diff --git a/README.md b/README.md index 081cbe1..5d02241 100644 --- a/README.md +++ b/README.md @@ -24,6 +24,27 @@ them are as follows: openldap_serverlocation: Portland openldap_serverorganization: IT + # Create users + openldap_enable_user_creation: true + openldap_server_users: + staff: + william: + password: 26April1564 + fullname: William Shakespeare + givenname: William + surname: Shakespeare + email: william@example.com + shell: /usr/bin/zsh + phone: "555-5555-555" + john: + password: 31Oct1795 + fullname: John Keats + givenname: John + surname: Keats + email: john@example.com + shell: /usr/bin/bash + + Examples -------- @@ -37,7 +58,7 @@ Examples openldap_server_domain_name: example.com openldap_server_rootpw: passme openldap_server_enable_ssl: false - + 2) Configure an OpenLDAP server with SSL: - hosts: all @@ -66,5 +87,3 @@ Author Information ------------------ Benno Joy - - diff --git a/defaults/main.yml b/defaults/main.yml index 51738ad..46cbc16 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -3,7 +3,7 @@ #The domain prefix for ldap openldap_server_domain_name: example.com -#This is the password for admin for openldap +#This is the password for admin for openldap openldap_server_rootpw: passme #The self signed ssl parameters @@ -12,7 +12,26 @@ openldap_server_state: oregon openldap_server_location: portland openldap_server_organization: IT +openldap_server_enable_plain: true openldap_server_enable_ssl: true +openldap_server_enable_ipc: true -#The ldif file -openldap_server_ldif: domain.ldif +# Create group and users +openldap_enable_user_creation: false +openldap_server_users: + staff: + william: + password: 26April1564 + fullname: William Shakespeare + givenname: William + surname: Shakespeare + email: william@example.com + shell: /usr/bin/zsh + phone: "555-5555-555" + john: + password: 31Oct1795 + fullname: John Keats + givenname: John + surname: Keats + email: john@example.com + shell: /usr/bin/bash diff --git a/tasks/add_users.yml b/tasks/add_users.yml new file mode 100644 index 0000000..1a4a3b1 --- /dev/null +++ b/tasks/add_users.yml @@ -0,0 +1,12 @@ +--- + +- name: Create users ldif file + template: src=users.ldif.j2 dest={{ openldap_server_app_path }}/users.ldif + register: users_copy + when: openldap_enable_user_creation + +- name: Add Users + when: users_copy.changed + register: command_result + failed_when: "command_result.rc not in [0,68]" + shell: ldapadd -c -x -D "cn=Manager,dc={{ openldap_server_domain_name.split('.')[0] }},dc={{ openldap_server_domain_name.split('.')[1] }}" -w {{ openldap_server_rootpw }} -f {{ openldap_server_app_path }}/users.ldif diff --git a/tasks/configure_ldap.yml b/tasks/configure_ldap.yml index 12929d6..e330d4f 100644 --- a/tasks/configure_ldap.yml +++ b/tasks/configure_ldap.yml @@ -40,8 +40,12 @@ service: name=slapd state=started enabled=yes - name: Copy the template for creating base dn - template: src={{ openldap_server_ldif }} dest=/tmp/ - register: result + template: src=domain.ldif.j2 dest={{ openldap_server_app_path }}/domain.ldif + register: domain_copy - name: add the base domain - shell: ldapadd -x -D "cn=Manager,dc={{ openldap_server_domain_name.split('.')[0] }},dc={{ openldap_server_domain_name.split('.')[1] }}" -w {{ openldap_server_rootpw }} -f {{ result.dest|default(result.path) }} && touch {{ openldap_server_app_path }}/rootdn_created creates={{ openldap_server_app_path }}/rootdn_created + when: domain_copy.changed + register: command_result + failed_when: "command_result.rc not in [0,68]" + shell: ldapadd -c -x -D "cn=Manager,dc={{ openldap_server_domain_name.split('.')[0] }},dc={{ openldap_server_domain_name.split('.')[1] }}" -w {{ openldap_server_rootpw }} -f {{ openldap_server_app_path }}/domain.ldif + diff --git a/tasks/install_ldap.yml b/tasks/install_ldap.yml index c2aba5e..281bb2d 100644 --- a/tasks/install_ldap.yml +++ b/tasks/install_ldap.yml @@ -5,13 +5,15 @@ - name: Install the openldap and required Packages for RedHat yum: name={{ item }} state=installed - with_items: openldap_server_pkgs + with_items: + - "{{ openldap_server_pkgs }}" when: ansible_os_family == 'RedHat' - name: Install the openldap and required Packages for Ubuntu apt: name={{ item }} state=installed update_cache=yes - with_items: openldap_server_pkgs + with_items: + - "{{ openldap_server_pkgs }}" environment: env when: ansible_os_family == 'Debian' @@ -19,7 +21,8 @@ file: path={{ openldap_server_app_path }}/slapd.d state=absent - name: Generate the root password for ldap - shell: slappasswd -s {{ openldap_server_rootpw }} + shell: slappasswd -h {SHA} -s {{ openldap_server_rootpw }} + changed_when: False register: root_password - name: Copy the slapd.conf configuration file for Redhat @@ -28,6 +31,12 @@ notify: - restart slapd +- name: Copy the /etc/sysconfig/slapd configuration file for Redhat + template: src=sysconfig.slapd.j2 dest=/etc/sysconfig/slapd + when: ansible_os_family == "RedHat" + notify: + - restart slapd + - name: Copy the slapd.conf configuration file template: src=slapd.conf_ubuntu.j2 dest={{ openldap_server_app_path }}/slapd.conf when: ansible_os_family == "Debian" diff --git a/tasks/main.yml b/tasks/main.yml index 9e96d40..ae32310 100644 --- a/tasks/main.yml +++ b/tasks/main.yml @@ -1,3 +1,4 @@ --- - include: install_ldap.yml - include: configure_ldap.yml +- include: add_users.yml diff --git a/templates/domain.ldif b/templates/domain.ldif deleted file mode 100644 index dab1703..0000000 --- a/templates/domain.ldif +++ /dev/null @@ -1,4 +0,0 @@ -dn: dc={{ openldap_server_domain_name.split('.')[0] }},dc={{ openldap_server_domain_name.split('.')[1] }} -objectClass: domain -dc: {{ openldap_server_domain_name.split('.')[0] }} - diff --git a/templates/domain.ldif.j2 b/templates/domain.ldif.j2 new file mode 100644 index 0000000..6c15b39 --- /dev/null +++ b/templates/domain.ldif.j2 @@ -0,0 +1,14 @@ +{% set ldap_domain = 'dc={},dc={}'.format(openldap_server_domain_name.split('.')[0],openldap_server_domain_name.split('.')[1]) %} +dn: {{ ldap_domain }} +objectClass: domain +dc: {{ openldap_server_domain_name.split('.')[0] }} + +dn: ou=Users,{{ ldap_domain }} +ou: Users +objectClass: top +objectClass: organizationalUnit + +dn: ou=Group,{{ ldap_domain }} +ou: Group +objectClass: top +objectClass: organizationalUnit diff --git a/templates/ldap.conf.j2 b/templates/ldap.conf.j2 index 6f8d3fc..229ddd4 100644 --- a/templates/ldap.conf.j2 +++ b/templates/ldap.conf.j2 @@ -6,11 +6,12 @@ # This file should be world readable but not world writable. BASE dc={{ openldap_server_domain_name.split('.')[0] }},dc={{ openldap_server_domain_name.split('.')[1] }} -{% if openldap_server_enable_ssl %} +{% if openldap_server_enable_ipc %} +URI ldapi:/// +{% elif openldap_server_enable_ssl %} URI ldaps://localhost TLS_REQCERT never -{% endif %} -{% if not openldap_server_enable_ssl %} +{% else %} URI ldap://localhost {% endif %} diff --git a/templates/sysconfig.slapd.j2 b/templates/sysconfig.slapd.j2 new file mode 100644 index 0000000..7060ec7 --- /dev/null +++ b/templates/sysconfig.slapd.j2 @@ -0,0 +1 @@ +SLAPD_URLS="{% if openldap_server_enable_plain %}ldap:/// {% endif %}{% if openldap_server_enable_ssl %}ldaps:/// {% endif %}{% if openldap_server_enable_ipc %}ldapi:/// {% endif %}" diff --git a/templates/users.ldif.j2 b/templates/users.ldif.j2 new file mode 100644 index 0000000..d8cbc04 --- /dev/null +++ b/templates/users.ldif.j2 @@ -0,0 +1,40 @@ +{% set ldap_domain = 'dc={},dc={}'.format(openldap_server_domain_name.split('.')[0],openldap_server_domain_name.split('.')[1]) %} +{% if openldap_server_users %} +{%- for group, users in openldap_server_users.items() -%} +{% set guid_loop = loop %} +dn: cn={{ group }},ou=Group,{{ ldap_domain }} +objectClass: posixGroup +cn: {{ group }} +gidNumber: {{ 10000 + guid_loop.index }} +{% for user in users.keys() %} +memberUid: {{ user }} +{% endfor %} + +{% for user, config in users.items() %} +dn: uid={{ user }},ou=Users,{{ ldap_domain }} +{% if 'fullname' in config %} +cn: {{ config['fullname'] }} +{% endif %} +{% if 'givenname' in config %} +givenName: {{ config['givenname'] }} +{% endif %} +{% if 'surname' in config %} +sn: {{ config['surname'] }} +{% endif %} +userPassword: {{ config['password'] }} +mail: {{ config['email'] }} +loginShell: {{ config.get('shell', '/bin/bash') }} +homeDirectory: {{ config.get('home', '/home/{}'.format(user)) }} +{% if 'phone' in config %} +telephoneNumber: {{ config['phone'] }} +{% endif %} +uidNumber: {{ 10000 + loop.index + guid_loop.index * 100 }} +gidNumber: {{ 10000 + guid_loop.index }} +objectClass: inetOrgPerson +objectClass: posixAccount +objectClass: shadowAccount + +{% endfor %} + +{% endfor %} +{% endif %} diff --git a/vars/main.yml b/vars/main.yml index c3fd52f..ab027c5 100644 --- a/vars/main.yml +++ b/vars/main.yml @@ -1,4 +1,3 @@ --- - env: RUNLEVEL: 1