Skip to content

Commit 4acbf71

Browse files
davidcoutadeurdavidcoutadeur
committed
first working version of the role
1 parent 5d905bc commit 4acbf71

File tree

7 files changed

+128
-16
lines changed

7 files changed

+128
-16
lines changed

‎README.md‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,13 @@
11
OpenLDAP
22
========
33

4-
Ansible role which installs and configures [LTP-Projects](https://ltb-project.org/)'s OpenLDAP.
4+
Ansible role which installs and configures [LTB-Project](https://ltb-project.org/)'s OpenLDAP.
55

66
Requirements
77
------------
88

9-
n/a
9+
- ansible
10+
- HTTP connection to the LTB-project's repository
1011

1112
Role Variables
1213
--------------
@@ -24,11 +25,13 @@ Dependencies
2425
Example Playbook
2526
----------------
2627

27-
Install and configure OpenLDAP on your servers:
28+
See `tests/test.yml`
2829

29-
- hosts: openldap_servers
30-
roles:
31-
- ldaptoolbox.openldap
30+
Run playbook with:
31+
32+
```
33+
ansible-playbook tests/test.yml -i tests/inventory --ask-vault-pass
34+
```
3235

3336
License
3437
-------

‎defaults/main.yml‎

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -43,15 +43,7 @@ ldaptoolbox_openldap_custom_schema_srcdir: ""
4343
ldaptoolbox_openldap_custom_schema_list: []
4444
ldaptoolbox_openldap_schema_dir: /usr/local/openldap/etc/openldap/schema
4545

46-
ldaptoolbox_openldap_manager: ""
47-
ldaptoolbox_openldap_suffix: ""
48-
49-
ldaptoolbox_openldap_syncrepl:
50-
- rid: 001
51-
provider: "ldap://localhost:389/"
52-
binddn: "{{ ldaptoolbox_openldap_"
53-
password: "{{ ldaptoolbox_openldap_syncrepl_password }}"
54-
searchbase: ""
46+
ldaptoolbox_openldap_suffix: "dc=my-domain,dc=com"
5547

5648
ldaptoolbox_olcPasswordHash: "{ARGON2}"
5749

‎templates/var/backups/openldap/config.ldif‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -154,7 +154,7 @@ dn: olcDatabase={2}monitor,cn=config
154154
objectClass: olcDatabaseConfig
155155
olcDatabase: {2}monitor
156156
olcRootDN: {{ ldaptoolbox_openldap_monitor_olcRootDN }}
157-
olcRootPW: {{ ldaptoolbox_openldap_monitor_olcRootPW }}
157+
olcRootPW: {{ ldaptoolbox_openldap_monitor_olcRootPW_hash }}
158158
olcAddContentAcl: FALSE
159159
olcLastMod: TRUE
160160
olcMaxDerefDepth: 15

‎tests/credentials-vault.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
$ANSIBLE_VAULT;1.1;AES256
2+
37346662633864343863613765313565646332363862653762336333653463613935356139623466
3+
6662616236333863363635623861646337373762623863380a313665623265353730363838303464
4+
33613665656335353063363431643530623261363938353735623561353839303266643739373239
5+
6230333536383634330a393337393865346464623632303461393433636165643131373166643361
6+
32313938666335623835316539643166666336373764336264306365653466333639363066386562
7+
32663864373166643664343137363463376631616363646137643535623931366631323739363265
8+
34313533353164616261373332643835666662373862633161306663323461626338613338313062
9+
30316163366434656664373830316366653065363438333431633162653237613939626465626534
10+
30356237346339633530373662313465303130303133363561303234373466326531313062653139
11+
35333161613038376266316333393363393736356539633363393864373766656232323033653931
12+
38343863643066376435346539633161393266313232356261646563356530366164316462633331
13+
61376361353730666635336631343265656331303966666364363637623237626466363239313066
14+
61323664386661396261343832633261623462613661343463346639343265626539623332613531
15+
66366561666134313361633461383138623737316161653539313131653266653332323633323563
16+
39613365306638316535613331323836366631633065393666643565633662616635623031373939
17+
35376366663237636237346235653135626630356133643135656433633732666135333337336664
18+
66613765303934666163656430643163306530626361306364353165313830666261393766363162
19+
36313239396230303763346334633737323666313466613336616238616537313462663963333239
20+
30386361626137386635626363396363366564643534316133643339303838313566376536353730
21+
38303565326136363665303030396239373066613764326364353130653864633534363634376238
22+
39616466393637393639613064346538636139386636373430626237633838316433613335356533
23+
32383162356337323032343231356336643966333739313333336531626537353333366264373163
24+
38353734313965353135373164636633613335323166386633613836326464376134663231626565
25+
30623866313662623565326463646264653638356336366563663161346464623232383563376237
26+
33396563616638306436636164386537323437626533393334393138396533663930333531663039
27+
65646438626239313166363465356536616666323838353938303632323430623330316339613766
28+
34336632643735326563376138343731643734363332646338663536613038666166353532333231
29+
35646338663333383035646233353139666163616265353831363463653937373833643832386165
30+
65366336633361366534336163313534646263363333613732363161663962643339373665663730
31+
63346135316534326463303865373137383939393633623261333566343733313864333965656531
32+
333164333263326366343466323234333837

‎tests/files/ldaptoolbox.oldap/usr/local/openldap/etc/openldap/schema/custom.ldif‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
# Custom ldif schema

