Skip to content

Commit 5a3bd46

Browse files
BertrandGounyBertrandGouny
committedAug 16, 2019
Merge branch 'hotfix-1.2.5' into stable
·
v1.5.0v1.2.5
2 parents f27f706 + 5e10294 commit 5a3bd46

File tree

13 files changed

+232
-86
lines changed

13 files changed

+232
-86
lines changed
 

‎CHANGELOG.md

+10
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,16 @@ All notable changes to this project will be documented in this file.
44
The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
55
and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
66

7+
## [1.2.5] - 2019-08-16
8+
## Added
9+
- Support for docker secrets #325. Thanks to @anagno !
10+
- Add DISABLE_CHOWN environment variable #240
11+
- pqChecker lib to check passwords strength with ppolicy pwdCheckModule
12+
13+
### Fixed
14+
- Fix of incorrectly positioned 'log-helper debug' command #327. Thanks to @turcan !
15+
- Fix domain dn #341. Thanks to @obourdon !
16+
717
## [1.2.4] - 2019-03-14
818
### Fixed
919
- Excessive RAM usage on 1.2.2, increased 10x from 1.2.1 #242

‎Makefile

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
NAME = osixia/openldap
2-
VERSION = 1.2.4
2+
VERSION = 1.2.5
33

44
.PHONY: build build-nocache test tag-latest push push-latest release git-tag-version
55

‎README.md

+68-55
Original file line numberDiff line numberDiff line change
@@ -4,47 +4,48 @@
44
![Docker Stars](https://img.shields.io/docker/stars/osixia/openldap.svg)
55
![](https://images.microbadger.com/badges/image/osixia/openldap.svg)
66

7-
Latest release: 1.2.4 - OpenLDAP 2.4.47 - [Changelog](CHANGELOG.md) | [Docker Hub](https://hub.docker.com/r/osixia/openldap/) 
7+
Latest release: 1.2.5 - OpenLDAP 2.4.47 - [Changelog](CHANGELOG.md) | [Docker Hub](https://hub.docker.com/r/osixia/openldap/) 
88

99
**A docker image to run OpenLDAP.**
1010

1111
> OpenLDAP website : [www.openldap.org](http://www.openldap.org/)
1212
1313

1414
- [osixia/openldap](#osixiaopenldap)
15-
- [Contributing](#contributing)
16-
- [Quick Start](#quick-start)
17-
- [Beginner Guide](#beginner-guide)
18-
- [Create new ldap server](#create-new-ldap-server)
19-
- [Data persistence](#data-persistence)
20-
- [Edit your server configuration](#edit-your-server-configuration)
21-
- [Seed ldap database with ldif](#seed-ldap-database-with-ldif)
22-
- [Use an existing ldap database](#use-an-existing-ldap-database)
23-
- [Backup](#backup)
24-
- [Administrate your ldap server](#administrate-your-ldap-server)
25-
- [TLS](#tls)
26-
- [Use auto-generated certificate](#use-auto-generated-certificate)
27-
- [Use your own certificate](#use-your-own-certificate)
28-
- [Disable TLS](#disable-tls)
29-
- [Multi master replication](#multi-master-replication)
30-
- [Fix docker mounted file problems](#fix-docker-mounted-file-problems)
31-
- [Debug](#debug)
32-
- [Environment Variables](#environment-variables)
33-
- [Default.yaml](#defaultyaml)
34-
- [Default.startup.yaml](#defaultstartupyaml)
35-
- [Set your own environment variables](#set-your-own-environment-variables)
36-
- [Use command line argument](#use-command-line-argument)
37-
- [Link environment file](#link-environment-file)
38-
- [Make your own image or extend this image](#make-your-own-image-or-extend-this-image)
39-
- [Advanced User Guide](#advanced-user-guide)
40-
- [Extend osixia/openldap:1.2.4 image](#extend-osixiaopenldap124-image)
41-
- [Make your own openldap image](#make-your-own-openldap-image)
42-
- [Tests](#tests)
43-
- [Kubernetes](#kubernetes)
44-
- [Under the hood: osixia/light-baseimage](#under-the-hood-osixialight-baseimage)
45-
- [Security](#security)
46-
- [Known security issues](#known-security-issues)
47-
- [Changelog](#changelog)
15+
- [Contributing](#Contributing)
16+
- [Quick Start](#Quick-Start)
17+
- [Beginner Guide](#Beginner-Guide)
18+
- [Create new ldap server](#Create-new-ldap-server)
19+
- [Data persistence](#Data-persistence)
20+
- [Edit your server configuration](#Edit-your-server-configuration)
21+
- [Seed ldap database with ldif](#Seed-ldap-database-with-ldif)
22+
- [Use an existing ldap database](#Use-an-existing-ldap-database)
23+
- [Backup](#Backup)
24+
- [Administrate your ldap server](#Administrate-your-ldap-server)
25+
- [TLS](#TLS)
26+
- [Use auto-generated certificate](#Use-auto-generated-certificate)
27+
- [Use your own certificate](#Use-your-own-certificate)
28+
- [Disable TLS](#Disable-TLS)
29+
- [Multi master replication](#Multi-master-replication)
30+
- [Fix docker mounted file problems](#Fix-docker-mounted-file-problems)
31+
- [Debug](#Debug)
32+
- [Environment Variables](#Environment-Variables)
33+
- [Default.yaml](#Defaultyaml)
34+
- [Default.startup.yaml](#Defaultstartupyaml)
35+
- [Set your own environment variables](#Set-your-own-environment-variables)
36+
- [Use command line argument](#Use-command-line-argument)
37+
- [Link environment file](#Link-environment-file)
38+
- [Docker Secrets](#Docker-Secrets)
39+
- [Make your own image or extend this image](#Make-your-own-image-or-extend-this-image)
40+
- [Advanced User Guide](#Advanced-User-Guide)
41+
- [Extend osixia/openldap:1.2.5 image](#Extend-osixiaopenldap125-dev-image)
42+
- [Make your own openldap image](#Make-your-own-openldap-image)
43+
- [Tests](#Tests)
44+
- [Kubernetes](#Kubernetes)
45+
- [Under the hood: osixia/light-baseimage](#Under-the-hood-osixialight-baseimage)
46+
- [Security](#Security)
47+
- [Known security issues](#Known-security-issues)
48+
- [Changelog](#Changelog)
4849

