Compare commits
No commits in common. "a143e8639a084b45e63edfd3c09ea1a7e064b862" and "aeda32f6778d7b1054021502e9789e2e9684c951" have entirely different histories.
a143e8639a
...
aeda32f677
|
|
@ -68,60 +68,25 @@ class wmdeit_ldap (
|
|||
],
|
||||
$ssldir = "/etc/ldap/ssl",
|
||||
|
||||
$acl = {
|
||||
# Super access to local root user
|
||||
'0 to *' => [
|
||||
'by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage',
|
||||
'by * break',
|
||||
],
|
||||
# Admin rights for members of Admin group
|
||||
'1 to *' => [
|
||||
"by set=\"user & [cn=Admins,ou=Groups,$database]/member\" write",
|
||||
'by * break'
|
||||
],
|
||||
# let users modify their passwords, and disable read acess to all others
|
||||
'2 to attrs=userPassword,sambaNTPassword' => [
|
||||
"by self write",
|
||||
"by anonymous auth",
|
||||
"by * none",
|
||||
],
|
||||
# let users read all
|
||||
'3 to *' => [
|
||||
"by anonymous break",
|
||||
"by * read",
|
||||
],
|
||||
"4 to dn.subtree=\"$database\" attrs=entry,objectClass" => [
|
||||
"by anonymous read",
|
||||
"by * break",
|
||||
],
|
||||
'5 to *' => [
|
||||
"by * none",
|
||||
]
|
||||
|
||||
|
||||
},
|
||||
|
||||
|
||||
# 'by set="user & [cn=Admins,ou=Groups,dc=wikimedia,dc=de]/member" write by * break'
|
||||
$acls = [
|
||||
# grant accces to domain admins
|
||||
'to * by set="user/uid & [cn=Domain Admins,cn=groups,dc=wikimedia,dc=de]/memberUid" write by * break',
|
||||
'to * by set="user/uid & [cn=Administrators,cn=Builtin,dc=wikimedia,dc=de]/memberUid" write by * break',
|
||||
|
||||
# super acces to local root user
|
||||
# 'to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by * break',
|
||||
# grant accces to domain admins
|
||||
# 'to * by set="user/uid & [cn=Domain Admins,cn=groups,dc=wikimedia,dc=de]/memberUid" write by * break',
|
||||
# 'to * by set="user/uid & [cn=Administrators,cn=Builtin,dc=wikimedia,dc=de]/memberUid" write by * break',
|
||||
# 'to * by set="user & [cn=Admins,ou=Groups,dc=wikimedia,dc=de]/member" write by * break',
|
||||
# 'to * by set="user/uid & [cn=Administrators,cn=Builtin,dc=wikimedia,dc=de]/memberUid" write by * break',
|
||||
|
||||
'to * by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage by * break',
|
||||
|
||||
# let users modify their passwords
|
||||
# 'to attrs=userPassword by self write by anonymous auth by dn="cn=admin,dc=wikimedia,dc=de" write by * none',
|
||||
# let users modify their passwords
|
||||
'to attrs=userPassword by self write by anonymous auth by dn="cn=admin,dc=wikimedia,dc=de" write by * none',
|
||||
|
||||
# 'to attrs=entry,children,objectClass,uid by anonymous read by * break',
|
||||
|
||||
# 'to * by anonymous none by * break',
|
||||
'to attrs=entry,children,objectClass,uid by anonymous read by * break',
|
||||
|
||||
# 'to dn.base="" by * read',
|
||||
# 'to * by self write by dn="cn=admin,dc=wikimedia,dc=de" write by * read',
|
||||
'to * by anonymous none by * break',
|
||||
|
||||
'to dn.base="" by * read',
|
||||
'to * by self write by dn="cn=admin,dc=wikimedia,dc=de" write by * read',
|
||||
]
|
||||
|
||||
){
|
||||
$clientcert = $facts[clientcert]
|
||||
|
|
@ -298,48 +263,33 @@ class wmdeit_ldap (
|
|||
rootpw => $rootpw,
|
||||
# syncrepl => $syncrepl,
|
||||
mirrormode => $mirrormode,
|
||||
}
|
||||
->
|
||||
openldap::server::overlay { "memberof on $database":
|
||||
ensure => present,
|
||||
}
|
||||
# ->
|
||||
} #->
|
||||
# openldap::server::overlay { "memberof on $database":
|
||||
# ensure => present,
|
||||
# } ->
|
||||
# openldap::server::overlay { "syncprov on $database":
|
||||
# ensure => present,
|
||||
# }
|
||||
->
|
||||
openldap::server::overlay { "smbk5pwd on $database":
|
||||
ensure => present,
|
||||
}
|
||||
# } ->
|
||||
# openldap::server::overlay { "smbk5pwd on $database":
|
||||
# ensure => present,
|
||||
# }
|
||||
|
||||
# $acls.each |Integer $i, $acl | {
|
||||
# notify{"Set ACL $i $acl":}
|
||||
# $acls.each |Integer $i, String $acl | {
|
||||
# openldap::server::access { "{$i}$acl":
|
||||
# openldap::server::access { "$i on $database":
|
||||
# suffix => "$database",
|
||||
# ensure => present,
|
||||
# access => $acl['access'],
|
||||
# what => $acl['to'],
|
||||
# }
|
||||
# }
|
||||
#
|
||||
|
||||
openldap::server::access_wrapper { $database :
|
||||
acl => $acl,
|
||||
}
|
||||
|
||||
|
||||
|
||||
#'''''##################################################################################################
|
||||
#
|
||||
#
|
||||
|
||||
# openldap::server::access { '{0}to * by set="user/uid & [cn=Domain Admins,cn=groups,dc=wikimedia,dc=de]/memberUid" write by * break on $database':
|
||||
## openldap::server::access { '{0}to * by set="user/uid & [cn=Domain Admins,cn=groups,dc=wikimedia,dc=de]/memberUid" write by * break':
|
||||
# suffix => "$database",
|
||||
# access => '{0}to * by set="user/uid & [cn=Domain Admins,cn=groups,dc=wikimedia,dc=de]/memberUid" write by * break',
|
||||
# ensure => present,
|
||||
# }
|
||||
#
|
||||
|
||||
# openldap::server::access { '{1}to * by set="user/uid & [cn=Administrators,cn=Builtin,dc=wikimedia,dc=de]/memberUid" write by * break':
|
||||
# suffix => "$database",
|
||||
# ensure => present,
|
||||
|
|
|
|||
|
|
@ -33,7 +33,7 @@ class wmdeit_ldap::lam(
|
|||
}
|
||||
|
||||
class { 'apache::mod::php':
|
||||
# php_version => '7.3'
|
||||
php_version => '7.3'
|
||||
}
|
||||
|
||||
class { '::php':
|
||||
|
|
@ -126,8 +126,8 @@ class wmdeit_ldap::lam(
|
|||
},
|
||||
|
||||
server_url => $conf['server_url'] ? {
|
||||
undef => 'ldap://localhost:389',
|
||||
default => $conf['server_url'],
|
||||
undef => "",
|
||||
default => 'ldap://localhost:389'
|
||||
},
|
||||
}
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in New Issue