Merge branch 'hotfix-0.2.2' into stable

Dockerfile

@@ -1,7 +1,16 @@
-FROM phusion/baseimage:0.9.8
-MAINTAINER Nick Stenning <nick@whiteink.com>
+FROM osixia/baseimage
+MAINTAINER Bertrand Gouny <bertrand.gouny@osixia.fr>
 
-ENV HOME /root
+# From Nick Stenning's work
+# https://github.com/nickstenning/docker-slapd
+
+# Default configuration: can be overridden at the docker command line
+ENV LDAP_ADMIN_PWD toor
+ENV LDAP_ORGANISATION Example Inc.
+ENV LDAP_DOMAIN example.com
+
+# /!\ To store the data outside the container, mount /var/lib/ldap as a data volume
+# add -v /some/host/directory:/var/lib/ldap to the run command
 
 # Disable SSH
 RUN rm -rf /etc/service/sshd /etc/my_init.d/00_regen_ssh_host_keys.sh
@@ -9,25 +18,25 @@ RUN rm -rf /etc/service/sshd /etc/my_init.d/00_regen_ssh_host_keys.sh
 # Use baseimage-docker's init system.
 CMD ["/sbin/my_init"]
 
-# Configure apt
-RUN echo 'deb http://us.archive.ubuntu.com/ubuntu/ precise universe' >> /etc/apt/sources.list
+# Resynchronize the package index files from their sources
 RUN apt-get -y update
 
-# Install slapd
-RUN LC_ALL=C DEBIAN_FRONTEND=noninteractive apt-get install -y slapd
-
-# Default configuration: can be overridden at the docker command line
-ENV LDAP_ROOTPASS toor
-ENV LDAP_ORGANISATION Acme Widgets Inc.
-ENV LDAP_DOMAIN example.com
+# Install openldap (slapd) and ldap-utils
+RUN LC_ALL=C DEBIAN_FRONTEND=noninteractive apt-get install -y slapd ldap-utils openssl
 
+# Expose ldap default port
 EXPOSE 389
 
+# Create TSL certificats directory
+RUN mkdir /etc/ldap/ssl
+
+# Add config directory 
+RUN mkdir /etc/ldap/config
+ADD config /etc/ldap/config
+
+# Add slapd deamon
 RUN mkdir /etc/service/slapd
 ADD slapd.sh /etc/service/slapd/run
 
-# To store the data outside the container, mount /var/lib/ldap as a data volume
-
+# Clear out the local repository of retrieved package files
 RUN apt-get clean && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
-
-# vim:ts=8:noet:

README.md

@@ -1,38 +1,31 @@
-## slapd
+## docker-openldap
 
-A basic configuration of the OpenLDAP server, slapd, with support for data
-volumes.
+Fork of Nick Stenning docker-slapd :
+https://github.com/nickstenning/docker-slapd
 
-This image will initialize a basic configuration of slapd. Most common schemas
-are preloaded (all the schemas that come preloaded with the default Ubuntu
-Precise install of slapd), but the only record added to the directory will be
-the root organisational unit.
+Add support of tls.
 
-You can (and should) configure the following by providing environment variables
-to `docker run`:
+### How to use tls
 
-- `LDAP_DOMAIN` sets the LDAP root domain. (e.g. if you provide `foo.bar.com`
-  here, the root of your directory will be `dc=foo,dc=bar,dc=com`)
-- `LDAP_ORGANISATION` sets the human-readable name for your organisation (e.g.
-  `Acme Widgets Inc.`)
-- `LDAP_ROOTPASS` sets the LDAP admin user password (i.e. the password for
-  `cn=admin,dc=example,dc=com` if your domain was `example.com`)
+Add `-v some/host/dir:/etc/ldap/ssl` and `--dns=127.0.0.1` to the run command.
 
-For example, to start a container running slapd for the `mycorp.com` domain,
-with data stored in `/data/ldap` on the host, use the following:
+`some/host/dir` must contain a least 3 files :
+- `ca.crt` certificate authority certificate
+- `ldap.crt` ldap server certificate
+- `ldap.key` ldap server certificate private key
 
-    docker run -v /data/ldap:/var/lib/ldap \
-               -e LDAP_DOMAIN=mycorp.com \
-               -e LDAP_ORGANISATION="My Mega Corporation" \
-               -e LDAP_ROOTPASS=s3cr3tpassw0rd \
-               -d nickstenning/slapd
+and optionaly `dhparam.pem` this file is genereted automaticaly if not present.
 
-You can find out which port the LDAP server is bound to on the host by running
-`docker ps` (or `docker port <container_id> 389`). You could then load an LDIF
-file (to set up your directory) like so:
+`--dns=127.0.0.1` allow to use certificate cn correctly.
 