4950
## Contributing
5051

@@ -57,11 +58,11 @@ If you find this image useful here's how you can help:
5758
## Quick Start
5859
Run OpenLDAP docker image:
5960

60-
docker run --name my-openldap-container --detach osixia/openldap:1.2.4
61+
docker run --name my-openldap-container --detach osixia/openldap:1.2.5
6162

6263
Do not forget to add the port mapping for both port 389 and 636 if you wish to access the ldap server from another machine.
6364

64-
docker run -p 389:389 -p 636:636 --name my-openldap-container --detach osixia/openldap:1.2.4
65+
docker run -p 389:389 -p 636:636 --name my-openldap-container --detach osixia/openldap:1.2.5
6566

6667
Either command starts a new container with OpenLDAP running inside. Let's make the first search in our LDAP container:
6768

@@ -97,7 +98,7 @@ It will create an empty ldap for the company **Example Inc.** and the domain **e
9798
By default the admin has the password **admin**. All those default settings can be changed at the docker command line, for example:
9899

99100
docker run --env LDAP_ORGANISATION="My Company" --env LDAP_DOMAIN="my-company.com" \
100-
--env LDAP_ADMIN_PASSWORD="JonSn0w" --detach osixia/openldap:1.2.4
101+
--env LDAP_ADMIN_PASSWORD="JonSn0w" --detach osixia/openldap:1.2.5
101102

102103
#### Data persistence
103104

@@ -148,12 +149,12 @@ argument to entrypoint if you don't want to overwrite them.
148149
# single file example:
149150
docker run \
150151
--volume ./bootstrap.ldif:/container/service/slapd/assets/config/bootstrap/ldif/50-bootstrap.ldif \
151-
osixia/openldap:1.2.4 --copy-service
152+
osixia/openldap:1.2.5 --copy-service
152153

153154
#directory example:
154155
docker run \
155156
--volume ./ldif:/container/service/slapd/assets/config/bootstrap/ldif/custom \
156-
osixia/openldap:1.2.4 --copy-service
157+
osixia/openldap:1.2.5 --copy-service
157158

158159
### Use an existing ldap database
159160

@@ -164,7 +165,7 @@ simply mount this directories as a volume to `/var/lib/ldap` and `/etc/ldap/slap
164165

165166
docker run --volume /data/slapd/database:/var/lib/ldap \
166167
--volume /data/slapd/config:/etc/ldap/slapd.d \
167-
--detach osixia/openldap:1.2.4
168+
--detach osixia/openldap:1.2.5
168169

169170
You can also use data volume containers. Please refer to:
170171
> [https://docs.docker.com/engine/tutorials/dockervolumes/](https://docs.docker.com/engine/tutorials/dockervolumes/)
@@ -184,7 +185,7 @@ If you are looking for a simple solution to administrate your ldap server you ca
184185
#### Use auto-generated certificate
185186
By default, TLS is already configured and enabled, certificate is created using container hostname (it can be set by docker run --hostname option eg: ldap.example.org).
186187

