-
Notifications
You must be signed in to change notification settings - Fork 829
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #3228 from fhanik/pr/ldap-as-part-of-docker
Add a docker service using openldap/slapd
- Loading branch information
Showing
17 changed files
with
626 additions
and
176 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,104 @@ | ||
| #!/bin/bash | ||
|
|
||
| set -e | ||
|
|
||
| RED='\033[0;31m' | ||
| GREEN='\033[0;32m' | ||
| NC='\033[0m' # No Color | ||
|
|
||
| SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )" | ||
| TMP_DIR=${SCRIPT_DIR}/tmp | ||
|
|
||
| pushd $SCRIPT_DIR | ||
|
|
||
| # Clean up old data | ||
| rm -f *.key | ||
| rm -f *.crt | ||
| rm -rf ${TMP_DIR} | ||
| mkdir -p ${TMP_DIR} | ||
|
|
||
| # Create a random passphrase for the private key | ||
| echo -e "${GREEN}Generating passphrase for private keys${NC}" | ||
| openssl rand -base64 48 > ${TMP_DIR}/privateKey.passphrase | ||
|
|
||
| # Generate CA private key | ||
| echo -e "${GREEN}Generating CA private key: ${RED}CA.key${NC}" | ||
| openssl genrsa -des3 -passout file:${TMP_DIR}/privateKey.passphrase -out CA.key 4096 | ||
| # Remove Passphrase from Key | ||
| cp CA.key ${TMP_DIR}/CA-original.key | ||
| openssl rsa -in ${TMP_DIR}/CA-original.key -passin file:${TMP_DIR}/privateKey.passphrase -out CA.key | ||
| rm -f ${TMP_DIR}/CA-original.key | ||
|
|
||
| # Generate CA certificate in PEM format | ||
| echo -e "${GREEN}Generating CA certificate: ${RED}CA.crt${NC}" | ||
| openssl req -x509 -new -nodes -key CA.key -sha256 -days 3650 -out CA.crt \ | ||
| -subj "/C=US/ST=WA/L=Vancouver/O=Tanzu/OU=AppSSP/CN=localhost" | ||
|
|
||
| # Generate server key and signing request | ||
| echo -e "${GREEN}Generating a server private key: ${RED}server.key${NC}" | ||
| openssl req -new -nodes -sha256 -out ${TMP_DIR}/server.csr -keyout server.key -newkey rsa:4096 \ | ||
| -subj "/C=US/ST=WA/L=Vancouver/O=Tanzu/OU=AppSSP/CN=localhost" | ||
|
|
||
| # Generate signing config | ||
|
|
||
| cat > ${TMP_DIR}/CA.conf <<EOL | ||
| [ ca ] | ||
| default_ca = ca_default | ||
| [ ca_default ] | ||
| certs = $TMP_DIR | ||
| new_certs_dir = $TMP_DIR/ca.db.certs | ||
| database = $TMP_DIR/ca.db.index | ||
| serial = $TMP_DIR/ca.db.serial | ||
| RANDFILE = $TMP_DIR/ca.db.rand | ||
| certificate = $TMP_DIR/CA.crt | ||
| private_key = $TMP_DIR/CA.key | ||
| default_days = 3650 | ||
| default_crl_days = 30 | ||
| default_md = sha256 | ||
| preserve = no | ||
| policy = generic_policy | ||
| [ generic_policy ] | ||
| countryName = optional | ||
| stateOrProvinceName = optional | ||
| localityName = optional | ||
| organizationName = optional | ||
| organizationalUnitName = optional | ||
| commonName = optional | ||
| emailAddress = optional | ||
| [req] | ||
| req_extensions = v3_req | ||
| distinguished_name = req_distinguished_name | ||
| [req_distinguished_name] | ||
| commonName = Common Name | ||
| commonName_max = 64 | ||
| [v3_req] | ||
| basicConstraints = critical,CA:TRUE | ||
| keyUsage = nonRepudiation, digitalSignature, keyEncipherment | ||
| EOL | ||
|
|
||
| # Create openssl certificate database | ||
| mkdir ${TMP_DIR}/ca.db.certs | ||
| touch ${TMP_DIR}/ca.db.index | ||
| echo "1234" > ${TMP_DIR}/ca.db.serial | ||
|
|
||
| # sign the server certificate | ||
| echo -e "${GREEN}Generating a signed server certificate: ${RED}server.crt${NC}" | ||
| openssl ca -batch -config ${TMP_DIR}/CA.conf -out server.crt -notext -days 3650 -in ${TMP_DIR}/server.csr -keyfile CA.key -extensions v3_req -cert CA.crt | ||
|
|
||
| # Delete the temporary data | ||
| rm -rf ${TMP_DIR} | ||
|
|
||
| chmod og+r server.key | ||
| chmod og+r server.crt | ||
| chmod og+r CA.key | ||
| chmod og+r CA.crt | ||
|
|
||
| echo -e "${GREEN}Certificates are ready: ${NC}" | ||
| echo -e "\t${GREEN}Server Certificate: ${RED}server.crt${NC}" | ||
| echo -e "\t${GREEN}Server Key : ${RED}server.key${NC}" | ||
| echo -e "\t${GREEN}CA Certificate : ${RED}CA.crt${NC}" | ||
| echo -e "\t${GREEN}CA Key : ${RED}CA.key${NC}" | ||
| popd |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,20 @@ | ||
