Merge branch 'release-0.3.0' into stable

Dockerfile

@@ -1,7 +1,16 @@
-FROM phusion/baseimage:0.9.8
+FROM osixia/baseimage
-MAINTAINER Nick Stenning <nick@whiteink.com>
+MAINTAINER Bertrand Gouny <bertrand.gouny@osixia.fr>
 
-ENV HOME /root
+# From Nick Stenning's work
+# https://github.com/nickstenning/docker-slapd
+
+# Default configuration: can be overridden at the docker command line
+ENV LDAP_ADMIN_PWD toor
+ENV LDAP_ORGANISATION Example Inc.
+ENV LDAP_DOMAIN example.com
+
+# /!\ To store the data outside the container, mount /var/lib/ldap as a data volume
+# add -v /some/host/directory:/var/lib/ldap to the run command
 
 # Disable SSH
 RUN rm -rf /etc/service/sshd /etc/my_init.d/00_regen_ssh_host_keys.sh
@@ -9,25 +18,25 @@ RUN rm -rf /etc/service/sshd /etc/my_init.d/00_regen_ssh_host_keys.sh
 # Use baseimage-docker's init system.
 CMD ["/sbin/my_init"]
 
-# Configure apt
+# Resynchronize the package index files from their sources
-RUN echo 'deb http://us.archive.ubuntu.com/ubuntu/ precise universe' >> /etc/apt/sources.list
 RUN apt-get -y update
 
-# Install slapd
+# Install openldap (slapd) and ldap-utils
-RUN LC_ALL=C DEBIAN_FRONTEND=noninteractive apt-get install -y slapd
+RUN LC_ALL=C DEBIAN_FRONTEND=noninteractive apt-get install -y slapd ldap-utils openssl
-
-# Default configuration: can be overridden at the docker command line
-ENV LDAP_ROOTPASS toor
-ENV LDAP_ORGANISATION Acme Widgets Inc.
-ENV LDAP_DOMAIN example.com
 
+# Expose ldap default port
 EXPOSE 389
 
+# Create TLS certificats directory
+RUN mkdir /etc/ldap/ssl
+
+# Add config directory 
+RUN mkdir /etc/ldap/config
+ADD config /etc/ldap/config
+
+# Add slapd deamon
 RUN mkdir /etc/service/slapd
 ADD slapd.sh /etc/service/slapd/run
 
-# To store the data outside the container, mount /var/lib/ldap as a data volume
+# Clear out the local repository of retrieved package files
-
 RUN apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
-
-# vim:ts=8:noet:

README.md

@@ -1,38 +1,31 @@
-## slapd
+## docker-openldap
 
-A basic configuration of the OpenLDAP server, slapd, with support for data
+Fork of Nick Stenning docker-slapd :
-volumes.
+https://github.com/nickstenning/docker-slapd
 
-This image will initialize a basic configuration of slapd. Most common schemas
+Add support of tls.
-are preloaded (all the schemas that come preloaded with the default Ubuntu
-Precise install of slapd), but the only record added to the directory will be
-the root organisational unit.
 
-You can (and should) configure the following by providing environment variables
+### How to use tls
-to `docker run`:
 
-- `LDAP_DOMAIN` sets the LDAP root domain. (e.g. if you provide `foo.bar.com`
+Add `-v some/host/dir:/etc/ldap/ssl` and `--dns=127.0.0.1` to the run command.
-  here, the root of your directory will be `dc=foo,dc=bar,dc=com`)
-- `LDAP_ORGANISATION` sets the human-readable name for your organisation (e.g.
-  `Acme Widgets Inc.`)
-- `LDAP_ROOTPASS` sets the LDAP admin user password (i.e. the password for
-  `cn=admin,dc=example,dc=com` if your domain was `example.com`)
 
-For example, to start a container running slapd for the `mycorp.com` domain,
+`some/host/dir` must contain a least 3 files :
-with data stored in `/data/ldap` on the host, use the following:
+- `ca.crt` certificate authority certificate
+- `ldap.crt` ldap server certificate
+- `ldap.key` ldap server certificate private key
 
-    docker run -v /data/ldap:/var/lib/ldap \
+and optionaly `dhparam.pem` this file is genereted automaticaly if not present.
-               -e LDAP_DOMAIN=mycorp.com \
-               -e LDAP_ORGANISATION="My Mega Corporation" \
-               -e LDAP_ROOTPASS=s3cr3tpassw0rd \
-               -d nickstenning/slapd
 
