masson
Version:
Module execution engine for cluster deployments.
243 lines (208 loc) • 8.97 kB
Markdown
# OpenLDAP Server Configure
The property "openldap_server.config_slappasswd" may be generated with the command `slappasswd`
and should correspond to "openldap_server.config_password".
## Provision users and groups
```json
{ "openldap_server": { "entries": {
"groups": {
"my_group": {
"gidNumber": "1234",
"memberUid": ["5678"]
},
"my_user": {
"gidNumber": "5678"
}
},
"users": {
"my_user": {
"uidNumber": "5678",
"gidNumber": "5678",
"userPassword": "my secret"
}
}
} } }
```
export default (service) ->
options = service.options
## Validation
# Todo: Generate '*_slappasswd' with command `slappasswd -s $password`, but only the first time, we
# need a mechanism to store configuration properties before.
throw new Error "Missing \"options.suffix\" property" unless options.suffix
throw new Error "Missing \"options.root_password\" property" unless options.root_password
# throw new Error "Missing \"options.root_slappasswd\" property" unless options.root_slappasswd
throw new Error "Missing \"options.config_dn\" property" unless options.config_dn
throw new Error "Missing \"options.config_password\" property" unless options.config_password
## Ennvironment
options.iptables ?= service.deps.iptables and service.deps.iptables.options.action is 'start'
options.fqdn = service.node.fqdn
## Identities
# Group
options.group = name: options.group if typeof options.group is 'string'
options.group ?= {}
options.group.name ?= 'ldap'
options.group.system ?= true
# User
options.user = name: options.user if typeof options.user is 'string'
options.user ?= {}
options.user.name ?= 'ldap'
options.user.system ?= true
options.user.gid = 'ldap'
options.user.shell = false
options.user.comment ?= 'LDAP User'
options.user.home = '/var/lib/ldap'
## Configuration
options.root_dn ?= "cn=Manager,#{options.suffix}"
options.log_level ?= 256
options.users_dn ?= "ou=users,#{options.suffix}"
options.groups_dn ?= "ou=groups,#{options.suffix}"
options.config_file ?= '/etc/openldap/slapd.d/cn=config/olcDatabase={0}config.ldif'
options.monitor_file ?= '/etc/openldap/slapd.d/cn=config/olcDatabase={1}monitor.ldif'
## ACL
throw Error 'Missing required "options.users_dn" property' unless options.users_dn
throw Error 'Missing required "options.groups_dn" property' unless options.groups_dn
# options.proxy_user ?= {}
# options.proxy_user.dn ?= "cn=nssproxy,#{options.users_dn}"
# options.proxy_user.uid ?= 'nssproxy'
# options.proxy_user.gecos ?= 'Network Service Switch Proxy User'
# options.proxy_user.objectClass ?= ['top', 'account', 'posixAccount', 'shadowAccount']
# options.proxy_user.userPassword ?= 'test'
# options.proxy_user.shadowLastChange ?= '15140'
# options.proxy_user.shadowMin ?= '0'
# options.proxy_user.shadowMax ?= '99999'
# options.proxy_user.shadowWarning ?= '7'
# options.proxy_user.loginShell ?= '/bin/false'
# options.proxy_user.uidNumber ?= '801'
# options.proxy_user.gidNumber ?= '801'
# options.proxy_user.homeDirectory ?= '/home/nssproxy'
# options.proxy_group ?= {}
# options.proxy_group.dn ?= "cn=nssproxy,#{options.groups_dn}"
# options.proxy_group.objectClass ?= ['top', 'posixGroup']
# options.proxy_group.gidNumber ?= '801'
# options.proxy_group.description ?= 'Network Service Switch Proxy'
## Backend
Select the backend for Openldap. It was originally bdb (Barkeley's DB), and moved to hdb.
In Centos/RHEL it's by default hdb. However since openldap 2.4 the recommend backend is
mdb (backend running inside slapd), which does provide the same functionalities than hdb
but with better performances.