187-
docker run --hostname ldap.my-company.com --detach osixia/openldap:1.2.4
188+
docker run --hostname ldap.my-company.com --detach osixia/openldap:1.2.5
188189

189190
#### Use your own certificate
190191

@@ -194,24 +195,24 @@ You can set your custom certificate at run time, by mounting a directory contain
194195
--env LDAP_TLS_CRT_FILENAME=my-ldap.crt \
195196
--env LDAP_TLS_KEY_FILENAME=my-ldap.key \
196197
--env LDAP_TLS_CA_CRT_FILENAME=the-ca.crt \
197-
--detach osixia/openldap:1.2.4
198+
--detach osixia/openldap:1.2.5
198199

199200
Other solutions are available please refer to the [Advanced User Guide](#advanced-user-guide)
200201

201202
#### Disable TLS
202203
Add --env LDAP_TLS=false to the run command:
203204

204-
docker run --env LDAP_TLS=false --detach osixia/openldap:1.2.4
205+
docker run --env LDAP_TLS=false --detach osixia/openldap:1.2.5
205206

206207
### Multi master replication
207208
Quick example, with the default config.
208209

209210
#Create the first ldap server, save the container id in LDAP_CID and get its IP:
210-
LDAP_CID=$(docker run --hostname ldap.example.org --env LDAP_REPLICATION=true --detach osixia/openldap:1.2.4)
211+
LDAP_CID=$(docker run --hostname ldap.example.org --env LDAP_REPLICATION=true --detach osixia/openldap:1.2.5)
211212
LDAP_IP=$(docker inspect -f "{{ .NetworkSettings.IPAddress }}" $LDAP_CID)
212213

213214
#Create the second ldap server, save the container id in LDAP2_CID and get its IP:
214-
LDAP2_CID=$(docker run --hostname ldap2.example.org --env LDAP_REPLICATION=true --detach osixia/openldap:1.2.4)
215+
LDAP2_CID=$(docker run --hostname ldap2.example.org --env LDAP_REPLICATION=true --detach osixia/openldap:1.2.5)
215216
LDAP2_IP=$(docker inspect -f "{{ .NetworkSettings.IPAddress }}" $LDAP2_CID)
216217

217218
#Add the pair "ip hostname" to /etc/hosts on each containers,
@@ -247,7 +248,7 @@ You may have some problems with mounted files on some systems. The startup scrip
247248

248249
To fix that run the container with `--copy-service` argument :
249250

250-
docker run [your options] osixia/openldap:1.2.4 --copy-service
251+
docker run [your options] osixia/openldap:1.2.5 --copy-service
251252

252253
### Debug
253254

@@ -256,11 +257,11 @@ Available levels are: `none`, `error`, `warning`, `info`, `debug` and `trace`.
256257

257258
Example command to run the container in `debug` mode:
258259

259-
docker run --detach osixia/openldap:1.2.4 --loglevel debug
260+
docker run --detach osixia/openldap:1.2.5 --loglevel debug
260261

261262
See all command line options:
262263

263-
docker run osixia/openldap:1.2.4 --help
264+
docker run osixia/openldap:1.2.5 --help
264265

265266

266267
## Environment Variables
@@ -326,7 +327,7 @@ Replication options:
326327

327328
If you want to set this variable at docker run command add the tag `#PYTHON2BASH:` and convert the yaml in python:
328329

329-
docker run --env LDAP_REPLICATION_HOSTS="#PYTHON2BASH:['ldap://ldap.example.org','ldap://ldap2.example.org']" --detach osixia/openldap:1.2.4
330+
docker run --env LDAP_REPLICATION_HOSTS="#PYTHON2BASH:['ldap://ldap.example.org','ldap://ldap2.example.org']" --detach osixia/openldap:1.2.5
330331

331332
To convert yaml to python online: http://yaml-online-parser.appspot.com/
332333

@@ -338,6 +339,7 @@ Other environment variables:
338339
- **LDAP_REMOVE_CONFIG_AFTER_SETUP**: delete config folder after setup. Defaults to `true`
339340
- **LDAP_SSL_HELPER_PREFIX**: ssl-helper environment variables prefix. Defaults to `ldap`, ssl-helper first search config from LDAP_SSL_HELPER_* variables, before SSL_HELPER_* variables.
340341
- **HOSTNAME**: set the hostname of the running openldap server. Defaults to whatever docker creates.
342+
- **DISABLE_CHOWN**: do not perform any chown to fix file ownership. Defaults to `false`
341343

