clayrisser / docker-openldap Goto Github PK

View Code? Open in Web Editor NEW

8.0 3.0 0.0 1.2 MB

openldap based on bitnami openldap with ppolicy, password hashing and support for ldif migrations

License: Apache License 2.0

Makefile 0.60% Dockerfile 53.08% Shell 43.28% Nix 3.04%

docker-openldap's Introduction

docker-openldap

openldap based on bitnami openldap with ppolicy, password hashing and support for ldif migrations

★ ★ ★ Please star this project if you found it useful. ★ ★ ★

docker pull registry.gitlab.com/bitspur/rock8s/docker-openldap

This image was created to address some limitations with the bitnami openldap image while still maintaining maximum compatibility with it.

You can view additional versions of the image at https://gitlab.com/bitspur/rock8s/docker-openldap/container_registry/4388893.

New Features

There are several new features that have been added to this image.

1. Password hashing

A new environment variable called LDAP_HASH_PASSWORD has been added that will automatically setup the environment to hash passwords. By default it is set to SHA512CRYPT, the strongest hashing algorithm available. The available options are the following.

NONE
SSHA
MD5
CRYPT
MD5CRYPT
SHA256CRYPT
SHA512CRYPT

2. Ldif migrations

The /ldifs folder does not support ldif migrations (records with a changetype). Instead /ldifs can only add new records.

If you need to modify existing records, put ldif migration files in the /migrations folder.

3. Support for .schema extension

The /schemas directory can include .ldif schemas or .schema schemas.

You can see some examples at context/schemas.

4. Templating support

The /schemas, /ldifs and /migrations directories all support .ldif.tmpl files which will be templated.

You can see an example at context/ldifs/00-organization.ldif.tmpl.

5. Support for additional modules and schemas

You can find the list of supported modules and schemas HERE

6. Easily compile custom modules into the image

You can see an example of this in the Dockerfile

7. Added support for slapcat command

Compatibility

his image based on the bitnami openldap image and is mostly compatible with the bitnami openldap image.

You can reference the official bitnami openldap image at the links below.

There are a few important differences though.

LDAP_CUSTOM_SCHEMA_DIR should not be changed. If you need to add custom schemas they must be placed in the /schemas directory.
LDAP_CUSTOM_LDIF_DIR should not be changed. If you need to add custom ldifs they must be placed in the /ldifs directory.
The version of ldap is different than the version used in bitnami. This is because openldap had to be compiled from scratch to add new modules. The most stable way to compile openldap was using the src from debian. This means the version will always match the version of the debian release instead of the version provided by bitnami.

Build

make build

Debug

start openldap
```
make up
```
open phpldapadmin at localhost:8080
start a shell to interact with ldap
```
make shell
```
run slapcat or ldapsearch commands to test and inspect

You can reference some useful commands at openldap-cheatsheet

Supported Modules and Schemas

Schemas

The following list of schemas are included in this release of openldap and can be enabled with the LDAP_EXTRA_SCHEMAS variable.

collective
corba
core
cosine
dsee
duaconf
dyngroup
inetorgperson
java
misc
msuser
namedobject
nis
openldap
pmi
ppolicy

Modules

The following list of modules are compiled in this release of openldap.

accesslog
auditlog
autogroup
back_bdb
back_dnssrv
back_hdb
back_ldap
back_meta
back_null
back_passwd
back_perl
back_relay
back_shell
back_sock
back_sql
collect
constraint
dds
deref
dyngroup
dynlist
hello_world
lastbind
memberof
pcache
ppolicy
pw-apr1
pw-argon2
pw-netscape
pw-pbkdf2
pw-sha2
refint
retcode
rwm
seqmod
smbk5pwd
smbkrb5pwd
smbkrb5pwd_srv
sssvlv
syncprov
translucent
unique
valsort

docker-openldap's People

Contributors

Stargazers

Watchers

docker-openldap's Issues

Hash variable does not apply

Default docker-compose.yml

version: "3.7"

services:
  openldap:
    container_name: ${NAME}
    image: ${IMAGE}:latest
    hostname: openldap
    ports:
      - 389:1389
    environment:
      LDAP_ADMIN_PASSWORD: P@ssw0rd
      LDAP_HASH_PASSWORD: SHA512CRYPT
      LDAP_USERS: "user1,user2"
      LDAP_PASSWORDS: "pass1,pass2"
      LDAP_SKIP_DEFAULT_TREE: "no"
    volumes:
      - openldap:/bitnami/openldap
volumes:
  openldap: {}

docker exec OpenLDAP slapcat -F /bitnami/openldap/slapd.d
results in a base64 encoded password: userPassword:: cGFzczI=

Which means LDAP_HASH_PASSWORD does not apply. Let's check /opt/bitnami/openldap/migrations/ppolicy.ldif

olcPasswordHash: {CRYPT}

How to properly setup a running container using your example? I tried adding LDAP_EXTRA_SCHEMAS and mounting the folders in context to no avail. A proper initial documentation would be appreciated and a full documentation for what your image supports and how to use it there.

Trying to add a user using phpLDAPadmin shows the following error:

Template Value Error
--
This template uses a selection list for attribute [gidNumber], however the selection list is empty.You may need to create some dependancy entries in your LDAP server so that this attribute renders with values. Alternatively, you may be able to define the appropriate selection values in the template file.

