-
-
Notifications
You must be signed in to change notification settings - Fork 48
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
6 changed files
with
244 additions
and
208 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,183 @@ | ||
| #!/usr/bin/with-contenv bash | ||
|
|
||
| ### Set Defaults | ||
| ADMIN_PASS=${ADMIN_PASS:-"admin"} | ||
| BACKEND=${BACKEND:-"mdb"} | ||
| BACKUP_CONFIG_CRON_PERIOD=${BACKUP_CONFIG_CRON_PERIOD:-"0 4 * * *"} | ||
| BACKUP_DATA_CRON_PERIOD=${BACKUP_DATA_CRON_PERIOD:-"0 4 * * *"} | ||
| BACKUP_TTL=${BACKUP_TTL:-15} | ||
| CONFIG_PASS=${CONFIG_PASS:-"config"} | ||
| DOMAIN=${DOMAIN:-"example.org"} | ||
| ENABLE_NGINX=${ENABLE_NGINX:-"FALSE"} | ||
| ENABLE_READONLY_USER=${ENABLE_READONLY_USER:-"false"} | ||
| ENABLE_REPLICATION=${ENABLE_REPLICATION:-"false"} | ||
| ENABLE_TLS=${ENABLE_TLS:-"true"} | ||
| FIRST_START_DONE="/assets/state/slapd-first-start-done" | ||
| LOG_LEVEL=${LOG_LEVEL:-256} | ||
| ORGANIZATION=${ORGANIZATION:-"Example Organization"} | ||
| READONLY_USER_PASS=${READONLY_USER_PASS:-"readonly"} | ||
| READONLY_USER_USER=${READONLY_USER_USER:-"readonly"} | ||
| REMOVE_CONFIG_AFTER_SETUP=${REMOVE_CONFIG_AFTER_SETUP:-"false"} | ||
| SCHEMA_TYPE=${SCHEMA_TYPE:-"nis"} | ||
| SSL_HELPER_PREFIX=${SSL_HELPER_PREFIX:-"ldap"} | ||
| TLS_CA_CRT_FILENAME=${TLS_CA_CRT_FILENAME:-"ca.pem"} | ||
| TLS_CA_CRT_PATH=${TLS_CA_CRT_PATH:-"/assets/slapd/certs"} | ||
| TLS_CIPHER_SUITE=${TLS_CIPHER_SUITE:-"ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:-DHE-DSS:-RSA:!aNULL:!MD5:!DSS:!SHA"} | ||
| TLS_CRT_FILENAME=${TLS_CRT_FILENAME:-"cert.pem"} | ||
| TLS_CRT_PATH=${TLS_CRT_PATH:-"/assets/slapd/certs"} | ||
| TLS_DH_PARAM_FILENAME=${TLS_DH_PARAM_FILENAME:-"dhparam.pem"} | ||
| TLS_DH_PARAM_KEYSIZE=${TLS_DH_PARAM_KEYSIZE:-2048} | ||
| TLS_DH_PARAM_PATH=${TLS_DH_PARAM_PATH:-"/assets/slapd/certs"} | ||
| TLS_ENFORCE=${TLS_ENFORCE:-"false"} | ||
| TLS_KEY_FILENAME=${TLS_KEY_FILENAME:-"key.pem"} | ||
| TLS_KEY_PATH=${TLS_KEY_PATH:-"/assets/slapd/certs"} | ||
| TLS_RESET_PERMISSIONS=${TLS_RESET_PERMISSIONS:-"TRUE"} | ||
| TLS_VERIFY_CLIENT=${TLS_VERIFY_CLIENT:-"try"} | ||
| ULIMIT_N=${ULIMIT_N:-1024} | ||
| WAS_STARTED_WITH_REPLICATION="/etc/openldap/slapd.d/docker-openldap-was-started-with-replication" | ||
| WAS_STARTED_WITH_TLS="/etc/openldap/slapd.d/docker-openldap-was-started-with-tls" | ||
| WAS_STARTED_WITH_TLS_ENFORCE="/etc/openldap/slapd.d/docker-openldap-was-started-with-tls-enforce" | ||
|
|
||
| ### Functions | ||
| function get_ldap_base_dn() { | ||
| # if BASE_DN is empty set value from DOMAIN | ||
| if [ -z "$BASE_DN" ]; then | ||
| IFS='.' read -ra BASE_DN_TABLE <<< "$DOMAIN" | ||
| for i in "${BASE_DN_TABLE[@]}"; do | ||
| EXT="dc=$i," | ||
| BASE_DN=$BASE_DN$EXT | ||
| done | ||
|
|
||
| IFS='.' read -a domain_elems <<< "${DOMAIN}" | ||
| SUFFIX="" | ||
| ROOT="" | ||
|
|
||
| for elem in "${domain_elems[@]}" ; do | ||
| if [ "x${SUFFIX}" = x ] ; then | ||
| SUFFIX="dc=${elem}" | ||
| ROOT="${elem}" | ||
| fi | ||
| done | ||
|
|
||
| BASE_DN=${BASE_DN::-1} | ||
| fi | ||
| } | ||
|
|
||
| # usage: file_env VAR [DEFAULT] | ||
| # ie: file_env 'XYZ_DB_PASSWORD' 'example' | ||
| # (will allow for "$XYZ_DB_PASSWORD_FILE" to fill in the value of | ||
| # "$XYZ_DB_PASSWORD" from a file, especially for Docker's secrets feature) | ||
| function file_env () { | ||
| local var="$1" | ||
| local fileVar="${var}_FILE" | ||
| local def="${2:-}" | ||
| local val="$def" | ||
| if [ "${!fileVar:-}" ]; then | ||
| val="$(cat "${!fileVar}")" | ||