‎tests/host_vars/localhost.yml‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
# Configuration openldap
2+
# ----------------------
3+
4+
ldaptoolbox_openldap_custom_schema_srcdir: "{{ playbook_dir }}/files/ldaptoolbox.oldap/usr/local/openldap/etc/openldap/schema"
5+
ldaptoolbox_openldap_custom_schema_list:
6+
- custom.ldif
7+
8+
ldaptoolbox_openldap_olcSaslHost: 127.0.0.1
9+
ldaptoolbox_openldap_olcSortVals: member
10+
ldaptoolbox_openldap_olcServerID: 1
11+
ldaptoolbox_openldap_olcTLSCACertificateFile: /etc/ssl/certs/ca-certificates.crt
12+
ldaptoolbox_openldap_olcTLSCertificateFile: /etc/ssl/certs/ssl-cert-snakeoil.pem
13+
ldaptoolbox_openldap_olcTLSCertificateKeyFile: /etc/ssl/private/ssl-cert-snakeoil.key
14+
ldaptoolbox_openldap_olcTLSProtocolMin: 3.3
15+
ldaptoolbox_openldap_olcLogLevel: stats
16+
17+
ldaptoolbox_openldap_config_olcRootDN: cn=admin,cn=config
18+
ldaptoolbox_openldap_config_olcRootPW_hash: "{{ ldaptoolbox_openldap_config_olcRootPW_hash_vault }}"
19+
ldaptoolbox_openldap_database_olcRootDN: cn=admin,dc=my-domain,dc=com
20+
ldaptoolbox_openldap_database_olcRootPW_hash: "{{ ldaptoolbox_openldap_database_olcRootPW_hash_vault }}"
21+
22+
ldaptoolbox_openldap_suffix: "dc=my-domain,dc=com"
23+
24+
ldaptoolbox_openldap_syncrepl:
25+
- rid: "001"
26+
provider: "ldap://localhost:389/"
27+
tlscert: "{{ ldaptoolbox_openldap_olcTLSCertificateFile }}"
28+
tlskey: "{{ ldaptoolbox_openldap_olcTLSCertificateKeyFile }}"
29+
tlscacert: "{{ ldaptoolbox_openldap_olcTLSCACertificateFile }}"
30+
tlsreqcert: "demand"
31+
binddn: "uid=syncrepl,ou=accounts,ou=infrastructure,dc=my-domain,dc=com"
32+
password: "{{ ldaptoolbox_openldap_syncrepl_password_vault }}"
33+
searchbase: "{{ ldaptoolbox_openldap_suffix }}"
34+
scope: "sub"
35+
type: "refreshAndPersist"
36+
retry: "5 5 300 +"
37+
- rid: "002"
38+
provider: "ldap://localhost:389/"
39+
tlscert: "{{ ldaptoolbox_openldap_olcTLSCertificateFile }}"
40+
tlskey: "{{ ldaptoolbox_openldap_olcTLSCertificateKeyFile }}"
41+
tlscacert: "{{ ldaptoolbox_openldap_olcTLSCACertificateFile }}"
42+
tlsreqcert: "demand"
43+
binddn: "uid=syncrepl,ou=accounts,ou=infrastructure,dc=my-domain,dc=com"
44+
password: "{{ ldaptoolbox_openldap_syncrepl_password_vault }}"
45+
searchbase: "{{ ldaptoolbox_openldap_suffix }}"
46+
scope: "sub"
47+
type: "refreshAndPersist"
48+
retry: "5 5 300 +"
49+
50+
ldaptoolbox_openldap_access_list:
51+
- to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by * break
52+
- to dn.base="" by * read
53+
- to dn.base="cn=Subschema" by * read
54+
- to * by self write by users read by anonymous auth
55+
56+
ldaptoolbox_openldap_database_olcLimits:
57+
- dn.base="uid=syncrepl,ou=accounts,ou=infrastructure,dc=my-domain,dc=com" size=unlimited time=unlimited
58+
59+
ldaptoolbox_openldap_database_olcDbIndexes:
60+
- "objectClass eq"
61+
- "entryUUID eq"
62+
- "entryCSN eq"
63+
- "cn pres,eq,sub"
64+
- "uid pres,eq,sub"
65+
66+
ldaptoolbox_openldap_database_olcDbMaxSize: "4294967296"
67+
68+
ldaptoolbox_openldap_overlay_syncprov_olcSpCheckpoint: "100 10"
69+
ldaptoolbox_openldap_overlay_syncprov_olcSpSessionlog: "100"
70+
71+
ldaptoolbox_openldap_overlay_ppolicy_olcPPolicyDefault: "cn=default,ou=ppolicies,dc=my-domain,dc=com"
72+
ldaptoolbox_openldap_overlay_ppolicy_olcPPolicyHashCleartext: "TRUE"
73+
ldaptoolbox_openldap_overlay_ppolicy_olcPPolicyUseLockout: "TRUE"
74+
75+
ldaptoolbox_openldap_overlay_refint_olcRefintAttribute: "member"
76+
ldaptoolbox_openldap_overlay_refint_olcRefintNothing: "cn=nothing,dc=my-domain,dc=com"
77+
78+
ldaptoolbox_openldap_overlay_dynlist_olcDlAttrSet: "groupOfURLs memberURL member+memberOf@groupOfNames*"
79+
80+
ldaptoolbox_openldap_monitor_olcRootDN: "cn=monitor"
81+
ldaptoolbox_openldap_monitor_olcRootPW_hash: "{{ ldaptoolbox_openldap_monitor_olcRootPW_hash_vault }}"
82+

‎tests/test.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,7 @@
11
---
22
- hosts: localhost
33
remote_user: root
4+
vars_files:
5+
- credentials-vault.yml
46
roles:
57
- ansible-role-ldaptoolbox-openldap

0 commit comments

Comments
 (0)