Error: `ldap_bind: Invalid credentials (49)`

Problem

Migrating from an old unmaintained OpenLDAP image osixia/docker-openldap, users added via LDIF fail to authenticate with "Invalid credentials (49)".

Reproduction

ldapwhoami and ldapsearch commands within the same running container (docker exec -it ldap-test bash) are both sufficient at illustrating the problem.

# Default internal admin user is successful:
$ ldapwhoami -v -H 'ldap://ldap.example.test' -D 'cn=admin,dc=example,dc=test' -w adminpassword

ldap_initialize( ldap://ldap.example.test:389/??base )
dn:cn=admin,dc=example,dc=test
Result: Success (0)

# Custom user added is not:
$ ldapwhoami -v -H 'ldap://ldap.example.test' -D 'userid=john.doe,ou=people,dc=example,dc=test' -w secret

ldap_initialize( ldap://ldap.example.test:389/??base )
ldap_bind: Invalid credentials (49)

Admin user can query the LDIF record successfully:

$ ldapsearch -v -x -H 'ldap://ldap.example.test' -b 'ou=people,dc=example,dc=test' -D 'cn=admin,dc=example,dc=test' -w adminpassword  '(&(userid=john.doe)(mailEnabled=TRUE))'

ldap_initialize( ldap://ldap.example.test:389/??base )
filter: (&(userid=john.doe)(mailEnabled=TRUE))
requesting: All userApplication attributes
# extended LDIF
#
# LDAPv3
# base <ou=people,dc=example,dc=test> with scope subtree
# filter: (&(userid=john.doe)(mailEnabled=TRUE))
# requesting: ALL
#

# john.doe, people, example.test
dn: uid=john.doe,ou=people,dc=example,dc=test
objectClass: organizationalPerson
objectClass: person
objectClass: top
objectClass: PostfixBookMailAccount
objectClass: extensibleObject
cn: John Doe
givenName: John
sn: Doe
uid: john.doe
userPassword:: c2VjcmV0
mail: [email protected]
mailEnabled: TRUE
mailUidNumber: 5000
mailGidNumber: 5000
mailAlias: [email protected]
mailGroupMember: [email protected]
mailHomeDirectory: /var/mail/example.test/john.doe/
mailStorageDirectory: maildir:/var/mail/example.test/john.doe/
mailQuota: 10240

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

Where userPassword is base64 encoded in the response to c2VjcmV0 (aka secret).

Related log output from the `ldapsearch` command

64dc88f8 conn=1008 fd=12 ACCEPT from IP=172.17.0.2:54138 (IP=0.0.0.0:389)
64dc88f8 conn=1008 op=0 BIND dn="cn=admin,dc=example,dc=test" method=128
64dc88f8 conn=1008 op=0 BIND dn="cn=admin,dc=example,dc=test" mech=SIMPLE ssf=0
64dc88f8 conn=1008 op=0 RESULT tag=97 err=0 text=
64dc88f8 conn=1008 op=1 SRCH base="ou=people,dc=example,dc=test" scope=2 deref=0 filter="(&(uid=john.doe)(mailEnabled=TRUE))"
64dc88f8 <= mdb_equality_candidates: (uid) not indexed
64dc88f8 <= mdb_equality_candidates: (mailEnabled) not indexed
64dc88f8 conn=1008 op=1 SEARCH RESULT tag=101 err=0 nentries=1 text=
64dc88f8 conn=1008 op=2 UNBIND
64dc88f8 conn=1008 fd=12 closed

Whereas the equivalent for the custom user fails with:

$ ldapsearch -v -x -H 'ldap://ldap.example.test' -b 'ou=people,dc=example,dc=test' -D 'userid=john.doe,ou=people,dc=example,dc=test' -w secret  '(&(userid=john.doe)(mailEnabled=TRUE))'

ldap_initialize( ldap://ldap.example.test:389/??base )
ldap_bind: Invalid credentials (49)


# Related log output from container logs:
64dc8a08 conn=1010 fd=12 ACCEPT from IP=172.17.0.2:42226 (IP=0.0.0.0:389)
64dc8a08 conn=1010 op=0 BIND dn="uid=john.doe,ou=people,dc=example,dc=test" method=128
64dc8a08 conn=1010 op=0 RESULT tag=97 err=49 text=
64dc8a08 conn=1010 op=1 UNBIND
64dc8a08 conn=1010 fd=12 closed

`docker run`

docker run --rm --name ldap-test \
  --env LDAP_ROOT='dc=example,dc=test' \
  --env LDAP_HASH_PASSWORD='NONE' \
  --env LDAP_PORT_NUMBER=389 \
  --env BITNAMI_DEBUG=true \
  --volume '/tmp/ldif/:/migrations/:ro' \
  --hostname 'ldap.example.test' \
  registry.gitlab.com/bitspur/rock8s/docker-openldap

The hash method is set to NONE just to keep it simple. I tried SHA for a predictable SHA-1 (due to no salt, slappasswd -s secret -h '{SHA}' always outputs {SHA}5en6G6MezRroT3XKqkdPOmY/BfQ=), but I am unsure why credentials are "invalid".
The custom .ldif files are mounted to /migrations as your README advises due to using changetype to do so. It doesn't seem to make any difference either way.

