Revert "Merge pull request #706 from OpenConext/release/680"

roles/sram_ldap/defaults/main.yml

@@ -0,0 +1,37 @@
+---
+sram_ldap_image: "ghcr.io/surfscz/sram-ldap:main"
+sram_ldap_conf_dir: "{{ current_release_appdir }}/sram/ldap"
+sram_ldap_ldif_dir: "{{ sram_ldap_conf_dir }}/schema"
+sram_ldap_certs_dir: "{{ sram_ldap_conf_dir }}/certs"
+sram_ldap_backup_dir: "{{ sram_ldap_conf_dir }}/ldap"
+sram_ldap_data_dir: "{{ sram_ldap_conf_dir}}/data"
+sram_ldap_uri: "ldap://localhost/"
+
+sram_ldap_user: "openldap"
+sram_ldap_group: "openldap"
+
+# admin_group: "ldap_admin"
+sram_ldap_admins:
+  - name: Admin
+    uid: admin
+    pw_hash: "!"
+    sshkey: ""
+
+sram_ldap_loglevel: "stats stats2 filter"
+
+sram_ldap_services_password: secret
+sram_ldap_monitor_password: secret
+sram_ldap_ldap_monitor_password: secret
+
+sram_ldap_rid_prefix: "ldap://"
+
+sram_ldap_base_domain: "{{ base_domain }}"
+sram_ldap_base_dn: >-
+  {{ ((sram_ldap_base_domain.split('.')|length)*['dc=']) |
+  zip(sram_ldap_base_domain.split('.')) | list | map('join', '') | list | join(',') }}
+sram_ldap_services_dn:
+  basedn: "dc=services,{{ sram_ldap_base_dn }}"
+  o:      "Services"
+  binddn: "cn=admin,{{ sram_ldap_base_dn }}"
+
+sram_ldap_hosts: {}

roles/sram_ldap/files/eduMember.ldif

@@ -0,0 +1,27 @@
+dn: cn=eduMember,cn=schema,cn=config
+objectClass: olcSchemaConfig
+cn: eduMember
+# Internet X.500 Schema for Ldappc
+# Includes the eduMember ObjectClass schema
+#
+#
+# An auxiliary object class, "eduMember," is a convenient container 
+# for an extensible set of attributes concerning group memberships. 
+# At this time, the only attributes specified as belonging to the 
+# object class are "isMemberOf" and "hasMember."
+#
+olcAttributeTypes: ( 1.3.6.1.4.1.5923.1.5.1.1
+  NAME 'isMemberOf'
+  DESC 'identifiers for groups to which containing entity belongs'
+  EQUALITY caseExactMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+olcAttributeTypes: ( 1.3.6.1.4.1.5923.1.5.1.2
+  NAME 'hasMember'
+  DESC 'identifiers for entities that are members of the group'
+  EQUALITY caseExactMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+olcObjectClasses: ( 1.3.6.1.4.1.5923.1.5.2.1
+  NAME 'eduMember'
+  AUXILIARY
+  MAY ( isMemberOf $ hasMember )
+  )

