Sign inSign up

mnorsic/samba-ad

By mnorsic

•Updated over 1 year ago

Samba configured MS Active Directory LDAP controller.

Image
Security
0

2.4K

mnorsic/samba-ad repository overview

⁠Overview

This image runs a Samba LDAP controller and can import LDIF files on startup, to pre-populate users, organization schema and other objects. LDIF files can be exported from MS Active Directory and adjusted to be imported.

⁠Environment variables

  • REALM - set to Active Directory realm, in uppercase (e.g. EXAMPLE.COM)
  • DOMAIN - NetBIOS domain in uppercase (e.g. EXAMPLE)
  • DOMAIN_DN - LDAP domain DN (e.g. dc=example,dc=com)
  • ADMINPASS - Domain administrator password

Domain administrator is created when creating domain as cn=Administrator,cn=Users,${DOMAIN_DN}

(e.g. cn=Administrator,cn=Users,dc=example,dc=com)

for given parameters above.

⁠LDIF files

Image is fetching all files in directory /ldif which can be mounted from outside.

⁠LDIF file examples

An example of LDIF file that contains organization schema, one user Test User and role MY_ROLE that is assigned to user:

dn: ou=Security_Groups,DC=example,DC=com
objectClass: organizationalUnit
ou: Security_Groups

dn: ou=Users,dc=example,dc=com
objectClass: organizationalUnit
ou: Users

dn:: Q049VGVzdCBVc2VyLE9VPVVzZXJzLERDPWV4YW1wbGUsREM9Y29t
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectClass: inetOrgPerson
objectClass: user
cn:: VGVzdCBVc2Vy
sn: User
title:: VGVzdCBVc2Vy
givenName:: VGVzdA==
distinguishedName:: Q049VGVzdCBVc2VyLE9VPVVzZXJzLERDPWV4YW1wbGUsREM9Y29t
instanceType: 4
displayName:: VGVzdCBVc2Vy
company:: RXhhbXBsZSBMTEM=
name:: VGVzdCBVc2Vy
userAccountControl: 512
badPwdCount: 0
lastLogoff: 0
sAMAccountName: testuser
userPrincipalName: [email protected]
lockoutTime: 0
mail: [email protected]
unicodePwd:: IgBQAGEAcwBzAHcAMAByAGQAIgA=

dn: CN=MY_ROLE,OU=Security_Groups,DC=example,DC=com
objectClass: groupOfNames
cn: MY_ROLE
distinguishedName: CN=MY_ROLE,OU=Security_Groups,DC=example,DC=com
name: MY_ROLE
objectCategory: CN=Group,CN=Schema,CN=Configuration,DC=example,DC=com
dSCorePropagationData: 16010101000000.0Z
member:: Q049VGVzdCBVc2VyLE9VPVVzZXJzLERDPWV4YW1wbGUsREM9Y29t

User data is stored in Base64-encoded format. User password is stored into unicodePwd field, and is generated as Base64-decoded value in UTF-16 format, e.g.

echo -n '"Passw0rd"' | iconv -f UTF-8 -t UTF-16LE | base64 -w 0

⁠Running

⁠Running standalone

The following example runs container and fills data from ./ldif directory:

docker run -d --rm --cap-add=SYS_ADMIN --name sambaad -p "389:389" -v "./ldif:/ldif" -e "REALM=EXAMPLE.COM" -e "DOMAIN=EXAMPLE" -e "DOMAIN_DN=dc=example,dc=com" -e "ADMINPASS=MySuperSecret" mnorsic/samba-ad

Additionally, mount point can be added to /var/lib/samba to persist data between runs:

docker run -d --rm --cap-add=SYS_ADMIN --name sambaad -p "389:389" -v "./ldif:/ldif" -v "./samba-data/var-lib/samba" -e "REALM=EXAMPLE.COM" -e "DOMAIN=EXAMPLE" -e "DOMAIN_DN=dc=example,dc=com" -e "ADMINPASS=MySuperSecret" mnorsic/samba-ad

⁠Running inside Docker Compose

services:
  samba-ad:
    cap_add:
      - SYS_ADMIN
      - DAC_READ_SEARCH
    image: mnorsic/samba-ad
    container_name: sambaad
    environment:
      - REALM=EXAMPLE.COM           # Your AD realm (uppercase)
      - DOMAIN=EXAMPLE              # Your NetBIOS domain
      - DOMAIN_DN=dc=example,dc=com # LDAP DN for your domain
      - ADMINPASS=MySuperSecret     # Administrator password
    volumes:
      - ./ldif:/ldif:ro             # Host folder for LDIF files (read-only)
      - ./samba-data:/var/lib/samba    # Persist Samba AD data
    ports:
      - "389:389"   # LDAP
    restart: unless-stopped

volumes:
  samba-data:

Tag summary

Content type

Image

Digest

sha256:4a7f7cc22…

Size

104.9 MB

Last updated

over 1 year ago

docker pull mnorsic/samba-ad