ldap/README.md

slapd

Slapd offers a LDAP server, which we mostly use for authentication of various services. Therefore, a lot of services have a direct (or indirect) dependency on this image.

Getting the image

This image is automatically build and pushed to the docker hub. Therefore getting the image should be as easy as running

docker pull zombi/ldap

Building slapd

It is also possible to manually build this image from this repository.

docker build -t zombi/ldap .

Running slapd

Copy over example configuration

cp docker-compose.yml{.example,}

run the service

docker-compose up -d

Custom schema

every .ldif or .sh file will be evaluated on server startup, if it's placed inside the '/docker-entrypoint-initdb.d/' directory. This allows you to Specify custom behaviour of the LDAP Server.

By default the server will load the schema from the 'fixtures/' directory, which will provide this features:

• MDB backend for better performance
• Indexing of most referenced attributes by default
• Base structure with People, Groups, Sevices, Domains and Policies.
• Simple but useful ACL rules, allowing users to change their own passwords.
• Password policy for strong cryptographic hashing of user passwords and password rotation.
• Referential integrity for e.g. group memberships.
• Support for core, cosine, nis, inetorgperson, ppolicy and misc schemas.
• Support for user-definable SSH public keys as attributes.
• enforcing of username and user ID uniqueness.

Configuration

The LDAP server can be configured for your organization using the environment variables:

• ROOTPW password for the administration user that is created by default. Make this hard to guess!
• ORGANIZATION Name of the organization running this LDAP server.
• SUFFIX overwrites the root node for all entries. By default this will be 'o=organizationname', but for compatibility you might want to set this to 'dc=domain,dc=tld'.
• DATADIR is the path to the directory containing the LDAP DATA; by default this is '/var/lib/ldap/'.
• CONFDIR points to the path containing the server configuration, by default this is '/etc/ldap/slapd.d'.

Backing up data

State stored in this container is essential to many other services, that use authentication and authorization. Therefore you should think about backing up the LDAP database in regular intervals.

simply copying all the data from data MAY NOT WORK, as there could be race conditions leading to database corruption during the backup. The recommended way is to use the included script for backing up the database into a compact .ldif plain text file.

running contrib/create-ldap-backup.sh will create two files:

• conf.ldif is a backup of the configuration.
• data.ldif contains all the saved datasets.