mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2025-08-29 15:06:26 +02:00
Optimized setup routine for memberOf ldap
This commit is contained in:
@@ -0,0 +1,45 @@
|
||||
# MemberOf Overlay Configuration for OpenLDAP
|
||||
#
|
||||
# This file activates the memberOf module and configures the memberOf overlay,
|
||||
# which is required by Nextcloud for proper group management.
|
||||
# @see https://docs.nextcloud.com/server/latest/admin_manual/configuration_user/user_auth_ldap.html
|
||||
# @see https://www.adimian.com/blog/how-to-enable-memberof-using-openldap/
|
||||
#
|
||||
# The first section loads the memberof module from the specified path.
|
||||
# - olcModuleLoad: Specifies that the "memberof" module should be loaded.
|
||||
# - olcModulePath: Provides the full path to the memberof shared object.
|
||||
#
|
||||
# The second section configures the memberOf overlay for the designated database.
|
||||
# - The DN "olcOverlay={0}memberof,olcDatabase={1}hdb,cn=config" sets up the overlay
|
||||
# on the database backend (here assumed to be "hdb").
|
||||
# - olcMemberOfDangling: ignore
|
||||
# Instructs the overlay to ignore references to non-existent objects.
|
||||
# - olcMemberOfRefInt: TRUE
|
||||
# Enables referential integrity so that changes in group membership automatically
|
||||
# update the user's "memberOf" attribute.
|
||||
# - olcMemberOfGroupOC: groupOfNames
|
||||
# Specifies that the overlay applies to groups with the object class "groupOfNames".
|
||||
# - olcMemberOfMemberAD: member
|
||||
# Indicates that the group's membership is stored in the "member" attribute.
|
||||
# - olcMemberOfMemberOfAD: memberOf
|
||||
# Defines that the overlay will maintain the "memberOf" attribute in user entries.
|
||||
#
|
||||
# IMPORTANT: All groups created before enabling this module must be deleted and recreated,
|
||||
# as the overlay only assigns the "member" attribute when a new group is created.
|
||||
dn: cn=module,cn=config
|
||||
cn: module
|
||||
objectClass: olcModuleList
|
||||
olcModuleLoad: memberof
|
||||
olcModulePath: /opt/bitnami/openldap/lib/openldap/memberof.so
|
||||
|
||||
dn: olcOverlay={0}memberof,olcDatabase={1}hdb,cn=config
|
||||
objectClass: olcConfig
|
||||
objectClass: olcMemberOf
|
||||
objectClass: olcOverlayConfig
|
||||
objectClass: top
|
||||
olcOverlay: memberof
|
||||
olcMemberOfDangling: ignore
|
||||
olcMemberOfRefInt: TRUE
|
||||
olcMemberOfGroupOC: groupOfNames
|
||||
olcMemberOfMemberAD: member
|
||||
olcMemberOfMemberOfAD: memberOf
|
||||
@@ -0,0 +1,10 @@
|
||||
# Refint Module Activation for OpenLDAP
|
||||
#
|
||||
# This section adds the refint module to the LDAP configuration.
|
||||
# The refint module ensures referential integrity by automatically updating
|
||||
# or removing references when objects are renamed or deleted.
|
||||
#
|
||||
# In this file, the "olcmoduleload" attribute is used to load the "refint" module.
|
||||
dn: cn=module{1},cn=config
|
||||
add: olcmoduleload
|
||||
olcmoduleload: refint
|
||||
@@ -0,0 +1,23 @@
|
||||
# Refint Overlay Configuration for OpenLDAP
|
||||
#
|
||||
# This file configures the refint overlay for the specified LDAP database.
|
||||
#
|
||||
# The overlay is applied to the database (here using the "hdb" backend) and is
|
||||
# responsible for maintaining referential integrity.
|
||||
#
|
||||
# The attribute "olcRefintAttribute" lists the attributes that will be monitored
|
||||
# for changes. In this case, changes to the following attributes will be tracked:
|
||||
# - memberof
|
||||
# - member
|
||||
# - manager
|
||||
# - owner
|
||||
#
|
||||
# This ensures that any changes in the LDAP directory (such as deletion or modification
|
||||
# of an object) automatically update all references to that object, preventing dangling references.
|
||||
dn: olcOverlay={1}refint,olcDatabase={1}hdb,cn=config
|
||||
objectClass: olcConfig
|
||||
objectClass: olcOverlayConfig
|
||||
objectClass: olcRefintConfig
|
||||
objectClass: top
|
||||
olcOverlay: {1}refint
|
||||
olcRefintAttribute: memberof member manager owner
|
||||
57
roles/docker-ldap/templates/ldif/04_access_roles.ldif.j2
Normal file
57
roles/docker-ldap/templates/ldif/04_access_roles.ldif.j2
Normal file
@@ -0,0 +1,57 @@
|
||||
#######################################################################
|
||||
# This file contains the CyMaIS default roles (converted to posix groups)
|
||||
# Roles define which kind of rights users have.
|
||||
#######################################################################
|
||||
|
||||
#######################################################################
|
||||
# Generic container for IT roles
|
||||