| FROM ubuntu:jammy | ||
|
|
||
| STOPSIGNAL SIGQUIT | ||
|
|
||
| SHELL ["/bin/bash", "-xo", "pipefail", "-c"] | ||
|
|
||
| # Generate locale C.UTF-8 | ||
| ENV LANG=C.UTF-8 | ||
| ENV TZ=UTC | ||
|
|
||
| RUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone | ||
|
|
||
| RUN DEBIAN_FRONTEND=noninteractive apt-get -qy update | ||
| RUN DEBIAN_FRONTEND=noninteractive apt-get -qy install slapd ldap-utils | ||
| RUN DEBIAN_FRONTEND=noninteractive apt-get -qy install libssl-dev ca-certificates | ||
|
|
||
| RUN mkdir -p /uaa/ldap/ | ||
| RUN mkdir -p /uaa/certificates/ | ||
|
|
||
| STOPSIGNAL SIGQUIT |
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,104 @@ | ||
| #!/bin/bash | ||
|
|
||
| # Used by ../docker-compose.yml | ||
| set -e | ||
| SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )" | ||
|
|
||
| LDAP_TLS_CHK=/tmp/ldap-tls-run-once | ||
| LDAP_SCHEMA_CHK=/tmp/ldap-schema-run-once | ||
|
|
||
| function restart_ldap() { | ||
| ### service slapd restart|stop doesn't kill the slapd daemon | ||
| pid=$(pgrep slapd || echo "0") | ||
| if [[ "$pid" -gt "0" ]]; then | ||
| echo "Sending QUIT signal to slapd" | ||
| kill -3 $pid | ||
| sleep 1 | ||
| pid=$(pgrep slapd || echo "0") | ||
| if [[ "$pid" == "0" ]]; then | ||
| echo "slapd stop [OK]" | ||
| else | ||
| echo "slapd stop [ERROR]" | ||
| kill -9 $pid | ||
| fi | ||
| fi | ||
| service slapd start | ||
| } | ||
|
|
||
| function generate_certs_if_needed() { | ||
| if | ||
| [ ! -f /uaa/certificates/server.crt ] || | ||
| [ ! -f /uaa/certificates/server.key ] || | ||
| [ ! -f /uaa/certificates/CA.crt ] || | ||
| [ ! -f /uaa/certificates/CA.key ]; then | ||
| /uaa/certificates/generate.sh | ||
| fi | ||
| } | ||
|
|
||
| function configure_slapd_tls() { | ||
| cp /uaa/certificates/CA.key /etc/ldap/sasl2/ | ||
| cp /uaa/certificates/CA.crt /etc/ldap/sasl2/ | ||
| cp /uaa/certificates/server.crt /etc/ldap/sasl2/ | ||
| cp /uaa/certificates/server.key /etc/ldap/sasl2/ | ||
| cp /etc/ssl/certs/ca-certificates.crt /etc/ldap/sasl2/ | ||
| cat /etc/ldap/sasl2/CA.crt >> /etc/ldap/sasl2/ca-certificates.crt | ||
| chown -R openldap:openldap /etc/ldap/sasl2 | ||
|
|
||
| echo "dn: cn=config | ||
| changetype: modify | ||
| add: olcTLSCACertificateFile | ||
| olcTLSCACertificateFile: /etc/ldap/sasl2/ca-certificates.crt | ||
| - | ||
| add: olcTLSCertificateFile | ||
| olcTLSCertificateFile: /etc/ldap/sasl2/server.crt | ||
| - | ||
| add: olcTLSCertificateKeyFile | ||
| olcTLSCertificateKeyFile: /etc/ldap/sasl2/server.key" > /etc/ldap/sasl2/uaa-certinfo.ldif | ||
| ## TODO start LDAP server here | ||
| restart_ldap | ||
| echo "Adding LDAP Certs" | ||
| ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/ldap/sasl2/uaa-certinfo.ldif | ||
| echo "LDAP Certs added" | ||
| sed -i "s/^SLAPD_SERVICES.*/SLAPD_SERVICES=\"ldap\:\/\/\/ ldapi\:\/\/\/ ldaps\:\/\/\/\"/g" /etc/default/slapd | ||
| sed -i "s/^TLS/\#TLS/g" /etc/ldap/ldap.conf | ||
| echo "TLS_CACERT /etc/ldap/sasl2/ca-certificates.crt | ||
| TLS_REQCERT allow | ||
| " >> /etc/ldap/ldap.conf | ||
| restart_ldap | ||
| } | ||
|
|
||
| if [ ! -f ${LDAP_SCHEMA_CHK} ]; then | ||
| generate_certs_if_needed | ||
| configure_slapd_tls | ||
| touch ${LDAP_TLS_CHK} | ||
| fi | ||
|
|
||
| echo "LDAP server Status:" | ||
| service slapd status || true | ||
|
|
||
| if [ ! -f ${LDAP_SCHEMA_CHK} ]; then | ||
| echo "Starting LDAP server." | ||
| restart_ldap | ||
| echo "Creating LDAP schema." | ||
| ldapadd -Y EXTERNAL -H ldapi:/// -f $SCRIPT_DIR/ldap_slapd_schema.ldif | ||
| echo "Populating LDAP database entries." | ||
| ldapadd -x -D 'cn=admin,dc=test,dc=com' -w password -f $SCRIPT_DIR/ldap_slapd_data.ldif | ||
| touch ${LDAP_SCHEMA_CHK} | ||
| else | ||
| echo "Starting LDAP server with existing data." | ||
| restart_ldap | ||
| fi | ||
|
|
||
| doExit() { | ||
| echo "Caught SIGTERM signal." | ||
| exit 0 | ||
| } | ||
|
|
||
| trap doExit SIGINT SIGQUIT SIGTERM | ||
|
|
||
| echo "LDAP server is READY" | ||
|
|
||
| # Do not exit the container in docker compose | ||
| while true; do | ||
| sleep 1 | ||
| done |
Oops, something went wrong.