Skip to content

Commit e43ecfc

Browse files
davidcoutadeurdavidcoutadeur
authored
Merge pull request #2 from davidcoutadeur/wip_role_creation
creation of the ansible role for OpenLDAP LTB
2 parents 83756ad + 4acbf71 commit e43ecfc

File tree

14 files changed

+500
-1
lines changed

14 files changed

+500
-1
lines changed

‎.github/workflows/test.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
name: Test ansible-role-ldaptoolbox-openldap
2+
3+
on: push
4+
5+
jobs:
6+
test-deployment:
7+
runs-on: ubuntu-latest
8+
name: test ansible-role-ldaptoolbox-openldap syntax
9+
steps:
10+
- uses: actions/checkout@v2
11+
- name: get repository
12+
run: |
13+
git fetch --unshallow
14+
git pull origin
15+
git config user.email "[email protected]"
16+
git config user.name "GitHub Actions"
17+
- name: test ansible syntax
18+
run: |
19+
sudo apt-get install -y python3-pip
20+
sudo pip3 install ansible
21+
ansible --version
22+
printf '[defaults]\nroles_path=../' >ansible.cfg
23+
ansible-playbook tests/test.yml -i tests/inventory --syntax-check

‎README.md‎

Lines changed: 45 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,45 @@
1-
# openldap-role-ansible
1+
OpenLDAP
2+
========
3+
4+
Ansible role which installs and configures [LTB-Project](https://ltb-project.org/)'s OpenLDAP.
5+
6+
Requirements
7+
------------
8+
9+
- ansible
10+
- HTTP connection to the LTB-project's repository
11+
12+
Role Variables
13+
--------------
14+
15+
You'll need to store the hash value for you admin password. You'll get it like this:
16+
17+
```
18+
/usr/local/openldap/sbin/slappasswd -o module-path="/usr/local/openldap/libexec/openldap" -o module-load="argon2" -h "{ARGON2}" -s "password"
19+
```
20+
21+
Dependencies
22+
------------
23+
24+
25+
Example Playbook
26+
----------------
27+
28+
See `tests/test.yml`
29+
30+
Run playbook with:
31+
32+
```
33+
ansible-playbook tests/test.yml -i tests/inventory --ask-vault-pass
34+
```
35+
36+
License
37+
-------
38+
39+
GPLv3
40+
41+
Author Information
42+
------------------
43+
44+
- Mathieu Jourdan
45+
- David Coutadeur

‎defaults/main.yml‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
---
2+
# defaults file for ansible-role-ldaptoolbox-openldap
3+
4+
# Common configuration
5+
# --------------------
6+
7+
# APT configuration
8+
ldaptoolbox_openldap_apt_key_url: "https://ltb-project.org/documentation/_static/RPM-GPG-KEY-LTB-project"
9+
ldaptoolbox_openldap_apt_key_id: "3FC3FD92ABA3975D2BEB95A70AC51F926D45BFC5"
10+
ldaptoolbox_openldap_apt_repo_filename: "ltb-project-openldap"
11+
ldaptoolbox_openldap_apt_keyrings_path: /usr/share/keyrings
12+
ldaptoolbox_openldap_apt_repo: "deb [arch=amd64 signed-by=/usr/share/keyrings/ltb-project-openldap.gpg] http://ltb-project.org/debian/openldap25/bullseye bullseye main"
13+
ldaptoolbox_openldap_apt_validate_certs: "true"
14+
15+
# Packages
16+
ldaptoolbox_openldap_packages_base: openldap-ltb, openldap-ltb-contrib-overlays, openldap-ltb-mdb-utils
17+
ldaptoolbox_openldap_packages_dependencies: libcrack2, curl
18+
ldaptoolbox_openldap_packages_state: present
19+
20+
# Configuration
21+
ldaptoolbox_openldap_configuration_backup_dir: /var/backups/openldap
22+
ldaptoolbox_openldap_configuration_timestamp_cmd: 'date +%Y%m%d%H%M%S'
23+
ldaptoolbox_openldap_configuration_timestamp: '00000000000000'
24+
ldaptoolbox_openldap_configuration_prefix: "config"
25+
ldaptoolbox_openldap_configuration_owner: ldap
26+
ldaptoolbox_openldap_configuration_group: ldap
27+
ldaptoolbox_openldap_configuration_mode: 0600
28+
ldaptoolbox_openldap_sslgroup: ssl-cert
29+
30+
ldaptoolbox_openldap_slapd_cli_cmd: /usr/local/openldap/sbin/slapd-cli
31+
32+
ldaptoolbox_openldap_module_list:
33+
- argon2.la
34+
- pw-pbkdf2.la
35+
- back_mdb.la
36+
- dynlist.la
37+
- ppolicy.la
38+
- syncprov.la
39+
- unique.la
40+
- refint.la
41+
42+
ldaptoolbox_openldap_custom_schema_srcdir: ""
43+
ldaptoolbox_openldap_custom_schema_list: []
44+
ldaptoolbox_openldap_schema_dir: /usr/local/openldap/etc/openldap/schema
45+
46+
ldaptoolbox_openldap_suffix: "dc=my-domain,dc=com"
47+
48+
ldaptoolbox_olcPasswordHash: "{ARGON2}"
49+