-You can find out which port the LDAP server is bound to on the host by running
+`--dns=127.0.0.1` allow to use the certificate cn correctly.
-`docker ps` (or `docker port <container_id> 389`). You could then load an LDIF
-file (to set up your directory) like so:
 
-    ldapadd -h localhost -p <host_port> -c -x -D cn=admin,dc=mycorp,dc=com -W -f
-data.ldif
 
-**NB**: Please be aware that by default docker will make the LDAP port
+### Example
-accessible from anywhere if the host firewall is unconfigured.
+
+    docker run --dns=127.0.0.1 \
+               -v /data/ldap/db:/var/lib/ldap \
+               -v /data/ldap/ssl/:/etc/ldap/ssl \
+               -v /data/ldap/log/:/var/log \
+               -e LDAP_DOMAIN=example.com \
+               -e LDAP_ORGANISATION="Example Corp." \
+               -e LDAP_ROOTPASS=toor \
+               -p 389:389 -d osixia/openldap

config/auto/tls.ldif

@@ -0,0 +1,17 @@
+dn: cn=config
+changetype: modify
+replace: olcTLSCACertificateFile
+olcTLSCACertificateFile: /etc/ldap/ssl/ca.crt
+-
+replace: olcTLSCertificateFile
+olcTLSCertificateFile: /etc/ldap/ssl/ldap.crt
+-
+replace: olcTLSCertificateKeyFile
+olcTLSCertificateKeyFile: /etc/ldap/ssl/ldap.key
+-
+replace: olcTLSDHParamFile
+olcTLSDHParamFile: /etc/ldap/ssl/dhparam.pem
+-
+replace: olcTLSVerifyClient
+olcTLSVerifyClient: never
+

config/logging.ldif

@@ -0,0 +1,4 @@
+dn: cn=config
+changetype: modify
+replace: olcLogLevel
+olcLogLevel: stats

slapd.sh

@@ -7,18 +7,23 @@ status () {
 }
 
 set -x
-: LDAP_ROOTPASS=${LDAP_ROOTPASS}
+: LDAP_ADMIN_PWD=${LDAP_ADMIN_PWD}
 : LDAP_DOMAIN=${LDAP_DOMAIN}
 : LDAP_ORGANISATION=${LDAP_ORGANISATION}
 
+
 if [ ! -e /var/lib/ldap/docker_bootstrapped ]; then
   status "configuring slapd for first run"
 
+  # permission error on /etc/ldap/slapd.conf if not set?! :'(
+  adduser openldap root
+
+  ############ Base config ############
   cat <<EOF | debconf-set-selections
-slapd slapd/internal/generated_adminpw password ${LDAP_ROOTPASS}
+slapd slapd/internal/generated_adminpw password ${LDAP_ADMIN_PWD}
-slapd slapd/internal/adminpw password ${LDAP_ROOTPASS}
+slapd slapd/internal/adminpw password ${LDAP_ADMIN_PWD}
-slapd slapd/password2 password ${LDAP_ROOTPASS}
+slapd slapd/password2 password ${LDAP_ADMIN_PWD}
-slapd slapd/password1 password ${LDAP_ROOTPASS}
+slapd slapd/password1 password ${LDAP_ADMIN_PWD}
 slapd slapd/dump_database_destdir string /var/backups/slapd-VERSION
 slapd slapd/domain string ${LDAP_DOMAIN}
 slapd shared/organization string ${LDAP_ORGANISATION}
@@ -32,11 +37,45 @@ EOF
 
   dpkg-reconfigure -f noninteractive slapd
 
+
+  ############ Custom config ############
+  slapd -h "ldap:/// ldapi:///" -u openldap -g openldap 
+  chown -R openldap:openldap /etc/ldap
+
+  # TLS
+  if [ -e /etc/ldap/ssl/ldap.crt ] && [ -e /etc/ldap/ssl/ldap.key ] && [ -e /etc/ldap/ssl/ca.crt ]; then
+    status "certificates found"
+
+    chmod 600 /etc/ldap/ssl/ldap.key
+
+    # create DHParamFile if not found
+    [ -f /etc/ldap/ssl/dhparam.pem ] || openssl dhparam -out /etc/ldap/ssl/dhparam.pem 2048
+
+    ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/ldap/config/auto/tls.ldif -Q 
+
+    # add fake dnsmasq route to certificate cn
+    cn=$(openssl x509 -in /etc/ldap/ssl/ldap.crt -subject -noout | sed -n 's/.*CN=\(.*\)\/*\(.*\)/\1/p')
+    echo "127.0.0.1	" $cn >> /etc/dhosts
+
+  fi
+
+  # Replication
+  # todo
+
+  # Other config files
+  for f in $(find /etc/ldap/config -maxdepth 1 -name \*.ldif -type f); do
+    status "Processing file ${f}"
+    ldapmodify -Y EXTERNAL -H ldapi:/// -f $f -Q 
+  done
+
+  kill -INT `cat /run/slapd/slapd.pid`
+
   touch /var/lib/ldap/docker_bootstrapped
+
 else
   status "found already-configured slapd"
 fi
 