342344

343345
### Set your own environment variables
@@ -346,7 +348,7 @@ Other environment variables:
346348
Environment variables can be set by adding the --env argument in the command line, for example:
347349

348350
docker run --env LDAP_ORGANISATION="My company" --env LDAP_DOMAIN="my-company.com" \
349-
--env LDAP_ADMIN_PASSWORD="JonSn0w" --detach osixia/openldap:1.2.4
351+
--env LDAP_ADMIN_PASSWORD="JonSn0w" --detach osixia/openldap:1.2.5
350352

351353
Be aware that environment variable added in command line will be available at any time
352354
in the container. In this example if someone manage to open a terminal in this container
@@ -357,28 +359,39 @@ he will be able to read the admin password in clear text from environment variab
357359
For example if your environment files **my-env.yaml** and **my-env.startup.yaml** are in /data/ldap/environment
358360

359361
docker run --volume /data/ldap/environment:/container/environment/01-custom \
360-
--detach osixia/openldap:1.2.4
362+
--detach osixia/openldap:1.2.5
361363

362364
Take care to link your environment files folder to `/container/environment/XX-somedir` (with XX < 99 so they will be processed before default environment files) and not directly to `/container/environment` because this directory contains predefined baseimage environment files to fix container environment (INITRD, LANG, LANGUAGE and LC_CTYPE).
363365

364366
Note: the container will try to delete the **\*.startup.yaml** file after the end of startup files so the file will also be deleted on the docker host. To prevent that : use --volume /data/ldap/environment:/container/environment/01-custom**:ro** or set all variables in **\*.yaml** file and don't use **\*.startup.yaml**:
365367

366368
docker run --volume /data/ldap/environment/my-env.yaml:/container/environment/01-custom/env.yaml \
367-
--detach osixia/openldap:1.2.4
369+
--detach osixia/openldap:1.2.5
370+
371+
#### Docker Secrets
372+
373+
As an alternative to passing sensitive information via environmental variables, _FILE may be appended to the listed variables, causing
374+
the startup.sh script to load the values for those values from files presented in the container. This is particular usefull for loading
375+
passwords using the [Docker secrets](https://docs.docker.com/engine/swarm/secrets/) mechanism. For example:
376+
377+
docker run --env LDAP_ORGANISATION="My company" --env LDAP_DOMAIN="my-company.com" \
378+
--env LDAP_ADMIN_PASSWORD_FILE=/run/secrets/authentication_admin_pw --detach osixia/openldap:1.2.4
379+
380+
Currently this is only supported for LDAP_ADMIN_PASSWORD, LDAP_CONFIG_PASSWORD, LDAP_READONLY_USER_PASSWORD
368381

369382
#### Make your own image or extend this image
370383

371384
This is the best solution if you have a private registry. Please refer to the [Advanced User Guide](#advanced-user-guide) just below.
372385

373386
## Advanced User Guide
374387

375-
### Extend osixia/openldap:1.2.4 image
388+
### Extend osixia/openldap:1.2.5 image
376389

377390
If you need to add your custom TLS certificate, bootstrap config or environment files the easiest way is to extends this image.
378391

379392
Dockerfile example:
380393

381-
FROM osixia/openldap:1.2.4
394+
FROM osixia/openldap:1.2.5
382395
MAINTAINER Your Name <your@name.com>
383396

384397
ADD bootstrap /container/service/slapd/assets/config/bootstrap
@@ -420,7 +433,7 @@ Run your image:
420433

421434
We use **Bats** (Bash Automated Testing System) to test this image:
422435

423-
> [https://github.com/sstephenson/bats](https://github.com/sstephenson/bats)
436+
> [https://github.com/bats-core/bats-core](https://github.com/bats-core/bats-core)
424437
425438
Install Bats, and in this project directory run:
426439

‎example/docker-compose.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
version: '2'
22
services:
33
openldap:
4-
image: osixia/openldap:1.2.4
4+
image: osixia/openldap:1.2.5
55
container_name: openldap
66
environment:
77
LDAP_LOG_LEVEL: "256"

‎example/extend-osixia-openldap/Dockerfile

+1-1
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM osixia/openldap:1.2.4
1+
FROM osixia/openldap:1.2.5
22
MAINTAINER Your Name <your@name.com>
33

44
ADD bootstrap /container/service/slapd/assets/config/bootstrap

‎example/kubernetes/simple/ldap-deployment.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ spec:
1313
spec:
1414
containers:
1515
- name: ldap
16-
image: osixia/openldap:1.2.4
16+
image: osixia/openldap:1.2.5
1717
volumeMounts:
1818
- name: ldap-data
1919
mountPath: /var/lib/ldap