#######################################################################
|
||||
dn: {{dn_roles}}
|
||||
objectClass: organizationalUnit
|
||||
ou: roles
|
||||
description: Container for IT access profiles (for rights management)
|
||||
|
||||
#######################################################################
|
||||
# Role: Super Administrator
|
||||
#######################################################################
|
||||
dn: cn=superadministrator,{{dn_roles}}
|
||||
objectClass: posixGroup
|
||||
cn: superadministrator
|
||||
gidNumber: 1000
|
||||
description: Role: Super Administrator – has full control over all systems and settings.
|
||||
|
||||
#######################################################################
|
||||
# Role: Administrator
|
||||
#######################################################################
|
||||
dn: cn=administrator,{{dn_roles}}
|
||||
objectClass: posixGroup
|
||||
cn: administrator
|
||||
gidNumber: 1001
|
||||
description: Role: Administrator – responsible for overall system management and configuration.
|
||||
|
||||
#######################################################################
|
||||
# Role: Manager
|
||||
#######################################################################
|
||||
dn: cn=manager,{{dn_roles}}
|
||||
objectClass: posixGroup
|
||||
cn: manager
|
||||
gidNumber: 1002
|
||||
description: Role: Manager – oversees operations, approves changes, and coordinates teams.
|
||||
|
||||
#######################################################################
|
||||
# Role: Moderator
|
||||
#######################################################################
|
||||
dn: cn=moderator,{{dn_roles}}
|
||||
objectClass: posixGroup
|
||||
cn: moderator
|
||||
gidNumber: 1003
|
||||
description: Role: Moderator – monitors activity and handles conflict resolution.
|
||||
|
||||
#######################################################################
|
||||
# Role: User
|
||||
#######################################################################
|
||||
dn: cn=user,{{dn_roles}}
|
||||
objectClass: posixGroup
|
||||
cn: user
|
||||
gidNumber: 1004
|
||||
description: Role: User - Uses the software
|
||||
@@ -1,147 +0,0 @@
|
||||
#######################################################################
|
||||
# This file contains the CyMaIS default groups #
|
||||
# Groupps define which kind of applications users have access to #
|
||||
#######################################################################
|
||||
|
||||
#######################################################################
|
||||
# Base container for all role-based groups
|
||||
#######################################################################
|
||||
dn: ou=groups,dc=veen,dc=world
|
||||
objectClass: organizationalUnit
|
||||
ou: groups
|
||||
description: Container for all role-based groups (by function/profession)
|
||||
|
||||
#######################################################################
|
||||
# Role: Administrators
|
||||
#######################################################################
|
||||
dn: cn=administrator,ou=groups,dc=veen,dc=world
|
||||
objectClass: groupOfUniqueNames
|
||||
cn: administrators
|
||||
description: Role: Administrators of this system
|
||||
uniqueMember: cn=dummy,ou=users,dc=veen,dc=world
|
||||
|
||||
#######################################################################
|
||||
# Role: Developer
|
||||
#######################################################################
|
||||
dn: cn=developer,ou=groups,dc=veen,dc=world
|
||||
objectClass: groupOfUniqueNames
|
||||
cn: developer
|
||||
description: Role: Developer and DevOps (coding, automation, CI/CD, etc.)
|
||||
uniqueMember: cn=dummy,ou=users,dc=veen,dc=world
|
||||
|
||||
#######################################################################
|
||||
# Role: Project Manager
|
||||
#######################################################################
|
||||
dn: cn=projectmanager,ou=groups,dc=veen,dc=world
|
||||
objectClass: groupOfUniqueNames
|
||||
cn: projectmanager
|
||||
description: Role: Project Manager and Collaboration (project planning, task management, etc.)
|
||||
uniqueMember: cn=dummy,ou=users,dc=veen,dc=world
|
||||
|
||||
#######################################################################
|
||||
# Role: Communication Specialist
|
||||
#######################################################################
|
||||
dn: cn=communicationspecialist,ou=groups,dc=veen,dc=world
|
||||
objectClass: groupOfUniqueNames
|
||||
cn: communicationspecialist
|
||||
description: Role: Communication Specialist (community management, messaging, social networks, etc.)
