majic-ansible-roles Files · roles/ldap

Files @ 61e6cfb81789

Branch filter:

Location: majic-ansible-roles/roles/ldap_server/defaults/main.yml

61e6cfb81789 964 B text/x-yaml Show Annotation Show as Raw Download as Raw

branko

MAR-51: Fixed documentation for ansible_key parameter in preseed role. Updated ca_certificates parameter in common role to accept key-value pairs of filenames and certificates to put on remote host (so lookups/inventory can be utilised in more flexible manner). Updated backup_client role to fail if it is not possible to extract encryption key IDs from deployed keys. Moved purging of Exim4 configuration files from handlers to tasks (more robust, and still idempotent). All documentation has been updated as well.

---

enable_backup: False
ldap_entries: []
ldap_server_domain: "{{ ansible_domain }}"
# Internal value, base DN.
ldap_server_int_basedn: "{{ ldap_server_domain | regex_replace('\\.', ',dc=') | regex_replace('^', 'dc=') }}"
ldap_server_organization: "Private"
ldap_server_log_level: 256
ldap_server_tls_certificate: "{{ tls_certificate_dir }}/{{ ansible_fqdn }}_ldap.pem"
ldap_server_tls_key: "{{ tls_private_key_dir }}/{{ ansible_fqdn }}_ldap.key"
ldap_server_ssf: 128
ldap_server_consumers: []
ldap_server_groups: []
ldap_permissions:
  - >
    to *
    by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage
    by dn="cn=admin,{{ ldap_server_int_basedn }}" manage
    by * break
  - >
    to attrs=userPassword,shadowLastChange
    by self write
    by anonymous auth
    by * none
  - >
    to dn.base=""
    by * read
  - >
    to *
    by self write
    by dn="cn=admin,{{ ldap_server_int_basedn }}" write
    by users read
    by * none