‎example/kubernetes/using-secrets/gce-statefullset.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ spec:
1212
spec:
1313
containers:
1414
- name: azaldap
15-
image: osixia/openldap:1.2.4
15+
image: osixia/openldap:1.2.5
1616
imagePullPolicy: IfNotPresent
1717
#command: ["/bin/bash","-c","while [ 1 = 1 ] ; do sleep 1; date; done"]
1818
ports:

‎example/kubernetes/using-secrets/ldap-deployment.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ spec:
1313
spec:
1414
containers:
1515
- name: ldap
16-
image: osixia/openldap:1.2.4
16+
image: osixia/openldap:1.2.5
1717
args: ["--copy-service"]
1818
volumeMounts:
1919
- name: ldap-data

‎image/Dockerfile

+21-11
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,9 @@ FROM osixia/light-baseimage:1.1.2
55
ARG LDAP_OPENLDAP_GID
66
ARG LDAP_OPENLDAP_UID
77

8+
ARG PQCHECKER_VERSION=2.0.0
9+
ARG PQCHECKER_MD5=c005ce596e97d13e39485e711dcbc7e1
10+
811
# Add openldap user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added
912
# If explicit uid or gid is given, use it.
1013
RUN if [ -z "${LDAP_OPENLDAP_GID}" ]; then groupadd -r openldap; else groupadd -r -g ${LDAP_OPENLDAP_GID} openldap; fi \
@@ -18,17 +21,24 @@ RUN echo "deb http://ftp.debian.org/debian stretch-backports main" >> /etc/apt/s
1821
#  https://github.com/osixia/docker-light-baseimage/blob/stable/image/service-available/:ssl-tools/download.sh
1922
RUN echo "path-include /usr/share/doc/krb5*" >> /etc/dpkg/dpkg.cfg.d/docker && apt-get -y update \
2023
&& /container/tool/add-service-available :ssl-tools \
21-
&& LC_ALL=C DEBIAN_FRONTEND=noninteractive apt-get -t stretch-backports install -y --no-install-recommends \
22-
ldap-utils \
23-
libsasl2-modules \
24-
libsasl2-modules-db \
25-
libsasl2-modules-gssapi-mit \
26-
libsasl2-modules-ldap \
27-
libsasl2-modules-otp \
28-
libsasl2-modules-sql \
29-
openssl \
30-
slapd \
31-
krb5-kdc-ldap \
24+
&& LC_ALL=C DEBIAN_FRONTEND=noninteractive apt-get -t stretch-backports install -y --no-install-recommends \
25+
ca-certificates \
26+
curl \
27+
ldap-utils \
28+
libsasl2-modules \
29+
libsasl2-modules-db \
30+
libsasl2-modules-gssapi-mit \
31+
libsasl2-modules-ldap \
32+
libsasl2-modules-otp \
33+
libsasl2-modules-sql \
34+
openssl \
35+
slapd \
36+
krb5-kdc-ldap \
37+
&& curl -o pqchecker.deb -SL http://www.meddeb.net/pub/pqchecker/deb/8/pqchecker_${PQCHECKER_VERSION}_amd64.deb \
38+
&& echo "${PQCHECKER_MD5} *pqchecker.deb" | md5sum -c - \
39+
&& dpkg -i pqchecker.deb \
40+
&& rm pqchecker.deb \
41+
&& apt-get remove -y --purge --auto-remove curl ca-certificates \
3242
&& apt-get clean \
3343
&& rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
3444

‎image/environment/default.yaml

+4-1
Original file line numberDiff line numberDiff line change
@@ -10,4 +10,7 @@
1010
LDAP_LOG_LEVEL: 256
1111

1212
# Ulimit
13-
LDAP_NOFILE: 1024
13+
LDAP_NOFILE: 1024
14+
15+
# Do not perform any chown to fix file ownership
16+
DISABLE_CHOWN: false

‎image/service/slapd/startup.sh

+58-12
Original file line numberDiff line numberDiff line change
@@ -10,14 +10,44 @@ log-helper level eq trace && set -x
1010
# see https://github.com/docker/docker/issues/8231
1111
ulimit -n $LDAP_NOFILE
1212

