majic-ansible-roles Files · roles/ldap

Files @ a7e783c2d7d6

Branch filter:

Location: majic-ansible-roles/roles/ldap_server/defaults/main.yml

a7e783c2d7d6 1.1 KiB text/x-yaml Show Annotation Show as Raw Download as Raw

branko

MAR-230: Add support for TLSv1.3 to the ldap_server role and drop TLSv1.1 from tests:

- Update the role defaults, make sure to include additional priority
strings for TLSv1.3.
- Document the specifics of TLSv1.3 cipher configuration.
- Update tests.

---

enable_backup: false
ldap_entries: []
# Internal value, base DN.
ldap_server_int_basedn: "{{ ldap_server_domain | regex_replace('\\.', ',dc=') | regex_replace('^', 'dc=') }}"
ldap_server_organization: "Private"
ldap_server_log_level: 256
ldap_server_ssf: 128
ldap_server_consumers: []
ldap_server_groups: []
ldap_permissions:
  - >
    to *
    by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage
    by dn="cn=admin,{{ ldap_server_int_basedn }}" manage
    by * break
  - >
    to attrs=userPassword,shadowLastChange
    by self write
    by anonymous auth
    by * none
  - >
    to dn.base=""
    by * read
  - >
    to *
    by self write
    by dn="cn=admin,{{ ldap_server_int_basedn }}" write
    by users read
    by * none

ldap_tls_ciphers: "NONE:\
+VERS-TLS1.2:\
+VERS-TLS1.3:\
+CTYPE-X509:\
+COMP-NULL:\
+SIGN-RSA-SHA256:\
+SIGN-RSA-SHA384:\
+SIGN-RSA-SHA512:\
+SIGN-RSA-PSS-RSAE-SHA256:\
+SIGN-RSA-PSS-RSAE-SHA384:\
+SIGN-RSA-PSS-RSAE-SHA512:\
+DHE-RSA:\
+ECDHE-RSA:\
+SHA256:\
+SHA384:\
+SHA512:\
+AEAD:\
+AES-128-GCM:\
+AES-256-GCM:\
+CHACHA20-POLY1305:\
+CURVE-ALL"