From 21790f63b0648c768af49b29e868a2f39531b2c0 Mon Sep 17 00:00:00 2001 From: Markus Hauschild Date: Mon, 30 Jan 2017 20:00:37 +0100 Subject: [PATCH] Unify ldap-server/mirror into slapd. --- host_vars/helium.binary-kitchen.net | 4 + roles/ldap-server/files/schema/kitchen.schema | 25 - roles/ldap-server/files/schema/radius.schema | 587 ---------------- roles/ldap-server/files/schema/samba.schema | 630 ------------------ roles/ldap-server/files/slapd | 45 -- roles/ldap-server/handlers/main.yml | 4 - roles/ldap-server/tasks/main.yml | 41 -- roles/ldap-server/templates/slapd.conf.j2 | 127 ---- .../files/schema/kitchen.schema | 0 .../files/schema/radius.schema | 0 .../files/schema/samba.schema | 0 roles/{ldap-mirror => slapd}/files/slapd | 0 .../{ldap-mirror => slapd}/handlers/main.yml | 0 roles/{ldap-mirror => slapd}/tasks/main.yml | 7 + .../templates/slapd.conf.j2 | 23 + site.yml | 4 +- 16 files changed, 36 insertions(+), 1461 deletions(-) create mode 100644 host_vars/helium.binary-kitchen.net delete mode 100644 roles/ldap-server/files/schema/kitchen.schema delete mode 100644 roles/ldap-server/files/schema/radius.schema delete mode 100644 roles/ldap-server/files/schema/samba.schema delete mode 100644 roles/ldap-server/files/slapd delete mode 100644 roles/ldap-server/handlers/main.yml delete mode 100644 roles/ldap-server/tasks/main.yml delete mode 100644 roles/ldap-server/templates/slapd.conf.j2 rename roles/{ldap-mirror => slapd}/files/schema/kitchen.schema (100%) rename roles/{ldap-mirror => slapd}/files/schema/radius.schema (100%) rename roles/{ldap-mirror => slapd}/files/schema/samba.schema (100%) rename roles/{ldap-mirror => slapd}/files/slapd (100%) rename roles/{ldap-mirror => slapd}/handlers/main.yml (100%) rename roles/{ldap-mirror => slapd}/tasks/main.yml (87%) rename roles/{ldap-mirror => slapd}/templates/slapd.conf.j2 (83%) diff --git a/host_vars/helium.binary-kitchen.net b/host_vars/helium.binary-kitchen.net new file mode 100644 index 0000000..924d9e2 --- /dev/null +++ b/host_vars/helium.binary-kitchen.net @@ -0,0 +1,4 @@ +--- + +slapd_hostname: ldapm.binary.kitchen +slapd_role: master diff --git a/roles/ldap-server/files/schema/kitchen.schema b/roles/ldap-server/files/schema/kitchen.schema deleted file mode 100644 index 6e5dc83..0000000 --- a/roles/ldap-server/files/schema/kitchen.schema +++ /dev/null @@ -1,25 +0,0 @@ -# Kitchen User schema -# Depends on core and cosine - -# attribute type definitions - -attributetype ( 1.3.6.1.4.1.47496.1.1 NAME 'mailAlternateAddress' - SUBSTR caseIgnoreSubstringsMatch - DESC 'Secondary (alias) mailaddresses for the same user' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) - -attributetype ( 1.3.6.1.4.1.47496.1.2 NAME 'rewMailAddress' - SUBSTR caseIgnoreSubstringsMatch - DESC 'Rewritten Mail Address' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - SINGLE-VALUE ) - -# object class definitions - -objectclass ( 1.3.6.1.4.1.47496.2.1 NAME 'kitchenUser' - DESC 'Binary Kitchen User' - SUP top AUXILIARY - MUST ( mail $ uid ) - MAY ( mailAlternateAddress $ rewMailAddress ) ) diff --git a/roles/ldap-server/files/schema/radius.schema b/roles/ldap-server/files/schema/radius.schema deleted file mode 100644 index 1c855c6..0000000 --- a/roles/ldap-server/files/schema/radius.schema +++ /dev/null @@ -1,587 +0,0 @@ -# This is a LDAPv3 schema for RADIUS attributes. -# Tested on OpenLDAP 2.0.7 -# Posted by Javier Fernandez-Sanguino Pena -# LDAP v3 version by Jochen Friedrich -# Updates by Adrian Pavlykevych -############## - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.1 - NAME 'radiusArapFeatures' - DESC '' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - SINGLE-VALUE - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.2 - NAME 'radiusArapSecurity' - DESC '' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - SINGLE-VALUE - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.3 - NAME 'radiusArapZoneAccess' - DESC '' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - SINGLE-VALUE - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.44 - NAME 'radiusAuthType' - DESC 'checkItem: Auth-Type' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - SINGLE-VALUE - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.4 - NAME 'radiusCallbackId' - DESC 'replyItem: Callback-Id' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - SINGLE-VALUE - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.5 - NAME 'radiusCallbackNumber' - DESC 'replyItem: Callback-Number' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - SINGLE-VALUE - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.6 - NAME 'radiusCalledStationId' - DESC 'checkItem: Called-Station-Id' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - SINGLE-VALUE - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.7 - NAME 'radiusCallingStationId' - DESC 'checkItem: Calling-Station-Id' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - SINGLE-VALUE - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.8 - NAME 'radiusClass' - DESC 'replyItem: Class' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.45 - NAME 'radiusClientIPAddress' - DESC '' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - SINGLE-VALUE - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.9 - NAME 'radiusFilterId' - DESC 'replyItem: Filter-Id' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.10 - NAME 'radiusFramedAppleTalkLink' - DESC 'replyItem: Framed-AppleTalk-Link' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - SINGLE-VALUE - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.11 - NAME 'radiusFramedAppleTalkNetwork' - DESC 'replyItem: Framed-AppleTalk-Network' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.12 - NAME 'radiusFramedAppleTalkZone' - DESC 'replyItem: Framed-AppleTalk-Zone' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - SINGLE-VALUE - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.13 - NAME 'radiusFramedCompression' - DESC 'replyItem: Framed-Compression' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.14 - NAME 