13+
14+
# usage: file_env VAR
15+
# ie: file_env 'XYZ_DB_PASSWORD'
16+
# (will allow for "$XYZ_DB_PASSWORD_FILE" to fill in the value of
17+
# "$XYZ_DB_PASSWORD" from a file, especially for Docker's secrets feature)
18+
file_env() {
19+
local var="$1"
20+
local fileVar="${var}_FILE"
21+
22+
# The variables are already defined from the docker-light-baseimage
23+
# So if the _FILE variable is available we ovewrite them
24+
if [ "${!fileVar:-}" ]; then
25+
log-helper trace "${fileVar} was defined"
26+
27+
val="$(< "${!fileVar}")"
28+
log-helper debug "${var} was repalced with the contents of ${fileVar} (the value was: ${val})"
29+
30+
export "$var"="$val"
31+
fi
32+
33+
unset "$fileVar"
34+
}
35+
36+
37+
file_env 'LDAP_ADMIN_PASSWORD'
38+
file_env 'LDAP_CONFIG_PASSWORD'
39+
file_env 'LDAP_READONLY_USER_PASSWORD'
40+
1341
# create dir if they not already exists
1442
[ -d /var/lib/ldap ] || mkdir -p /var/lib/ldap
1543
[ -d /etc/ldap/slapd.d ] || mkdir -p /etc/ldap/slapd.d
1644

1745
# fix file permissions
18-
chown -R openldap:openldap /var/lib/ldap
19-
chown -R openldap:openldap /etc/ldap
20-
chown -R openldap:openldap ${CONTAINER_SERVICE_DIR}/slapd
46+
if [ "${DISABLE_CHOWN,,}" == "false" ]; then
47+
chown -R openldap:openldap /var/lib/ldap
48+
chown -R openldap:openldap /etc/ldap
49+
chown -R openldap:openldap ${CONTAINER_SERVICE_DIR}/slapd
50+
fi
2151

2252
FIRST_START_DONE="${CONTAINER_STATE_DIR}/slapd-first-start-done"
2353
WAS_STARTED_WITH_TLS="/etc/ldap/slapd.d/docker-openldap-was-started-with-tls"
@@ -51,7 +81,15 @@ if [ ! -e "$FIRST_START_DONE" ]; then
5181

5282
LDAP_BASE_DN=${LDAP_BASE_DN::-1}
5383
fi
54-
84+
# Check that LDAP_BASE_DN and LDAP_DOMAIN are in sync
85+
domain_from_base_dn=$(echo $LDAP_BASE_DN | tr ',' '\n' | sed -e 's/^.*=//' | tr '\n' '.' | sed -e 's/\.$//')
86+
set +e
87+
echo "$domain_from_base_dn" | egrep -q ".*$LDAP_DOMAIN\$"
88+
if [ $? -ne 0 ]; then
89+
log-helper error "Error: domain $domain_from_base_dn derived from LDAP_BASE_DN $LDAP_BASE_DN does not match LDAP_DOMAIN $LDAP_DOMAIN"
90+
exit 1
91+
fi
92+
set -e
5593
}
5694

5795
function is_new_schema() {
@@ -65,6 +103,7 @@ if [ ! -e "$FIRST_START_DONE" ]; then
65103

66104
function ldap_add_or_modify (){
67105
local LDIF_FILE=$1
106+
68107
log-helper debug "Processing file ${LDIF_FILE}"
69108
sed -i "s|{{ LDAP_BASE_DN }}|${LDAP_BASE_DN}|g" $LDIF_FILE
70109
sed -i "s|{{ LDAP_BACKEND }}|${LDAP_BACKEND}|g" $LDIF_FILE
@@ -74,9 +113,9 @@ if [ ! -e "$FIRST_START_DONE" ]; then
74113
sed -i "s|{{ LDAP_READONLY_USER_PASSWORD_ENCRYPTED }}|${LDAP_READONLY_USER_PASSWORD_ENCRYPTED}|g" $LDIF_FILE
75114
fi
76115
if grep -iq changetype $LDIF_FILE ; then
77-
ldapmodify -Y EXTERNAL -Q -H ldapi:/// -f $LDIF_FILE 2>&1 | log-helper debug || ldapmodify -h localhost -p 389 -D cn=admin,$LDAP_BASE_DN -w "$LDAP_ADMIN_PASSWORD" -f $LDIF_FILE 2>&1 | log-helper debug
116+
( ldapmodify -Y EXTERNAL -Q -H ldapi:/// -f $LDIF_FILE 2>&1 || ldapmodify -h localhost -p 389 -D cn=admin,$LDAP_BASE_DN -w "$LDAP_ADMIN_PASSWORD" -f $LDIF_FILE 2>&1 ) | log-helper debug
78117
else
79-
ldapadd -Y EXTERNAL -Q -H ldapi:/// -f $LDIF_FILE |& log-helper debug || ldapadd -h localhost -p 389 -D cn=admin,$LDAP_BASE_DN -w "$LDAP_ADMIN_PASSWORD" -f $LDIF_FILE 2>&1 | log-helper debug
118+
( ldapadd -Y EXTERNAL -Q -H ldapi:/// -f $LDIF_FILE 2>&1 || ldapadd -h localhost -p 389 -D cn=admin,$LDAP_BASE_DN -w "$LDAP_ADMIN_PASSWORD" -f $LDIF_FILE 2>&1 ) | log-helper debug
80119
fi
81120
}
82121

