diff options
| author | Guilhem Moulin <guilhem@fripost.org> | 2013-12-01 22:21:41 +0100 |
|---|---|---|
| committer | Guilhem Moulin <guilhem@fripost.org> | 2015-06-07 02:51:02 +0200 |
| commit | 0c99d9d1600c0fe2c494f9c59ba8ea7966dcd65f (patch) | |
| tree | d97af36efc2f16a7164df52b5663d599196e6a7b /roles/common-LDAP/tasks | |
| parent | ad5c4ebef590371352b4349443a7661fd25301ac (diff) | |
Provision /etc/default/slapd
This is because the UNIX domain socket to connect to when performing
LDAP lookups needs to be in the chroot.
Also, don't open a INET socket unless we're a Sync Provider.
Diffstat (limited to 'roles/common-LDAP/tasks')
| -rw-r--r-- | roles/common-LDAP/tasks/main.yml | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/roles/common-LDAP/tasks/main.yml b/roles/common-LDAP/tasks/main.yml index cb1e835..270924c 100644 --- a/roles/common-LDAP/tasks/main.yml +++ b/roles/common-LDAP/tasks/main.yml @@ -1,67 +1,83 @@ - name: Install OpenLDAP apt: pkg={{ item }} with_items: - slapd - ldap-utils - ldapvi - db-util - python-ldap +- name: Configure slapd + template: src=etc/default/slapd.j2 + dest=/etc/default/slapd + owner=root group=root + mode=0644 + register: r1 + notify: + - Restart slapd + # Upon install slapd create and populate a database under /var/lib/ldap. # We clear it up and create a children directory to get finer-grain # control. - name: Clear empty /var/lib/ldap # Don't remove the database (and fail) if it contains something else # than its suffix or cn=admin,... openldap: dbdirectory=/var/lib/ldap ignoredn=cn=admin state=absent - name: Create directory /var/lib/ldap/fripost file: path=/var/lib/ldap/fripost owner=openldap group=openldap state=directory mode=0700 - name: Copy /var/lib/ldap/fripost/DB_CONFIG copy: src=var/lib/ldap/fripost/DB_CONFIG dest=/var/lib/ldap/fripost/DB_CONFIG owner=openldap group=openldap mode=0600 + register: r2 notify: # Not sure if required - Restart slapd - name: Create directory /etc/ldap/fripost file: path=/etc/ldap/fripost owner=root group=root state=directory mode=0755 - name: Copy fripost database definition template: src=etc/ldap/database.ldif.j2 dest=/etc/ldap/fripost/database.ldif owner=root group=root mode=0600 - name: Copy fripost schema copy: src=etc/ldap/schema/fripost.ldif dest=/etc/ldap/schema/fripost.ldif owner=root group=root mode=0644 - name: Load fripost's schema and configure the database openldap: target=/etc/ldap/{{ item }} state=present with_items: - schema/fripost.ldif # TODO load other required schemas *before* loading the database - fripost/database.ldif - name: Load LDAP modules openldap: module={{ item }}.la state=present with_items: # TODO only if provider - syncprov # TODO only if writable - constraint +- name: Start slapd + service: name=slapd state=started + when: not (r1.changed or r2.changed) + +- meta: flush_handlers + # TODO: authz constraint syncprov syncrepl |