mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2025-09-24 11:06:24 +02:00
Kevin Veen-Birkenbach
208848579d
- Add handlers/main.yml to load memberof/refint modules and import groups via docker exec - Use OPENLDAP_CONTAINER consistently (replace OPENLDAP_NAME) - Rename tasks/ldifs_creation.yml -> tasks/_ldifs_creation.yml and update includes - Drop default param from get_app_conf calls; add explicit meta: flush_handlers - docker-compose: honor OPENLDAP_NETWORK_EXPOSE_LOCAL | bool; minor formatting - env template: formatting/comments consistency - Remove unused 01_rbac_group.ldif.j2; rename 02_rbac_roles -> 01_rbac_roles and fix filter to LDAP - vars: rename OPENLDAP_NAME -> OPENLDAP_CONTAINER; prune LDIF schema type Conversation: https://chatgpt.com/share/68d1d25d-e788-800f-bfb6-13b1f5bc6121
56 lines
1.8 KiB
YAML
56 lines
1.8 KiB
YAML
---
|
|
# Reset both Database and Configuration Admin passwords in LDAP via LDAPI
|
|
|
|
- name: "Query available LDAP databases"
|
|
shell: |
|
|
docker exec {{ OPENLDAP_CONTAINER }} \
|
|
ldapsearch -Y EXTERNAL -H ldapi:/// -LLL -b cn=config "(olcDatabase=*)" dn
|
|
register: ldap_databases
|
|
|
|
- name: "Determine data backend DN (mdb)"
|
|
set_fact:
|
|
data_backend_dn: >-
|
|
{{ ldap_databases.stdout_lines
|
|
| select('search','^dn: olcDatabase=.*mdb')
|
|
| map('regex_replace','^dn: ','')
|
|
| list
|
|
| first }}
|
|
|
|
- name: "Determine config backend DN"
|
|
set_fact:
|
|
config_backend_dn: >-
|
|
{{ ldap_databases.stdout_lines
|
|
| select('search','^dn: olcDatabase=\{[0-9]+\}config,cn=config$')
|
|
| map('regex_replace','^dn: ','')
|
|
| list
|
|
| first }}
|
|
|
|
- name: "Generate hash for Database Admin password"
|
|
shell: |
|
|
docker exec {{ OPENLDAP_CONTAINER }} \
|
|
slappasswd -s "{{ LDAP.BIND_CREDENTIAL }}"
|
|
register: database_admin_pw_hash
|
|
|
|
- name: "Reset Database Admin password in LDAP (olcRootPW)"
|
|
shell: |
|
|
docker exec -i {{ OPENLDAP_CONTAINER }} ldapmodify -Y EXTERNAL -H ldapi:/// <<EOF
|
|
dn: {{ data_backend_dn }}
|
|
changetype: modify
|
|
replace: olcRootPW
|
|
olcRootPW: {{ database_admin_pw_hash.stdout }}
|
|
EOF
|
|
|
|
- name: "Generate hash for Configuration Admin password"
|
|
shell: |
|
|
docker exec {{ OPENLDAP_CONTAINER }} \
|
|
slappasswd -s "{{ applications | get_app_conf(application_id, 'credentials.administrator_password', True) }}"
|
|
register: config_admin_pw_hash
|
|
|
|
- name: "Reset Configuration Admin password in LDAP (olcRootPW)"
|
|
shell: |
|
|
docker exec -i {{ OPENLDAP_CONTAINER }} ldapmodify -Y EXTERNAL -H ldapi:/// <<EOF
|
|
dn: {{ config_backend_dn }}
|
|
changetype: modify
|
|
replace: olcRootPW
|
|
olcRootPW: {{ config_admin_pw_hash.stdout }}
|
|
EOF |