roles/sram_ldap/files/eduPerson.ldif

@@ -0,0 +1,83 @@
+dn: cn=eduperson,cn=schema,cn=config
+objectClass: olcSchemaConfig
+cn: eduperson
+olcAttributeTypes: ( 1.3.6.1.4.1.5923.1.1.1.1 
+ NAME 'eduPersonAffiliation' 
+ DESC 'eduPerson per Internet2 and EDUCAUSE' 
+ EQUALITY caseIgnoreMatch 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+olcAttributeTypes: ( 1.3.6.1.4.1.5923.1.1.1.7 
+ NAME 'eduPersonEntitlement' 
+ DESC 'eduPerson per Internet2 and EDUCAUSE' 
+ EQUALITY caseExactMatch 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+olcAttributeTypes: ( 1.3.6.1.4.1.5923.1.1.1.2 
+ NAME 'eduPersonNickName' 
+ DESC 'eduPerson per Internet2 and EDUCAUSE' 
+ EQUALITY caseIgnoreMatch 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+olcAttributeTypes: ( 1.3.6.1.4.1.5923.1.1.1.3 
+ NAME 'eduPersonOrgDN' 
+ DESC 'eduPerson per Internet2 and EDUCAUSE' 
+ EQUALITY distinguishedNameMatch 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE )
+olcAttributeTypes: ( 1.3.6.1.4.1.5923.1.1.1.4 
+ NAME 'eduPersonOrgUnitDN' 
+ DESC 'eduPerson per Internet2 and EDUCAUSE' 
+ EQUALITY distinguishedNameMatch 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+olcAttributeTypes: ( 1.3.6.1.4.1.5923.1.1.1.5
+ NAME 'eduPersonPrimaryAffiliation' 
+ DESC 'eduPerson per Internet2 and EDUCAUSE' 
+ EQUALITY caseIgnoreMatch 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+olcAttributeTypes: ( 1.3.6.1.4.1.5923.1.1.1.8 
+ NAME 'eduPersonPrimaryOrgUnitDN' 
+ DESC 'eduPerson per Internet2 and EDUCAUSE' 
+ EQUALITY distinguishedNameMatch  
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 SINGLE-VALUE )
+olcAttributeTypes: ( 1.3.6.1.4.1.5923.1.1.1.6 
+ NAME 'eduPersonPrincipalName' 
+ DESC 'eduPerson per Internet2 and EDUCAUSE' 
+ EQUALITY caseIgnoreMatch  
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+olcAttributeTypes: ( 1.3.6.1.4.1.5923.1.1.1.12 
+ NAME 'eduPersonPrincipalNamePrior' 
+ DESC 'eduPersonPrincipalNamePrior per Internet2' 
+ EQUALITY caseIgnoreMatch 
+ SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' )
+olcAttributeTypes: ( 1.3.6.1.4.1.5923.1.1.1.9 
+ NAME 'eduPersonScopedAffiliation' 
+ DESC 'eduPerson per Internet2 and EDUCAUSE' 
+ EQUALITY caseIgnoreMatch 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+olcAttributeTypes: ( 1.3.6.1.4.1.5923.1.1.1.10 
+ NAME 'eduPersonTargetedID' 
+ DESC 'eduPerson per Internet2 and EDUCAUSE' 
+ EQUALITY caseExactMatch 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+olcAttributeTypes: ( 1.3.6.1.4.1.5923.1.1.1.11 
+ NAME 'eduPersonAssurance' 
+ DESC 'eduPerson per Internet2 and EDUCAUSE' 
+ EQUALITY caseExactMatch 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+olcAttributeTypes: ( 1.3.6.1.4.1.5923.1.1.1.13 
+ NAME 'eduPersonUniqueId' 
+ DESC 'eduPersonUniqueId per Internet2' 
+ EQUALITY caseIgnoreMatch 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE )
+olcAttributeTypes: ( 1.3.6.1.4.1.5923.1.1.1.16 
+ NAME 'eduPersonOrcid' 
+ DESC 'ORCID researcher identifiers belonging to the principal' 
+ EQUALITY caseIgnoreMatch 
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 )
+olcObjectClasses: ( 1.3.6.1.4.1.5923.1.1.2 
+ NAME 'eduPerson' 
+ AUXILIARY 
+ MAY ( 
+ eduPersonAffiliation $ eduPersonNickname $ eduPersonOrgDN $ 
+ eduPersonOrgUnitDN $ eduPersonPrimaryAffiliation $ 
+ eduPersonPrincipalName $ eduPersonEntitlement $ eduPersonPrimaryOrgUnitDN $ 
+ eduPersonScopedAffiliation $ eduPersonTargetedID $ eduPersonAssurance $ 
+ eduPersonPrincipalNamePrior $ eduPersonUniqueId $ eduPersonOrcid ) 
+ )

roles/sram_ldap/files/groupOfMembers.ldif

@@ -0,0 +1,19 @@
+# Internet X.500 Schema for Ldappc
+# Includes the groupOfMembers ObjectClass schema
+#
+# Taken from RFC2307bis draft 2
+# https://tools.ietf.org/html/draft-howard-rfc2307bis-02
+#
+# An structural object class, "groupOfMembers" is a convenient container
+# for an extensible set of attributes concerning group memberships.
+#
+dn: cn=groupOfMembers,cn=schema,cn=config
+objectClass: olcSchemaConfig
+cn: groupOfMembers
+olcObjectClasses: ( 1.3.6.1.1.1.2.18 SUP top STRUCTURAL
+  NAME 'groupOfMembers'
+  DESC 'A group with members (DNs)'
+  MUST cn
+  MAY ( businessCategory $ seeAlso $ owner $ ou $ o $
+        description $ member )
+  )

