Restructured openldap tasks

roles/svc-db-openldap/config/main.yml

@@ -8,4 +8,11 @@ images:
   openldap:       "bitnami/openldap:latest"
 webinterface:     "lam"                               # The webinterface which should be used. Possible: lam and phpldapadmin
 features:
-  ldap:           true
+  ldap:           true
+import:           
+# Here it's possible to define what can be imported. 
+# It doesn't make sense to let  the import run everytime because its very time consuming
+  credentials:    true 
+  schemas:        true 
+  entries:        true 
+  users:          true

roles/svc-db-openldap/tasks/02_schemas.yml

@@ -0,0 +1,5 @@
+- name: "Include Nextcloud Schema"
+  include_tasks: schemas/nextcloud.yml
+
+- name: "Include openssh-lpk Schema"
+  include_tasks: schemas/openssh_lpk.yml

roles/svc-db-openldap/tasks/03_entries.yml

@@ -0,0 +1,56 @@
+###############################################################################
+# 1) Create the LDAP entry if it does not yet exist
+###############################################################################
+- name: Ensure LDAP users exist
+  community.general.ldap_entry:
+    dn:           "{{ ldap.user.attributes.id }}={{ item.key }},{{ ldap.dn.ou.users }}"
+    server_uri:   "{{ ldap_server_uri }}"
+    bind_dn:      "{{ ldap.dn.administrator.data }}"
+    bind_pw:      "{{ ldap.bind_credential }}"
+    objectClass:  "{{ ldap.user.objects.structural }}"
+    attributes:
+      uid:           "{{ item.value.username }}"
+      sn:            "{{ item.value.sn  | default(item.key) }}"
+      cn:            "{{ item.value.cn  | default(item.key) }}"
+      userPassword:  "{SSHA}{{ item.value.password }}"
+      loginShell:    /bin/bash
+      homeDirectory: "/home/{{ item.key }}"
+      uidNumber:     "{{ item.value.uid | int }}"
+      gidNumber:     "{{ item.value.gid | int }}"
+    state: present            # ↳ creates but never updates
+  async: 60
+  poll: 0
+  loop: "{{ users | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
+
+###############################################################################
+# 2) Keep the objectClass list AND the mail attribute up-to-date
+###############################################################################
+- name: Ensure required objectClass values and mail address are present
+  community.general.ldap_attrs:
+    dn: "{{ ldap.user.attributes.id }}={{ item.key }},{{ ldap.dn.ou.users }}"
+    server_uri: "{{ ldap_server_uri }}"
+    bind_dn: "{{ ldap.dn.administrator.data }}"
+    bind_pw: "{{ ldap.bind_credential }}"
+    attributes:
+      objectClass: "{{ ldap.user.objects.structural }}"
+      mail:        "{{ item.value.email }}"
+    state: exact
+  async: 60
+  poll: 0
+  loop: "{{ users | dict2items }}"
+  loop_control:
+    label: "{{ item.key }}"
+
+- name: "Ensure container for application roles exists"
+  community.general.ldap_entry:
+    dn: "{{ ldap.dn.ou.roles }}"
+    server_uri: "{{ ldap_server_uri }}"
+    bind_dn:  "{{ ldap.dn.administrator.data }}"
+    bind_pw:  "{{ ldap.bind_credential }}"
+    objectClass: organizationalUnit
+    attributes:
+      ou: roles
+      description: Container for application access profiles
+    state: present

roles/svc-db-openldap/tasks/ldifs_creation.yml

@@ -8,4 +8,4 @@
       lookup('fileglob', role_path ~ '/templates/ldif/' ~ folder ~ '/*.j2', wantlist=True)
       | sort
     }}
-  notify: "Import {{ folder }} LDIF files"
+  notify: "Import {{ folder }} LDIF files"

roles/svc-db-openldap/tasks/main.yml

@@ -34,8 +34,8 @@
     timeout: 120
     state: started
 
-- name: "Reset LDAP admin passwords"
+- name: "Reset LDAP Credentials"
-  include_tasks: reset_admin_passwords.yml
+  include_tasks: 01_credentials.yml
   when: applications | get_app_conf(application_id, 'network.local', True)
 