'radiusFramedIPAddress' - DESC 'replyItem: Framed-IP-Address' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - SINGLE-VALUE - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.15 - NAME 'radiusFramedIPNetmask' - DESC 'replyItem: Framed-IP-Netmask' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - SINGLE-VALUE - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.16 - NAME 'radiusFramedIPXNetwork' - DESC 'replyItem: Framed-IPX-Network' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - SINGLE-VALUE - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.17 - NAME 'radiusFramedMTU' - DESC 'replyItem: Framed-MTU' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - SINGLE-VALUE - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.18 - NAME 'radiusFramedProtocol' - DESC 'replyItem: Framed-Protocol' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - SINGLE-VALUE - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.19 - NAME 'radiusFramedRoute' - DESC 'replyItem: Framed-Route' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.20 - NAME 'radiusFramedRouting' - DESC 'replyItem: Framed-Routing' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - SINGLE-VALUE - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.46 - NAME 'radiusGroupName' - DESC '' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.47 - NAME 'radiusHint' - DESC '' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - SINGLE-VALUE - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.48 - NAME 'radiusHuntgroupName' - DESC '' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.21 - NAME 'radiusIdleTimeout' - DESC 'replyItem: Idle-Timeout' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - SINGLE-VALUE - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.22 - NAME 'radiusLoginIPHost' - DESC 'replyItem: Login-IP-Host' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.23 - NAME 'radiusLoginLATGroup' - DESC 'replyItem: Login-LAT-Group' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - SINGLE-VALUE - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.24 - NAME 'radiusLoginLATNode' - DESC 'replyItem: Login-LAT-Node' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - SINGLE-VALUE - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.25 - NAME 'radiusLoginLATPort' - DESC 'replyItem: Login-LAT-Port' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - SINGLE-VALUE - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.26 - NAME 'radiusLoginLATService' - DESC 'replyItem: Login-LAT-Service' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - SINGLE-VALUE - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.27 - NAME 'radiusLoginService' - DESC 'replyItem: Login-Service' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - SINGLE-VALUE - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.28 - NAME 'radiusLoginTCPPort' - DESC 'replyItem: Login-TCP-Port' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - SINGLE-VALUE - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.29 - NAME 'radiusPasswordRetry' - DESC '' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - SINGLE-VALUE - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.30 - NAME 'radiusPortLimit' - DESC 'replyItem: Port-Limit' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - SINGLE-VALUE - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.49 - NAME 'radiusProfileDn' - DESC '' - EQUALITY distinguishedNameMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 - SINGLE-VALUE - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.31 - NAME 'radiusPrompt' - DESC '' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - SINGLE-VALUE - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.50 - NAME 'radiusProxyToRealm' - DESC '' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - SINGLE-VALUE - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.51 - NAME 'radiusReplicateToRealm' - DESC '' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - SINGLE-VALUE - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.52 - NAME 'radiusRealm' - DESC '' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - SINGLE-VALUE - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.32 - NAME 'radiusServiceType' - DESC 'replyItem: Service-Type' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - SINGLE-VALUE - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.33 - NAME 'radiusSessionTimeout' - DESC 'replyItem: Session-Timeout' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - SINGLE-VALUE - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.34 - NAME 'radiusTerminationAction' - DESC 'replyItem: Termination-Action' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - SINGLE-VALUE - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.35 - NAME 'radiusTunnelAssignmentId' - DESC '' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.36 - NAME 'radiusTunnelMediumType' - DESC '' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.37 - NAME 'radiusTunnelPassword' - DESC '' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - SINGLE-VALUE - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.38 - NAME 'radiusTunnelPreference' - DESC '' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.39 - NAME 'radiusTunnelPrivateGroupId' - DESC '' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.40 - NAME 'radiusTunnelServerEndpoint' - DESC '' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.41 - NAME 'radiusTunnelType' - DESC '' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.42 - NAME 'radiusVSA' - DESC '' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.43 - NAME 'radiusTunnelClientEndpoint' - DESC '' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - ) - - -#need to change asn1.id -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.53 - NAME 'radiusSimultaneousUse' - DESC 'checkItem: Simultaneous-Use' - SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 - SINGLE-VALUE - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.54 - NAME 'radiusLoginTime' - DESC '' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - SINGLE-VALUE - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.55 - NAME 'radiusUserCategory' - DESC '' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - SINGLE-VALUE - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.56 - NAME 'radiusStripUserName' - DESC '' - SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 - SINGLE-VALUE - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.57 - NAME 'dialupAccess' - DESC '' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - SINGLE-VALUE - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.58 - NAME 'radiusExpiration' - DESC 'checkItem: Expiration' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - SINGLE-VALUE - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.59 - NAME 'radiusCheckItem' - DESC 'checkItem: $GENERIC$' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.60 - NAME 'radiusReplyItem' - DESC 'replyItem: $GENERIC$' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.61 - NAME 'radiusNASIpAddress' - DESC '' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - SINGLE-VALUE - ) - -attributetype - ( 1.3.6.1.4.1.3317.4.3.1.62 - NAME 'radiusReplyMessage' - DESC 'replyItem: Reply-Message' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 - ) - - -objectclass - ( 1.3.6.1.4.1.3317.4.3.2.1 - NAME 'radiusprofile' - SUP top AUXILIARY - DESC '' - MUST cn - MAY ( radiusArapFeatures $ radiusArapSecurity $ radiusArapZoneAccess $ - radiusAuthType $ radiusCallbackId $ radiusCallbackNumber $ - radiusCalledStationId $ radiusCallingStationId $ radiusClass $ - radiusClientIPAddress $ radiusFilterId $ radiusFramedAppleTalkLink $ - radiusFramedAppleTalkNetwork $ radiusFramedAppleTalkZone $ - radiusFramedCompression $ radiusFramedIPAddress $ - radiusFramedIPNetmask $ radiusFramedIPXNetwork $ - radiusFramedMTU $ radiusFramedProtocol $ - radiusCheckItem $ radiusReplyItem $ - radiusFramedRoute $ radiusFramedRouting $ radiusIdleTimeout $ - radiusGroupName $ radiusHint $ radiusHuntgroupName $ - radiusLoginIPHost $ radiusLoginLATGroup $ radiusLoginLATNode $ - radiusLoginLATPort $ radiusLoginLATService $ radiusLoginService $ - radiusLoginTCPPort $ radiusLoginTime $ radiusPasswordRetry $ - radiusPortLimit $ radiusPrompt $ radiusProxyToRealm $ - radiusRealm $ radiusReplicateToRealm $ radiusServiceType $ - radiusSessionTimeout $ radiusStripUserName $ - radiusTerminationAction $ radiusTunnelClientEndpoint $ radiusProfileDn $ - radiusSimultaneousUse $ radiusTunnelAssignmentId $ - radiusTunnelMediumType $ radiusTunnelPassword $ radiusTunnelPreference $ - radiusTunnelPrivateGroupId $ radiusTunnelServerEndpoint $ - radiusTunnelType $ radiusUserCategory $ radiusVSA $ - radiusExpiration $ dialupAccess $ radiusNASIpAddress $ - radiusReplyMessage ) - ) - -objectclass - ( 1.3.6.1.4.1.3317.4.3.2.2 - NAME 'radiusObjectProfile' - SUP top STRUCTURAL - DESC 'A Container Objectclass to be used for creating radius profile object' - MUST cn - MAY ( uid $ userPassword $ description ) - ) diff --git a/roles/ldap-server/files/schema/samba.schema b/roles/ldap-server/files/schema/samba.schema deleted file mode 100644 index 716c191..0000000 --- a/roles/ldap-server/files/schema/samba.schema +++ /dev/null @@ -1,630 +0,0 @@ -## -## schema file for OpenLDAP 2.x -## Schema for storing Samba user accounts and group maps in LDAP -## OIDs are owned by the Samba Team -## -## Prerequisite schemas - uid (cosine.schema) -## - displayName (inetorgperson.schema) -## - gidNumber (nis.schema) -## -## 1.3.6.1.4.1.7165.2.1.x - attributetypes -## 1.3.6.1.4.1.7165.2.2.x - objectclasses -## -## Printer support -## 1.3.6.1.4.1.7165.2.3.1.x - attributetypes -## 1.3.6.1.4.1.7165.2.3.2.x - objectclasses -## -## Samba4 -## 1.3.6.1.4.1.7165.4.1.x - attributetypes -## 1.3.6.1.4.1.7165.4.2.x - objectclasses -## 1.3.6.1.4.1.7165.4.3.x - LDB/LDAP Controls -## 1.3.6.1.4.1.7165.4.4.x - LDB/LDAP Extended Operations -## 1.3.6.1.4.1.7165.4.255.x - mapped OIDs due to conflicts between AD and standards-track -## -## ----- READ THIS WHEN ADDING A NEW ATTRIBUTE OR OBJECT CLASS ------ -## -## Run the 'get_next_oid' bash script in this directory to find the -## next available OID for attribute type and object classes. -## -## $ ./get_next_oid -## attributetype ( 1.3.6.1.4.1.7165.2.1.XX NAME .... -## objectclass ( 1.3.6.1.4.1.7165.2.2.XX NAME .... -## -## Also ensure that new entries adhere to the declaration style -## used throughout this file -## -## ( 1.3.6.1.4.1.7165.2.XX.XX NAME .... -## ^ ^ ^ -## -## The spaces are required for the get_next_oid script (and for -## readability). -## -## ------------------------------------------------------------------ - -# objectIdentifier SambaRoot 1.3.6.1.4.1.7165 -# objectIdentifier Samba3 SambaRoot:2 -# objectIdentifier Samba3Attrib Samba3:1 -# objectIdentifier Samba3ObjectClass Samba3:2 -# objectIdentifier Samba4 SambaRoot:4 - -######################################################################## -## HISTORICAL ## -######################################################################## - -## -## Password hashes -## -#attributetype ( 1.3.6.1.4.1.7165.2.1.1 NAME 'lmPassword' -# DESC 'LanManager Passwd' -# EQUALITY caseIgnoreIA5Match -# SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32} SINGLE-VALUE ) - -#attributetype ( 1.3.6.1.4.1.7165.2.1.2 NAME 'ntPassword' -# DESC 'NT Passwd' -# EQUALITY caseIgnoreIA5Match -# SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32} SINGLE-VALUE ) - -## -## Account flags in string format ([UWDX ]) -## -#attributetype ( 1.3.6.1.4.1.7165.2.1.4 NAME 'acctFlags' -# DESC 'Account Flags' -# EQUALITY caseIgnoreIA5Match -# SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{16} SINGLE-VALUE ) - -## -## Password timestamps & policies -## -#attributetype ( 1.3.6.1.4.1.7165.2.1.3 NAME 'pwdLastSet' -# DESC 'NT pwdLastSet' -# EQUALITY integerMatch -# SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) - -#attributetype ( 1.3.6.1.4.1.7165.2.1.5 NAME 'logonTime' -# DESC 'NT logonTime' -# EQUALITY integerMatch -# SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) - -#attributetype ( 1.3.6.1.4.1.7165.2.1.6 NAME 'logoffTime' -# DESC 'NT logoffTime' -# EQUALITY integerMatch -# SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) - -#attributetype ( 1.3.6.1.4.1.7165.2.1.7 NAME 'kickoffTime' -# DESC 'NT kickoffTime' -# EQUALITY integerMatch -# SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) - -#attributetype ( 1.3.6.1.4.1.7165.2.1.8 NAME 'pwdCanChange' -# DESC 'NT pwdCanChange' -# EQUALITY integerMatch -# SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) - -#attributetype ( 1.3.6.1.4.1.7165.2.1.9 NAME 'pwdMustChange' -# DESC 'NT pwdMustChange' -# EQUALITY integerMatch -# SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) - -## -## string settings -## -#attributetype ( 1.3.6.1.4.1.7165.2.1.10 NAME 'homeDrive' -# DESC 'NT homeDrive' -# EQUALITY caseIgnoreIA5Match -# SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{4} SINGLE-VALUE ) - -#attributetype ( 1.3.6.1.4.1.7165.2.1.11 NAME 'scriptPath' -# DESC 'NT scriptPath' -# EQUALITY caseIgnoreIA5Match -# SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{255} SINGLE-VALUE ) - -#attributetype ( 1.3.6.1.4.1.7165.2.1.12 NAME 'profilePath' -# DESC 'NT profilePath' -# EQUALITY caseIgnoreIA5Match -# SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{255} SINGLE-VALUE ) - -#attributetype ( 1.3.6.1.4.1.7165.2.1.13 NAME 'userWorkstations' -# DESC 'userWorkstations' -# EQUALITY caseIgnoreIA5Match -# SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{255} SINGLE-VALUE ) - -#attributetype ( 1.3.6.1.4.1.7165.2.1.17 NAME 'smbHome' -# DESC 'smbHome' -# EQUALITY caseIgnoreIA5Match -# SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{128} ) - -#attributetype ( 1.3.6.1.4.1.7165.2.1.18 NAME 'domain' -# DESC 'Windows NT domain to which the user belongs' -# EQUALITY caseIgnoreIA5Match -# SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{128} ) - -## -## user and group RID -## -#attributetype ( 1.3.6.1.4.1.7165.2.1.14 NAME 'rid' -# DESC 'NT rid' -# EQUALITY integerMatch -# SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) - -#attributetype ( 1.3.6.1.4.1.7165.2.1.15 NAME 'primaryGroupID' -# DESC 'NT Group RID' -# EQUALITY integerMatch -# SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) - -## -## The smbPasswordEntry objectclass has been depreciated in favor of the -## sambaAccount objectclass -## -#objectclass ( 1.3.6.1.4.1.7165.2.2.1 NAME 'smbPasswordEntry' SUP top AUXILIARY -# DESC 'Samba smbpasswd entry' -# MUST ( uid $ uidNumber ) -# MAY ( lmPassword $ ntPassword $ pwdLastSet $ acctFlags )) - -#objectclass ( 1.3.6.1.4.1.7165.2.2.2 NAME 'sambaAccount' SUP top STRUCTURAL -# DESC 'Samba Account' -# MUST ( uid $ rid ) -# MAY ( cn $ lmPassword $ ntPassword $ pwdLastSet $ logonTime $ -# logoffTime $ kickoffTime $ pwdCanChange $ pwdMustChange $ acctFlags $ -# displayName $ smbHome $ homeDrive $ scriptPath $ profilePath $ -# description $ userWorkstations $ primaryGroupID $ domain )) - -#objectclass ( 1.3.6.1.4.1.7165.2.2.3 NAME 'sambaAccount' SUP top AUXILIARY -# DESC 'Samba Auxiliary Account' -# MUST ( uid $ rid ) -# MAY ( cn $ lmPassword $ ntPassword $ pwdLastSet $ logonTime $ -# logoffTime $ kickoffTime $ pwdCanChange $ pwdMustChange $ acctFlags $ -# displayName $ smbHome $ homeDrive $ scriptPath $ profilePath $ -# description $ userWorkstations $ primaryGroupID $ domain )) - -######################################################################## -## END OF HISTORICAL ## -######################################################################## - -####################################################################### -## Attributes used by Samba 3.0 schema ## -####################################################################### - -## -## Password hashes -## -attributetype ( 1.3.6.1.4.1.7165.2.1.24 NAME 'sambaLMPassword' - DESC 'LanManager Password' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32} SINGLE-VALUE ) - -attributetype ( 1.3.6.1.4.1.7165.2.1.25 NAME 'sambaNTPassword' - DESC 'MD4 hash of the unicode password' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32} SINGLE-VALUE ) - -## -## Account flags in string format ([UWDX ]) -## -attributetype ( 1.3.6.1.4.1.7165.2.1.26 NAME 'sambaAcctFlags' - DESC 'Account Flags' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{16} SINGLE-VALUE ) - -## -## Password timestamps & policies -## -attributetype ( 1.3.6.1.4.1.7165.2.1.27 NAME 'sambaPwdLastSet' - DESC 'Timestamp of the last password update' - EQUALITY integerMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) - -attributetype ( 1.3.6.1.4.1.7165.2.1.28 NAME 'sambaPwdCanChange' - DESC 'Timestamp of when the user is allowed to update the password' - EQUALITY integerMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) - -attributetype ( 1.3.6.1.4.1.7165.2.1.29 NAME 'sambaPwdMustChange' - DESC 'Timestamp of when the password will expire' - EQUALITY integerMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) - -attributetype ( 1.3.6.1.4.1.7165.2.1.30 NAME 'sambaLogonTime' - DESC 'Timestamp of last logon' - EQUALITY integerMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) - -attributetype ( 1.3.6.1.4.1.7165.2.1.31 NAME 'sambaLogoffTime' - DESC 'Timestamp of last logoff' - EQUALITY integerMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) - -attributetype ( 1.3.6.1.4.1.7165.2.1.32 NAME 'sambaKickoffTime' - DESC 'Timestamp of when the user will be logged off automatically' - EQUALITY integerMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) - -attributetype ( 1.3.6.1.4.1.7165.2.1.48 NAME 'sambaBadPasswordCount' - DESC 'Bad password attempt count' - EQUALITY integerMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) - -attributetype ( 1.3.6.1.4.1.7165.2.1.49 NAME 'sambaBadPasswordTime' - DESC 'Time of the last bad password attempt' - EQUALITY integerMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) - -attributetype ( 1.3.6.1.4.1.7165.2.1.55 NAME 'sambaLogonHours' - DESC 'Logon Hours' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{42} SINGLE-VALUE ) - -## -## string settings -## -attributetype ( 