openshift / openldap Goto Github PK

License: Apache License 2.0

Shell 77.90% Makefile 5.25% Dockerfile 16.84%

openldap's Introduction

OpenLDAP for OpenShift - Docker images

DISCLAIMER - IMAGES ONLY FOR INTERNAL TESTING OF ORIGIN REPOSITORY

This repository contains Dockerfiles for OpenLDAP images for OpenShift testing. Images are based on CentOS. Images are NOT meant to be used for LDAP servers in any environment other than the OpenShift Origin test environment at this time. No guarantees are given for the efficacy or stability of images in this repository or those created with Dockerfiles from this repository.

If you are working on developing this image, refer to the hacking document for detailed discussion of deploying OpenLDAP as a Docker container under OpenShift.

Versions

OpenLDAP versions currently provided are:

openldap-2.4.41

CentOS versions currently supported are:

CentOS7

Installation

To build an OpenLDAP image from scratch run:

$ git clone https://github.com/openshift/openldap.git
$ cd openldap
$ make build

Environment variables and volumes

The image recognizes the following environment variables that you can set during initialization by passing -e VAR=VALUE to the Docker run command.

Variable name	Description	Default
`OPENLDAP_ROOT_PASSWORD`	OpenLDAP `olcRootPW` password	`admin`
`OPENLDAP_ROOT_DN_SUFFIX`	OpenLDAP `olcSuffix` suffix	`dc=example,dc=com`
`OPENLDAP_ROOT_DN_PREFIX`	OpenLDAP `olcRootDN` prefix	`cn=Manager`
`OPENLDAP_DEBUG_LEVEL`	OpenLDAP Server Debug Level	`256`
`OPENLDAP_LISTEN_URIS`	OpenLDAP Server Listen URIs	`ldaps:/// ldap:///`

The following table details the possible debug levels.

Debug Level	Description
-1	Enable all debugging
0	Enable no debugging
1	Trace function calls
2	Debug packet handling
4	Heavy trace debugging
8	Connection management
16	Log packets sent and recieved
32	Search filter processing
64	Configuration file processing
128	Access control list processing
256	Stats log connections, operations and results
512	Stats log entries sent
1024	Log communication with shell backends
2048	Log entry parsing debugging

You can also set the following mount points by passing the -v /host:/container flag to Docker.

Volume mount point	Description
`/var/lib/ldap`	OpenLDAP data directory
`/etc/openldap/`	OpenLDAP configuration directory.

Notice: When mounting a directory from the host into the container, ensure that the mounted directory has the appropriate permissions and that the owner and group of the directory matches the user UID or name which is running inside the container.

Usage

If you want to set only the mandatory environment variables and not store the LDAP directory in a host directory, execute the following command:

$ docker run -d --name openldap_server -p 389:389 -p 636:636 openshift/openldap-2441-centos7:latest

This will create a container named openldap_server running OpenLDAP with an admin user with credentials cn=Manager,dc=example,dc=com:admin. Ports 389 and 636 will be exposed and mapped to the host for ldap and ldaps endpoints, respectively. If you want your directory to be persistent across container executions, also add a -v /host/data/path:/var/lib/ldap argument to specify the OpenLDAP data files, and a -v /host/config/path:/etc/openshift argument to specify OpenLDAP configuration files. Ensure that a file named CONFIGURED exists in the directory you are mounting to /etc/openldap so that the startup scripts do not try to re-configure slapd.

If the configuration directory is not initialized, the entrypoint script will first run run-openldap.sh and setup necessary directory users and passwords. After the database is initialized, or if it was already present, slapd is executed and will run as PID 1. You can stop the detached container by running docker stop openldap_server.