Log output during startup

rm: cannot remove '/opt/bitnami/openldap/ldifs': Permission denied
 08:21:29.93 INFO  ==> ** Starting LDAP setup **
 08:21:29.95 INFO  ==> Validating settings in LDAP_* env vars
 08:21:29.95 INFO  ==> Initializing OpenLDAP...
 08:21:29.95 DEBUG ==> Ensuring expected directories/files exist...
 08:21:29.96 INFO  ==> Creating LDAP online configuration
 08:21:29.96 INFO  ==> Creating slapd.ldif
 08:21:29.98 INFO  ==> Starting OpenLDAP server in background
64dc8709 @(#) $OpenLDAP: slapd 2.4.57+dfsg-3+deb11u1 (May 14 2022 18:32:57) $
        Debian OpenLDAP Maintainers <[email protected]>
64dc8709 slapd starting
 08:21:30.99 INFO  ==> Configure LDAP credentials for admin user
SASL/EXTERNAL authentication started
64dc870a conn=1000 fd=12 ACCEPT from PATH=/var/run/slapd/ldapi (PATH=/var/run/slapd/ldapi)
64dc870a conn=1000 op=0 BIND dn="" method=163
64dc870a conn=1000 op=0 BIND authcid="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth" authzid="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth"
64dc870a conn=1000 op=0 BIND dn="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth" mech=EXTERNAL sasl_ssf=0 ssf=71
64dc870a conn=1000 op=0 RESULT tag=97 err=0 text=
SASL username: gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth
SASL SSF: 0
64dc870a conn=1000 op=1 MOD dn="olcDatabase={2}mdb,cn=config"
64dc870a conn=1000 op=1 MOD attr=olcSuffix
64dc870a conn=1000 op=1 RESULT tag=103 err=0 text=
64dc870a conn=1000 op=2 MOD dn="olcDatabase={2}mdb,cn=config"
64dc870a conn=1000 op=2 MOD attr=olcRootDN
64dc870a conn=1000 op=2 RESULT tag=103 err=0 text=
64dc870a conn=1000 op=3 MOD dn="olcDatabase={2}mdb,cn=config"
64dc870a conn=1000 op=3 MOD attr=olcRootPW
64dc870a conn=1000 op=3 RESULT tag=103 err=0 text=
64dc870a conn=1000 op=4 MOD dn="olcDatabase={1}monitor,cn=config"
64dc870a conn=1000 op=4 MOD attr=olcAccess
64dc870a conn=1000 op=4 RESULT tag=103 err=0 text=
64dc870a conn=1000 op=5 UNBIND
64dc870a conn=1000 fd=12 closed
modifying entry "olcDatabase={2}mdb,cn=config"

modifying entry "olcDatabase={2}mdb,cn=config"

modifying entry "olcDatabase={2}mdb,cn=config"

modifying entry "olcDatabase={1}monitor,cn=config"

 08:21:30.99 INFO  ==> Adding LDAP extra schemas
SASL/EXTERNAL authentication started
64dc870b conn=1001 fd=12 ACCEPT from PATH=/var/run/slapd/ldapi (PATH=/var/run/slapd/ldapi)
64dc870b conn=1001 op=0 BIND dn="" method=163
64dc870b conn=1001 op=0 BIND authcid="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth" authzid="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth"
64dc870b conn=1001 op=0 BIND dn="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth" mech=EXTERNAL sasl_ssf=0 ssf=71
64dc870b conn=1001 op=0 RESULT tag=97 err=0 text=
SASL username: gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth
SASL SSF: 0
64dc870b conn=1001 op=1 ADD dn="cn=cosine,cn=schema,cn=config"
64dc870b conn=1001 op=1 RESULT tag=105 err=0 text=
adding new entry "cn=cosine,cn=schema,cn=config"

64dc870b conn=1001 op=2 UNBIND
64dc870b conn=1001 fd=12 closed
SASL/EXTERNAL authentication started
64dc870b conn=1002 fd=12 ACCEPT from PATH=/var/run/slapd/ldapi (PATH=/var/run/slapd/ldapi)
64dc870b conn=1002 op=0 BIND dn="" method=163
64dc870b conn=1002 op=0 BIND authcid="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth" authzid="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth"
64dc870b conn=1002 op=0 BIND dn="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth" mech=EXTERNAL sasl_ssf=0 ssf=71
64dc870b conn=1002 op=0 RESULT tag=97 err=0 text=
SASL username: gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth
SASL SSF: 0
64dc870b conn=1002 op=1 ADD dn="cn=inetorgperson,cn=schema,cn=config"
64dc870b conn=1002 op=1 RESULT tag=105 err=0 text=
adding new entry "cn=inetorgperson,cn=schema,cn=config"

64dc870b conn=1002 op=2 UNBIND
64dc870b conn=1002 fd=12 closed
SASL/EXTERNAL authentication started
64dc870b conn=1003 fd=12 ACCEPT from PATH=/var/run/slapd/ldapi (PATH=/var/run/slapd/ldapi)
64dc870b conn=1003 op=0 BIND dn="" method=163
64dc870b conn=1003 op=0 BIND authcid="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth" authzid="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth"
64dc870b conn=1003 op=0 BIND dn="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth" mech=EXTERNAL sasl_ssf=0 ssf=71
64dc870b conn=1003 op=0 RESULT tag=97 err=0 text=
SASL username: gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth
SASL SSF: 0
64dc870b conn=1003 op=1 ADD dn="cn=misc,cn=schema,cn=config"
64dc870b conn=1003 op=1 RESULT tag=105 err=0 text=
adding new entry "cn=misc,cn=schema,cn=config"