‎handlers/main.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
---
2+
# handlers file for ansible-role-ldaptoolbox-openldap

‎meta/main.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
galaxy_info:
2+
author: Mathieu Jourdan, David Coutadeur
3+
description: installs and configures [LTP-Projects](https://ltb-project.org/)' OpenLDAP.
4+
license: GPL-3.0-or-later
5+
6+
min_ansible_version: 2.10
7+
8+
platforms:
9+
- name: Debian
10+
versions:
11+
- bullseye
12+
13+
galaxy_tags:
14+
- identity
15+
- openldap
16+
- ldap
17+
- ldaptoolbox
18+
19+
dependencies: []

‎tasks/ldaptoolbox-repository.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
---
2+
# tasks file for ansible-role-ldaptoolbox-openldap
3+
4+
- name: debian repository
5+
block:
6+
7+
- name: fetch repository key
8+
ansible.builtin.shell: "curl {{ ldaptoolbox_openldap_apt_key_url }} | gpg --dearmor > {{ ldaptoolbox_openldap_apt_keyrings_path }}/{{ ldaptoolbox_openldap_apt_repo_filename }}.gpg"
9+
10+
- name: add repository
11+
ansible.builtin.apt_repository:
12+
repo: "{{ ldaptoolbox_openldap_apt_repo }}"
13+
filename: "{{ ldaptoolbox_openldap_apt_repo_filename }}"
14+
update_cache: yes
15+
state: present
16+
17+
when:
18+
- ansible_os_family == "Debian"
19+

‎tasks/main.yml‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
---
2+
# tasks file for ansible-role-ldaptoolbox-openldap
3+
4+
# Installation
5+
# ------------
6+
7+
- name: install package dependencies
8+
package:
9+
name: "{{ ldaptoolbox_openldap_packages_dependencies }}"
10+
state: "{{ ldaptoolbox_openldap_packages_state }}"
11+
12+
- name: install ldaptoolbox repository
13+
include_tasks: ldaptoolbox-repository.yml
14+
15+
- name: install openldap packages
16+
package:
17+
name: "{{ ldaptoolbox_openldap_packages_base }}"
18+
state: "{{ ldaptoolbox_openldap_packages_state }}"
19+
20+
- name: allow ldap to read TLS certificates
21+
ansible.builtin.user:
22+
name: "{{ ldaptoolbox_openldap_configuration_owner }}"
23+
groups: "{{ ldaptoolbox_openldap_sslgroup }}"
24+
state: present
25+
when: ldaptoolbox_openldap_olcTLSCertificateFile is defined
26+
27+
# Configuration
28+
# -------------
29+
30+
- name: deploy config file
31+
ansible.builtin.template:
32+
src: ".{{ ldaptoolbox_openldap_configuration_backup_dir }}/{{ ldaptoolbox_openldap_configuration_prefix }}.ldif"
33+
dest: "{{ ldaptoolbox_openldap_configuration_backup_dir }}/{{ ldaptoolbox_openldap_configuration_prefix }}-{{ ldaptoolbox_openldap_configuration_timestamp }}.ldif"
34+
owner: "{{ ldaptoolbox_openldap_configuration_owner }}"
35+
group: "{{ ldaptoolbox_openldap_configuration_group }}"
36+
mode: "{{ ldaptoolbox_openldap_configuration_mode }}"
37+
38+
- name: deploy custom schema
39+
ansible.builtin.template:
40+
src: "{{ ldaptoolbox_openldap_custom_schema_srcdir }}/{{ item }}"
41+
dest: "{{ ldaptoolbox_openldap_schema_dir }}/{{ item }}"
42+
owner: "{{ ldaptoolbox_openldap_configuration_owner }}"
43+
group: "{{ ldaptoolbox_openldap_configuration_group }}"
44+
loop: "{{ ldaptoolbox_openldap_custom_schema_list }}"
45+
46+
- name: load config from file
47+
ansible.builtin.shell: "{{ ldaptoolbox_openldap_slapd_cli_cmd }} restoreconfig"
48+
49+
# Import Data
50+
# -----------
51+
52+
#TODO
53+