Test

This repository also provides a test framework, which checks basic functionality of the OpenLDAP image. To run the tests, execute the follwing:

$ cd openldap
$ make test

openldap's People

Contributors

Stargazers

Watchers

openldap's Issues

Future Release Branches Frozen For Merging | branch:release-4.16 branch:release-4.17

The following branches are being fast-forwarded from the current development branch (master) as placeholders for future releases. No merging is allowed into these release branches until they are unfrozen for production release.

release-4.16
release-4.17

For more information, see the branching documentation.

openshift/openldap-2441-centos7 404 from Docker Hub, build from source fails

openshift/openldap-2441-centos7 went missing from Docker Hub and building from source fails with error:

$ docker build -t openshift/openldap-2441-centos7 -f images/Dockerfile.rhel7 .

... skip ...

2023-10-24T10:15:54.2611716Z #12 12.34 This system is not receiving updates. You can use subscription-manager on the host to register and assign subscriptions.
2023-10-24T10:15:54.2615205Z #12 12.34 
2023-10-24T10:15:54.2616674Z #12 12.36 Cleaning repos: ubi-7 ubi-7-rhah ubi-7-server-extras-rpms
2023-10-24T10:15:54.2618165Z #12 12.36               : ubi-7-server-optional-rpms ubi-server-rhscl-7-rpms
2023-10-24T10:15:54.2620236Z #12 12.39 Failed to set capabilities on file `/usr/sbin/slapd' (No such file or directory)
2023-10-24T10:15:54.2622200Z #12 12.39 usage: setcap [-q] [-v] (-r|-|<caps>) <filename> [ ... (-r|-|<capsN>) <filenameN> ]
2023-10-24T10:15:54.2624190Z #12 12.39 
2023-10-24T10:15:54.2624883Z #12 12.39  Note <filename> must be a regular (non-symlink) file.
2023-10-24T10:15:54.3084027Z #12 ERROR: process "/bin/sh -c yum install -y git openssl openldap openldap-servers openldap-clients procps-ng &&     yum clean all -y &&     setcap 'cap_net_bind_service=+ep' /usr/sbin/slapd &&     mkdir -p /var/lib/ldap &&     chmod a+rwx -R /var/lib/ldap &&     mkdir -p /etc/openldap &&     chmod a+rwx -R /etc/openldap &&     mkdir -p /var/run/openldap &&     chmod a+rwx -R /var/run/openldap &&     chmod -R a+rw /opt/openshift" did not complete successfully: exit code: 1
2023-10-24T10:15:54.3088186Z ------
2023-10-24T10:15:54.3091900Z  > [8/8] RUN yum install -y git openssl openldap openldap-servers openldap-clients procps-ng &&     yum clean all -y &&     setcap 'cap_net_bind_service=+ep' /usr/sbin/slapd &&     mkdir -p /var/lib/ldap &&     chmod a+rwx -R /var/lib/ldap &&     mkdir -p /etc/openldap &&     chmod a+rwx -R /etc/openldap &&     mkdir -p /var/run/openldap &&     chmod a+rwx -R /var/run/openldap &&     chmod -R a+rw /opt/openshift:
2023-10-24T10:15:54.3096150Z 12.32 Loaded plugins: ovl, product-id, search-disabled-repos, subscription-manager
2023-10-24T10:15:54.3097108Z 12.34 
2023-10-24T10:15:54.3098371Z 12.34 This system is not receiving updates. You can use subscription-manager on the host to register and assign subscriptions.
2023-10-24T10:15:54.3188887Z 12.34 
2023-10-24T10:15:54.3189936Z 12.36 Cleaning repos: ubi-7 ubi-7-rhah ubi-7-server-extras-rpms
2023-10-24T10:15:54.3195350Z 12.36               : ubi-7-server-optional-rpms ubi-server-rhscl-7-rpms
2023-10-24T10:15:54.3198661Z 12.39 Failed to set capabilities on file `/usr/sbin/slapd' (No such file or directory)
2023-10-24T10:15:54.3200119Z 12.39 usage: setcap [-q] [-v] (-r|-|<caps>) <filename> [ ... (-r|-|<capsN>) <filenameN> ]
2023-10-24T10:15:54.3201037Z 12.39 
2023-10-24T10:15:54.3202001Z 12.39  Note <filename> must be a regular (non-symlink) file.
2023-10-24T10:15:54.3202762Z ------
2023-10-24T10:15:54.3203097Z Dockerfile.rhel7:27
2023-10-24T10:15:54.3203557Z --------------------
2023-10-24T10:15:54.3204277Z   26 |     # Install OpenLDAP Server, give it permissionst to bind to low ports
2023-10-24T10:15:54.3205943Z   27 | >>> RUN yum install -y git openssl openldap openldap-servers openldap-clients procps-ng && \
2023-10-24T10:15:54.3207158Z   28 | >>>     yum clean all -y && \
2023-10-24T10:15:54.3208014Z   29 | >>>     setcap 'cap_net_bind_service=+ep' /usr/sbin/slapd && \
2023-10-24T10:15:54.3209267Z   30 | >>>     mkdir -p /var/lib/ldap && \
2023-10-24T10:15:54.3210106Z   31 | >>>     chmod a+rwx -R /var/lib/ldap && \
2023-10-24T10:15:54.3210875Z   32 | >>>     mkdir -p /etc/openldap && \
2023-10-24T10:15:54.3211659Z   33 | >>>     chmod a+rwx -R /etc/openldap && \
2023-10-24T10:15:54.3212451Z   34 | >>>     mkdir -p /var/run/openldap && \
2023-10-24T10:15:54.3213235Z   35 | >>>     chmod a+rwx -R /var/run/openldap && \
2023-10-24T10:15:54.3214026Z   36 | >>>     chmod -R a+rw /opt/openshift 
2023-10-24T10:15:54.3214636Z   37 |     
2023-10-24T10:15:54.3215192Z --------------------
2023-10-24T10:15:54.3219480Z ERROR: failed to solve: process "/bin/sh -c yum install -y git openssl openldap openldap-servers openldap-clients procps-ng &&     yum clean all -y &&     setcap 'cap_net_bind_service=+ep' /usr/sbin/slapd &&     mkdir -p /var/lib/ldap &&     chmod a+rwx -R /var/lib/ldap &&     mkdir -p /etc/openldap &&     chmod a+rwx -R /etc/openldap &&     mkdir -p /var/run/openldap &&     chmod a+rwx -R /var/run/openldap &&     chmod -R a+rw /opt/openshift" did not complete successfully: exit code: 1

