@@ -4,6 +4,14 @@ All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
## [1.2.1] - 2018-05-14
### Security
- The default "write" access to "*" by "self" in the file "config/bootstrap/ldif/02-security.ldif" allowed anyone to change all the data about himself. This includes the gid and uid numbers what could lead to serious security issues.
This has been changed to ```olcAccess: to * by self read by dn="cn=admin,{{ LDAP_BASE_DN }}" write by * none"```
@@ -177,7 +177,7 @@ If you are looking for a simple solution to administrate your ldap server you ca
#### Use auto-generated certificate
By default, TLS is already configured and enabled, certificate is created using container hostname (it can be set by docker run --hostname option eg: ldap.example.org).
docker run --hostname ldap.my-company.com --detach osixia/openldap:1.2.0
docker run --hostname ldap.my-company.com --detach osixia/openldap:1.2.1
#### Use your own certificate
@@ -187,24 +187,24 @@ You can set your custom certificate at run time, by mounting a directory contain
--env LDAP_TLS_CRT_FILENAME=my-ldap.crt \
--env LDAP_TLS_KEY_FILENAME=my-ldap.key \
--env LDAP_TLS_CA_CRT_FILENAME=the-ca.crt \
--detach osixia/openldap:1.2.0
--detach osixia/openldap:1.2.1
Other solutions are available please refer to the [Advanced User Guide](#advanced-user-guide)
#### Disable TLS
Add --env LDAP_TLS=false to the run command:
docker run --env LDAP_TLS=false --detach osixia/openldap:1.2.0
docker run --env LDAP_TLS=false --detach osixia/openldap:1.2.1
### Multi master replication
Quick example, with the default config.
#Create the first ldap server, save the container id in LDAP_CID and get its IP:
LDAP_CID=$(docker run --hostname ldap.example.org --env LDAP_REPLICATION=true --detach osixia/openldap:1.2.0)
LDAP_CID=$(docker run --hostname ldap.example.org --env LDAP_REPLICATION=true --detach osixia/openldap:1.2.1)
Be aware that environment variable added in command line will be available at any time
in the container. In this example if someone manage to open a terminal in this container
@@ -349,14 +349,14 @@ he will be able to read the admin password in clear text from environment variab
For example if your environment files **my-env.yaml** and **my-env.startup.yaml** are in /data/ldap/environment
docker run --volume /data/ldap/environment:/container/environment/01-custom \
--detach osixia/openldap:1.2.0
--detach osixia/openldap:1.2.1
Take care to link your environment files folder to `/container/environment/XX-somedir` (with XX < 99 so they will be processed before default environment files) and not directly to `/container/environment` because this directory contains predefined baseimage environment files to fix container environment (INITRD, LANG, LANGUAGE and LC_CTYPE).
Note: the container will try to delete the **\*.startup.yaml** file after the end of startup files so the file will also be deleted on the docker host. To prevent that : use --volume /data/ldap/environment:/container/environment/01-custom**:ro** or set all variables in **\*.yaml** file and don't use **\*.startup.yaml**:
docker run --volume /data/ldap/environment/my-env.yaml:/container/environment/01-custom/env.yaml \
--detach osixia/openldap:1.2.0
--detach osixia/openldap:1.2.1
#### Make your own image or extend this image
@@ -364,13 +364,13 @@ This is the best solution if you have a private registry. Please refer to the [A
## Advanced User Guide
### Extend osixia/openldap:1.2.0 image
### Extend osixia/openldap:1.2.1 image
If you need to add your custom TLS certificate, bootstrap config or environment files the easiest way is to extends this image.
olcAccess: to attrs=userPassword,shadowLastChange by self write by dn="cn=admin,{{ LDAP_BASE_DN }}" write by anonymous auth by * none
olcAccess: to * by self write by dn="cn=admin,{{ LDAP_BASE_DN }}" write by * none
olcAccess: to * by self read by dn="cn=admin,{{ LDAP_BASE_DN }}" write by * none
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Bertrand Gouny