‎templates/var/backups/openldap/config.ldif‎

Lines changed: 164 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,164 @@
1+
dn: cn=config
2+
objectClass: olcGlobal
3+
cn: config
4+
olcConfigFile: slapd.conf
5+
olcConfigDir: slapd.d
6+
olcArgsFile: /usr/local/openldap/var/run/slapd.args
7+
olcAttributeOptions: lang-
8+
olcAuthzPolicy: none
9+
olcConcurrency: 0
10+
olcConnMaxPending: 100
11+
olcConnMaxPendingAuth: 1000
12+
olcGentleHUP: FALSE
13+
olcIdleTimeout: 0
14+
olcIndexSubstrIfMaxLen: 4
15+
olcIndexSubstrIfMinLen: 2
16+
olcIndexSubstrAnyLen: 4
17+
olcIndexSubstrAnyStep: 2
18+
olcIndexIntLen: 4
19+
olcListenerThreads: 1
20+
olcLocalSSF: 71
21+
olcPidFile: /usr/local/openldap/var/run/slapd.pid
22+
olcReadOnly: FALSE
23+
olcSaslHost: {{ ldaptoolbox_openldap_olcSaslHost }}
24+
olcSaslSecProps: none
25+
olcServerID: 1
26+
olcSockbufMaxIncoming: 262143
27+
olcSockbufMaxIncomingAuth: 16777215
28+
olcThreads: 16
29+
olcTLSCACertificateFile: {{ ldaptoolbox_openldap_olcTLSCACertificateFile }}
30+
olcTLSCertificateFile: {{ ldaptoolbox_openldap_olcTLSCertificateFile }}
31+
olcTLSCertificateKeyFile: {{ ldaptoolbox_openldap_olcTLSCertificateKeyFile }}
32+
olcTLSCRLCheck: none
33+
olcTLSVerifyClient: allow
34+
olcTLSProtocolMin: {{ ldaptoolbox_openldap_olcTLSProtocolMin }}
35+
olcToolThreads: 1
36+
olcWriteTimeout: 0
37+
olcLogLevel: {{ ldaptoolbox_openldap_olcLogLevel }}
38+
39+
dn: cn=module{0},cn=config
40+
objectClass: olcModuleList
41+
cn: module{0}
42+
olcModulePath: /usr/local/openldap/lib64/:/usr/local/openldap/libexec/openldap/
43+
{% for module in ldaptoolbox_openldap_module_list %}
44+
olcModuleLoad: {{ module }}
45+
{% endfor %}
46+
47+
dn: cn=schema,cn=config
48+
objectClass: olcSchemaConfig
49+
cn: schema
50+
51+
include: file:///usr/local/openldap/etc/openldap/schema/core.ldif
52+
53+
include: file:///usr/local/openldap/etc/openldap/schema/cosine.ldif
54+
55+
include: file:///usr/local/openldap/etc/openldap/schema/nis.ldif
56+
57+
include: file:///usr/local/openldap/etc/openldap/schema/inetorgperson.ldif
58+
59+
include: file:///usr/local/openldap/etc/openldap/schema/dyngroup.ldif
60+
61+
{% for schema in ldaptoolbox_openldap_custom_schema_list %}
62+
include: file://{{ ldaptoolbox_openldap_schema_dir }}/{{ schema }}
63+
{% endfor %}
64+
65+
dn: olcDatabase={-1}frontend,cn=config
66+
objectClass: olcDatabaseConfig
67+
objectClass: olcFrontendConfig
68+
olcDatabase: {-1}frontend
69+
{% for rule in ldaptoolbox_openldap_access_list %}
70+
olcAccess: {{ rule }}
71+
{% endfor %}
72+
olcAddContentAcl: FALSE
73+
olcLastMod: TRUE
74+
olcMaxDerefDepth: 0
75+
olcReadOnly: FALSE
76+
olcSchemaDN: cn=Subschema
77+
olcSecurity: ssf=128
78+
olcSizeLimit: 500
79+
olcSyncUseSubentry: FALSE
80+
olcMonitoring: FALSE
81+
olcPasswordHash: {{ ldaptoolbox_olcPasswordHash }}
82+
olcSortVals: {{ ldaptoolbox_openldap_olcSortVals }}
83+
84+
dn: olcDatabase={0}config,cn=config
85+
objectClass: olcDatabaseConfig
86+
olcDatabase: {0}config
87+
olcAccess: {0}to * by * none
88+
olcAddContentAcl: TRUE
89+
olcLastMod: TRUE
90+
olcMaxDerefDepth: 15
91+
olcReadOnly: FALSE
92+
olcRootDN: {{ ldaptoolbox_openldap_config_olcRootDN }}
93+
olcRootPW: {{ ldaptoolbox_openldap_config_olcRootPW_hash }}
94+
olcSyncUseSubentry: FALSE
95+
olcMonitoring: FALSE
96+
97+