|
||||
uniqueMember: cn=dummy,ou=users,dc=veen,dc=world
|
||||
|
||||
#######################################################################
|
||||
# Role: Content Manager
|
||||
#######################################################################
|
||||
dn: cn=contentmanager,ou=groups,dc=veen,dc=world
|
||||
objectClass: groupOfUniqueNames
|
||||
cn: contentmanager
|
||||
description: Role: Content Manager/CMS Administrator (content creation, website management, etc.)
|
||||
uniqueMember: cn=dummy,ou=users,dc=veen,dc=world
|
||||
|
||||
#######################################################################
|
||||
# Role: Marketing Analyst
|
||||
#######################################################################
|
||||
dn: cn=marketinganalyst,ou=groups,dc=veen,dc=world
|
||||
objectClass: groupOfUniqueNames
|
||||
cn: marketinganalyst
|
||||
description: Role: Marketing Analyst (marketing, finance, and analytics)
|
||||
uniqueMember: cn=dummy,ou=users,dc=veen,dc=world
|
||||
|
||||
#######################################################################
|
||||
# Role: DevOps Engineer
|
||||
#######################################################################
|
||||
dn: cn=devopsengineer,ou=groups,dc=veen,dc=world
|
||||
objectClass: groupOfUniqueNames
|
||||
cn: devopsengineer
|
||||
description: Role: DevOps Engineer (continuous integration, deployment, and container orchestration)
|
||||
uniqueMember: cn=dummy,ou=users,dc=veen,dc=world
|
||||
|
||||
#######################################################################
|
||||
# Role: Database Administrator
|
||||
#######################################################################
|
||||
dn: cn=databaseadministrator,ou=groups,dc=veen,dc=world
|
||||
objectClass: groupOfUniqueNames
|
||||
cn: databaseadministrator
|
||||
description: Role: Database Administrator (database management and data integrity)
|
||||
uniqueMember: cn=dummy,ou=users,dc=veen,dc=world
|
||||
|
||||
#######################################################################
|
||||
# Role: Security Specialist
|
||||
#######################################################################
|
||||
dn: cn=securityspecialist,ou=groups,dc=veen,dc=world
|
||||
objectClass: groupOfUniqueNames
|
||||
cn: securityspecialist
|
||||
description: Role: Security Specialist (container security, vulnerability assessments, and compliance)
|
||||
uniqueMember: cn=dummy,ou=users,dc=veen,dc=world
|
||||
|
||||
#######################################################################
|
||||
# Role: Network Administrator
|
||||
#######################################################################
|
||||
dn: cn=networkadministrator,ou=groups,dc=veen,dc=world
|
||||
objectClass: groupOfUniqueNames
|
||||
cn: networkadministrator
|
||||
description: Role: Network Administrator (network configuration, connectivity, and firewall management)
|
||||
uniqueMember: cn=dummy,ou=users,dc=veen,dc=world
|
||||
|
||||
#######################################################################
|
||||
# Role: IT Support Specialist
|
||||
#######################################################################
|
||||
dn: cn=itsupportspecialist,ou=groups,dc=veen,dc=world
|
||||
objectClass: groupOfUniqueNames
|
||||
cn: itsupportspecialist
|
||||
description: Role: IT Support Specialist (technical support and troubleshooting)
|
||||
uniqueMember: cn=dummy,ou=users,dc=veen,dc=world
|
||||
|
||||
#######################################################################
|
||||
# Role: Quality Assurance Engineer
|
||||
#######################################################################
|
||||
dn: cn=qualityassuranceengineer,ou=groups,dc=veen,dc=world
|
||||
objectClass: groupOfUniqueNames
|
||||
cn: qualityassuranceengineer
|
||||
description: Role: Quality Assurance Engineer (testing and ensuring software quality)
|
||||
uniqueMember: cn=dummy,ou=users,dc=veen,dc=world
|
||||
|
||||
#######################################################################
|
||||
# Role: Business Analyst
|
||||
#######################################################################
|
||||
dn: cn=businessanalyst,ou=groups,dc=veen,dc=world
|
||||
objectClass: groupOfUniqueNames
|
||||
cn: businessanalyst
|
||||
description: Role: Business Analyst (analyzing business requirements and translating them into technical needs)
|
||||
uniqueMember: cn=dummy,ou=users,dc=veen,dc=world
|
||||
|
||||
#######################################################################
|
||||
# Role: Product Owner
|
||||
#######################################################################
|
||||
