Bertrand GounyandClaude Opus 5.5
52230d6cd7
- Update the base image to osixia/baseimage:alpine-2.0.0 and build the CI/CD tool with osixia/dagger-build (Go 1.26.9). - Add Dagger integration tests: default bootstrap, alternative schemas, all compatible modules and schemas with every bootstrap feature on a 3-node replicated cluster with TLS required, backup/restore, simulated upgrade and upgrade from previous releases. - Fix bootstrap failing with "Argument list too long" with large schemas: load them with LDIF include: lines, fail on missing schemas. - Default OPENLDAP_BOOTSTRAP_PPOLICY_DEFAULT_CHECK_QUALITY to 1 so pwdMinLength is enforced. - Align the CI workflow with osixia/container-baseimage and add Dependabot. - Document available schemas and modules and their incompatibilities. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
OpenLDAP Schemas
This directory contains optional schemas that can be loaded during bootstrap with OPENLDAP_BOOTSTRAP_SCHEMAS.
Available schemas
All schemas are copied to /etc/openldap/schema:
- OpenLDAP (Alpine package):
collective.ldif,corba.ldif,core.ldif,cosine.ldif,dsee.ldif,duaconf.ldif,dyngroup.ldif,inetorgperson.ldif,java.ldif,misc.ldif,msuser.ldif,namedobject.ldif,nis.ldif,openldap.ldif,pmi.ldif - this directory:
eduperson.ldif,kerberos.ldif,openssh-lpk.ldif,postfix-book.ldif,rfc2307bis.ldif,samba.ldif,sudo.ldif,totp.ldif,virtualMail.ldif
Incompatibilities, all other schemas can be loaded together:
nis.ldifandrfc2307bis.ldif(default);postfix-book.ldifandvirtualMail.ldif;msuser.ldifis provided by OpenLDAP for reference only and cannot be loaded.
eduperson
Academic identity schema used in higher-education federations (students, staff, affiliations, scoped identifiers).
https://github.com/REFEDS/eduperson/blob/master/schema/openldap/eduperson.schema
kerberos
Kerberos LDAP schema for storing principals and Kerberos-related attributes in LDAP-backed KDC setups.
https://github.com/krb5/krb5/blob/master/src/plugins/kdb/ldap/libkdb_ldap/kerberos.schema
openssh-lpk
Adds OpenSSH public key attributes (for example sshPublicKey) to publish SSH keys directly from LDAP.
postfix-book
Postfix Book schema used by docker-mailserver LDAP provisioning. It defines
PostfixBookMailAccount, PostfixBookMailForward, mailEnabled,
mailAlias and mailGroupMember.
Both the traditional OpenLDAP .schema format and the cn=config .ldif
format are provided. Do not load this schema together with virtualMail: they
define several attributes with the same names but different OIDs.
rfc2307bis
Extended RFC2307/NIS-style schema for UNIX account/group integration, including better group/member modeling.
https://dev.gentoo.org/~robbat2/distfiles/rfc2307bis.schema-20120525
Fixed version: https://github.com/shoop/openldap-rfc2307bis/blob/master/rfc2307bis.schema
samba
Samba directory schema for domain/account attributes used by Samba services and legacy domain integration.
https://gitlab.com/samba-team/samba/-/blob/master/examples/LDAP/samba.schema
sudo
Schema for storing sudo rules in LDAP (sudoRole) so sudo policy can be centralized.
https://www.sudo.ws/docs/man/sudoers.ldap.man/
totp
Schema for Time-based One-Time Password (TOTP) secrets and metadata for LDAP-based 2FA workflows.
https://github.com/wheelybird/ldap-totp-schema/blob/main/totp-schema.ldif
virtualMail
Mail-oriented schema for virtual mailbox deployments (mail accounts, aliases, delivery metadata).
Do not load this schema together with postfix-book: they define several
attributes with the same names but different OIDs.
https://github.com/tleuxner/ldap-virtualMail/blob/master/schema.txt