dn: olcDatabase={1}mdb,cn=config
98+
objectClass: olcDatabaseConfig
99+
objectClass: olcMdbConfig
100+
olcDatabase: {1}mdb
101+
olcDbDirectory: /usr/local/openldap/var/openldap-data
102+
olcSuffix: {{ ldaptoolbox_openldap_suffix }}
103+
olcLastMod: TRUE
104+
{% for limit in ldaptoolbox_openldap_database_olcLimits %}
105+
olcLimits: {{ limit }}
106+
{% endfor %}
107+
olcMaxDerefDepth: 15
108+
olcReadOnly: FALSE
109+
olcRootDN: {{ ldaptoolbox_openldap_database_olcRootDN }}
110+
olcRootPW: {{ ldaptoolbox_openldap_database_olcRootPW_hash }}
111+
olcSyncUseSubentry: FALSE
112+
olcLastBind: TRUE
113+
{% for syncrepl in ldaptoolbox_openldap_syncrepl %}
114+
olcSyncrepl: rid={{ syncrepl.rid }} provider={{ syncrepl.provider }} bindmethod=simple timeout=0 network-timeout=0 binddn="{{ syncrepl.binddn }}" credentials="{{ syncrepl.password }}" keepalive=0:0:0 starttls=no {% if syncrepl.tlscert %}tls_cert="{{ syncrepl.tlscert }}" tls_key={{ syncrepl.tlskey }}" tls_cacert="{{ syncrepl.tlscacert }}" tls_reqcert="{{ syncrepl.tlsreqcert }}"{% endif %} filter="(objectclass=*)" searchbase="{{ syncrepl.searchbase }}" scope="{{ syncrepl.scope }}" schemachecking=on type="{{ syncrepl.type }}" retry="{{ syncrepl.retry }}"
115+
{% endfor %}
116+
{% if ldaptoolbox_openldap_syncrepl|length > 0 %}
117+
olcMultiProvider: TRUE
118+
{% endif %}
119+
olcMonitoring: TRUE
120+
{% for index in ldaptoolbox_openldap_database_olcDbIndexes %}
121+
olcDbIndex: {{ index }}
122+
{% endfor %}
123+
olcDbMaxSize: {{ ldaptoolbox_openldap_database_olcDbMaxSize }}
124+
125+
dn: olcOverlay={0}syncprov,olcDatabase={1}mdb,cn=config
126+
objectClass: olcOverlayConfig
127+
objectClass: olcSyncProvConfig
128+
olcOverlay: {0}syncprov
129+
olcSpCheckpoint: {{ ldaptoolbox_openldap_overlay_syncprov_olcSpCheckpoint }}
130+
olcSpSessionlog: {{ ldaptoolbox_openldap_overlay_syncprov_olcSpSessionlog }}
131+
132+
dn: olcOverlay={1}ppolicy,olcDatabase={1}mdb,cn=config
133+
objectClass: olcOverlayConfig
134+
objectClass: olcPPolicyConfig
135+
olcOverlay: {1}ppolicy
136+
olcPPolicyDefault: {{ ldaptoolbox_openldap_overlay_ppolicy_olcPPolicyDefault }}
137+
olcPPolicyHashCleartext: {{ ldaptoolbox_openldap_overlay_ppolicy_olcPPolicyHashCleartext }}
138+
olcPPolicyUseLockout: {{ ldaptoolbox_openldap_overlay_ppolicy_olcPPolicyUseLockout }}
139+
140+
dn: olcOverlay={2}refint,olcDatabase={1}mdb,cn=config
141+
objectClass: olcOverlayConfig
142+
objectClass: olcRefintConfig
143+
olcOverlay: {2}refint
144+
olcRefintAttribute: {{ ldaptoolbox_openldap_overlay_refint_olcRefintAttribute }}
145+
olcRefintNothing: {{ ldaptoolbox_openldap_overlay_refint_olcRefintNothing }}
146+
147+
dn: olcOverlay={3}dynlist,olcDatabase={1}mdb,cn=config
148+
objectClass: olcOverlayConfig
149+
objectClass: olcDynamicList
150+
olcOverlay: {3}dynlist
151+
olcDlAttrSet: {{ ldaptoolbox_openldap_overlay_dynlist_olcDlAttrSet }}
152+
153+
dn: olcDatabase={2}monitor,cn=config
154+
objectClass: olcDatabaseConfig
155+
olcDatabase: {2}monitor
156+
olcRootDN: {{ ldaptoolbox_openldap_monitor_olcRootDN }}
157+
olcRootPW: {{ ldaptoolbox_openldap_monitor_olcRootPW_hash }}
158+
olcAddContentAcl: FALSE
159+
olcLastMod: TRUE
160+
olcMaxDerefDepth: 15
161+
olcReadOnly: FALSE
162+
olcSyncUseSubentry: FALSE
163+
olcMonitoring: FALSE
164+

0 commit comments

Comments
 (0)