roles/sram_ldap/files/ldap-add

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+
+# Copyright (C) 2015-2019 Maciej Delmanowski <drybjed@gmail.com>
+# Copyright (C) 2015-2019 DebOps <https://debops.org/>
+# SPDX-License-Identifier: GPL-3.0-only
+
+# Check if specified LDAP schema file is loaded in the local slapd cn=config
+# database. If not, try loading it in the server.
+
+
+set -o nounset -o pipefail -o errexit
+
+schema_file="${1}"
+
+if [ -z "${schema_file}" ] ; then
+    printf "Error: You need to specify schema file to load\\n" && exit 1
+fi
+
+if [ ! -e "${schema_file}" ] ; then
+    printf "Error: %s does not exist\\n" "${schema_file}" && exit 1
+fi
+
+if [ ! -r "${schema_file}" ] ; then
+    printf "Error: %s is unreadable\\n" "${schema_file}" && exit 1
+fi
+
+# The schema file is already converted, we can deal with them directly
+if [[ "${schema_file}" == *.ldif ]] ; then
+
+    # Get the DN of the schema
+    schema_dn="$(grep -E '^^dn:\s' "${schema_file}")"
+
+    # Get list of already installed schemas from local LDAP server
+    schema_list() {
+        ldapsearch -Y EXTERNAL -H ldapi:/// -LLLQ -b 'cn=schema,cn=config' dn \
+        | sed -e '/^$/d' -e 's/{[0-9]\+}//'
+    }
+
+    if schema_list | grep -q "${schema_dn}" ; then
+
+        # Schema is already installed, do nothing
+        exit 80
+
+    else
+
+        # Try installing the schema in the database
+        ldapadd -Y EXTERNAL -H ldapi:/// -f "${schema_file}"
+
+    fi
+
+fi

roles/sram_ldap/files/ldapPublicKey.ldif

@@ -0,0 +1,21 @@
+dn: cn=openssh-lpk-openldap,cn=schema,cn=config
+objectClass: olcSchemaConfig
+cn: openssh-lpk-openldap
+#
+# LDAP Public Key Patch schema for use with openssh-ldappubkey
+#                              useful with PKA-LDAP also
+#
+# Author: Eric AUGE <eau@phear.org>
+# 
+# Based on the proposal of : Mark Ruijter
+#
+# octetString SYNTAX
+olcAttributeTypes: ( 1.3.6.1.4.1.24552.500.1.1.1.13 NAME 'sshPublicKey' 
+  DESC 'MANDATORY: OpenSSH Public key' 
+  EQUALITY octetStringMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
+# printableString SYNTAX yes|no
+olcObjectClasses: ( 1.3.6.1.4.1.24552.500.1.1.2.0 NAME 'ldapPublicKey' SUP top AUXILIARY
+  DESC 'MANDATORY: OpenSSH LPK olcObjectClasses:'
+  MUST ( sshPublicKey $ uid ) 
+  )

roles/sram_ldap/files/sczGroup.ldif

@@ -0,0 +1,23 @@
+# Internet X.500 Schema for Ldappc
+# Includes the sczGroup ObjectClass schema
+#
+# An auxiliary object class, "sczGroup," is a convenient container
+# for an extensible set of attributes concerning group memberships.
+# At this time, the only attribute specified as belonging to the
+# object class is "sczMember."
+#
+# It is specifically configured to support the memberOf overlay.
+#
+dn: cn=sczGroup,cn=schema,cn=config
+objectClass: olcSchemaConfig
+cn: sczGroup
+olcAttributeTypes: ( 1.3.6.1.4.1.1076.20.40.50.1.1
+  NAME 'sczMember'
+  DESC 'DN identifiers for entities that are members of the group'
+  EQUALITY distinguishedNameMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+olcObjectClasses: ( 1.3.6.1.4.1.1076.20.40.50.1
+  NAME 'sczGroup'
+  AUXILIARY
+  MAY ( sczMember )
+  )

roles/sram_ldap/files/sramPerson.ldif

@@ -0,0 +1,23 @@
+# Internet X.500 Schema for Ldappc
+# Includes the sramPerson ObjectClass schema
+#
+# An auxiliary object class, "sramPerson," is a convenient container
+# for an extensible set of attributes concerning sram persons.
+# At this time, the only attribute specified as belonging to the
+# object class is "sramInactiveDays".
+#
+dn: cn=sramPerson,cn=schema,cn=config
+objectClass: olcSchemaConfig
+cn: sramPerson
+olcAttributeTypes: ( 1.3.6.1.4.1.1076.20.100.20.2.1 NAME 'sramInactiveDays'
+  DESC 'Number of days this entity was inactive'
+  EQUALITY IntegerMatch
+  ORDERING IntegerOrderingMatch
+  SYNTAX 1.3.6.1.4.1.1466.115.121.1.27
+  )
+olcObjectClasses: ( 1.3.6.1.4.1.1076.20.100.20.1.1 NAME 'sramPerson'
+  AUXILIARY
+  MAY (
+    sramInactiveDays
+    )
+  )