Is there any workaround available ?

Support RHEL7-based images

Allow for RHEL7-based images using make.

Enable LDAPS

Add support for TLS/SSl for LDAPS over poer 686. Most likely done with blind-mounting the certs to etc/openldap/certs and updating the database with the following ldif:

dn: cn=config
changetype: modify
add: olcTLSCACertificateFile
olcTLSCACertificateFile: /etc/openldap/certs/ca-bundle.crt
-
replace: olcTLSCertificateFile
olcTLSCertificateFile: /etc/openldap/certs/server.crt
-
replace: olcTLSCertificateKeyFile
olcTLSCertificateKeyFile: /etc/openldap/certs/server.key

Can I refer this repository to create openldap docker image in private cloud which isn't built in Openshift?

I need change and customise some codes to adapt for our environment. But the "DISCLAIMER" part in README confused me if I still can use it or not.

Can I refer this repository to create openldap docker image in private cloud which isn't built in Openshift?

Add testing for images

Tests necessary:

make sure container can be made
test run-openldap.sh with random user and with root
test ldapadd or ldapmodify with root credentials
test ldapmodify for things requiring cn=config credentials
test connection once the server is up
test a simple ldapsearch get all to confirm starting Organization object
test invalid blind-mount
run slaptest
test LDAPS

Enable blind-mount of config

Blind-mounting valid etc/openldap and var/lib/ldap should be supported for migration of existing LDAP setups.

Allows to run with non privileged ports (> 1024)

by default it runs on port 389,
ca we allows it to run with non privileged ports (> 1024) ?