dn: cn=productowner,ou=groups,dc=veen,dc=world
|
||||
objectClass: groupOfUniqueNames
|
||||
cn: productowner
|
||||
description: Role: Product Owner (oversees product strategy and manages feature prioritization)
|
||||
uniqueMember: cn=dummy,ou=users,dc=veen,dc=world
|
||||
|
||||
#######################################################################
|
||||
# Role: Operations Manager
|
||||
#######################################################################
|
||||
dn: cn=operationsmanager,ou=groups,dc=veen,dc=world
|
||||
objectClass: groupOfUniqueNames
|
||||
cn: operationsmanager
|
||||
description: Role: Operations Manager (oversees daily operations and ensures system performance)
|
||||
uniqueMember: cn=dummy,ou=users,dc=veen,dc=world
|
||||
@@ -1,75 +0,0 @@
|
||||
#######################################################################
|
||||
# This file contains the CyMaIS default roles
|
||||
# Roles define which kind of rights users have
|
||||
#######################################################################
|
||||
|
||||
#######################################################################
|
||||
# Generic container for IT roles
|
||||
#######################################################################
|
||||
dn: ou=roles,dc=example,dc=com
|
||||
objectClass: organizationalUnit
|
||||
ou: roles
|
||||
description: Container for generic IT roles (for rights management)
|
||||
|
||||
#######################################################################
|
||||
# Role: Super Administrator
|
||||
#######################################################################
|
||||
dn: cn=superadministrator,ou=roles,dc=example,dc=com
|
||||
objectClass: groupOfUniqueNames
|
||||
cn: superadministrator
|
||||
description: Role: Super Administrator – has full control over all systems and settings.
|
||||
uniqueMember: cn=dummy,ou=users,dc=example,dc=com
|
||||
|
||||
#######################################################################
|
||||
# Role: Administrator
|
||||
#######################################################################
|
||||
dn: cn=administrator,ou=roles,dc=example,dc=com
|
||||
objectClass: groupOfUniqueNames
|
||||
cn: administrator
|
||||
description: Role: Administrator – responsible for overall system management and configuration.
|
||||
uniqueMember: cn=dummy,ou=users,dc=example,dc=com
|
||||
|
||||
#######################################################################
|
||||
# Role: Manager
|
||||
#######################################################################
|
||||
dn: cn=manager,ou=roles,dc=example,dc=com
|
||||
objectClass: groupOfUniqueNames
|
||||
cn: manager
|
||||
description: Role: Manager – oversees operations, approves changes, and coordinates teams.
|
||||
uniqueMember: cn=dummy,ou=users,dc=example,dc=com
|
||||
|
||||
#######################################################################
|
||||
# Role: Moderator
|
||||
#######################################################################
|
||||
dn: cn=moderator,ou=roles,dc=example,dc=com
|
||||
objectClass: groupOfUniqueNames
|
||||
cn: moderator
|
||||
description: Role: Moderator – monitors activity and handles conflict resolution.
|
||||
uniqueMember: cn=dummy,ou=users,dc=example,dc=com
|
||||
|
||||
#######################################################################
|
||||
# Role: Publisher
|
||||
#######################################################################
|
||||
dn: cn=publisher,ou=roles,dc=example,dc=com
|
||||
objectClass: groupOfUniqueNames
|
||||
cn: publisher
|
||||
description: Role: Publisher – responsible for releasing content or updates.
|
||||
uniqueMember: cn=dummy,ou=users,dc=example,dc=com
|
||||
|
||||
#######################################################################
|
||||
# Role: Contributor
|
||||
#######################################################################
|
||||
dn: cn=contributor,ou=roles,dc=veen,dc=world
|
||||
objectClass: groupOfUniqueNames
|
||||
cn: contributor
|
||||
description: Contributor (Allowed to participate, but not to publish)
|
||||
uniqueMember: cn=dummy,ou=users,dc=veen,dc=world
|
||||
|
||||
#######################################################################
|
||||
# Role: Subscriber
|
||||
#######################################################################
|
||||
dn: cn=subscriber,ou=roles,dc=veen,dc=world
|
||||
objectClass: groupOfUniqueNames
|
||||
cn: subscriber
|
||||
description: Subscriber (read-only; manage own profile)
|
||||
uniqueMember: cn=dummy,ou=users,dc=veen,dc=world
|
||||
@@ -1 +0,0 @@
|
||||
# Default users
|
||||
Reference in New Issue
Block a user