WMDE
/
puppet-wmdeit_ldap
2
0
Fork 0
Code Issues Pull Requests Releases 1 Wiki Activity

Activated syncrepl

This commit is contained in:
Tobias Herre 2020-09-11 09:04:56 +02:00
parent 1421e140b6
commit 726a33a0bf
1 changed files with 31 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
manifests/init.pp
View File

@ -90,15 +90,16 @@ class wmdeit_ldap (
"by anonymous break", "by anonymous break",
"by * read", "by * read",
], ],
# let anonymous users list uids
"4 to dn.subtree=\"$database\" attrs=entry,objectClass,uid" => [ "4 to dn.subtree=\"$database\" attrs=entry,objectClass,uid" => [
"by anonymous read", "by anonymous read",
"by * break", "by * break",
], ],
# deny access to anything else
'5 to *' => [ '5 to *' => [
"by * none", "by * none",
] ]
}, },
){ ){
@ -131,7 +132,6 @@ class wmdeit_ldap (
ensure => present, ensure => present,
} }
class { 'openldap::server': class { 'openldap::server':
ssl_ca => "$cacert", ssl_ca => "$cacert",
ssl_cert => "$pubcert", ssl_cert => "$pubcert",
@ -141,7 +141,7 @@ class wmdeit_ldap (
# delete all schema and databases created by default during installation # delete all schema and databases created by default during installation
# This is some kind of a dirty hack because we use # This is some kind of a dirty hack because we use
# in before => and irequire => some internal classes of module openldap # in "before =>" and "require =>" some internal classes of module openldap
exec { 'wmdemanaged': exec { 'wmdemanaged':
before => Class['::openldap::server::config'], before => Class['::openldap::server::config'],
require => Class['::openldap::server::install'], require => Class['::openldap::server::install'],
@ -194,7 +194,6 @@ class wmdeit_ldap (
# value => { "TLSCACertificateFile"=>"$ssldir/ca.pem" } # value => { "TLSCACertificateFile"=>"$ssldir/ca.pem" }
# } # }
# openldap::server::globalconf { 'TLSCertificateKeyFile': # openldap::server::globalconf { 'TLSCertificateKeyFile':
# ensure => present, # ensure => present,
# value => { "TLSCertificateKeyFile"=>"$ssldir/privkey.pem" } # value => { "TLSCertificateKeyFile"=>"$ssldir/privkey.pem" }
@ -259,14 +258,23 @@ class wmdeit_ldap (
# Build list of syncrepl-entries, store it in $syncrepl # Build list of syncrepl-entries, store it in $syncrepl
# if !empty ($syncrepl_providers) { if !empty ($syncrepl_providers) {
# $mirrormode=true $mirrormode=true
# $syncrepl = $syncrepl_providers.map |Integer $index, String $provider| { $syncrepl = $syncrepl_providers.map |Integer $index, $provider| {
# $i = $index+1 $i = $index+1
# "rid=00$i provider=$provider binddn=\"$rootdn\" bindmethod=simple credentials=$rootpw searchbase=\"$database\" type=refreshAndPersist tls_cacert=$cacert tls_key=$privkey tls_cert=$pubcert starttls=yes retry=\"3 60 6 300 30 +\"" #timeout=1" "rid=00$i provider=${provider[proto]}://${provider[host]}:${provider[port]} binddn=\"$rootdn\" bindmethod=simple credentials=$rootpw searchbase=\"$database\" scope=sub attrs=\"*,+\" filter=\"(objectClass=*)\" type=refreshAndPersist tls_cacert=$cacert tls_key=$privkey tls_cert=$pubcert starttls=yes retry=\"3 60 6 300 30 +\" timeout=1"
# } }
# } $syncrepl_providers.each |Integer $index, $provider| {
if $provider[ip] {
host{"host_$index":
name => $provider[host],
ip => $provider[ip],
ensure => present,
}
}
}
}
# create the main database # create the main database
openldap::server::database { "$database": openldap::server::database { "$database":
@ -274,17 +282,17 @@ class wmdeit_ldap (
ensure => present, ensure => present,
rootdn => $rootdn, rootdn => $rootdn,
rootpw => $rootpw, rootpw => $rootpw,
# syncrepl => $syncrepl, syncrepl => $syncrepl,
mirrormode => $mirrormode, mirrormode => $mirrormode,
} }
-> ->
openldap::server::overlay { "memberof on $database": openldap::server::overlay { "memberof on $database":
ensure => present, ensure => present,
} }
# -> ->
# openldap::server::overlay { "syncprov on $database": openldap::server::overlay { "syncprov on $database":
# ensure => present, ensure => present,
# } }
-> ->
openldap::server::overlay { "smbk5pwd on $database": openldap::server::overlay { "smbk5pwd on $database":
ensure => present, ensure => present,