-status "starting slapd"
+status "starting slapd on default port 389"
 set -x
-exec /usr/sbin/slapd -h "ldap:///" -u openldap -g openldap -d 0
+exec /usr/sbin/slapd -h "ldap:///" -u openldap -g openldap -d -1

test.sh

@@ -0,0 +1,48 @@
+#!/bin/sh
+
+# Tests
+error=0
+ok=0
+
+echo_start () {
+  echo "------- Start $* test -------"
+}
+
+echo_error () {
+  echo "\n$(tput setaf 1)/!\ $* failed$(tput sgr0)\n"
+  error=`expr $error + 1`
+}
+
+echo_ok () {
+  echo "\n--> $* ok\n"
+  ok=`expr $ok + 1`
+}
+
+run_test () {
+  fction=$1
+  out=test/test.out
+
+  echo_start $fction
+
+  #./test/$1.sh | tee $out 2>&1
+  ./test/$1.sh > $out 2>&1
+  
+  if [ "$(grep -c "$2" $out)" -eq 0 ]; then
+    echo_error $fction
+  else
+    echo_ok  $fction
+  fi
+
+  rm $out
+}
+
+
+./test/tools/prepare.sh
+run_test build "Successfully built"
+run_test run-simple "dn: dc=example,dc=com"
+run_test run-tls "dn: dc=example,dc=com"
+./test/tools/end.sh
+
+echo "------- Test finished -------"
+echo $error " failed " $ok " passed"
+

test/build.sh

@@ -0,0 +1,4 @@
+#!/bin/sh
+sudo docker.io build -t openldap-test .
+#sudo docker.io build --no-cache=true -t openldap-test .
+

test/delete-container.sh

@@ -0,0 +1,11 @@
+#!/bin/sh
+
+# remove openldap test containers
+sudo docker.io ps -a > testcontainers.out
+
+if [ "$(grep -c "openldap-test-container" ./testcontainers.out)" -ne 0 ]; then
+  sudo docker.io stop openldap-test-container
+  sudo docker.io rm openldap-test-container
+fi
+
+rm testcontainers.out

test/end.sh

@@ -0,0 +1,3 @@
+#!/bin/sh
+
+./test/delete-container.sh

test/prepare.sh

@@ -0,0 +1,3 @@
+#!/bin/sh
+
+./test/delete-container.sh

test/run-simple.sh

@@ -0,0 +1,7 @@
+#!/bin/sh
+
+docker.io run --name openldap-test-container -p 65389:389 -d openldap-test
+sleep 5
+ldapsearch -x -h localhost -p 65389 -b dc=example,dc=com
+
+$(pwd)/test/tools/delete-container.sh

test/run-tls.sh

@@ -0,0 +1,21 @@
+#!/bin/sh
+
+docker.io run  --name openldap-test-container --dns=127.0.0.1 -v `pwd`/test/ssl:/etc/ldap/ssl -p 65389:389 -d openldap-test
+
+cert=$(echo `pwd`/test/ssl/ldap.crt)
+certCN=$(openssl x509 -in $cert -subject -noout | sed -n 's/.*CN=\(.*\)\/*\(.*\)/\1/p')
+addLine=$(echo "127.0.0.1" $certCN)
+
+echo $addLine >> /etc/hosts
+cp /etc/ldap/ldap.conf /etc/ldap/ldap.conf.old
+sed -i 's,TLS_CACERT.*,TLS_CACERT '"$cert"',g' /etc/ldap/ldap.conf
+
+
+sleep 5
+ldapsearch -x -h $certCN -p 65389 -b dc=example,dc=com -ZZ
+
+sed -i '/'"$addLine"'/d' /etc/hosts
+cp /etc/ldap/ldap.conf.old /etc/ldap/ldap.conf
+rm /etc/ldap/ldap.conf.old
+
+$(pwd)/test/tools/delete-container.sh

