majic-ansible-roles Files · testsite/group

Files @ 5524a4ad9904

Branch filter:

Location: majic-ansible-roles/testsite/group_vars/ldap.yml

5524a4ad9904 1.7 KiB text/x-yaml Show Annotation Show as Raw Download as Raw

branko

MAR-1: Set the truststore for LDAP client. Create one more LDAP entry for people. Add sn, user password, and mail to existing LDAP people entries.

---

ldap_client_config:
  - comment: Set the base DN
    option: BASE
    value: dc=example,dc=com
  - comment: Set the default URI
    option: URI
    value: ldapi:///
  - comment: Set the default bind DN
    option: BINDDN
    value: cn=admin,dc=example,dc=com
  - comment: Set the LDAP TLS truststore
    option: TLS_CACERT
    value: /etc/ssl/certs/truststore.pem

ldap_server_config:
  domain: "example.com"
  organization: "Example Inc."
  log_level: 256
  tls_certificate: /etc/ssl/certs/ldap.example.com.pem
  tls_key: /etc/ssl/private/ldap.example.com.pem
  ssf: 128

ldap_permissions:
  - filter: '(olcSuffix=dc=example,dc=com)'
    rules:
      - >
        to *
        by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage
        by dn="cn=admin,dc=example,dc=com" manage
        by * break
      - >
        to attrs=userPassword,shadowLastChange
        by self write
        by anonymous auth
        by * none
      - >
        to dn.base=""
        by * read
      - >
        to *
        by self write
        by dn="cn=admin,dc=example,dc=com" write
        by users read
        by * none

ldap_entries:
  - dn: ou=people,dc=example,dc=com
    objectClass: organizationalUnit
    ou: people
  - dn: ou=groups,dc=example,dc=com
    objectClass: organizationalUnit
    ou: groups
  - dn: uid=johndoe,ou=people,dc=example,dc=com
    objectClass:
      - inetOrgPerson
    uid: johndoe
    cn: John Doe
    sn: Doe
    userPassword: johndoe
    mail: john.doe@example.com
  - dn: uid=janedoe,ou=people,dc=example,dc=com
    objectClass:
      - inetOrgPerson
    uid: janedoe
    cn: Jane Doe
    sn: Doe
    userPassword: janedoe
    mail: jane.doe@example.com