#!/bin/sh
: ${slapd_root_dn:='cn=admin'}
: ${slapd_replicator_dn:="cn=replicator,${basedn}"}
: ${slapd_result_size_limit:='10000'}
: ${slapd_db_max_size:='1073741824'} # 1 GB
: ${slapd_accesslog_db_max_size:='134217728'} # 128 MB
: ${slapd_syncrepl_checkpoint_ops:='100'}
: ${slapd_syncrepl_checkpoint_minutes:='10'}
: ${slapd_syncrepl_session_log:='1000'}
: ${slapd_syncrepl_cleanup_age:='7'}
: ${slapd_syncrepl_cleanup_interval:='1'}
: ${slapd_admin_role:='role-ldap-admin'}
slapd_user=ldap
slapd_data_dir=/var/db/openldap-data
slapd_conf_dir=/usr/local/etc/openldap
slapd_socket=/var/run/openldap/ldapi
slapd_ldapi_uri="ldapi://$(echo "$slapd_socket" | sed 's|/|%2f|g')"
slapd_tls_cert="${slapd_conf_dir}/slapd.crt"
slapd_tls_key="${slapd_conf_dir}/slapd.key"
slapd_replicator_tls_cert="${slapd_conf_dir}/replicator.crt"
slapd_replicator_tls_key="${slapd_conf_dir}/replicator.key"
slapd_keytab="${keytab_dir}/slapd.keytab"
is_primary_server(){
# Return 0 if the current hostname is equal to $idm_primary_server.
# If $idm_primary_server is unset, use the first hostname in $idm_server_list.
_primary="${idm_primary_server:-$(echo "$idm_server_list" | awk 'NR==1{print $1}')}"
test "$BOXCONF_HOSTNAME" = "$_primary"
}
pkg install -y \
openldap26-server \
cyrus-sasl-saslauthd
# Create ZFS dataset for OpenLDAP DB.
create_dataset -o "mountpoint=${slapd_data_dir}" "${state_dataset}/openldap-data"
# To prevent a circular dependency in poudriere, we have to make a special "set"
# of packages for the IDM hosts in which cyrus-sasl-gssapi is built with the
# Heimdal libraries in base, rather than MIT.
#
# Heimdal does not support the KRB5_KTNAME environment variable with slapd.
# However, you *can* specify a keytab by creating a ~/.krb5/config file in
# the slapd user's home directory.
pw user mod "$slapd_user" -d "$slapd_conf_dir"
install_directory -m 0755 "${slapd_conf_dir}/.krb5"
install_template -m 0644 "${slapd_conf_dir}/.krb5/config"
# Copy TLS certificate for LDAP server.
install_certificate -o "$slapd_user" -g "$slapd_user" slapd "$slapd_tls_cert"
install_certificate_key -o "$slapd_user" -g "$slapd_user" slapd "$slapd_tls_key"
# Copy client certificate for LDAP replication.
install_certificate -o "$slapd_user" -g "$slapd_user" replicator "$slapd_replicator_tls_cert"
install_certificate_key -o "$slapd_user" -g "$slapd_user" replicator "$slapd_replicator_tls_key"
# Copy LDIF for the cn=config database.
install_template -m 0600 "${slapd_conf_dir}/slapd.ldif"
# Copy third-party schema files.
install_file -m 0644 \
"${slapd_conf_dir}/schema/rfc2307bis.ldif" \
"${slapd_conf_dir}/schema/kerberos.ldif" \
"${slapd_conf_dir}/schema/openssh-lpk.ldif" \
"${slapd_conf_dir}/schema/sudo.ldif" \
"${slapd_conf_dir}/schema/dnsdomain2.ldif" \
"${slapd_conf_dir}/schema/mailservice.ldif"
# Create the directories for the LDAP databases.
install_directory -m 0770 -o "$slapd_user" -g "$slapd_user" \
"${slapd_data_dir}" \
"${slapd_data_dir}/accesslog"