test/ssl/ca.crt

@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDZzCCAh+gAwIBAgIEU2ehnzANBgkqhkiG9w0BAQsFADAjMSEwHwYDVQQDExhU
+ZXN0IENBIENvbXBhbnkgLSBPc2l4aWEwHhcNMTQwNTA1MTQzNTExWhcNMTUwNTA1
+MTQzNTExWjAjMSEwHwYDVQQDExhUZXN0IENBIENvbXBhbnkgLSBPc2l4aWEwggFS
+MA0GCSqGSIb3DQEBAQUAA4IBPwAwggE6AoIBMQDdf+DVT4rPGxNB1SwL6git8Lw1
+AsEvd+rHAMKyCSRxbJywvtN/OKxVz4qWCkoRvcffG0uyoWRE+1w6DnT8ON+8uvuI
+2wbrLydFxuZdouZZJiX0QbXWra9lQpDWO2EAiPFchbN/K9+fXwV4SpsI3B7bGwM/
+sVtn6khbxvtzn+9yUmjIpA7q8i9NLVoX8UwagANtFIVE/Dc/MwaX7ayu6yYiNLXx
+GHzWXzQcTS6vWcVaf+pkq6/zZdXn0jVNfqnwAu3ooTWO3BeuQvGaQeRpRVlM0lPh
+oM7YFhR8b13Y5EmkZtSjoM+7ZOKF5mqBvluj65gIcQxnx4l4YCZ4MUVAlZBYc87h
+2JSYrAlq6eBhJzkNDi21jqtqSr1i08XICZrz4Vk8lrexWbRGzyz537La1LYNAgMB
+AAGjQzBBMA8GA1UdEwEB/wQFMAMBAf8wDwYDVR0PAQH/BAUDAwcEADAdBgNVHQ4E
+FgQUnod7FQfSDLyWVeBSTTdCriQoEHYwDQYJKoZIhvcNAQELBQADggExAGtv/8Ot
+3Acs+KlR+0OBtnWe6sfzfQ2fRJvol7szp0Nto+zTZLbtCEvNGIVkd8eLrm9a9soa
+pY/pC6dAPPZHho/G46quSjtSARU/tlbabkRsCfHiWIvtjqKIyzqk+YjOc767pd0G
+iWKxF98sI4fKdlZ+Aqw+9vO2KwQMYEtrIiCbPUYMff/BzxkrwUBnYcTjISPwEd3Z
+JylfG78qsB8N6UOf89jRX2O7HCy6CGJvcuxbkwaCd5iqgLhBXj9bU7xgy/A2udav
+JV/uV+vWDcy8cI22Xz1jfPpimAZjv+Qb3NjDX5nxjTciAEsNges0QdxZ71dfEqo+
+DGSImtM8ORivPw7oXADztCC+11KcV4THa6wmu+Sblsxe46ldAwb6MLvMN04zALUN
+mW4ojToqYgz9Jgc=
+-----END CERTIFICATE-----

test/ssl/dhparam.pem

@@ -0,0 +1,8 @@
+-----BEGIN DH PARAMETERS-----
+MIIBCAKCAQEAwC8hQ6nZ2kNNmZAGGYN8++rUvNlDjKqdwWubUnqY08ng6FfGcouL
+VSvgsF3LeERW/h4hrkgN983QjwrbBOrNp+7B59lhCs6Acvi87dXf3iaGNy4Gca43
+ERVkAJ7IWdXydyb9COANRtmBb1JvvYMAeVeMdofk8EcOW/kUV2adAQKluAcVhgRQ
+Pesp5i6Lv1kN5zVHDGkrJz5h0Mzi35aYia0gSnVCqEzmU7Omnz/gXY3Jdx91ym5Y
+2dTZuUZgIhco2bfPbhDl/1g0a1PWz7rxw24KJloNZC3nEt3JqIto83GsgaUtYxFT
+EWINSpghTjl4Z0CGCamJ6HXsNJGaVUXuGwIBAg==
+-----END DH PARAMETERS-----