@@ -96,6 +135,7 @@ if [ ! -e "$FIRST_START_DONE" ]; then
96135
log-helper info "Database and config directory are empty..."
97136
log-helper info "Init new ldap server..."
98137

138+
get_ldap_base_dn
99139
cat <<EOF | debconf-set-selections
100140
slapd slapd/internal/generated_adminpw password ${LDAP_ADMIN_PASSWORD}
101141
slapd slapd/internal/adminpw password ${LDAP_ADMIN_PASSWORD}
@@ -127,7 +167,9 @@ EOF
127167
mv /tmp/schema/cn=config/cn=schema/* /etc/ldap/slapd.d/cn=config/cn=schema
128168
rm -r /tmp/schema
129169

130-
chown -R openldap:openldap /etc/ldap/slapd.d/cn=config/cn=schema
170+
if [ "${DISABLE_CHOWN,,}" == "false" ]; then
171+
chown -R openldap:openldap /etc/ldap/slapd.d/cn=config/cn=schema
172+
fi
131173
fi
132174

133175
rm ${CONTAINER_SERVICE_DIR}/slapd/assets/config/bootstrap/schema/rfc2307bis.*
@@ -204,8 +246,10 @@ EOF
204246
ssl-helper $LDAP_SSL_HELPER_PREFIX $PREVIOUS_LDAP_TLS_CRT_PATH $PREVIOUS_LDAP_TLS_KEY_PATH $PREVIOUS_LDAP_TLS_CA_CRT_PATH
205247
[ -f ${PREVIOUS_LDAP_TLS_DH_PARAM_PATH} ] || openssl dhparam -out ${LDAP_TLS_DH_PARAM_PATH} 2048
206248

207-
chmod 600 ${PREVIOUS_LDAP_TLS_DH_PARAM_PATH}
208-
chown openldap:openldap $PREVIOUS_LDAP_TLS_CRT_PATH $PREVIOUS_LDAP_TLS_KEY_PATH $PREVIOUS_LDAP_TLS_CA_CRT_PATH $PREVIOUS_LDAP_TLS_DH_PARAM_PATH
249+
if [ "${DISABLE_CHOWN,,}" == "false" ]; then
250+
chmod 600 ${PREVIOUS_LDAP_TLS_DH_PARAM_PATH}
251+
chown openldap:openldap $PREVIOUS_LDAP_TLS_CRT_PATH $PREVIOUS_LDAP_TLS_KEY_PATH $PREVIOUS_LDAP_TLS_CA_CRT_PATH $PREVIOUS_LDAP_TLS_DH_PARAM_PATH
252+
fi
209253
fi
210254

211255
# start OpenLDAP
@@ -308,10 +352,12 @@ EOF
308352

309353
# create DHParamFile if not found
310354
[ -f ${LDAP_TLS_DH_PARAM_PATH} ] || openssl dhparam -out ${LDAP_TLS_DH_PARAM_PATH} 2048
311-
chmod 600 ${LDAP_TLS_DH_PARAM_PATH}
312-
355+
313356
# fix file permissions
314-
chown -R openldap:openldap ${CONTAINER_SERVICE_DIR}/slapd
357+
if [ "${DISABLE_CHOWN,,}" == "false" ]; then
358+
chmod 600 ${LDAP_TLS_DH_PARAM_PATH}
359+
chown -R openldap:openldap ${CONTAINER_SERVICE_DIR}/slapd
360+
fi
315361

316362
# adapt tls ldif
317363
sed -i "s|{{ LDAP_TLS_CA_CRT_PATH }}|${LDAP_TLS_CA_CRT_PATH}|g" ${CONTAINER_SERVICE_DIR}/slapd/assets/config/tls/tls-enable.ldif

‎test/test.bats

+58
Original file line numberDiff line numberDiff line change
@@ -19,25 +19,83 @@ load test_helper
1919

