Patrick de Ruiter
c66df72e8d
Some checks failed
CI Pipeline / lint (push) Successful in 20s
CI Pipeline / build (push) Successful in 1m2s
CI Pipeline / test (push) Successful in 1m2s
CI Pipeline / security-scan (push) Successful in 1m32s
CI Pipeline / autotag (push) Successful in 25s
CI Pipeline / push (push) Successful in 22s
CI Pipeline / update-cd (push) Failing after 17s
slapadd doesn't understand LDIF change records (changetype: modify). Move TLS configuration attributes directly into the cn=config entry instead of using a separate modify operation.
95 lines
2.7 KiB
Bash
95 lines
2.7 KiB
Bash
#!/bin/sh
|
|
set -e
|
|
|
|
. /scripts/utils.sh
|
|
|
|
log_info "Initializing cn=config..."
|
|
|
|
# Generate password hashes
|
|
LDAP_ADMIN_PASSWORD_HASH=$(hash_password "$LDAP_ADMIN_PASSWORD")
|
|
LDAP_CONFIG_PASSWORD_HASH=$(hash_password "$LDAP_CONFIG_PASSWORD")
|
|
export LDAP_ADMIN_PASSWORD_HASH LDAP_CONFIG_PASSWORD_HASH
|
|
|
|
# Create initial slapd.d configuration
|
|
rm -rf /etc/openldap/slapd.d/*
|
|
|
|
# Build TLS attributes if enabled
|
|
TLS_CONFIG=""
|
|
if [ "$LDAP_TLS_ENABLED" = "true" ] && [ -f "$LDAP_TLS_CERT_FILE" ] && [ -f "$LDAP_TLS_KEY_FILE" ]; then
|
|
log_info "Adding TLS configuration..."
|
|
TLS_CONFIG="olcTLSCertificateFile: ${LDAP_TLS_CERT_FILE}
|
|
olcTLSCertificateKeyFile: ${LDAP_TLS_KEY_FILE}"
|
|
if [ -f "$LDAP_TLS_CA_FILE" ]; then
|
|
TLS_CONFIG="${TLS_CONFIG}
|
|
olcTLSCACertificateFile: ${LDAP_TLS_CA_FILE}"
|
|
fi
|
|
TLS_CONFIG="${TLS_CONFIG}
|
|
olcTLSVerifyClient: ${LDAP_TLS_VERIFY_CLIENT}"
|
|
fi
|
|
|
|
# Create base cn=config LDIF
|
|
cat > /tmp/init-config.ldif << EOF
|
|
dn: cn=config
|
|
objectClass: olcGlobal
|
|
cn: config
|
|
olcArgsFile: /run/openldap/slapd.args
|
|
olcPidFile: /run/openldap/slapd.pid
|
|
olcLogLevel: ${LDAP_LOG_LEVEL}
|
|
${TLS_CONFIG}
|
|
|
|
dn: cn=module{0},cn=config
|
|
objectClass: olcModuleList
|
|
cn: module{0}
|
|
olcModulePath: /usr/lib/openldap
|
|
olcModuleLoad: back_mdb.so
|
|
olcModuleLoad: memberof.so
|
|
olcModuleLoad: refint.so
|
|
olcModuleLoad: unique.so
|
|
olcModuleLoad: ppolicy.so
|
|
olcModuleLoad: syncprov.so
|
|
|
|
dn: cn=schema,cn=config
|
|
objectClass: olcSchemaConfig
|
|
cn: schema
|
|
|
|
dn: olcDatabase={-1}frontend,cn=config
|
|
objectClass: olcDatabaseConfig
|
|
objectClass: olcFrontendConfig
|
|
olcDatabase: {-1}frontend
|
|
olcSizeLimit: 500
|
|
olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by * break
|
|
olcAccess: {1}to dn.base="" by * read
|
|
olcAccess: {2}to dn.base="cn=subschema" by * read
|
|
|
|
dn: olcDatabase={0}config,cn=config
|
|
objectClass: olcDatabaseConfig
|
|
olcDatabase: {0}config
|
|
olcRootDN: cn=admin,cn=config
|
|
olcRootPW: ${LDAP_CONFIG_PASSWORD_HASH}
|
|
olcAccess: {0}to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by * break
|
|
|
|
dn: olcDatabase={1}mdb,cn=config
|
|
objectClass: olcDatabaseConfig
|
|
objectClass: olcMdbConfig
|
|
olcDatabase: {1}mdb
|
|
olcSuffix: ${LDAP_BASE_DN}
|
|
olcRootDN: cn=admin,${LDAP_BASE_DN}
|
|
olcRootPW: ${LDAP_ADMIN_PASSWORD_HASH}
|
|
olcDbDirectory: /var/lib/openldap/openldap-data
|
|
olcDbIndex: objectClass eq
|
|
olcDbIndex: cn eq,pres,sub
|
|
olcDbIndex: entryCSN eq
|
|
olcDbIndex: entryUUID eq
|
|
olcDbMaxSize: 1073741824
|
|
EOF
|
|
|
|
# Import the configuration
|
|
log_info "Importing cn=config with slapadd..."
|
|
/usr/sbin/slapadd -n 0 -F /etc/openldap/slapd.d -l /tmp/init-config.ldif
|
|
|
|
# Set proper ownership
|
|
chown -R ldap:ldap /etc/openldap/slapd.d
|
|
chown -R ldap:ldap /var/lib/openldap
|
|
|
|
log_info "cn=config initialization complete"
|