1.3.6.1.4.1.7165.2.1.33 NAME 'sambaHomeDrive' - DESC 'Driver letter of home directory mapping' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{4} SINGLE-VALUE ) - -attributetype ( 1.3.6.1.4.1.7165.2.1.34 NAME 'sambaLogonScript' - DESC 'Logon script path' - EQUALITY caseIgnoreMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255} SINGLE-VALUE ) - -attributetype ( 1.3.6.1.4.1.7165.2.1.35 NAME 'sambaProfilePath' - DESC 'Roaming profile path' - EQUALITY caseIgnoreMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255} SINGLE-VALUE ) - -attributetype ( 1.3.6.1.4.1.7165.2.1.36 NAME 'sambaUserWorkstations' - DESC 'List of user workstations the user is allowed to logon to' - EQUALITY caseIgnoreMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{255} SINGLE-VALUE ) - -attributetype ( 1.3.6.1.4.1.7165.2.1.37 NAME 'sambaHomePath' - DESC 'Home directory UNC path' - EQUALITY caseIgnoreMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} ) - -attributetype ( 1.3.6.1.4.1.7165.2.1.38 NAME 'sambaDomainName' - DESC 'Windows NT domain to which the user belongs' - EQUALITY caseIgnoreMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} ) - -attributetype ( 1.3.6.1.4.1.7165.2.1.47 NAME 'sambaMungedDial' - DESC 'Base64 encoded user parameter string' - EQUALITY caseExactMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1050} ) - -attributetype ( 1.3.6.1.4.1.7165.2.1.54 NAME 'sambaPasswordHistory' - DESC 'Concatenated MD5 hashes of the salted NT passwords used on this account' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{32} ) - -## -## SID, of any type -## - -attributetype ( 1.3.6.1.4.1.7165.2.1.20 NAME 'sambaSID' - DESC 'Security ID' - EQUALITY caseIgnoreIA5Match - SUBSTR caseExactIA5SubstringsMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{64} SINGLE-VALUE ) - -## -## Primary group SID, compatible with ntSid -## - -attributetype ( 1.3.6.1.4.1.7165.2.1.23 NAME 'sambaPrimaryGroupSID' - DESC 'Primary Group Security ID' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{64} SINGLE-VALUE ) - -attributetype ( 1.3.6.1.4.1.7165.2.1.51 NAME 'sambaSIDList' - DESC 'Security ID List' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{64} ) - -## -## group mapping attributes -## -attributetype ( 1.3.6.1.4.1.7165.2.1.19 NAME 'sambaGroupType' - DESC 'NT Group Type' - EQUALITY integerMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) - -## -## Store info on the domain -## - -attributetype ( 1.3.6.1.4.1.7165.2.1.21 NAME 'sambaNextUserRid' - DESC 'Next NT rid to give our for users' - EQUALITY integerMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) - -attributetype ( 1.3.6.1.4.1.7165.2.1.22 NAME 'sambaNextGroupRid' - DESC 'Next NT rid to give out for groups' - EQUALITY integerMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) - -attributetype ( 1.3.6.1.4.1.7165.2.1.39 NAME 'sambaNextRid' - DESC 'Next NT rid to give out for anything' - EQUALITY integerMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) - -attributetype ( 1.3.6.1.4.1.7165.2.1.40 NAME 'sambaAlgorithmicRidBase' - DESC 'Base at which the samba RID generation algorithm should operate' - EQUALITY integerMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) - -attributetype ( 1.3.6.1.4.1.7165.2.1.41 NAME 'sambaShareName' - DESC 'Share Name' - EQUALITY caseIgnoreMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SINGLE-VALUE ) - -attributetype ( 1.3.6.1.4.1.7165.2.1.42 NAME 'sambaOptionName' - DESC 'Option Name' - EQUALITY caseIgnoreMatch - SUBSTR caseIgnoreSubstringsMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} ) - -attributetype ( 1.3.6.1.4.1.7165.2.1.43 NAME 'sambaBoolOption' - DESC 'A boolean option' - EQUALITY booleanMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE ) - -attributetype ( 1.3.6.1.4.1.7165.2.1.44 NAME 'sambaIntegerOption' - DESC 'An integer option' - EQUALITY integerMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) - -attributetype ( 1.3.6.1.4.1.7165.2.1.45 NAME 'sambaStringOption' - DESC 'A string option' - EQUALITY caseExactIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE ) - -attributetype ( 1.3.6.1.4.1.7165.2.1.46 NAME 'sambaStringListOption' - DESC 'A string list option' - EQUALITY caseIgnoreMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 ) - - -##attributetype ( 1.3.6.1.4.1.7165.2.1.50 NAME 'sambaPrivName' -## SUP name ) - -##attributetype ( 1.3.6.1.4.1.7165.2.1.52 NAME 'sambaPrivilegeList' -## DESC 'Privileges List' -## EQUALITY caseIgnoreIA5Match -## SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{64} ) - -attributetype ( 1.3.6.1.4.1.7165.2.1.53 NAME 'sambaTrustFlags' - DESC 'Trust Password Flags' - EQUALITY caseIgnoreIA5Match - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 ) - -# "min password length" -attributetype ( 1.3.6.1.4.1.7165.2.1.58 NAME 'sambaMinPwdLength' - DESC 'Minimal password length (default: 5)' - EQUALITY integerMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) - -# "password history" -attributetype ( 1.3.6.1.4.1.7165.2.1.59 NAME 'sambaPwdHistoryLength' - DESC 'Length of Password History Entries (default: 0 => off)' - EQUALITY integerMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) - -# "user must logon to change password" -attributetype ( 1.3.6.1.4.1.7165.2.1.60 NAME 'sambaLogonToChgPwd' - DESC 'Force Users to logon for password change (default: 0 => off, 2 => on)' - EQUALITY integerMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) - -# "maximum password age" -attributetype ( 1.3.6.1.4.1.7165.2.1.61 NAME 'sambaMaxPwdAge' - DESC 'Maximum password age, in seconds (default: -1 => never expire passwords)' - EQUALITY integerMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) - -# "minimum password age" -attributetype ( 1.3.6.1.4.1.7165.2.1.62 NAME 'sambaMinPwdAge' - DESC 'Minimum password age, in seconds (default: 0 => allow immediate password change)' - EQUALITY integerMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) - -# "lockout duration" -attributetype ( 1.3.6.1.4.1.7165.2.1.63 NAME 'sambaLockoutDuration' - DESC 'Lockout duration in minutes (default: 