64dc870b conn=1003 op=2 UNBIND
64dc870b conn=1003 fd=12 closed
SASL/EXTERNAL authentication started
64dc870b conn=1004 fd=12 ACCEPT from PATH=/var/run/slapd/ldapi (PATH=/var/run/slapd/ldapi)
64dc870b conn=1004 op=0 BIND dn="" method=163
64dc870b conn=1004 op=0 BIND authcid="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth" authzid="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth"
64dc870b conn=1004 op=0 BIND dn="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth" mech=EXTERNAL sasl_ssf=0 ssf=71
64dc870b conn=1004 op=0 RESULT tag=97 err=0 text=
SASL username: gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth
SASL SSF: 0
64dc870b conn=1004 op=1 ADD dn="cn=nis,cn=schema,cn=config"
64dc870b conn=1004 op=1 RESULT tag=105 err=0 text=
64dc870b conn=1004 op=2 UNBIND
64dc870b conn=1004 fd=12 closed
adding new entry "cn=nis,cn=schema,cn=config"

SASL/EXTERNAL authentication started
64dc870b conn=1005 fd=12 ACCEPT from PATH=/var/run/slapd/ldapi (PATH=/var/run/slapd/ldapi)
64dc870b conn=1005 op=0 BIND dn="" method=163
64dc870b conn=1005 op=0 BIND authcid="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth" authzid="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth"
64dc870b conn=1005 op=0 BIND dn="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth" mech=EXTERNAL sasl_ssf=0 ssf=71
64dc870b conn=1005 op=0 RESULT tag=97 err=0 text=
SASL username: gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth
SASL SSF: 0
64dc870b conn=1005 op=1 ADD dn="cn=ppolicy,cn=schema,cn=config"
64dc870b conn=1005 op=1 RESULT tag=105 err=0 text=
64dc870b conn=1005 op=2 UNBIND
64dc870b conn=1005 fd=12 closed
adding new entry "cn=ppolicy,cn=schema,cn=config"

 08:21:31.02 INFO  ==> Adding custom schemas : /opt/bitnami/openldap/schemas ...
64dc870b daemon: shutdown requested and initiated.
64dc870b slapd shutdown: waiting for 0 operations/tasks to finish
64dc870b slapd stopped.
 08:21:32.21 INFO  ==> Starting OpenLDAP server in background
64dc870c @(#) $OpenLDAP: slapd 2.4.57+dfsg-3+deb11u1 (May 14 2022 18:32:57) $
        Debian OpenLDAP Maintainers <[email protected]>
64dc870c slapd starting
 08:21:33.22 INFO  ==> Creating LDAP default tree
64dc870d conn=1000 fd=12 ACCEPT from PATH=/var/run/slapd/ldapi (PATH=/var/run/slapd/ldapi)
64dc870d conn=1000 op=0 BIND dn="cn=admin,dc=example,dc=test" method=128
64dc870d conn=1000 op=0 BIND dn="cn=admin,dc=example,dc=test" mech=SIMPLE ssf=0
64dc870d conn=1000 op=0 RESULT tag=97 err=0 text=
64dc870d conn=1000 op=1 ADD dn="dc=example,dc=test"
64dc870d conn=1000 op=1 RESULT tag=105 err=0 text=
64dc870d conn=1000 op=2 ADD dn="ou=users,dc=example,dc=test"
64dc870d conn=1000 op=2 RESULT tag=105 err=0 text=
64dc870d conn=1000 op=3 ADD dn="cn=user01,ou=users,dc=example,dc=test"
64dc870d conn=1000 op=3 RESULT tag=105 err=0 text=
64dc870d conn=1000 op=4 ADD dn="cn=user02,ou=users,dc=example,dc=test"
64dc870d conn=1000 op=4 RESULT tag=105 err=0 text=
64dc870d conn=1000 op=5 ADD dn="cn=readers,ou=users,dc=example,dc=test"
64dc870d conn=1000 op=5 RESULT tag=105 err=0 text=
64dc870d conn=1000 op=6 UNBIND
64dc870d conn=1000 fd=12 closed
adding new entry "dc=example,dc=test"

adding new entry "ou=users,dc=example,dc=test"

adding new entry "cn=user01,ou=users,dc=example,dc=test"

adding new entry "cn=user02,ou=users,dc=example,dc=test"

adding new entry "cn=readers,ou=users,dc=example,dc=test"

64dc870d daemon: shutdown requested and initiated.
64dc870d slapd shutdown: waiting for 0 operations/tasks to finish
64dc870d slapd stopped.

