Skip to content

Commit 31533d7

Browse files
fhanikfhanik
committed
Add openldap/slapd as a docker service
This service gets populated with the same data set as the in memory albeit, the InMemoryLDAPServer and slapd use two separate file for data now InMemoryLdapServer uses ./uaa/src/test/resources/ldap_init.ldif (same as before) docker-compose uses ./scripts/ldap/ldap_slapd_data.ldif (new, copy of ldap_init.ldif for now) docker-compose uses ./scripts/ldap/ldap_slapd_schema.ldif (new, copy of ldap_db_init.ldif for now)) The old scripts still use ./uaa/src/test/resources/ldap_db_init.ldif but will be removed in future PR
1 parent e09db03 commit 31533d7

12 files changed

+551
-152
lines changed

‎scripts/docker-compose.yml

Lines changed: 13 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: uaa
22

33
services:
4-
postgres:
4+
postgresql:
55
image: "postgres:15"
66
ports:
77
- 5432:5432
@@ -33,22 +33,19 @@ services:
3333
- TZ=${TZ}
3434
command:
3535
- --sql_mode=ONLY_FULL_GROUP_BY,STRICT_TRANS_TABLES,NO_ZERO_IN_DATE,NO_ZERO_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_ENGINE_SUBSTITUTION,PAD_CHAR_TO_FULL_LENGTH
36+
3637
openldap:
37-
image: docker.io/bitnami/openldap:2.6
38+
build:
39+
context: .
40+
dockerfile: ldap/Dockerfile
3841
ports:
39-
- '389:1389'
40-
- '636:1636'
41-
# docs of these env vars: https://github.com/bitnami/containers/tree/2724f9cd02b3b4e7986a1e2a0b0b30af3737bbd2/bitnami/openldap#configuration
42-
environment:
43-
- LDAP_ROOT=dc=test,dc=com
44-
- LDAP_ADMIN_USERNAME=admin
45-
- LDAP_ADMIN_PASSWORD=password
46-
- LDAP_USERS=user01,user02
47-
- LDAP_PASSWORDS=password1,password2
48-
- LDAP_GROUP=some-ldap-group
42+
- '389:389'
43+
- '636:636'
44+
entrypoint: [ "/bin/bash", "-c" ]
45+
command:
46+
- "/uaa/ldap/ldap-start-and-populate.sh"
47+
tty: true
4948
volumes:
50-
- 'openldap_data:/bitnami/openldap'
49+
- ./ldap:/uaa/ldap/
50+
- ./certificates:/uaa/certificates/
5151

52-
volumes:
53-
openldap_data:
54-
driver: local

‎scripts/ldap/Dockerfile

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
FROM ubuntu:jammy
2+
3+
STOPSIGNAL SIGQUIT
4+
5+
SHELL ["/bin/bash", "-xo", "pipefail", "-c"]
6+
7+
# Generate locale C.UTF-8
8+
ENV LANG=C.UTF-8
9+
ENV TZ=UTC
10+
11+
RUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone
12+
13+
RUN DEBIAN_FRONTEND=noninteractive apt-get -qy update
14+
RUN DEBIAN_FRONTEND=noninteractive apt-get -qy install slapd ldap-utils
15+
RUN DEBIAN_FRONTEND=noninteractive apt-get -qy install libssl-dev ca-certificates
16+
17+
RUN mkdir -p /uaa/ldap/
18+
RUN mkdir -p /uaa/certificates/
19+
20+
STOPSIGNAL SIGQUIT

‎scripts/ldap/docker-compose.yml

Lines changed: 0 additions & 22 deletions
This file was deleted.

‎scripts/ldap/docker-confirm-ldapquery.sh

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,10 @@ set -e
66

77
echo ==================================GET all userApplication attributes using anonymous bind=============================================
88

9-
ldapsearch -vvv -x -L -H ldap://localhost -b dc=test,dc=com
9+
LDAPTLS_REQCERT=never ldapsearch -vvv -x -L -H ldaps://localhost -b dc=test,dc=com
1010

1111
echo =====================================Bind with Admin and Seach for user01==========================================
1212

13-
ldapsearch -vvv -x -L -H ldap://localhost -b dc=test,dc=com -D "cn=admin,dc=test,dc=com" -w password "(cn=user01)"
13+
LDAPTLS_REQCERT=never ldapsearch -vvv -x -L -H ldaps://localhost -b dc=test,dc=com -D "cn=admin,dc=test,dc=com" -w password "(cn=user01)"
1414

1515
echo -e "\n*********** SUCCESS"

‎scripts/ldap/install-ldap.sh

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,11 @@
11
#!/bin/bash
22

3+
## TODO - remove this script. The ../docker-compose.yml has a container with the same setup
4+
35
set -e
46

7+
SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
8+
59
cd `dirname $0`/../..
610

711
sudo apt-get -qy purge slapd ldap-utils
@@ -49,5 +53,5 @@ olcTLSCertificateKeyFile: /etc/ssl/private/ldap01_slapd_key.pem" > /etc/ssl/cert
4953

