153 lines
4.9 KiB
Bash
Executable File
153 lines
4.9 KiB
Bash
Executable File
#!/bin/sh -e
|
|
|
|
LDAP_CONF_DIR=/etc/openldap/slapd.d
|
|
LDAP_DATA_DIR=/var/lib/openldap/openldap-data
|
|
LDAP_URLPREFIX=ldap
|
|
|
|
export LDAP_IPC_URL=ldapi://%2Frun%2Fopenldap%2Fldapi
|
|
|
|
dc_str=$(echo ${LDAP_FQDN} | sed -e s:[.]:,dc=:g)
|
|
[ -z "$LDAP_SUFFIX" ] && export LDAP_SUFFIX=dc=$dc_str
|
|
|
|
# Set ulimit - See https://github.com/docker/docker/issues/8231
|
|
ulimit -n $LDAP_ULIMIT
|
|
|
|
INITIAL_START=0
|
|
|
|
if [ ! -d ${LDAP_CONF_DIR} ]; then
|
|
INITIAL_START=1
|
|
|
|
# At first startup, create directories and configurations
|
|
[ -z "${LDAP_ROOTDN}" ] && LDAP_ROOTDN=cn=admin,${LDAP_SUFFIX}
|
|
|
|
if [ ! -z "$LDAP_ROOTPW" ]; then
|
|
LDAP_ROOTPW_HASH=$(slappasswd -o module-load=pw-pbkdf2.so \
|
|
-h {PBKDF2-SHA512} -s "$LDAP_ROOTPW")
|
|
elif [[ -z "$LDAP_ROOTPW_HASH" && -s /run/secrets/$LDAP_ROOTPW_SECRETNAME ]]; then
|
|
LDAP_ROOTPW_HASH=$(slappasswd -o module-load=pw-pbkdf2.so \
|
|
-h {PBKDF2-SHA512} -s "$(cat /run/secrets/$LDAP_ROOTPW_SECRETNAME)")
|
|
fi
|
|
|
|
if [ -z "$LDAP_ROOTPW_HASH" ]; then
|
|
echo "** Secret LDAP_ROOTPW_SECRETNAME unspecified **"
|
|
exit 1
|
|
fi
|
|
|
|
export LDAP_DATA_DIR
|
|
|
|
mkdir -p -m 750 ${LDAP_CONF_DIR} /run/openldap
|
|
|
|
if [[ "$(ls -A /etc/ssl/openldap)" ]]; then
|
|
CA_CERT=/etc/ssl/openldap/ca_cert.pem
|
|
SSL_KEY=/etc/ssl/openldap/tls.key
|
|
SSL_CERT=/etc/ssl/openldap/tls.crt
|
|
|
|
if [[ -f ${CA_CERT} ]]; then
|
|
echo "TLSCACertificateFile ${CA_CERT}" >> /root/slapd.conf
|
|
fi
|
|
|
|
echo "TLSCertificateFile ${SSL_CERT}" >> /root/slapd.conf
|
|
echo "TLSCertificateKeyFile ${SSL_KEY}" >> /root/slapd.conf
|
|
echo "TLSCipherSuite HIGH:-SSLv2:-SSLv3" >> /root/slapd.conf
|
|
LDAP_URLPREFIX=ldaps
|
|
fi
|
|
|
|
sed -i -e "s/^#BASE.*/BASE ${LDAP_SUFFIX}/" /etc/openldap/ldap.conf
|
|
export LDAP_DOMAIN=$(echo ${LDAP_FQDN} | cut -d . -f 1)
|
|
export LDAP_EMAIL_DOMAIN=$(echo "$LDAP_FQDN" | awk -F. '{print $(NF-1)"."$NF}')
|
|
|
|
|
|
if [[ -n "$LDAP_READONLY_USER_USERNAME" && -n "$LDAP_READONLY_USER_PASSWORD" ]]; then
|
|
echo "encrypting readonly user password..";
|
|
LDAP_READONLY_USER_PASSWORD_ENCRYPTED=$(slappasswd \
|
|
-o module-load=pw-pbkdf2.so \
|
|
-h '{PBKDF2-SHA512}' \
|
|
-s "$LDAP_READONLY_USER_PASSWORD")
|
|
|
|
export LDAP_READONLY_USER_PASSWORD_ENCRYPTED
|
|
else
|
|
mv /root/ldif/20-readonly-user.ldif /root/ldif/20-readonly-user.ldif.unused
|
|
fi
|
|
|
|
