bresam/openldap repository overview

⁠bitnami/openldap extended

An extended variant of bitnami/openldap | hub.docker.com⁠ | github.com⁠

Easy configurable disable_anon_bind, memberOf and openssh-lpk

You can find this project on github⁠ and docker hub⁠

⁠Changes

• Additional ldif config files which can be used (executed) by ENV variable:
  • disable anonymous bind (login/read)
  • openldap-memberof-overlay⁠
  • openssh-lpk⁠

⁠ENV config

For general configurations and usage instructions have a look at the bitnami openldap documentation⁠

• LDAP_EXTRA_SCHEMAS:
  Bitnami's default config is: "cosine,inetorgperson,nis"
  • Disable anonymous bind disable-bind-anon
LDAP_EXTRA_SCHEMAS="cosine,inetorgperson,nis,disable-bind-anon"
  • Add openssh-lpk
LDAP_EXTRA_SCHEMAS="cosine,inetorgperson,nis,openssh-lpk"
  • Add memberof
LDAP_EXTRA_SCHEMAS="cosine,inetorgperson,nis,memberof"
    Groups created before (like readers created by default schema) need to be deleted and recreated before the memberof overlay takes into action

⁠Playground

By docker compose we start an openldap and phpldapadmin containers.
PhpLdapAdmin has a preconfigured connection to the ldap server, the default password is admin.
VIRTUAL_HOST is configured to http://ldap.test⁠ or just use the mapped port http://localhost:8080⁠

Have a look or edit config in docker-compose.yaml⁠

# start environment
docker compose up -d --build

# restart environment after config changes
docker compose down && docker compose up -d --build

⁠PhpLdapAdmin

Preconfigured connections:

• 1 openldap-extended (unsecure): non-tls connection
• 2 openldap-extended (tls): not used yet, needs tls config on server
• 3 openldap-bitnami (unsecure): non-tls connection
• 4 openldap-bitnami (tls): not used yet, needs tls config on server

⁠Connect with other ldap clients from localhost

Bind DN: cn=admin,dc=example,dc=com Password: admin

Container ports of ldap services are bound to localhost by default and can be accessed with any locally installed ldap client:

• openldap-extended
  • unsecure: localhost:1389
  • secure (tls): localhost:1636 not used yet, needs tls config on server
• openldap-bitnami
  • unsecure: localhost:2389
  • secure (tls): localhost:2636 not used yet, needs tls config on server

⁠Notes

You don't need any of these, but possibly it could help on future debugging stuff

docker compose down && docker volume prune -f && docker compose up -d --build

ldapadd -Y EXTERNAL -H "ldapi:///" -f "/opt/bitnami/openldap/etc/schema/disable-bind-anon.ldif"
ldapadd -Y EXTERNAL -H "ldapi:///" -f "/opt/bitnami/openldap/etc/schema/openssh-lpk.ldif"
ldapadd -Y EXTERNAL -H "ldapi:///" -f "/opt/bitnami/openldap/etc/schema/memberof.ldif"

ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// -b cn=config dn

⁠memberOf

https://technicalnotes.wordpress.com/2014/04/19/openldap-setup-with-memberof-overlay/⁠

https://www.adimian.com/blog/how-to-enable-memberof-using-openldap/⁠