2020
}
2121

22+
@test "ldap domain with ldap base dn" {
23+
24+
run_image -h ldap.example.org -e LDAP_TLS=false -e LDAP_DOMAIN=example.com -e LDAP_BASE_DN="dc=example,dc=org"
25+
26+
sleep 2
27+
28+
CSTATUS=$(check_container)
29+
clear_container
30+
31+
[ "$CSTATUS" != "running 0" ]
32+
33+
}
34+
35+
@test "ldap domain with ldap base dn subdomain" {
36+
37+
run_image -h ldap.example.fr -e LDAP_TLS=false -e LDAP_DOMAIN=example.fr -e LDAP_BASE_DN="ou=myou,o=example,c=fr"
38+
39+
sleep 2
40+
41+
CSTATUS=$(check_container)
42+
clear_container
43+
44+
[ "$CSTATUS" == "running 0" ]
45+
46+
}
47+
48+
@test "ldap domain with ldap base dn subdomain included" {
49+
50+
run_image -h ldap.example.com -e LDAP_TLS=false -e LDAP_DOMAIN=example.com -e LDAP_BASE_DN="ou=myou,o=example,dc=com,c=fr"
51+
52+
sleep 2
53+
54+
CSTATUS=$(check_container)
55+
clear_container
56+
57+
[ "$CSTATUS" != "running 0" ]
58+
59+
}
60+
2261
@test "ldapsearch database from created volumes" {
2362

2463
rm -rf VOLUMES && mkdir -p VOLUMES/config VOLUMES/database
2564
LDAP_CID=$(docker run -h ldap.example.org -e LDAP_TLS=false --volume $PWD/VOLUMES/database:/var/lib/ldap --volume $PWD/VOLUMES/config:/etc/ldap/slapd.d -d $NAME:$VERSION)
2665
wait_process_by_cid $LDAP_CID slapd
2766
run docker exec $LDAP_CID ldapsearch -x -h ldap.example.org -b dc=example,dc=org -D "cn=admin,dc=example,dc=org" -w admin
2867
docker kill $LDAP_CID
68+
clear_containers_by_cid $LDAP_CID
69+
2970
[ "$status" -eq 0 ]
71+
3072
LDAP_CID=$(docker run -h ldap.example.org -e LDAP_TLS=false --volume $PWD/VOLUMES/database:/var/lib/ldap --volume $PWD/VOLUMES/config:/etc/ldap/slapd.d -d $NAME:$VERSION)
3173
wait_process_by_cid $LDAP_CID slapd
3274
run docker exec $LDAP_CID ldapsearch -x -h ldap.example.org -b dc=example,dc=org -D "cn=admin,dc=example,dc=org" -w admin
3375
run docker exec $LDAP_CID chown -R $UID:$UID /var/lib/ldap /etc/ldap/slapd.d
3476
docker kill $LDAP_CID
3577
rm -rf VOLUMES
78+
clear_containers_by_cid $LDAP_CID
3679

3780
[ "$status" -eq 0 ]
3881

3982
}
4083

84+
@test "ldapsearch database with password provided from file" {
85+
86+
rm $PWD/password.txt && touch $PWD/password.txt
87+
echo "strongPassword" >> $PWD/password.txt
88+
89+
run_image -h ldap.osixia.net -e LDAP_ADMIN_PASSWORD_FILE=/run/secrets/admin_pw.txt --volume $PWD/password.txt:/run/secrets/admin_pw.txt
90+
wait_process slapd
91+
run docker exec $CONTAINER_ID ldapsearch -x -h ldap.osixia.net -b dc=example,dc=org -ZZ -D "cn=admin,dc=example,dc=org" -w strongPassword
92+
clear_container
93+
rm $PWD/password.txt
94+
95+
[ "$status" -eq 0 ]
96+
}
97+
98+
4199
@test "ldapsearch new database with strict TLS" {
42100

43101
run_image -h ldap.example.org

‎test/test_helper.bash

100644100755
+7-1
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ build_image() {
99
}
1010

1111
run_image() {
12-
CONTAINER_ID=$(docker run $@ -d $IMAGE_NAME --copy-service -c "/container/service/slapd/test.sh")
12+
CONTAINER_ID=$(docker run $@ -d $IMAGE_NAME --copy-service -c "/container/service/slapd/test.sh" $EXTRA_DOCKER_RUN_FLAGS)
1313
CONTAINER_IP=$(get_container_ip_by_cid $CONTAINER_ID)
1414
}
1515

@@ -34,6 +34,12 @@ wait_process() {
3434
wait_process_by_cid $CONTAINER_ID $@
3535
}
3636

37+
check_container() {
38+
# "Status" = "exited", and "ExitCode" != 0,
39+
local CSTAT=$(docker inspect -f "{{ .State.Status }} {{ .State.ExitCode }}" $CONTAINER_ID)
40+
echo "$CSTAT"
41+
}
42+
3743
# generic functions
3844
get_container_ip_by_cid() {
3945
local IP=$(docker inspect -f "{{ .NetworkSettings.IPAddress }}" $1)

0 commit comments

Comments
 (0)
Please sign in to comment.