# Database structure
|
|
TMP=$(mktemp)
|
|
for file in $(find /root/ldif -type f) /root/slapd.conf; do
|
|
cat "${file}" | envsubst > $TMP
|
|
mv $TMP "${file}"
|
|
done
|
|
|
|
cp /root/slapd.conf /etc/openldap/slapd.conf
|
|
|
|
slaptest -f /etc/openldap/slapd.conf -F ${LDAP_CONF_DIR} -n0
|
|
|
|
# Load LDIF base schemas with slapadd
|
|
if [ ! -s ${LDAP_DATA_DIR}/data.mdb ]; then
|
|
|
|
for file in $(find /root/ldif -maxdepth 1 -name '00-*.ldif' -type f | sort); do
|
|
echo "Loading ${file}"
|
|
slapadd -F "${LDAP_CONF_DIR}" -l "${file}" -n1
|
|
done
|
|
|
|
if [[ -f /root/ldif/20-readonly-user.ldif ]]; then
|
|
echo "Loading readonly LDAP user"
|
|
slapadd -F "${LDAP_CONF_DIR}" -l /root/ldif/20-readonly-user.ldif -n1
|
|
fi
|
|
|
|
fi
|
|
fi
|
|
|
|
touch /var/log/slapd-audit.log
|
|
|
|
mkdir -p -m 750 /run/openldap
|
|
|
|
chown -R ldap:ldap ${LDAP_CONF_DIR} ${LDAP_DATA_DIR} /run/openldap \
|
|
/var/log/slapd-audit.log
|
|
|
|
tail -f -n0 /var/log/slapd-audit.log |
|
|
sed "s/^${LDAP_PWD_ATTRIBUTE}::.*/${LDAP_PWD_ATTRIBUTE}:: --redacted--/" &
|
|
|
|
# Load ldif files to cn=config, password policies and optional data with ldapadd
|
|
(
|
|
if [[ "${INITIAL_START}" = "1" ]]; then
|
|
sleep 10
|
|
|
|
echo 'Loading server additional config'
|
|
for file in $(find /root/ldif -maxdepth 1 -name '01-*.ldif' -type f | sort); do
|
|
echo "Loading ${file}"
|
|
envsubst < "${file}" | \
|
|
ldapmodify -Y EXTERNAL -H ${LDAP_IPC_URL}
|
|
done
|
|
|
|
echo 'Loading password policy'
|
|
envsubst < /root/ldif/10-passwordDefaultPolicy.ldif | \
|
|
ldapadd -Y EXTERNAL -H ${LDAP_IPC_URL}
|
|
|
|
if [[ -d /etc/openldap/prepopulate ]]; then
|
|
|
|
for file in `find /etc/openldap/prepopulate`; do
|
|
echo "Loading optional file: ${file}"
|
|
envsubst < "${file}" | \
|
|
ldapadd -Y EXTERNAL -H ${LDAP_IPC_URL}
|
|
done
|
|
fi
|
|
fi
|
|
|
|
echo 'Setting user passwords'
|
|
|
|
PW_FILE=$(find /run/secrets/$LDAP_USERPW_SECRETNAME -type f | head -1)
|
|
|
|
if [[ ! -z "${PW_FILE}" && -s "${PW_FILE}" ]]; then
|
|
awk -F : -v dnattr=${LDAP_DN_ATTR} \
|
|
-v suffix=,${LDAP_OU}${LDAP_SUFFIX} \
|
|
-v pwdattr=${LDAP_PWD_ATTRIBUTE} \
|
|
'{ print "dn: " dnattr "=" $1 suffix "\n" \
|
|
"changetype: modify\n" \
|
|
"replace: " pwdattr "\n" \
|
|
pwdattr ": " $2 "\n" }' <${PW_FILE} | \
|
|
ldapmodify -Y EXTERNAL -H ${LDAP_IPC_URL}
|
|
fi
|
|
) &
|
|
|
|
exec slapd -h "${LDAP_URLPREFIX}:/// ${LDAP_IPC_URL}" \
|
|
-F ${LDAP_CONF_DIR} -u ldap -g ldap -d "${LDAP_LOG_LEVEL}"
|