starred/container-openldap
1
0
Fork 0
mirror of https://github.com/osixia/container-openldap.git synced 2026-11-06 20:48:18 -04:00
Code Issues Packages Projects Releases Wiki Activity

feat(bootstrap): add last successful bind tracking

Browse Source
This commit is contained in:
Bertrand Gouny
2026-10-18 23:29:58 +02:00
parent d7fd334797
commit 8e34fdbc19
11 changed files with 131 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/openldap-bootstrap/assets/ldif/README.md
+1 -1
View File
@@ -65,7 +65,7 @@ Core OpenLDAP configuration applied on every bootstrap. Files are numbered to co
| `40-frontend.ldif.template` | Frontend database (password hash algorithm) |
| `50-config.ldif.template` | Config database (`olcDatabase=config`) with root DN and credentials |
| `59-config-acl-close.ldif` | Closes config ACLs (deny all) |
| `60-database.ldif.template` | Main data database (MDB backend) with indexes |
| `60-database.ldif.template` | Main data database (MDB backend) with indexes and last successful bind settings |
| `65-database-acl.ldif.template` | Data database ACLs (password self-service, basic attributes readable by authenticated users) |
| `69-database-acl-close.ldif` | Closes data ACLs (deny all) |
| `70-monitor.ldif.template` | Monitor database configuration |
services/openldap-bootstrap/assets/ldif/config/base/60-database.ldif.template
+2
View File
@@ -7,6 +7,8 @@ olcSuffix: ${OPENLDAP_BOOTSTRAP_SUFFIX}
olcRootDN: ${OPENLDAP_BOOTSTRAP_DATA_ROOT_DN}
olcRootPW: ${OPENLDAP_BOOTSTRAP_DATA_ROOT_PASSWORD_HASHED}
olcDbMaxSize: ${OPENLDAP_BOOTSTRAP_DATA_DATABASE_MAX_SIZE}
olcLastBind: ${OPENLDAP_BOOTSTRAP_DATA_LAST_BIND}
olcLastBindPrecision: ${OPENLDAP_BOOTSTRAP_DATA_LAST_BIND_PRECISION}
olcDbIndex: objectClass eq
olcDbIndex: uid eq,sub
olcDbIndex: mail eq,sub
services/openldap-bootstrap/assets/scripts/00-base.sh
+2 -1
View File
@@ -40,6 +40,7 @@ if [ "${TYPE}" = "env" ]; then
done
OPENLDAP_BOOTSTRAP_MONITOR_ENABLED=${OPENLDAP_BOOTSTRAP_MONITOR_ENABLED^^}
OPENLDAP_BOOTSTRAP_DATA_LAST_BIND=${OPENLDAP_BOOTSTRAP_DATA_LAST_BIND^^}
OPENLDAP_BOOTSTRAP_ORGANIZATION_DC=$(get_dn_attr dc "${OPENLDAP_BOOTSTRAP_SUFFIX}")
@@ -47,7 +48,7 @@ if [ "${TYPE}" = "env" ]; then
container log fatal "OPENLDAP_BOOTSTRAP_SUFFIX must start with dc= (got ${OPENLDAP_BOOTSTRAP_SUFFIX})"
fi
prepare_env_file "${ENV_FILE}" OPENLDAP_GROUP_GID OPENLDAP_USER_UID OPENLDAP_BOOTSTRAP_CONFIG_ROOT_PASSWORD_HASHED OPENLDAP_BOOTSTRAP_DATA_ROOT_PASSWORD_HASHED OPENLDAP_BOOTSTRAP_MODULES_LDIF OPENLDAP_BOOTSTRAP_SCHEMAS_LDIF OPENLDAP_BOOTSTRAP_MONITOR_ENABLED OPENLDAP_BOOTSTRAP_ORGANIZATION_DC
prepare_env_file "${ENV_FILE}" OPENLDAP_GROUP_GID OPENLDAP_USER_UID OPENLDAP_BOOTSTRAP_CONFIG_ROOT_PASSWORD_HASHED OPENLDAP_BOOTSTRAP_DATA_ROOT_PASSWORD_HASHED OPENLDAP_BOOTSTRAP_MODULES_LDIF OPENLDAP_BOOTSTRAP_SCHEMAS_LDIF OPENLDAP_BOOTSTRAP_MONITOR_ENABLED OPENLDAP_BOOTSTRAP_DATA_LAST_BIND OPENLDAP_BOOTSTRAP_ORGANIZATION_DC
elif [ "${TYPE}" = "ldif" ]; then
SOURCE_DIR="$2"
services/openldap-bootstrap/assets/scripts/README.md
+1 -1
View File
@@ -11,7 +11,7 @@ Scripts are executed in numeric order. Most are feature-gated by an environment
| Script | Trigger | Description |
|--------|---------|-------------|
| `00-base.sh` | always | Core bootstrap: password hashing for root DNs, module and schema setup, base LDIF files |
| `00-base.sh` | always | Core bootstrap: password hashing for root DNs, module and schema setup, last successful bind settings, base LDIF files |
| `10-tls.sh` | `OPENLDAP_BOOTSTRAP_TLS=true` | Applies TLS certificate and protocol configuration |
| `15-tls-required.sh` | `OPENLDAP_BOOTSTRAP_TLS_REQUIRED=true` | Enforces minimum 128-bit SSF (warns if TLS is not also enabled) |
| `20-database-readonly.sh` | `OPENLDAP_BOOTSTRAP_DATA_READONLY=true` | Creates a read-only service account for the data database |