roles/sram_ldap/files/voPerson.ldif

@@ -0,0 +1,44 @@
+dn: cn=voperson,cn=schema,cn=config
+objectClass: olcSchemaConfig
+cn: voperson
+olcAttributeTypes: {0}( 1.3.6.1.4.1.34998.3.3.1.1 NAME 'voPersonApplicationUID
+ ' DESC 'voPerson Application-Specific User Identifier' EQUALITY caseIgnoreMat
+ ch SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' )
+olcAttributeTypes: {1}( 1.3.6.1.4.1.34998.3.3.1.2 NAME 'voPersonAuthorName' DE
+ SC 'voPerson Author Name' EQUALITY caseIgnoreMatch SYNTAX '1.3.6.1.4.1.1466.1
+ 15.121.1.15' )
+olcAttributeTypes: {2}( 1.3.6.1.4.1.34998.3.3.1.3 NAME 'voPersonCertificateDN'
+  DESC 'voPerson Certificate Distinguished Name' EQUALITY distinguishedNameMat
+ ch SYNTAX '1.3.6.1.4.1.1466.115.121.1.12' )
+olcAttributeTypes: {3}( 1.3.6.1.4.1.34998.3.3.1.4 NAME 'voPersonCertificateIss
+ uerDN' DESC 'voPerson Certificate Issuer DN' EQUALITY distinguishedNameMatch 
+ SYNTAX '1.3.6.1.4.1.1466.115.121.1.12' )
+olcAttributeTypes: {4}( 1.3.6.1.4.1.34998.3.3.1.5 NAME 'voPersonExternalID' DE
+ SC 'voPerson Scoped External Identifier' EQUALITY caseIgnoreMatch SYNTAX '1.3
+ .6.1.4.1.1466.115.121.1.15' )
+olcAttributeTypes: {5}( 1.3.6.1.4.1.34998.3.3.1.6 NAME 'voPersonID' DESC 'voPe
+ rson Unique Identifier' EQUALITY caseIgnoreMatch SYNTAX '1.3.6.1.4.1.1466.115
+ .121.1.15' )
+olcAttributeTypes: {6}( 1.3.6.1.4.1.34998.3.3.1.7 NAME 'voPersonPolicyAgreemen
+ t' DESC 'voPerson Policy Agreement Indicator' EQUALITY caseIgnoreMatch SYNTAX
+ '1.3.6.1.4.1.1466.115.121.1.15' )
+olcAttributeTypes: {7}( 1.3.6.1.4.1.34998.3.3.1.8 NAME 'voPersonSoRID' DESC 'v
+ oPerson External Identifier' EQUALITY caseIgnoreMatch SYNTAX '1.3.6.1.4.1.146
+ 6.115.121.1.15' )
+olcAttributeTypes: {8}( 1.3.6.1.4.1.34998.3.3.1.9 NAME 'voPersonStatus' DESC '
+ voPerson Status' EQUALITY caseIgnoreMatch SYNTAX '1.3.6.1.4.1.1466.115.121.1.
+ 15' )
+olcAttributeTypes: {9}( 1.3.6.1.4.1.34998.3.3.1.10 NAME 'voPersonAffiliation' 
+ DESC 'voPerson Affiliation Within Local Scope' EQUALITY caseIgnoreMatch SYNTA
+ X '1.3.6.1.4.1.1466.115.121.1.15' )
+olcAttributeTypes: {10}( 1.3.6.1.4.1.34998.3.3.1.11 NAME 'voPersonExternalAffi
+ liation' DESC 'voPerson Scoped External Affiliation' EQUALITY caseIgnoreMatch
+  SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' )
+olcAttributeTypes: {11}( 1.3.6.1.4.1.34998.3.3.1.12 NAME 'voPersonScopedAffili
+ ation' DESC 'voPerson Affiliation With Explicit Local Scope' EQUALITY caseIgn
+ oreMatch SYNTAX '1.3.6.1.4.1.1466.115.121.1.15' )
+olcObjectClasses: {0}( 1.3.6.1.4.1.34998.3.3.1 NAME 'voPerson' AUXILIARY MAY (
+  voPersonAffiliation $ voPersonApplicationUID $ voPersonAuthorName $ voPerson
+ CertificateDN $ voPersonCertificateIssuerDN $ voPersonExternalAffiliation $ v
+ oPersonExternalID $ voPersonID $ voPersonPolicyAgreement $ voPersonScopedAffi
+ liation $ voPersonSoRID $ voPersonStatus ) )

roles/sram_ldap/handlers/main.yml

@@ -0,0 +1,6 @@
+---
+- name: Restart the ldap container
+  community.docker.docker_container:
+    name: "sram-ldap"
+    restart: true
+    state: started