5054
fi
5155

52-
sudo ldapadd -Y EXTERNAL -H ldapi:/// -f uaa/src/test/resources/ldap_db_init.ldif
53-
sudo ldapadd -x -D 'cn=admin,dc=test,dc=com' -w password -f uaa/src/test/resources/ldap_init.ldif
56+
sudo ldapadd -Y EXTERNAL -H ldapi:/// -f ${SCRIPT_DIR}/ldap_slapd_schema.ldif
57+
sudo ldapadd -x -D 'cn=admin,dc=test,dc=com' -w password -f ${SCRIPT_DIR}/ldap_slapd_data.ldif

‎scripts/ldap/ldap-start-and-populate.sh

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
#!/bin/bash
2+
3+
# Used by ../docker-compose.yml
4+
set -e
5+
SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" &> /dev/null && pwd )"
6+
7+
LDAP_TLS_CHK=/tmp/ldap-tls-run-once
8+
LDAP_SCHEMA_CHK=/tmp/ldap-schema-run-once
9+
10+
function restart_ldap() {
11+
### service slapd restart|stop doesn't kill the slapd daemon
12+
pid=$(pgrep slapd || echo "0")
13+
if [[ "$pid" -gt "0" ]]; then
14+
echo "Sending QUIT signal to slapd"
15+
kill -3 $pid
16+
sleep 1
17+
pid=$(pgrep slapd || echo "0")
18+
if [[ "$pid" == "0" ]]; then
19+
echo "slapd stop [OK]"
20+
else
21+
echo "slapd stop [ERROR]"
22+
kill -9 $pid
23+
fi
24+
fi
25+
service slapd start
26+
}
27+
28+
function generate_certs_if_needed() {
29+
if
30+
[ ! -f /uaa/certificates/server.crt ] ||
31+
[ ! -f /uaa/certificates/server.key ] ||
32+
[ ! -f /uaa/certificates/CA.crt ] ||
33+
[ ! -f /uaa/certificates/CA.key ]; then
34+
/uaa/certificates/generate.sh
35+
fi
36+
}
37+
38+
function configure_slapd_tls() {
39+
cp /uaa/certificates/CA.key /etc/ldap/sasl2/
40+
cp /uaa/certificates/CA.crt /etc/ldap/sasl2/
41+
cp /uaa/certificates/server.crt /etc/ldap/sasl2/
42+
cp /uaa/certificates/server.key /etc/ldap/sasl2/
43+
cp /etc/ssl/certs/ca-certificates.crt /etc/ldap/sasl2/
44+
cat /etc/ldap/sasl2/CA.crt >> /etc/ldap/sasl2/ca-certificates.crt
45+
chown -R openldap:openldap /etc/ldap/sasl2
46+
47+
echo "dn: cn=config
48+
changetype: modify
49+
add: olcTLSCACertificateFile
50+
olcTLSCACertificateFile: /etc/ldap/sasl2/ca-certificates.crt
51+
-
52+
add: olcTLSCertificateFile
53+
olcTLSCertificateFile: /etc/ldap/sasl2/server.crt
54+
-
55+
add: olcTLSCertificateKeyFile
56+
olcTLSCertificateKeyFile: /etc/ldap/sasl2/server.key" > /etc/ldap/sasl2/uaa-certinfo.ldif
57+
## TODO start LDAP server here
58+
restart_ldap
59+
echo "Adding LDAP Certs"
60+
ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/ldap/sasl2/uaa-certinfo.ldif
61+
echo "LDAP Certs added"
62+
sed -i "s/^SLAPD_SERVICES.*/SLAPD_SERVICES=\"ldap\:\/\/\/ ldapi\:\/\/\/ ldaps\:\/\/\/\"/g" /etc/default/slapd
63+
sed -i "s/^TLS/\#TLS/g" /etc/ldap/ldap.conf
64+
echo "TLS_CACERT /etc/ldap/sasl2/ca-certificates.crt
65+
TLS_REQCERT allow
66+
" >> /etc/ldap/ldap.conf
67+
restart_ldap
68+
}
69+
70+
if [ ! -f ${LDAP_SCHEMA_CHK} ]; then
71+
generate_certs_if_needed
72+
configure_slapd_tls
73+
touch ${LDAP_TLS_CHK}
74+
fi
75+
76+
echo "LDAP server Status:"
77+
service slapd status || true
78+
79+
if [ ! -f ${LDAP_SCHEMA_CHK} ]; then
80+
echo "Starting LDAP server."
81+
restart_ldap
82+
echo "Creating LDAP schema."
83+
ldapadd -Y EXTERNAL -H ldapi:/// -f $SCRIPT_DIR/ldap_slapd_schema.ldif
84+
echo "Populating LDAP database entries."
85+
ldapadd -x -D 'cn=admin,dc=test,dc=com' -w password -f $SCRIPT_DIR/ldap_slapd_data.ldif
86+
touch ${LDAP_SCHEMA_CHK}
87+
else
88+
echo "Starting LDAP server with existing data."
89+
restart_ldap
90+
fi
91+
92+
doExit() {
93+
echo "Caught SIGTERM signal."
94+
exit 0
95+
}
96+
97+
trap doExit SIGINT SIGQUIT SIGTERM
98+
99+
echo "LDAP server is READY"
100+
101+
# Do not exit the container in docker compose
102+
while true; do
103+
sleep 1
104+
done

0 commit comments

Comments
 (0)