 - name: "create directory {{ldif_host_path}}{{item}}"
@@ -45,8 +45,8 @@
     mode: 0755
   loop: "{{ldif_types}}"
 
-- name: "Process all LDIF types"
+- name: "Import LDIF Configuration"
-  include_tasks: create_ldif_files.yml
+  include_tasks: ldifs_creation.yml
   loop:
     - configuration
   loop_control:
@@ -61,75 +61,18 @@
       - python-ldap
     state: present
 
-- name: "Include Nextcloud Schema"
+- name: "Include Schemas (if enabled)"
-  include_tasks: schemas/nextcloud.yml
+  include_tasks: 02_schemas.yml
 
-- name: "Include openssh-lpk Schema"
+- name: "Import LDAP Entries (if enabled)"
-  include_tasks: schemas/openssh_lpk.yml
+  include_tasks: 03_entries.yml
 
-###############################################################################
+- name: "Import LDIF Data (if enabled)"
-# 1) Create the LDAP entry if it does not yet exist
+  include_tasks: ldifs_creation.yml
-###############################################################################
-- name: Ensure LDAP users exist
-  community.general.ldap_entry:
-    dn:           "{{ ldap.user.attributes.id }}={{ item.key }},{{ ldap.dn.ou.users }}"
-    server_uri:   "{{ ldap_server_uri }}"
-    bind_dn:      "{{ ldap.dn.administrator.data }}"
-    bind_pw:      "{{ ldap.bind_credential }}"
-    objectClass:  "{{ ldap.user.objects.structural }}"
-    attributes:
-      uid:           "{{ item.value.username }}"
-      sn:            "{{ item.value.sn  | default(item.key) }}"
-      cn:            "{{ item.value.cn  | default(item.key) }}"
-      userPassword:  "{SSHA}{{ item.value.password }}"
-      loginShell:    /bin/bash
-      homeDirectory: "/home/{{ item.key }}"
-      uidNumber:     "{{ item.value.uid | int }}"
-      gidNumber:     "{{ item.value.gid | int }}"
-    state: present            # ↳ creates but never updates
-  async: 60
-  poll: 0
-  loop: "{{ users | dict2items }}"
-  loop_control:
-    label: "{{ item.key }}"
-
-###############################################################################
-# 2) Keep the objectClass list AND the mail attribute up-to-date
-###############################################################################
-- name: Ensure required objectClass values and mail address are present
-  community.general.ldap_attrs:
-    dn: "{{ ldap.user.attributes.id }}={{ item.key }},{{ ldap.dn.ou.users }}"
-    server_uri: "{{ ldap_server_uri }}"
-    bind_dn: "{{ ldap.dn.administrator.data }}"
-    bind_pw: "{{ ldap.bind_credential }}"
-    attributes:
-      objectClass: "{{ ldap.user.objects.structural }}"
-      mail:        "{{ item.value.email }}"
-    state: exact
-  async: 60
-  poll: 0
-  loop: "{{ users | dict2items }}"
-  loop_control:
-    label: "{{ item.key }}"
-
-- name: "Ensure container for application roles exists"
-  community.general.ldap_entry:
-    dn: "{{ ldap.dn.ou.roles }}"
-    server_uri: "{{ ldap_server_uri }}"
-    bind_dn:  "{{ ldap.dn.administrator.data }}"
-    bind_pw:  "{{ ldap.bind_credential }}"
-    objectClass: organizationalUnit
-    attributes:
-      ou: roles
-      description: Container for application access profiles
-    state: present
-
-- name: "Process all LDIF types"
-  include_tasks: create_ldif_files.yml
   loop:
     - data
   loop_control:
     loop_var: folder
 
 - name: "Add Objects to all users"
-  include_tasks: add_user_objects.yml
+  include_tasks: 04_user_updates.yml