-    ldapadd -h localhost -p <host_port> -c -x -D cn=admin,dc=mycorp,dc=com -W -f
-data.ldif
 
-**NB**: Please be aware that by default docker will make the LDAP port
-accessible from anywhere if the host firewall is unconfigured.
+### Example
+
+    docker run --dns=127.0.0.1 \
+               -v /data/ldap/db:/var/lib/ldap \
+               -v /data/ldap/ssl/:/etc/ldap/ssl \
+               -v /data/ldap/log/:/var/log \
+               -e LDAP_DOMAIN=example.com \
+               -e LDAP_ORGANISATION="Example Corp." \
+               -e LDAP_ROOTPASS=toor \
+               -p 389:389 -d osixia/openldap

config/auto/tls.ldif

@@ -0,0 +1,17 @@
+dn: cn=config
+changetype: modify
+replace: olcTLSCACertificateFile
+olcTLSCACertificateFile: /etc/ldap/ssl/ca.crt
+-
+replace: olcTLSCertificateFile
+olcTLSCertificateFile: /etc/ldap/ssl/ldap.crt
+-
+replace: olcTLSCertificateKeyFile
+olcTLSCertificateKeyFile: /etc/ldap/ssl/ldap.key
+-
+replace: olcTLSDHParamFile
+olcTLSDHParamFile: /etc/ldap/ssl/dhparam.pem
+-
+replace: olcTLSVerifyClient
+olcTLSVerifyClient: never
+

config/logging.ldif

@@ -0,0 +1,4 @@
+dn: cn=config
+changetype: modify
+replace: olcLogLevel
+olcLogLevel: stats

slapd.sh

@@ -7,18 +7,19 @@ status () {
 }
 
 set -x
-: LDAP_ROOTPASS=${LDAP_ROOTPASS}
+: LDAP_ADMIN_PWD=${LDAP_ADMIN_PWD}
 : LDAP_DOMAIN=${LDAP_DOMAIN}
 : LDAP_ORGANISATION=${LDAP_ORGANISATION}
 
+############ Base config ############
 if [ ! -e /var/lib/ldap/docker_bootstrapped ]; then
   status "configuring slapd for first run"
 
   cat <<EOF | debconf-set-selections
-slapd slapd/internal/generated_adminpw password ${LDAP_ROOTPASS}
-slapd slapd/internal/adminpw password ${LDAP_ROOTPASS}
-slapd slapd/password2 password ${LDAP_ROOTPASS}
-slapd slapd/password1 password ${LDAP_ROOTPASS}
+slapd slapd/internal/generated_adminpw password ${LDAP_ADMIN_PWD}
+slapd slapd/internal/adminpw password ${LDAP_ADMIN_PWD}
+slapd slapd/password2 password ${LDAP_ADMIN_PWD}
+slapd slapd/password1 password ${LDAP_ADMIN_PWD}
 slapd slapd/dump_database_destdir string /var/backups/slapd-VERSION
 slapd slapd/domain string ${LDAP_DOMAIN}
 slapd shared/organization string ${LDAP_ORGANISATION}
@@ -33,10 +34,43 @@ EOF
   dpkg-reconfigure -f noninteractive slapd
 
   touch /var/lib/ldap/docker_bootstrapped
+
 else
   status "found already-configured slapd"
 fi
 
-status "starting slapd"
+############ Dynamic config ############
+slapd -h "ldap:/// ldapi:///" -u openldap -g openldap
+chown -R openldap:openldap /etc/ldap
+
+# TLS
+if [ -e /etc/ldap/ssl/ldap.crt ] && [ -e /etc/ldap/ssl/ldap.key ] && [ -e /etc/ldap/ssl/ca.crt ]; then
+  status "certificates found"
+
+  chmod 600 /etc/ldap/ssl/ldap.key
+
+  # create DHParamFile if not found
+  [ -f /etc/ldap/ssl/dhparam.pem ] || openssl dhparam -out /etc/ldap/ssl/dhparam.pem 2048
+
+  ldapmodify -Y EXTERNAL -H ldapi:/// -f /etc/ldap/config/auto/tls.ldif 
+
+  # add fake dnsmasq route to certificate cn
+  cn=$(openssl x509 -in /etc/ldap/ssl/ldap.crt -subject -noout | sed -n 's/.*CN=\(.*\).\^*/\1/p')
+  echo "127.0.0.1	" $cn >> /etc/dhosts
+
+fi
+
+# Replication
+# todo
+
+# Other config files
+for f in $(find /etc/ldap/config -maxdepth 1 -name \*.ldif -type f); do
+  status "Processing file ${f}"
+  ldapmodify -Y EXTERNAL -H ldapi:/// -f $f
+done
+
+pkill slapd
+
+status "starting slapd on default port 389"
 set -x
-exec /usr/sbin/slapd -h "ldap:///" -u openldap -g openldap -d 0
+exec /usr/sbin/slapd -h "ldap:///" -u openldap -g openldap -d -1