slapd: mise au point, reglage acl sur cn=config

README.md

@@ -17,6 +17,7 @@ defined in vars/main.yml and vars/CentOS.yml
   * ldap_suffix      - constructed from variables above example.net
   * ldap_admin_dn    - cn=manager,{{ ldap_suffix }}
   * ldap_admin_password - 123Soleil - should be in a vault ...)
+  * ldap_secret_file - default to /root/.ldap.secret
   * ldap_packages    - liste of packages - should be the only thing to change to
     adapt to other distro
   * ldap_service     - name of service unit file - slapd

defaults/main.yml

@@ -2,6 +2,7 @@
 # defaults file for /etc/ansible/roles/slapd
 ldap_domain: example
 ldap_domain_ext: fr
+ldap_secret_file: /root/.ldap.secret
 ldap_provider_uri: "{{ ansible_fqdn }}"
 ldap_suffix: "{{ ldap_domain }},{{ ldap_domain_ext }}"
 import_data: false

handlers/main.yml

@@ -1,2 +1,6 @@
 ---
-# handlers file for /etc/ansible/roles/slapd
+# handlers file for /etc/ansible/roles/slapd
+- name: restart_slapd
+  service:
+    name: slapd
+    state: restarted

tasks/import_ldap_schema.yml

@@ -1,7 +1,7 @@
 - name: check if schema is loaded
   command: "ldapsearch -LLL -Y EXTERNAL -H ldapi:/// -b cn=schema,cn=config dn"
   register: ldap_schema_list
-  changed_when
+  changed_when: false
 
 - name: import additional schemas
   command: "ldapadd -Y EXTERNAL -H ldapi:/// -f /etc/openldap/schema/{{ schema }}.ldif"

tasks/inject_ldif.yml

@@ -1,9 +0,0 @@
-- name: copy ldif files
-  copy:
-    src: "{{ ldap_ldif_dir }}/{{ ldif }}"
-    dest: "/root/Ldif/{{ ldif }}"
-
-- name: import additional schemas
-  command: "ldapadd -s /root/.ldap.secret -D {{ ldap_admin_dn }} -x /root/Ldif/{{ ldif }} -c"
-  ignore_error: true
-

tasks/main.yml

@@ -32,6 +32,17 @@
     olcRootDN: "{{ ldap_admin_dn }}"
     olcRootPW: "{{ ldap_admin_password }}"
 
+- name: reconfigure slapd - access to cn=config
+  ldap_attr:
+    dn: olcDatabase={0}config,cn=config
+    name: olcAccess
+    values:
+      >-
+      to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage
+      by dn.base={{ ldap_admin_dn }}  manage
+      by * none
+    state: exact
+
 - name: load additionnal schema
   include_tasks: import_ldap_schema.yml
   loop: "{{ ldap_schemas }}"
@@ -50,7 +61,7 @@
 
 - name: create passwd file
   copy:
-    dest: /root/.ldap.secrets
+    dest: "{{ ldap_secret_file }}"
     mode: 0600
     content: "{{ ldap_admin_password }}"
 
@@ -78,10 +89,11 @@
       register: ldif_list
 
     - name: import ldif files
-      command: "ldapadd -y -c /root/.ldap.secrets -xD {{ ldap_admin_dn }} -f {{ item .path}}"
+      command: "ldapadd -c -y /root/.ldap.secret -xD {{ ldap_admin_dn }} -f {{ item .path}}"
       with_items: "{{ ldif_list.files }}"
       ignore_errors: true
   when: ldap_ldif_files is defined
+  tags: wip
 
 - name: configure replication provider
   include_tasks: replication_provider.yml
@@ -117,17 +129,31 @@
     - "{{ ldap_ssl_cert_path }}"
     - "{{ ldap_ssl_key_path }}"
     - "{{ ldap_ssl_cacert_path }}"
-  - name: send ldif file
-    template:
-      src: ssl.ldif
-      dest: /root/
 
-  - name: import ldif
-    command: ldapmodify  -c -Y EXTERNAL -H ldapi:/// -f /root/ssl.ldif
+- name: send ldif file
+  template:
+    src: ssl.ldif
+    dest: /root/
 
-  - name: remove ldif
-    file:
-      path: /root/ssl.ldif
-      state: absent
+- name: import ldif
+  command: ldapmodify  -c -Y EXTERNAL -H ldapi:/// -f /root/ssl.ldif
+
+- name: configure url
+  lineinfile:
+    path: /etc/sysconfig/slapd
+    regexp: '^SLAPD_URLS="ldapi:/// ldap:///"'
+    line: 'SLAPD_URLS="ldapi:/// ldap:/// ldaps:///"'
+    state: present
+  notify: restart_slapd
+
+- name: remove ldif
+  file:
+    path: /root/ssl.ldif
+    state: absent
   when: ldap_have_ssl
 
+- name: configure ldap aliases
+  tags: shell
+  template:
+    src: ldap_aliases.sh
+    dest: /etc/profile.d/

templates/change_suffix_and_dit_admin.ldif

@@ -9,3 +9,7 @@ olcrootdn: {{ ldap_admin_dn }}
 replace: olcrootpw
 olcrootpw: {{ ldap_admin_password }}
 
+dn: olcDatabase={0}config,cn=config
+changetype: modify
+replace: olcAccess
+olcAccess: to * by dn.base="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage by dn.base={{ ldap_admin_dn }}  manage by * none

templates/ldap.conf

@@ -1,5 +1,9 @@
-URI ldap://localhost/
 BASE {{ ldap_suffix }}
 {%if ldap_have_ssl %}
+URI ldaps://{{ ldap_server }}
 TLS_CACERT {{ ldap_ssl_cacert_path }}
+TLS_REQCERT allow 
+URI ldap://localhost/
+{%else%}
+URI ldap://localhost
 {%endif%}

templates/ldap_aliases.sh

@@ -0,0 +1,4 @@
+alias ldm="ldapmodify -x -D {{ ldap_admin_dn }} -y {{ ldap_secret_file }}"
+alias lda="ldapadd -x -D {{ ldap_admin_dn }} -y {{ ldap_secret_file }}"
+alias lds="ldapsearch -xLLL -D {{ ldap_admin_dn }} -y {{ ldap_secret_file }}"
+alias ldrm="ldapdelete -x -D {{ ldap_admin_dn }} -y {{ ldap_secret_file }}"