30, -1 => forever)' - EQUALITY integerMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) - -# "reset count minutes" -attributetype ( 1.3.6.1.4.1.7165.2.1.64 NAME 'sambaLockoutObservationWindow' - DESC 'Reset time after lockout in minutes (default: 30)' - EQUALITY integerMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) - -# "bad lockout attempt" -attributetype ( 1.3.6.1.4.1.7165.2.1.65 NAME 'sambaLockoutThreshold' - DESC 'Lockout users after bad logon attempts (default: 0 => off)' - EQUALITY integerMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) - -# "disconnect time" -attributetype ( 1.3.6.1.4.1.7165.2.1.66 NAME 'sambaForceLogoff' - DESC 'Disconnect Users outside logon hours (default: -1 => off, 0 => on)' - EQUALITY integerMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) - -# "refuse machine password change" -attributetype ( 1.3.6.1.4.1.7165.2.1.67 NAME 'sambaRefuseMachinePwdChange' - DESC 'Allow Machine Password changes (default: 0 => off)' - EQUALITY integerMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) - -# -attributetype ( 1.3.6.1.4.1.7165.2.1.68 NAME 'sambaClearTextPassword' - DESC 'Clear text password (used for trusted domain passwords)' - EQUALITY octetStringMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 ) - -# -attributetype ( 1.3.6.1.4.1.7165.2.1.69 NAME 'sambaPreviousClearTextPassword' - DESC 'Previous clear text password (used for trusted domain passwords)' - EQUALITY octetStringMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 ) - -attributetype ( 1.3.6.1.4.1.7165.2.1.70 NAME 'sambaTrustType' - DESC 'Type of trust' - EQUALITY integerMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) - -attributetype ( 1.3.6.1.4.1.7165.2.1.71 NAME 'sambaTrustAttributes' - DESC 'Trust attributes for a trusted domain' - EQUALITY integerMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) - -attributetype ( 1.3.6.1.4.1.7165.2.1.72 NAME 'sambaTrustDirection' - DESC 'Direction of a trust' - EQUALITY integerMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE ) - -attributetype ( 1.3.6.1.4.1.7165.2.1.73 NAME 'sambaTrustPartner' - DESC 'Fully qualified name of the domain with which a trust exists' - EQUALITY caseIgnoreMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} ) - -attributetype ( 1.3.6.1.4.1.7165.2.1.74 NAME 'sambaFlatName' - DESC 'NetBIOS name of a domain' - EQUALITY caseIgnoreMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{128} ) - -attributetype ( 1.3.6.1.4.1.7165.2.1.75 NAME 'sambaTrustAuthOutgoing' - DESC 'Authentication information for the outgoing portion of a trust' - EQUALITY caseExactMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1050} ) - -attributetype ( 1.3.6.1.4.1.7165.2.1.76 NAME 'sambaTrustAuthIncoming' - DESC 'Authentication information for the incoming portion of a trust' - EQUALITY caseExactMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1050} ) - -attributetype ( 1.3.6.1.4.1.7165.2.1.77 NAME 'sambaSecurityIdentifier' - DESC 'SID of a trusted domain' - EQUALITY caseIgnoreIA5Match SUBSTR caseExactIA5SubstringsMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{64} SINGLE-VALUE ) - -attributetype ( 1.3.6.1.4.1.7165.2.1.78 NAME 'sambaTrustForestTrustInfo' - DESC 'Forest trust information for a trusted domain object' - EQUALITY caseExactMatch - SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1050} ) - - -####################################################################### -## objectClasses used by Samba 3.0 schema ## -####################################################################### - -## The X.500 data model (and therefore LDAPv3) says that each entry can -## only have one structural objectclass. OpenLDAP 2.0 does not enforce -## this currently but will in v2.1 - -## -## added new objectclass (and OID) for 3.0 to help us deal with backwards -## compatibility with 2.2 installations (e.g. ldapsam_compat) --jerry -## -objectclass ( 1.3.6.1.4.1.7165.2.2.6 NAME 'sambaSamAccount' SUP top AUXILIARY - DESC 'Samba 3.0 Auxilary SAM Account' - MUST ( uid $ sambaSID ) - MAY ( cn $ sambaLMPassword $ sambaNTPassword $ sambaPwdLastSet $ - sambaLogonTime $ sambaLogoffTime $ sambaKickoffTime $ - sambaPwdCanChange $ sambaPwdMustChange $ sambaAcctFlags $ - displayName $ sambaHomePath $ sambaHomeDrive $ sambaLogonScript $ - sambaProfilePath $ description $ sambaUserWorkstations $ - sambaPrimaryGroupSID $ sambaDomainName $ sambaMungedDial $ - sambaBadPasswordCount $ sambaBadPasswordTime $ - sambaPasswordHistory $ sambaLogonHours)) - -## -## Group mapping info -## -objectclass ( 1.3.6.1.4.1.7165.2.2.4 NAME 'sambaGroupMapping' SUP top AUXILIARY - DESC 'Samba Group Mapping' - MUST ( gidNumber $ sambaSID $ sambaGroupType ) - MAY ( displayName $ description $ sambaSIDList )) - -## -## Trust password for trust relationships (any kind) -## -objectclass ( 1.3.6.1.4.1.7165.2.2.14 NAME 'sambaTrustPassword' SUP top STRUCTURAL - DESC 'Samba Trust Password' - MUST ( sambaDomainName $ sambaNTPassword $ sambaTrustFlags ) - MAY ( sambaSID $ sambaPwdLastSet )) - -## -## Trust password for trusted domains -## (to be stored beneath the trusting sambaDomain object in the DIT) -## -objectclass ( 1.3.6.1.4.1.7165.2.2.15 NAME 'sambaTrustedDomainPassword' SUP top STRUCTURAL - DESC 'Samba Trusted Domain Password' - MUST ( sambaDomainName $ sambaSID $ - sambaClearTextPassword $ sambaPwdLastSet ) - MAY ( sambaPreviousClearTextPassword )) - -## -## Whole-of-domain info -## -objectclass ( 1.3.6.1.4.1.7165.2.2.5 NAME 'sambaDomain' SUP top STRUCTURAL - DESC 'Samba Domain Information' - MUST ( sambaDomainName $ - sambaSID ) - MAY ( sambaNextRid $ sambaNextGroupRid $ sambaNextUserRid $ - sambaAlgorithmicRidBase $ - sambaMinPwdLength $ sambaPwdHistoryLength $ sambaLogonToChgPwd $ - sambaMaxPwdAge $ sambaMinPwdAge $ - sambaLockoutDuration $ sambaLockoutObservationWindow $ sambaLockoutThreshold $ - sambaForceLogoff $ sambaRefuseMachinePwdChange )) - -## -## used for idmap_ldap module -## -objectclass ( 1.3.6.1.4.1.7165.2.2.7 NAME 'sambaUnixIdPool' SUP top AUXILIARY - DESC 'Pool for allocating UNIX