 08:21:34.28 INFO  ==> ** LDAP setup finished! **
 08:21:34.30 INFO  ==> ** Starting slapd **
64dc870e @(#) $OpenLDAP: slapd 2.4.57+dfsg-3+deb11u1 (May 14 2022 18:32:57) $
        Debian OpenLDAP Maintainers <[email protected]>
64dc870e slapd starting
64dc870e conn=1000 fd=12 ACCEPT from PATH=/var/run/slapd/ldapi (PATH=/var/run/slapd/ldapi)
64dc870e conn=1000 op=0 BIND dn="" method=163
64dc870e conn=1000 op=0 BIND authcid="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth" authzid="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth"
64dc870e conn=1000 op=0 BIND dn="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth" mech=EXTERNAL sasl_ssf=0 ssf=71
64dc870e conn=1000 op=0 RESULT tag=97 err=0 text=
64dc870e conn=1000 op=1 EXT oid=1.3.6.1.4.1.4203.1.11.3
64dc870e conn=1000 op=1 WHOAMI
64dc870e conn=1000 op=1 RESULT oid= err=0 text=
dn:gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth
64dc870e conn=1000 op=2 UNBIND
64dc870e conn=1000 fd=12 closed
ldapmodify -Y EXTERNAL -H ldapi:/// -f /opt/bitnami/openldap/migrations/00-access.ldif
SASL/EXTERNAL authentication started
64dc870e conn=1001 fd=12 ACCEPT from PATH=/var/run/slapd/ldapi (PATH=/var/run/slapd/ldapi)
64dc870e conn=1001 op=0 BIND dn="" method=163
64dc870e conn=1001 op=0 BIND authcid="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth" authzid="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth"
64dc870e conn=1001 op=0 BIND dn="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth" mech=EXTERNAL sasl_ssf=0 ssf=71
64dc870e conn=1001 op=0 RESULT tag=97 err=0 text=
SASL username: gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth
SASL SSF: 0
64dc870e conn=1001 op=1 MOD dn="olcDatabase={2}mdb,cn=config"
64dc870e conn=1001 op=1 MOD attr=olcAccess
64dc870e conn=1001 op=1 RESULT tag=103 err=0 text=
modifying entry "olcDatabase={2}mdb,cn=config"

64dc870e conn=1001 op=2 UNBIND
64dc870e conn=1001 fd=12 closed
ldapmodify -Y EXTERNAL -H ldapi:/// -f /opt/bitnami/openldap/migrations/01_mail-tree.ldif
SASL/EXTERNAL authentication started
64dc870e conn=1002 fd=12 ACCEPT from PATH=/var/run/slapd/ldapi (PATH=/var/run/slapd/ldapi)
64dc870e conn=1002 op=0 BIND dn="" method=163
64dc870e conn=1002 op=0 BIND authcid="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth" authzid="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth"
64dc870e conn=1002 op=0 BIND dn="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth" mech=EXTERNAL sasl_ssf=0 ssf=71
64dc870e conn=1002 op=0 RESULT tag=97 err=0 text=
SASL username: gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth
SASL SSF: 0
64dc870e conn=1002 op=1 ADD dn="ou=people,dc=example,dc=test"
64dc870e conn=1002 op=1 RESULT tag=105 err=0 text=
64dc870e conn=1002 op=2 UNBIND
adding new entry "ou=people,dc=example,dc=test"

64dc870e conn=1002 fd=12 closed
ldapmodify -Y EXTERNAL -H ldapi:/// -f /opt/bitnami/openldap/migrations/02_user-email.ldif
SASL/EXTERNAL authentication started
64dc870e conn=1003 fd=12 ACCEPT from PATH=/var/run/slapd/ldapi (PATH=/var/run/slapd/ldapi)
64dc870e conn=1003 op=0 BIND dn="" method=163
64dc870e conn=1003 op=0 BIND authcid="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth" authzid="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth"
64dc870e conn=1003 op=0 BIND dn="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth" mech=EXTERNAL sasl_ssf=0 ssf=71
64dc870e conn=1003 op=0 RESULT tag=97 err=0 text=
SASL username: gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth
SASL SSF: 0
64dc870e conn=1003 op=1 ADD dn="uid=john.doe,ou=people,dc=example,dc=test"
64dc870e conn=1003 op=1 RESULT tag=105 err=0 text=
64dc870e conn=1003 op=2 UNBIND
64dc870e conn=1003 fd=12 closed
adding new entry "userid=john.doe,ou=people,dc=example,dc=test"

