nicolabs/vegardit-docker-openldap
1
0
Fork 0
mirror of https://github.com/vegardit/docker-openldap.git synced 2026-04-11 12:24:24 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

add LDAP_INIT_ALLOW_CONFIG_ACCESS

Browse source
This commit is contained in:
sebthom 2023-05-15 00:13:45 +02:00
parent 453ab1ce43
commit 9b2a999872
4 changed files with 13 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
README.md
View file

@ -44,6 +44,7 @@ ### <a name="initial-config"></a>Initial configuration
LDAP_INIT_ROOT_USER_DN='uid=admin,${LDAP_INIT_ORG_DN}'
LDAP_INIT_ROOT_USER_PW='changeit'
LDAP_INIT_RFC2307BIS_SCHEMA=0 # 0=use NIS (RFC2307) schema, 1=use RFC2307bis schema
LDAP_INIT_ALLOW_CONFIG_ACCESS='true' # if set to true, the "cn=config" namespace can be read/edited by LDAP admins
```
Environment variables can for example be set using `docker run` with `-e`, e.g.

1
image/Dockerfile
View file

@ -90,6 +90,7 @@ ENV \
LDAP_INIT_ADMIN_GROUP_DN='cn=ldapadmins,ou=Groups,${LDAP_INIT_ORG_DN}' \
LDAP_INIT_ROOT_USER_DN='uid=admin,${LDAP_INIT_ORG_DN}' \
LDAP_INIT_ROOT_USER_PW='' \
LDAP_INIT_ALLOW_CONFIG_ACCESS='false' \
LDAP_INIT_PPOLICY_DEFAULT_DN='cn=DefaultPasswordPolicy,ou=Policies,${LDAP_INIT_ORG_DN}' \
LDAP_INIT_PPOLICY_PW_MIN_LENGTH=8 \
LDAP_INIT_PPOLICY_MAX_FAILURES=3 \

7
image/ldifs/init_config_admin_access.ldif Normal file
View file

@ -0,0 +1,7 @@
dn: olcDatabase={0}config,cn=config
changetype: modify
add: olcAccess
olcAccess: to *
by dn="${LDAP_INIT_ROOT_USER_DN}" write
by group/groupOfUniqueNames/uniqueMember="${LDAP_INIT_ADMIN_GROUP_DN}" write
by * none

4
image/run.sh
View file

@ -138,6 +138,10 @@ if [ ! -e /etc/ldap/slapd.d/initialized ]; then
ldif add -Y EXTERNAL /opt/ldifs/init_module_unique.ldif
ldif add -Y EXTERNAL /opt/ldifs/init_module_ppolicy.ldif
if [ "${LDAP_INIT_ALLOW_CONFIG_ACCESS:-false}" == "true" ]; then
ldif modify -Y EXTERNAL /opt/ldifs/init_config_admin_access.ldif
fi
LDAP_INIT_ORG_DN_ATTR=$(substr_before $LDAP_INIT_ORG_DN "," | str_replace "=" ": ") # referenced by init_org_tree.ldif
ldif add -x -D "$LDAP_INIT_ROOT_USER_DN" -w "$LDAP_INIT_ROOT_USER_PW" /opt/ldifs/init_org_tree.ldif
ldif add -x -D "$LDAP_INIT_ROOT_USER_DN" -w "$LDAP_INIT_ROOT_USER_PW" /opt/ldifs/init_org_ppolicy.ldif