# If slapd.d doesn't exist, populate it with slapd.ldif.
if [ ! -d "${slapd_conf_dir}/slapd.d" ]; then
install_directory -m 0700 -o "$slapd_user" "${slapd_conf_dir}/slapd.d"
slapadd -v -n0 -F "${slapd_conf_dir}/slapd.d" -l "${slapd_conf_dir}/slapd.ldif"
chown -R "${slapd_user}:${slapd_user}" "${slapd_conf_dir}/slapd.d"
fi
# Copy the LDAP client configs.
install_template -m 0644 "${slapd_conf_dir}/ldap.conf"
# Copy slapd SASL configuration.
install_template -m 0644 /usr/local/lib/sasl2/slapd.conf
# Allow slapd to read the saslauthd socket.
install_directory -m 0750 -o "$saslauthd_user" -g "$slapd_user" "$saslauthd_runtime_dir"
# Enable OpenLDAP in /etc/rc.conf, and start it.
# Note: whatever LDAP IP you specified in $slapd_server_list must be present in
# the `-h` argument to slapd. That's how slapd figures out its own server ID.
sysrc -v \
slapd_enable=YES \
slapd_cn_config=YES \
slapd_flags="-h '${slapd_ldapi_uri}/ ldap://0.0.0.0/ ldaps://0.0.0.0/ ldaps://${BOXCONF_DEFAULT_IPV4}/'" \
slapd_sockets="$slapd_socket" \
slapd_krb5_ktname="$slapd_keytab" \
saslauthd_flags='-a kerberos5' \
saslauthd_enable=YES
service saslauthd restart
service slapd restart
# Create directory tree.
if is_primary_server; then
# dc=example,dc=com
ldap_add "$basedn" <<EOF
objectClass: dcObject
objectClass: organization
dc: $(ldap_rdn_value "$basedn")
o: ${site}
EOF
# ou=accounts,dc=example,dc=com
ldap_add "$accounts_basedn" <<EOF
objectClass: organizationalUnit
ou: $(ldap_rdn_value "$accounts_basedn")
EOF
# ou=users,ou=accounts,dc=example,dc=com
ldap_add "$users_basedn" <<EOF
objectClass: organizationalUnit
ou: $(ldap_rdn_value "$users_basedn")
EOF
# ou=people,ou=users,ou=accounts,dc=example,dc=com
ldap_add "$people_basedn" <<EOF
objectClass: organizationalUnit
ou: $(ldap_rdn_value "$people_basedn")
EOF
# ou=robots,ou=users,ou=accounts,dc=example,dc=com
ldap_add "$robots_basedn" <<EOF
objectClass: organizationalUnit
ou: $(ldap_rdn_value "$robots_basedn")
EOF
# ou=hosts,ou=accounts,dc=example,dc=com
ldap_add "$hosts_basedn" <<EOF
objectClass: organizationalUnit
ou: $(ldap_rdn_value "$hosts_basedn")
EOF
# ou=services,ou=accounts,dc=example,dc=com
ldap_add "$services_basedn" <<EOF
objectClass: organizationalUnit
ou: $(ldap_rdn_value "$services_basedn")
EOF
# ou=groups,ou=accounts,dc=example,dc=com
ldap_add "$groups_basedn" <<EOF
objectClass: organizationalUnit
ou: $(ldap_rdn_value "$groups_basedn")
EOF
# ou=userprivate,ou=groups,ou=accounts,dc=example,dc=com
ldap_add "$private_groups_basedn" <<EOF
objectClass: organizationalUnit
ou: $(ldap_rdn_value "$private_groups_basedn")
EOF
# ou=roles,ou=groups,ou=accounts,dc=example,dc=com
ldap_add "$roles_basedn" <<EOF
objectClass: organizationalUnit
ou: $(ldap_rdn_value "$roles_basedn")
EOF
# cn=role-ldap-admin,ou=roles,ou=groups,ou=accounts,dc=example,dc=com
ldap_add "cn=${slapd_admin_role},${roles_basedn}" <<EOF
objectClass: groupOfMembers
cn: ${slapd_admin_role}
EOF
# ou=automount,dc=example,dc=com
ldap_add "$automount_basedn" <<EOF
objectClass: organizationalUnit
ou: $(ldap_rdn_value "$automount_basedn")
EOF
# ou=sudo,dc=example,dc=com
ldap_add "$sudo_basedn" <<EOF
objectClass: organizationalUnit
ou: $(ldap_rdn_value "$sudo_basedn")
EOF
fi