ldapmodify -Y EXTERNAL -H ldapi:/// -f /opt/bitnami/openldap/migrations/auditlog.ldif
SASL/EXTERNAL authentication started
64dc870e conn=1004 fd=12 ACCEPT from PATH=/var/run/slapd/ldapi (PATH=/var/run/slapd/ldapi)
64dc870e conn=1004 op=0 BIND dn="" method=163
64dc870e conn=1004 op=0 BIND authcid="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth" authzid="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth"
64dc870e conn=1004 op=0 BIND dn="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth" mech=EXTERNAL sasl_ssf=0 ssf=71
64dc870e conn=1004 op=0 RESULT tag=97 err=0 text=
SASL username: gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth
SASL SSF: 0
64dc870e conn=1004 op=1 UNBIND
64dc870e conn=1004 fd=12 closed
ldapmodify -Y EXTERNAL -H ldapi:/// -f /opt/bitnami/openldap/migrations/ppolicy.ldif
SASL/EXTERNAL authentication started
64dc870e conn=1005 fd=12 ACCEPT from PATH=/var/run/slapd/ldapi (PATH=/var/run/slapd/ldapi)
64dc870e conn=1005 op=0 BIND dn="" method=163
64dc870e conn=1005 op=0 BIND authcid="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth" authzid="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth"
64dc870e conn=1005 op=0 BIND dn="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth" mech=EXTERNAL sasl_ssf=0 ssf=71
64dc870e conn=1005 op=0 RESULT tag=97 err=0 text=
SASL username: gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth
SASL SSF: 0
64dc870e conn=1005 op=1 UNBIND
64dc870e conn=1005 fd=12 closed
ldapmodify -Y EXTERNAL -H ldapi:/// -f /opt/bitnami/openldap/migrations/smbkrb5pwd.ldif
SASL/EXTERNAL authentication started
64dc870e conn=1006 fd=12 ACCEPT from PATH=/var/run/slapd/ldapi (PATH=/var/run/slapd/ldapi)
64dc870e conn=1006 op=0 BIND dn="" method=163
64dc870e conn=1006 op=0 BIND authcid="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth" authzid="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth"
64dc870e conn=1006 op=0 BIND dn="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth" mech=EXTERNAL sasl_ssf=0 ssf=71
64dc870e conn=1006 op=0 RESULT tag=97 err=0 text=
SASL username: gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth
SASL SSF: 0
64dc870e conn=1006 op=1 UNBIND
64dc870e conn=1006 fd=12 closed
ldapmodify -Y EXTERNAL -H ldapi:/// -f /opt/bitnami/openldap/migrations/syncrepl.ldif
SASL/EXTERNAL authentication started
64dc870e conn=1007 fd=12 ACCEPT from PATH=/var/run/slapd/ldapi (PATH=/var/run/slapd/ldapi)
64dc870e conn=1007 op=0 BIND dn="" method=163
64dc870e conn=1007 op=0 BIND authcid="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth" authzid="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth"
64dc870e conn=1007 op=0 BIND dn="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth" mech=EXTERNAL sasl_ssf=0 ssf=71
64dc870e conn=1007 op=0 RESULT tag=97 err=0 text=
SASL username: gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth
SASL SSF: 0
64dc870e conn=1007 op=1 UNBIND
64dc870e conn=1007 fd=12 closed

Relevant snippet from above log (for the two custom LDIF files)

ldapmodify -Y EXTERNAL -H ldapi:/// -f /opt/bitnami/openldap/migrations/01_mail-tree.ldif
SASL/EXTERNAL authentication started
64dc870e conn=1002 fd=12 ACCEPT from PATH=/var/run/slapd/ldapi (PATH=/var/run/slapd/ldapi)
64dc870e conn=1002 op=0 BIND dn="" method=163
64dc870e conn=1002 op=0 BIND authcid="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth" authzid="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth"
64dc870e conn=1002 op=0 BIND dn="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth" mech=EXTERNAL sasl_ssf=0 ssf=71
64dc870e conn=1002 op=0 RESULT tag=97 err=0 text=
SASL username: gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth
SASL SSF: 0
64dc870e conn=1002 op=1 ADD dn="ou=people,dc=example,dc=test"
64dc870e conn=1002 op=1 RESULT tag=105 err=0 text=
64dc870e conn=1002 op=2 UNBIND
adding new entry "ou=people,dc=example,dc=test"

64dc870e conn=1002 fd=12 closed
ldapmodify -Y EXTERNAL -H ldapi:/// -f /opt/bitnami/openldap/migrations/02_user-email.ldif
SASL/EXTERNAL authentication started
64dc870e conn=1003 fd=12 ACCEPT from PATH=/var/run/slapd/ldapi (PATH=/var/run/slapd/ldapi)
64dc870e conn=1003 op=0 BIND dn="" method=163
64dc870e conn=1003 op=0 BIND authcid="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth" authzid="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth"
64dc870e conn=1003 op=0 BIND dn="gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth" mech=EXTERNAL sasl_ssf=0 ssf=71
64dc870e conn=1003 op=0 RESULT tag=97 err=0 text=
SASL username: gidNumber=0+uidNumber=1001,cn=peercred,cn=external,cn=auth
SASL SSF: 0
64dc870e conn=1003 op=1 ADD dn="uid=john.doe,ou=people,dc=example,dc=test"
64dc870e conn=1003 op=1 RESULT tag=105 err=0 text=
64dc870e conn=1003 op=2 UNBIND
64dc870e conn=1003 fd=12 closed
adding new entry "userid=john.doe,ou=people,dc=example,dc=test"

Custom LDIF

Minimized to the two files below (2nd relies on the postfix-book.schema this image already provides). Creates a single mail user account to test against.

01_mail-tree.ldif:

dn: ou=people,dc=example,dc=test
changetype: add
objectClass: organizationalUnit
objectClass: top
ou: people

02_user-email.ldif:

# --------------------------------------------------------------------
# Create mail accounts
# --------------------------------------------------------------------
# John Doe
dn: userid=john.doe,ou=people,dc=example,dc=test
changetype: add
objectClass: organizationalPerson
objectClass: person
objectClass: top
objectClass: PostfixBookMailAccount
objectClass: extensibleObject
cn: John Doe
givenName: John
surname: Doe
userid: john.doe
userPassword: secret
mail: [email protected]
# postfix-book.schema:
mailEnabled: TRUE
mailUidNumber: 5000
mailGidNumber: 5000
mailAlias: [email protected]
mailGroupMember: [email protected]
mailHomeDirectory: /var/mail/example.test/john.doe/
mailStorageDirectory: maildir:/var/mail/example.test/john.doe/
mailQuota: 10240

Background

Over the past two days (no LDAP experience), I've been trying to migrate the docker-mailserver LDAP test away from the osixia/docker-openldap image (we've used an old pinned version from many years ago, the latest just crashes).

