|
||||
uidnumber: 1005
|
||||
userpassword: {SSHA}fH8F5MAoNyc9QTnn4wDp3w4ZJPttNdBA
|
||||
|
||||
dn: cn=Nekane Eskisabel,cn=users,ou=groups,dc=ldap,dc=lainoa,dc=eus
|
||||
active: TRUE
|
||||
cn: Nekane Eskisabel
|
||||
fakecn: FALSE
|
||||
gidnumber: 501
|
||||
givenname: Nekane
|
||||
homedirectory: home/user/amona
|
||||
mail: ertzillegi54@gmail.com
|
||||
objectclass: top
|
||||
objectclass: inetOrgPerson
|
||||
objectclass: posixAccount
|
||||
objectclass: accountsManagement
|
||||
secureauth: FALSE
|
||||
sn: Eskisabel
|
||||
uid: amona
|
||||
uidnumber: 1006
|
||||
userpassword: {SSHA}rJcOSS7WyqqxfstkuWJdjn/p00h95xTw
|
||||
@@ -0,0 +1,45 @@
|
||||
services:
|
||||
app:
|
||||
image: openldap:2.6.14
|
||||
environment:
|
||||
LDAP_ROOTDN: ${LDAP_ROOTDN}
|
||||
LDAP_BASE_DN: ${LDAP_BASE_DN}
|
||||
#LDAP_ROOTDN: ${LDAP_ROOTDN:-cn=admin,dc=ldap,dc=lainoa,dc=eus}
|
||||
LDAP_ROOTPW: ${LDAP_ROOTPW}
|
||||
LDAP_FQDN: ldap.lainoa.eus
|
||||
LDAP_DN_ATTR: cn
|
||||
LDAP_ORGANIZATION: wproject
|
||||
LDAP_READONLY_USER: "true"
|
||||
LDAP_READONLY_USER_USERNAME: ${LDAP_READONLY_USER_USERNAME}
|
||||
LDAP_READONLY_USER_PASSWORD: ${LDAP_READONLY_USER_PASSWORD}
|
||||
#hostname: openldap
|
||||
volumes:
|
||||
- ./data:/var/lib/openldap/openldap-data
|
||||
- ./data/prepopulate:/etc/openldap/prepopulate:ro
|
||||
- ./certs:/etc/ssl/openldap:ro
|
||||
ports:
|
||||
- ${PORT_OPENLDAP:-389}:389
|
||||
- ${PORT_OPENLDAP_SSL:-636}:636
|
||||
secrets:
|
||||
- openldap-user-passwords
|
||||
|
||||
phpldapadmin:
|
||||
image: phpldapadmin/phpldapadmin:latest
|
||||
environment:
|
||||
LDAP_HOST: app
|
||||
LDAP_BASE_DN: dc=ldap,dc=lainoa,dc=eus
|
||||
LDAP_USERNAME: cn=admin,dc=ldap,dc=lainoa,dc=eus
|
||||
LDAP_PASSWORD: ${LDAP_ROOTPW}
|
||||
#LDAP_LOGIN_ATTR: dn
|
||||
LDAP_LOGIN_ATTR: uid
|
||||
LDAP_LOGIN_OBJECTCLASS: simpleSecurityObject
|
||||
LDAP_ALLOW_GUEST: "FALSE"
|
||||
LDAP_ALERT_ROOTDN: "TRUE"
|
||||
ports:
|
||||
- "8080:8080"
|
||||
depends_on:
|
||||
- app
|
||||
|
||||
secrets:
|
||||
openldap-user-passwords:
|
||||
file: ./secrets/passwords.txt
|
||||
@@ -0,0 +1,5 @@
|
||||
LDAP_ROOTDN=cn=admin,dc=ldap,dc=example,dc=com
|
||||
LDAP_BASE_DN=cn=admin,dc=ldap,dc=example,dc=com
|
||||
LDAP_ROOTPW='root_pwd'
|
||||
LDAP_READONLY_USER_USERNAME='readonly'
|
||||
LDAP_READONLY_USER_PASSWORD='readonly_pwd'
|
||||
Reference in New Issue
Block a user