Optimized LDAP. Implemented passwordchange, usernames etc.

roles/docker-ldap/tasks/main.yml

@@ -25,6 +25,10 @@
   
 - include_tasks: "{{ playbook_dir }}/roles/docker-compose/tasks/create-files.yml"
 
+- name: "Reset LDAP admin passwords"
+  include_tasks: reset_admin_passwords.yml
+  when: applications[application_id].network.local
+
 - name: "create directory {{ldif_host_path}}{{item}}"
   file:
     path: "{{ldif_host_path}}{{item}}"
@@ -59,13 +63,13 @@
 ###############################################################################
 - name: Ensure LDAP users exist
   community.general.ldap_entry:
-    dn: "{{ ldap.attributes.user_id }}={{ item.key }},{{ ldap.dn.users }}"
-    server_uri: "{{ ldap_server_uri }}"
-    bind_dn: "{{ ldap.dn.administrator.data }}"
-    bind_pw: "{{ ldap.bind_credential }}"
-    objectClass: "{{ ldap.user_objects.structural }}"
+    dn:           "{{ ldap.attributes.user_id }}={{ item.key }},{{ ldap.dn.users }}"
+    server_uri:   "{{ ldap_server_uri }}"
+    bind_dn:      "{{ ldap.dn.administrator.data }}"
+    bind_pw:      "{{ ldap.bind_credential }}"
+    objectClass:  "{{ ldap.user_objects.structural }}"
     attributes:
-      uid:           "{{ item.key }}" # {{ ldap.attributes.user_id }} can't be used as key here, dynamic key generation isn't possible
+      uid:           "{{ item.value.username }}"
       sn:            "{{ item.value.sn  | default(item.key) }}"
       cn:            "{{ item.value.cn  | default(item.key) }}"
       userPassword:  "{SSHA}{{ item.value.password }}"

roles/docker-ldap/tasks/reset_admin_passwords.yml

@@ -0,0 +1,57 @@
+---
+# Reset both Database and Configuration Admin passwords in LDAP via LDAPI
+# roles/docker-ldap/tasks/reset_admin_passwords.yml
+
+- name: "Query available LDAP databases"
+  shell: |
+    docker exec {{ applications[application_id].hostname }} \
+      ldapsearch -Y EXTERNAL -H ldapi:/// -LLL -b cn=config "(olcDatabase=*)" dn
+  register: ldap_databases
+
+- name: "Determine data backend DN (mdb)"
+  set_fact:
+    data_backend_dn: >-
+      {{ ldap_databases.stdout_lines
+         | select('search','^dn: olcDatabase=.*mdb')
+         | map('regex_replace','^dn: ','')
+         | list
+         | first }}
+
+- name: "Determine config backend DN"
+  set_fact:
+    config_backend_dn: >-
+      {{ ldap_databases.stdout_lines
+         | select('search','^dn: olcDatabase=\{[0-9]+\}config,cn=config$')
+         | map('regex_replace','^dn: ','')
+         | list
+         | first }}
+
+- name: "Generate hash for Database Admin password"
+  shell: |
+    docker exec {{ applications[application_id].hostname }} \
+      slappasswd -s "{{ ldap.bind_credential }}"
+  register: database_admin_pw_hash
+
+- name: "Reset Database Admin password in LDAP (olcRootPW)"
+  shell: |
+    docker exec -i {{ applications[application_id].hostname }} ldapmodify -Y EXTERNAL -H ldapi:/// <<EOF
+    dn: {{ data_backend_dn }}
+    changetype: modify
+    replace: olcRootPW
+    olcRootPW: {{ database_admin_pw_hash.stdout }}
+    EOF
+
+- name: "Generate hash for Configuration Admin password"
+  shell: |
+    docker exec {{ applications[application_id].hostname }} \
+      slappasswd -s "{{ applications[application_id].credentials.administrator_password }}"
+  register: config_admin_pw_hash
+
+- name: "Reset Configuration Admin password in LDAP (olcRootPW)"
+  shell: |
+    docker exec -i {{ applications[application_id].hostname }} ldapmodify -Y EXTERNAL -H ldapi:/// <<EOF
+    dn: {{ config_backend_dn }}
+    changetype: modify
+    replace: olcRootPW
+    olcRootPW: {{ config_admin_pw_hash.stdout }}
+    EOF

roles/docker-mobilizon/vars/configuration.yml

@@ -1,3 +1,6 @@
 titel:        "Mobilizon on {{ primary_domain | upper }}"
 images:
-  mobilizon:  "docker.io/framasoft/mobilizon"
+  mobilizon:  "docker.io/framasoft/mobilizon"
+features:
+  central_database: true
+  oidc:             true