Ryb does install hdb/bdb by default, but administrators can choose mdb.
options.backend ?= 'hdb'
throw Error "Unsupported slapd backend #{options.backend}" unless options.backend in ['hdb','mdb']
if options.backend is 'mdb'
options.db_dir ?= "#{options.user.home}/mdb-db"
options.db_max_size ?= '1073741824'# 1 Gb
## SSL/TLS
options.tls ?= false
unless options.tls
options.port ?= 389
options.uri ?= "ldap://#{service.node.fqdn}:#{options.port}"
else
throw Error 'TLS mode requires "tls_cert_file"' unless options.tls_cert_file
throw Error 'TLS mode requires "tls_key_file"' unless options.tls_key_file
options.port ?= 636
options.uri ?= "ldaps://#{service.node.fqdn}:#{options.port}"
## Slapd
options.urls ?= [ 'ldapi:///','ldap:///' ]
options.urls.push 'ldaps:///' if options.tls and options.urls.indexOf('ldaps:///') is -1
## High Availability (HA)
options.server_ids = {}
for openldap_srv, i in service.deps.openldap_server.sort( (srv) -> srv.node.fqdn )
options.server_ids[openldap_srv.node.fqdn] ?= "#{i+1}"
if openldap_srv.node.fqdn isnt service.node.fqdn
options.remote_provider = unless openldap_srv.options.tls
then "ldap://#{openldap_srv.node.fqdn}:#{openldap_srv.options.port or 389}"
else "ldaps://#{openldap_srv.node.fqdn}:#{openldap_srv.options.port or 636}"
## SASL
options.saslauthd = service.deps.saslauthd
## Entries
Provision users and groups
options.ldapadd ?= []
options.ldapdelete ?= []
options.entries ?= {}
options.entries.groups ?= {}
for name, group of options.entries.groups
continue unless group
group = options.entries.groups[name] = misc.merge {},
group = misc.merge {},
dn: "cn=#{name},#{options.groups_dn}"
objectClass: [ 'top', 'posixGroup' ]
memberUid: []
, group
throw Error "Required Entry: gidNumber" unless group.gidNumber
options.entries.users ?= {}
for name, user of options.entries.users
continue unless user
user = options.entries.users[name] = misc.merge {},
dn: "cn=#{name},#{options.users_dn}"
objectClass: [
'top', 'inetOrgPerson', 'organizationalPerson',
'person', 'posixAccount'
]
sn: "#{name}"
uid: "#{name}"
homeDirectory: "/home/#{name}"
loginShell: '/bin/bash'
# givenName: ''
# displayname: ''
, user
throw Error "Required Entry: uidNumber" unless user.uidNumber
throw Error "Required Entry: gidNumber" unless user.gidNumber
throw Error "Required Entry: userPassword" unless user.userPassword
## Kerberos Schema
# Normalization
options.krb5 ?= {}
options.krb5.kerberos_dn ?= "cn=kerberos,#{options.suffix}"
throw Error "attribute 'ou' not allowed" unless options.krb5.kerberos_dn.indexOf('ou=') is -1
# Configure openldap_server_krb5
# {admin_group, users_dn, groups_dn, admin_user} = options.krb5
# User for kdc
# Example: "dn: cn=krbadmin,ou=groups,dc=adaltas,dc=com"
options.krb5.kdc_user ?= {}
options.krb5.kdc_user = misc.merge {},
dn: "cn=krbadmin,#{options.users_dn}"
objectClass: [
'top', 'inetOrgPerson', 'organizationalPerson',
'person', 'posixAccount'
]
givenName: 'Kerberos Administrator'
mail: 'kerberos.admin@company.com'
sn: 'krbadmin'
uid: 'krbadmin'
uidNumber: '800'
gidNumber: '800'
homeDirectory: '/home/krbadmin'
loginShell: '/bin/false'
displayname: 'Kerberos Administrator'
userPassword: 'test'
, options.krb5.kdc_user
# User for krbadmin
# Example: "dn: cn=krbadmin,ou=groups,dc=adaltas,dc=com"
options.krb5.krbadmin_user ?= {}
options.krb5.krbadmin_user = misc.merge {},
dn: "cn=krbadmin,#{options.users_dn}"
objectClass: [
'top', 'inetOrgPerson', 'organizationalPerson',
'person', 'posixAccount'
]
givenName: 'Kerberos Administrator'
mail: 'kerberos.admin@company.com'
sn: 'krbadmin'
uid: 'krbadmin'
uidNumber: '800'
gidNumber: '800'
homeDirectory: '/home/krbadmin'
loginShell: '/bin/false'
displayname: 'Kerberos Administrator'
userPassword: 'test'
, options.krb5.krbadmin_user
# Group for krbadmin
# Example: "dn: cn=krbadmin,ou=groups,dc=adaltas,dc=com"
options.krb5.krbadmin_group ?= {}
options.krb5.krbadmin_group = misc.merge {},
dn: "cn=krbadmin,#{options.groups_dn}"
# cn: 'krbadmin'
objectClass: [ 'top', 'posixGroup' ]
gidNumber: '800'
description: 'Kerberos administrator\'s group.'
, options.krb5.krbadmin_group
## Dependencies
misc = require '@nikitajs/core/lib/misc'