test/ssl/ldap.crt

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDAzCCAbugAwIBAgIEU2eiHTANBgkqhkiG9w0BAQsFADAjMSEwHwYDVQQDExhU
+ZXN0IENBIENvbXBhbnkgLSBPc2l4aWEwHhcNMTQwNTA1MTQzNzE3WhcNMjQwNTAy
+MTQzNzE3WjBAMR4wHAYDVQQKExVUZXN0IENvbXBhbnkgLSBPc2l4aWExHjAcBgNV
+BAMTFWxkYXAtdGVzdC5leGFtcGxlLmNvbTCBnzANBgkqhkiG9w0BAQEFAAOBjQAw
+gYkCgYEA0/9/VYQARBLg7TrEiO4DAjcBAt3u3IQNNo8YdsL9iGwmRTPOspxOBVuQ
+2AVEIuT+4KLnm01q1NA+tEvXdfXI9eIN5zjCVTdt6VqwrF9E3zWxYEkuSJ4FWOhN
+dc0837hWBg+mBl/d6fSTkmeRc9fpwwr1jK7t10/BIzMr/pCzf10CAwEAAaN2MHQw
+DAYDVR0TAQH/BAIwADATBgNVHSUEDDAKBggrBgEFBQcDATAPBgNVHQ8BAf8EBQMD
+B6AAMB0GA1UdDgQWBBThLwuObrBzlp4qsKs0NHFMrCgn8jAfBgNVHSMEGDAWgBSe
+h3sVB9IMvJZV4FJNN0KuJCgQdjANBgkqhkiG9w0BAQsFAAOCATEAiAl9RGibKsfQ
+5Vbz2ZjsykzYj9Dhkxp7fc7RdrK0SEHGXn8Qeg5jf+j9DtfhTrZPVF7Jn4WOvuqh
+okQPrwRaDox6rtFPjsIR9JIO3/N2OvA3ozQyWqzB1ksU7CHJ5jGRskHBftSH2xwF
+kdGvSMIAmr9VpZ/sp4ykmADWC/bfz8BXYJDOsCBzJMtss/12hBqiJQhSsuBAsOT7
+40hG0t2S7mjGHWDF9PoARmNQ7X3Xc8j7V+dXLpNfZfc+htgI27WcOv7al4kxd//p
+22a77U/q+9B1CV8T2q1UTRnQqPHxtgoRLd+5qzEtzBW37ecAs2eAs9Z7D3O/fScu
+v0RxHSpnZDtL/JZcf3KO96l4sqCp6Ue5Ldg3tOvD4O46hjrlvUYnHcDdJjNYZ7rD
+f5kGXs20Mg==
+-----END CERTIFICATE-----

test/ssl/ldap.key

@@ -0,0 +1,15 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIICWwIBAAKBgQDT/39VhABEEuDtOsSI7gMCNwEC3e7chA02jxh2wv2IbCZFM86y
+nE4FW5DYBUQi5P7gouebTWrU0D60S9d19cj14g3nOMJVN23pWrCsX0TfNbFgSS5I
+ngVY6E11zTzfuFYGD6YGX93p9JOSZ5Fz1+nDCvWMru3XT8EjMyv+kLN/XQIDAQAB
+AoGAHY7OgKxWYydkr/7VHyhcSAdGP1GVN667ruM1rH1UXxyBG331MEcFw853+/6D
++P+Hn+dmtmsNXZ2pWHcIk/xQZ+MEsAdm+OZ1qpBJjHA0izJ6sqZaNxSToKCR4SHM
+/ACPAKqM9r2g1jqXzLKzgHBVc25Fonb1vUilTpC3YfaN+sECQQDmQGEcEK9Lvyi9
+RV1fONDP3Z9cPRaSzpjUjlQAWNbhvcoUYV4AOy+tVClDErRIs/Oo+wCOL+bHlMom
+zghcmxThAkEA67SPV0pNFR32gXvRZT4uKvCJcAjmNY4LMpet5DJ41Spq6+lbqXwY
+1e87zEei1UvdmEXOjVsa1wXcg8Ks+/59/QJAHh+CFOfh5ykFLW3rv09xkiBOfwTG
+9UHuILDWMI1u322zCGOMpr8Xh7ehBlNmHrTcRdlAw1lk+etvXxBJa8QmQQJABbNT
+OCg63wTfflgxQ0KSuUUh/cypTKhHywxyDy/NTlJ9TYFSTzIKI7pqdtFQtdnk3Rbr
+HO4UIxkoMSOXLW0FPQJARScXqZd7Lmwlw+ovAubfdOZdxjWGFZLRRZifiYZqtnQ1
+aw8PjdkaIPxLjCwSOelV9SsMue6a7nvkxKEn6QbT0w==
+-----END RSA PRIVATE KEY-----

test/tools/delete-container.sh

@@ -0,0 +1,11 @@
+#!/bin/sh
+
+# remove openldap test container
+sudo docker.io ps -a > testcontainer.out
+
+if [ "$(grep -c "openldap-test-container" ./testcontainer.out)" -ne 0 ]; then
+  sudo docker.io stop openldap-test-container
+  sudo docker.io rm openldap-test-container
+fi
+
+rm testcontainer.out

test/tools/end.sh

@@ -0,0 +1,3 @@
+#!/bin/sh
+
+./test/tools/delete-container.sh

test/tools/prepare.sh

@@ -0,0 +1,3 @@
+#!/bin/sh
+
+./test/tools/delete-container.sh