Commit message (Collapse) | Author | Age | Files | |
---|---|---|---|---|
* | LDAP: Expose part of the database to Nextcloud. | Guilhem Moulin | 2018-04-04 | 1 |
| | ||||
* | Upgrade playbooks to Ansible 2.0. | Guilhem Moulin | 2016-02-12 | 1 |
| | ||||
* | Upgrade the LDAP config to Jessie. | Guilhem Moulin | 2015-06-07 | 2 |
| | ||||
* | Make the Ansible LDAP plugin able to delete entries and attributes. | Guilhem Moulin | 2015-06-07 | 1 |
| | | | | | Use it to delete cn=admin,dc=fripost,dc=org, and to remove the rootDN on the 'config' database. | |||
* | Fix race condition when generating cerificates for slapd. | Guilhem Moulin | 2015-06-07 | 1 |
| | | | | | The SyncProv won't start if the file olcTLSCACertificateFile points to doesn't exist. | |||
* | Remove o=mailHosting from the LDAP directory suffix. | Guilhem Moulin | 2015-06-07 | 1 |
| | | | | | | So our suffix is now a mere 'dc=fripost,dc=org'. We're also using the default '/var/lib/ldap' as olcDbDirectory (hence we don't clear it before hand). | |||
* | Configure SyncRepl (OpenLDAP replication) and related ACLs. | Guilhem Moulin | 2015-06-07 | 1 |
| | | | | | | | | | | | | | | | | | | | | | | | The clients are identified using their certificate, and connect securely to the SyncProv. There are a few workarounds (XXX) in the ACLs due to Postfix not supporting SASL binds in Wheezy. Overview: - Authentication (XXX: strong authentication) is required prior to any DIT operation (see 'olcRequires'). - We force a Security Strength Factor of 128 or above for all operations (see 'olcSecurity'), meaning one must use either a local connection (eg, ldapi://, possible since we set the 'olcLocalSSF' to 128), or TLS with at least 128 bits of security. - XXX: Services may not simple bind other than locally on a ldapi:// socket. If no remote access is needed, they should use SASL/EXTERNAL on a ldapi:// socket whenever possible (if the service itself supports SASL binds). If remote access is needed, they should use SASL/EXTERNAL on a ldaps:// socket, and their identity should be derived from the CN of the client certificate only (hence services may not simple bind). - Admins have restrictions similar to that of the services. - User access is only restricted by our global 'olcSecurity' attribute. | |||
* | Enable zero-copy updates to the LDAP directory. | Guilhem Moulin | 2015-06-07 | 1 |
| | ||||
* | Configure the LDAP provider. | Guilhem Moulin | 2015-06-07 | 2 |
(Hence the SyncProv overlay.) |