uids/gids' - MUST ( uidNumber $ gidNumber ) ) - - -objectclass ( 1.3.6.1.4.1.7165.2.2.8 NAME 'sambaIdmapEntry' SUP top AUXILIARY - DESC 'Mapping from a SID to an ID' - MUST ( sambaSID ) - MAY ( uidNumber $ gidNumber ) ) - -objectclass ( 1.3.6.1.4.1.7165.2.2.9 NAME 'sambaSidEntry' SUP top STRUCTURAL - DESC 'Structural Class for a SID' - MUST ( sambaSID ) ) - -objectclass ( 1.3.6.1.4.1.7165.2.2.10 NAME 'sambaConfig' SUP top AUXILIARY - DESC 'Samba Configuration Section' - MAY ( description ) ) - -objectclass ( 1.3.6.1.4.1.7165.2.2.11 NAME 'sambaShare' SUP top STRUCTURAL - DESC 'Samba Share Section' - MUST ( sambaShareName ) - MAY ( description ) ) - -objectclass ( 1.3.6.1.4.1.7165.2.2.12 NAME 'sambaConfigOption' SUP top STRUCTURAL - DESC 'Samba Configuration Option' - MUST ( sambaOptionName ) - MAY ( sambaBoolOption $ sambaIntegerOption $ sambaStringOption $ - sambaStringListoption $ description ) ) - - -## retired during privilege rewrite -##objectclass ( 1.3.6.1.4.1.7165.2.2.13 NAME 'sambaPrivilege' SUP top AUXILIARY -## DESC 'Samba Privilege' -## MUST ( sambaSID ) -## MAY ( sambaPrivilegeList ) ) - -## -## used for IPA_ldapsam -## -objectclass ( 1.3.6.1.4.1.7165.2.2.16 NAME 'sambaTrustedDomain' SUP top STRUCTURAL - DESC 'Samba Trusted Domain Object' - MUST ( cn ) - MAY ( sambaTrustType $ sambaTrustAttributes $ sambaTrustDirection $ - sambaTrustPartner $ sambaFlatName $ sambaTrustAuthOutgoing $ - sambaTrustAuthIncoming $ sambaSecurityIdentifier $ - sambaTrustForestTrustInfo) ) diff --git a/roles/ldap-server/files/slapd b/roles/ldap-server/files/slapd deleted file mode 100644 index cb6f1b6..0000000 --- a/roles/ldap-server/files/slapd +++ /dev/null @@ -1,45 +0,0 @@ -# Default location of the slapd.conf file or slapd.d cn=config directory. If -# empty, use the compiled-in default (/etc/ldap/slapd.d with a fallback to -# /etc/ldap/slapd.conf). -SLAPD_CONF= - -# System account to run the slapd server under. If empty the server -# will run as root. -SLAPD_USER="openldap" - -# System group to run the slapd server under. If empty the server will -# run in the primary group of its user. -SLAPD_GROUP="openldap" - -# Path to the pid file of the slapd server. If not set the init.d script -# will try to figure it out from $SLAPD_CONF (/etc/ldap/slapd.conf by -# default) -SLAPD_PIDFILE= - -# slapd normally serves ldap only on all TCP-ports 389. slapd can also -# service requests on TCP-port 636 (ldaps) and requests via unix -# sockets. -# Example usage: -# SLAPD_SERVICES="ldap://127.0.0.1:389/ ldaps:/// ldapi:///" -SLAPD_SERVICES="ldap://127.0.0.1:389/ ldaps:/// ldapi:///" - -# If SLAPD_NO_START is set, the init script will not start or restart -# slapd (but stop will still work). Uncomment this if you are -# starting slapd via some other means or if you don't want slapd normally -# started at boot. -#SLAPD_NO_START=1 - -# If SLAPD_SENTINEL_FILE is set to path to a file and that file exists, -# the init script will not start or restart slapd (but stop will still -# work). Use this for temporarily disabling startup of slapd (when doing -# maintenance, for example, or through a configuration management system) -# when you don't want to edit a configuration file. -SLAPD_SENTINEL_FILE=/etc/ldap/noslapd - -# For Kerberos authentication (via SASL), slapd by default uses the system -# keytab file (/etc/krb5.keytab). To use a different keytab file, -# uncomment this line and change the path. -#export KRB5_KTNAME=/etc/krb5.keytab - -# Additional options to pass to slapd -SLAPD_OPTIONS="" diff --git a/roles/ldap-server/handlers/main.yml b/roles/ldap-server/handlers/main.yml deleted file mode 100644 index 9d9efb3..0000000 --- a/roles/ldap-server/handlers/main.yml +++ /dev/null @@ -1,4 +0,0 @@ ---- - -- name: Restart slapd - service: name=slapd state=restarted diff --git a/roles/ldap-server/tasks/main.yml b/roles/ldap-server/tasks/main.yml deleted file mode 100644 index 7b78bb2..0000000 --- a/roles/ldap-server/tasks/main.yml +++ /dev/null @@ -1,41 +0,0 @@ ---- - -- name: Install slapd - apt: name={{ item }} state=present - with_items: - - slapd - - slapd-smbk5pwd - tags: ldap - -- name: Remove slapd.d - file: path=/etc/ldap/slapd.d state=absent - notify: Restart slapd - tags: ldap - -- name: Copy schema definitons - copy: src={{ item }} dest=/etc/ldap/{{ item }} - with_items: - - schema/radius.schema - - schema/samba.schema - - schema/kitchen.schema - notify: Restart slapd - tags: ldap - -- name: Configure slapd (init script) - copy: src=slapd dest=/etc/default/slapd - notify: Restart slapd - tags: ldap - -- name: Configure slapd - template: src=slapd.conf.j2 dest=/etc/ldap/slapd.conf - notify: Restart slapd - tags: ldap - -- name: Ensure certificates are available - command: openssl req -x509 -nodes -newkey rsa:2048 -keyout /etc/ldap/ssl/ldapm.key -out /etc/ldap/ssl/ldapm.crt -days 730 -subj "/CN=ldapm.binary.kitchen" creates=/etc/ldap/ssl/ldapm.crt - notify: Restart slapd - tags: nginx - -- name: Start slapd - service: name=slapd state=started enabled=yes - tags: ldap diff --git a/roles/ldap-server/templates/slapd.conf.j2 b/roles/ldap-server/templates/slapd.conf.j2 deleted file mode 100644 index ea656f6..0000000 --- a/roles/ldap-server/templates/slapd.conf.j2 +++ /dev/null @@ -1,127 +0,0 @@ -# -# See slapd.conf(5) for details on configuration options. -# This file should NOT be world readable. -# - -####################################################################### -# Schemas -####################################################################### - -include /etc/ldap/schema/core.schema -include /etc/ldap/schema/cosine.schema -include /etc/ldap/schema/inetorgperson.schema -include /etc/ldap/schema/kitchen.schema -include /etc/ldap/schema/nis.schema -include /etc/ldap/schema/misc.schema -include /etc/ldap/schema/samba.schema -include /etc/ldap/schema/radius.schema - - -####################################################################### -# Files, logging, modules -####################################################################### - -pidfile /var/run/slapd/slapd.pid -argsfile /var/run/slapd/slapd.args - -#loglevel stats sync -loglevel sync - -# Load dynamic backend modules: -modulepath /usr/lib/ldap -moduleload back_hdb.la -moduleload syncprov.la - -# Sample security restrictions -# Require integrity protection (prevent hijacking) -# Require 112-bit (3DES or better) encryption for updates -# Require 63-bit encryption for simple bind -# security ssf=1 update_ssf=112 simple_bind=64 - - -####################################################################### -# ACL -####################################################################### - -access to dn.base="" by * read -access to dn.base="cn=Subschema" by * read -access to attrs=userPassword - by self write - by anonymous auth - by * read -access to attrs=loginShell - by self write - by users read - by * read -access to * - by self read - by users read - by * none - - -####################################################################### -# TLS -####################################################################### - -TLSCertificateFile /etc/ldap/ssl/ldapm.crt -TLSCertificateKeyFile /etc/ldap/ssl/ldapm.key -TLSCACertificateFile {{ ldap_ca }} -TLSCipherSuite NORMAL -TLSVerifyClient never - - -####################################################################### -# BDB database definitions -####################################################################### - -database hdb -suffix "{{ ldap_base }}" -# -checkpoint 32 30 -rootdn "cn=Manager,dc=binary-kitchen,dc=de" -rootpw {SSHA}47Ywo8cJtaDsUEsV1P9kfqCA2YA212Sb -# The database directory MUST exist prior to running slapd AND -# should only be accessible by the slapd and slap tools. -# Mode 700 recommended. -directory /var/lib/ldap - - -####################################################################### -# Indices -####################################################################### - -index objectClass eq - -# Replication related -index entryCSN eq -index entryUUID eq - -# Posix Users/Groups -index cn eq -index gidNumber eq -index memberUid eq -index uid eq -index uidNumber eq - -# Mail -index mail eq -index mailAlternateAddress eq - - -####################################################################### -# Replication -####################################################################### - -overlay syncprov -syncprov-checkpoint 10 1 -syncprov-sessionlog 100 - - -####################################################################### -# Samba Password Sync -####################################################################### - -moduleload smbk5pwd.so -overlay smbk5pwd -smbk5pwd-enable samba -smbk5pwd-must-change 0 diff --git a/roles/ldap-mirror/files/schema/kitchen.schema b/roles/slapd/files/schema/kitchen.schema similarity index 100% rename from roles/ldap-mirror/files/schema/kitchen.schema rename to roles/slapd/files/schema/kitchen.schema diff --git a/roles/ldap-mirror/files/schema/radius.schema b/roles/slapd/files/schema/radius.schema similarity index 100% rename from roles/ldap-mirror/files/schema/radius.schema rename to roles/slapd/files/schema/radius.schema diff --git a/roles/ldap-mirror/files/schema/samba.schema b/roles/slapd/files/schema/samba.schema similarity index 100% rename from roles/ldap-mirror/files/schema/samba.schema rename to roles/slapd/files/schema/samba.schema diff --git a/roles/ldap-mirror/files/slapd b/roles/slapd/files/slapd similarity index 100% rename from roles/ldap-mirror/files/slapd rename to roles/slapd/files/slapd diff --git a/roles/ldap-mirror/handlers/main.yml b/roles/slapd/handlers/main.yml similarity index 100% rename from roles/ldap-mirror/handlers/main.yml rename to roles/slapd/handlers/main.yml diff --git a/roles/ldap-mirror/tasks/main.yml b/roles/slapd/tasks/main.yml similarity index 87% rename from roles/ldap-mirror/tasks/main.yml rename to roles/slapd/tasks/main.yml index 4a40284..37d1481 100644 --- a/roles/ldap-mirror/tasks/main.yml +++ b/roles/slapd/tasks/main.yml @@ -6,6 +6,13 @@ - slapd tags: ldap +- name: Install slapd + apt: name={{ item }} state=present + with_items: + - slapd-smbk5pwd + when: slapd_role == "master" + tags: ldap + - name: Remove slapd.d file: path=/etc/ldap/slapd.d state=absent notify: Restart slapd diff --git a/roles/ldap-mirror/templates/slapd.conf.j2 b/roles/slapd/templates/slapd.conf.j2 similarity index 83% rename from roles/ldap-mirror/templates/slapd.conf.j2 rename to roles/slapd/templates/slapd.conf.j2 index 423d3af..fd6931e 100644 --- a/roles/ldap-mirror/templates/slapd.conf.j2 +++ b/roles/slapd/templates/slapd.conf.j2 @@ -30,6 +30,9 @@ loglevel sync # Load dynamic backend modules: modulepath /usr/lib/ldap moduleload back_hdb.la +{% if slapd_role == 'master' %} +moduleload syncprov.la +{% endif %} # Sample security restrictions # Require integrity protection (prevent hijacking) @@ -107,6 +110,25 @@ index mail eq index mailAlternateAddress eq +{% if slapd_role == 'master' %} +####################################################################### +# Replication +####################################################################### + +overlay syncprov +syncprov-checkpoint 10 1 +syncprov-sessionlog 100 + + +####################################################################### +# Samba Password Sync +####################################################################### + +moduleload smbk5pwd.so +overlay smbk5pwd +smbk5pwd-enable samba +smbk5pwd-must-change 0 +{% elif slapd_role == 'slave' %} ####################################################################### # Replication Consumer ####################################################################### @@ -120,3 +142,4 @@ syncrepl rid=1 bindmethod=simple credentials="aise7Aap9umu" tls_reqcert=demand +{% endif %} diff --git a/site.yml b/site.yml index 087b8f2..bcd9e56 100644 --- a/site.yml +++ b/site.yml @@ -11,7 +11,7 @@ roles: - dns - dhcpd - - ldap-mirror + - slapd - name: Setup BK member server hosts: sulis.binary.kitchen @@ -28,7 +28,7 @@ - name: Setup ldap server hosts: helium.binary-kitchen.net roles: - - ldap-server + - slapd - name: Setup mail server hosts: lithium.binary-kitchen.net