That image was last maintained 2 years ago, and the bitnami openldap image seems to be one of the only actively maintained ones I came across that seemed suitable. However I ran into some compatibility issues there and my inexperience with LDAP... but this variant image with improvements is almost working, last roadblock is getting created users to successfully authenticate.

use ppolicy add pwdMaxAge not work

Hi, i use this image, and load ppolicy module, add object in phpLPADAdmin with pwdMaxAge, but it not work for me. The new user like:

dn: cn=lisi,ou=policies,dc=univer,dc=ai
cn: lisi
objectclass: inetOrgPerson
objectclass: pwdPolicy
pwdattribute: 2.5.4.35
pwdmaxage: 30
sn: li
uid: lisi
userpassword: {MD5}ICy5YqxZB1uWSwcVLSNLcA==

Custom Schema

Great Work what you done.

I did try for hours now search on bitnami (i found similar issue but the solution did not work) so i hope you can help me here.

I am trying to add this schema : https://github.com/variablenix/ldap-mail-schema/blob/master/postfix-book.schema
but for some reason it wont get recognized.

I did put the schema in the folder "/data/openldapv2/conf/custom"

services:
  openldap:
    image: registry.gitlab.com/bitspur/rock8s/docker-openldap:latest
    container_name: openldap
    ports:
      - '389:389'
      - '636:636'
    environment:
      - LDAP_ADMIN_USERNAME=admin
      - LDAP_ADMIN_PASSWORD=supersecretpass!
      - LDAP_ROOT=dc=test,dc=in,dc=ua
      - LDAP_PORT_NUMBER=389
      - LDAP_LDAPS_PORT_NUMBER=636
      - BITNAMI_DEBUG=true
      - LDAP_ENABLE_TLS=yes
      - LDAP_TLS_CERT_FILE=/opt/bitnami/openldap/certs/openldap.crt
      - LDAP_TLS_KEY_FILE=/opt/bitnami/openldap/certs/openldap.key
      - LDAP_TLS_CA_FILE=/opt/bitnami/openldap/certs/openldapCA.crt
      - LDAP_CUSTOM_SCHEMA_DIR=/custom-schemas
    volumes:
      - ./data/openldapv2/storage/openldap_data:/bitnami/openldap:rw
      - ./data/openldapv2/conf/cert:/opt/bitnami/openldap/certs:ro
      - ./data/openldapv2/conf/custom:/custom-schemas:rw

    domainname: "test.in.ua"
    hostname: "openldap"
    networks:
      - openldap

This is only one output of the logs which i found.

openldap  |  17:05:55.97 INFO  ==> Adding custom schemas : /custom-schemas ...
openldap  | 64e4eaf3 daemon: shutdown requested and initiated.
openldap  | 64e4eaf3 slapd shutdown: waiting for 0 operations/tasks to finish

I am not LDAP expert, sorry if i am doing something wront but i took a lot of time to check bitnami repo.

Thank you

Confused on how to add schemas and enable modules

I am currently trying out this image over bitname/openldap since you advertised modules such as memberof and built in schemas.
However I have yet to get either of them working :/

Tried 1

Starting the container with my configs below yields this error for postfix-boot:

/opt/bitnami/openldap/etc/schema/postfix-book.ldif: No such file or directory

And I've not seen any sign of memberof being loaded altough I added it to my ldifs folder
root@zungenbrecher:/opt/ldap# cat ldifs/memberof.ldif

dn: cn=module,cn=config
cn: module
objectClass: olcModuleList
olcModulePath: /opt/bitnami/openldap/libexec
olcModuleLoad: memberof.la

I have no name!@9615e2a23efd:/$ slapcat -n0 | grep olcModuleLoad gives no output

.env:

LDAP_ORGANISATION="Melijn"

LDAP_ROOT="dc=melijn,dc=com"
LDAP_ADMIN_USERNAME=admin
LDAP_ADMIN_PASSWORD=redacted
LDAP_USER_DC=users
LDAP_GROUP=readers
LDAP_ADD_SCHEMAS=yes
LDAP_EXTRA_SCHEMAS=cosine, inetorgperson, nis, postfix-book
LDAP_HASH_PASSWORD=SHA512CRYPT

LDAP_SKIP_DEFAULT_TREE=no

LDAP_ULIMIT_NOFILES=1024
LDAP_ALLOW_ANON_BINDING=no
LDAP_LOGLEVEL=256 # https://www.openldap.org/doc/admin25/slapdconfig.html