| elif [ "${!var:-}" ]; then | ||
| val="${!var}" | ||
| fi | ||
| if [ -z ${val} ]; then | ||
| print_error "error: neither $var nor $fileVar are set but are required" | ||
| exit 1 | ||
| fi | ||
| export "$var"="$val" | ||
| unset "$fileVar" | ||
| } | ||
|
|
||
| IFS='.' read -a domain_elems <<< "${DOMAIN}" | ||
| SUFFIX="" | ||
| ROOT="" | ||
|
|
||
| for elem in "${domain_elems[@]}" ; do | ||
| if [ "x${SUFFIX}" = x ] ; then | ||
| SUFFIX="dc=${elem}" | ||
| ROOT="${elem}" | ||
| else | ||
| BASE_DN="${SUFFIX},dc=${elem}" | ||
| fi | ||
| done | ||
|
|
||
| function is_new_schema() { | ||
| local COUNT=$(ldapsearch -Q -Y EXTERNAL -H ldapi:/// -b cn=schema,cn=config cn | grep -c $1) | ||
| if [ "$COUNT" -eq 0 ]; then | ||
| echo 1 | ||
| else | ||
| echo 0 | ||
| fi | ||
| } | ||
|
|
||
| function ldap_add_or_modify (){ | ||
| local LDIF_FILE=$1 | ||
| print_notice "Processing file ${LDIF_FILE}" | ||
| sed -i "s|<BASE_DN>|${BASE_DN}|g" $LDIF_FILE | ||
| sed -i "s|<BACKEND>|${BACKEND}|g" $LDIF_FILE | ||
| if [ "${READONLY_USER,,}" == "true" ]; then | ||
| sed -i "s|<READONLY_USER_USER>|${READONLY_USER_USER}|g" $LDIF_FILE | ||
| sed -i "s|<READONLY_USER_PASS_ENCRYPTED>|${READONLY_USER_PASS_ENCRYPTED}|g" $LDIF_FILE | ||
| fi | ||
| if grep -iq changetype $LDIF_FILE ; then | ||
| silent ldapmodify -Y EXTERNAL -Q -H ldapi:/// -f $LDIF_FILE | ||
| else | ||
| silent ldapadd -Y EXTERNAL -Q -H ldapi:/// -f $LDIF_FILE | ||
| fi | ||
| } | ||
|
|
||
| function schema2ldif (){ | ||
| SCHEMAS=$1 | ||
|
|
||
| # Dual Schema Support | ||
| if [ "$SCHEMA_TYPE" = "rfc2307bis" ] || [ "$SCHEMA_TYPE" = "RFC2307BIS" ]; then | ||
| cp -R /assets/slapd/config/bootstrap/schema/rfc2307bis/rfc2307bis.schema /etc/openldap/schema/ | ||
| SCHEMA_TYPE="rfc2307bis" | ||
| else | ||
| SCHEMA_TYPE="nis" | ||
| fi | ||
|
|
||
| tmpd=`mktemp -d` | ||
| pushd ${tmpd} >>/dev/null | ||
|
|
||
| echo "include /etc/openldap/schema/core.schema" >> convert.dat | ||
| echo "include /etc/openldap/schema/cosine.schema" >> convert.dat | ||
| echo "include /etc/openldap/schema/${SCHEMA_TYPE}.schema" >> convert.dat | ||
| echo "include /etc/openldap/schema/inetorgperson.schema" >> convert.dat | ||
|
|
||
| for schema in ${SCHEMAS} ; do | ||
| echo "include ${schema}" >> convert.dat | ||
| done | ||
|
|
||
| silent slaptest -f convert.dat -F . | ||
|
|
||
| if [ $? -ne 0 ] ; then | ||
| print_error "slaptest conversion failed!" | ||
| exit | ||
| fi | ||
|
|
||
| for schema in ${SCHEMAS} ; do | ||
| fullpath=${schema} | ||
| schema_name=`basename ${fullpath} .schema` | ||
| schema_dir=`dirname ${fullpath}` | ||
| ldif_file=${schema_name}.ldif | ||
|
|
||
| find . -name *\}${schema_name}.ldif -exec mv '{}' ./${ldif_file} \; | ||
|
|
||
| # TODO: these sed invocations could all be combined | ||
| sed -i "/dn:/ c dn: cn=${schema_name},cn=schema,cn=config" ${ldif_file} | ||
| sed -i "/cn:/ c cn: ${schema_name}" ${ldif_file} | ||
| sed -i '/structuralObjectClass/ d' ${ldif_file} | ||
| sed -i '/entryUUID/ d' ${ldif_file} | ||
| sed -i '/creatorsName/ d' ${ldif_file} | ||
| sed -i '/createTimestamp/ d' ${ldif_file} | ||
| sed -i '/entryCSN/ d' ${ldif_file} | ||
| sed -i '/modifiersName/ d' ${ldif_file} | ||
| sed -i '/modifyTimestamp/ d' ${ldif_file} | ||
|
|
||
| # slapd seems to be very sensitive to how a file ends. There should be no blank lines. | ||
| sed -i '/^ *$/d' ${ldif_file} | ||
|
|
||
| mv ${ldif_file} ${schema_dir} | ||
| done | ||
|
|
||
| popd >>/dev/null | ||
| rm -rf $tmpd | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.