LDAP_PORT_NUMBER=389
LDAP_LDAPS_PORT_NUMBER=636

LDAP_ENABLE_TLS=yes
LDAP_TLS_CERT_FILE=/opt/bitnami/openldap/certs2/cert.pem
LDAP_TLS_KEY_FILE=/opt/bitnami/openldap/certs2/privkey.pem
LDAP_TLS_CA_FILE=/opt/bitnami/openldap/certs2/fullchain.pem

docker-compose.yml:

version: "2.1"
services:
  ldap:
    image: registry.gitlab.com/bitspur/rock8s/docker-openldap:latest
    container_name: ldap
    ports:
      - 389:389
      - 636:636
    env_file: .env
    depends_on:
      - ldap_certs
    volumes:
      - /data/openldap2:/bitnami/openldap
      - ./migrations:/migrations
      - ./ldifs:/ldifs
      - ./schemas:/schemas
      - ./data/certs/ldap.melijn.com:/opt/bitnami/openldap/certs2:r
    restart: unless-stopped
    networks:
      - proxy_default
  ldap_certs:
    image: docker.io/matrixdotorg/dehydrated:latest
    container_name: ldap_certs
    volumes:
      - ./data:/data
    env_file: .certs.env
  ldap_admin:
    image: osixia/phpldapadmin:latest
    container_name: ldap_admin
    depends_on:
      - ldap
    environment:
      PHPLDAPADMIN_LDAP_HOSTS: "ldap"
      PHPLDAPADMIN_HTTPS: "false"
    networks:
      - proxy_default
    labels:
      - "traefik.http.routers.ldap-admin.rule=Host(`ldapadmin.melijn.com`)"
      - "traefik.enable=true"
      - "traefik.http.services.ldap-admin.loadbalancer.server.port=80"
      - "traefik.http.routers.ldap-admin.tls=true"
      - "traefik.http.routers.ldap-admin.entrypoints=websecure"
      - "traefik.http.routers.ldap-admin.tls.certresolver=le"
networks:
  proxy_default:
    external: true

Startup log:
startup.txt

Tried too

Same things but memberof.ldif inside schemas
Same things but postfix-book inside schemas
Same things without postfix-book inside the LDAP_EXTRA_SCHEMAS and postfix-book inside schemas

Could someone please point out what I'm doing wrong here ?

Make build does not work

Running ubuntu

make build

gzip: stdin: not in gzip format
tar: Child returned status 1
tar: Error is not recoverable: exiting now
chmod: cannot access '/data/home/test/test/docker-openldap/.mkpm/mkpm/.bin/mkpm': No such file or directory
./mkpm: 77: exec: /data/home/test/test/docker-openldap/.mkpm/mkpm/.bin/mkpm: not found
make: *** [Makefile:8: build] Error 127

Which dependencies are missing? GNU tools are installed by default, make is installed, remake is installed

EDIT: After installing https://github.com/clayrisser/mkpm

chmod: cannot access '/data/home/test/test/docker-openldap/.mkpm/mkpm/.bin/mkpm': No such file or directory
./mkpm: 77: exec: /data/home/test/test/docker-openldap/.mkpm/mkpm/.bin/mkpm: not found
make: *** [Makefile:8: build] Error 127

user can't be added due to gidNumber misconfiguration

Trying to add a user using phpLDAPadmin shows the following error:

Template Value Error
--
This template uses a selection list for attribute [gidNumber], however the selection list is empty.You may need to create some dependancy entries in your LDAP server so that this attribute renders with values. Alternatively, you may be able to define the appropriate selection values in the template file.

Make Build wont run

Dear Community,

currently i am strugling to make this project work at my MacBook.

if i run "make build" i get following error :

% make build
tar: Error opening archive: Unrecognized archive format
chmod: /tmp/docker-openldap/.mkpm/mkpm/.bin/mkpm: No such file or directory
./mkpm: line 77: /tmp/docker-openldap/.mkpm/mkpm/.bin/mkpm: No such file or directory
./mkpm: line 77: exec: /tmp/docker-openldap/.mkpm/mkpm/.bin/mkpm: cannot execute: No such file or directory

I have attempted a minor workaround by copying the 'mkpm' directory to /tmp/docker-openldap/.mkpm/mkpm/.bin/. However, despite this effort, the build process has been running for an extended duration of 2 hours, even after appending -j 12 to the 'make' command.

System Information:

Operating System: MacOS M2 (14.1 (23B74))
Make Version:

%: make -v
GNU Make 3.81
Copyright (C) 2006  Free Software Foundation, Inc.
This is free software; see the source for copying conditions.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

I would greatly appreciate any assistance, as I have been striving to achieve functional LDAP support for my Postfix setup for the past week, and I had hoped that this LDAP server would offer a viable solution.

Thank you for your consideration and support.

Recommend Projects

React

A declarative, efficient, and flexible JavaScript library for building user interfaces.
Vue.js

🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript

TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
TensorFlow

An Open Source Machine Learning Framework for Everyone
Django

The Web framework for perfectionists with deadlines.
Laravel

A PHP framework for web artisans
D3

Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

javascript

JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
web

Some thing interesting about web. New door for the world.
server

A server is a program made to process requests and deliver data to clients.
Machine learning

Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Visualization

Some thing interesting about visualization, use data art
Game

Some thing interesting about game, make everyone happy.

Recommend Org

Facebook

We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft

Open source projects and samples from Microsoft.
Google

Google ❤️ Open Source for everyone.
Alibaba

Alibaba Open Source for everyone
D3

Data-Driven Documents codes.
Tencent

China tencent open source team.