OpenLDAP

How to create a small OpenLDAP server in a container

In some cases where you need to spin up a small LDAP server for testing or 'temporary production' environments, the following docker-compose stack should fit the bill. This stack will utilize a bootstrap.ldif file to populate the LDAP directory. You may choose to keep this LDAP server without any state (useful for testing) by simply not mounting the data volumes. In such cases, a restart of the container will re-create all users and groups based on the bootstrap.ldif.

This docker-compose stack also includes an instance of PHPLdapAdmin, a web tool that lets you view and manage users and groups. You may remove this if desired by commenting out the lines in the docker-compose.yml file.

Create a docker-compose.yml file with the following contents. Adjust as necessary. Notice the admin LDAP account password is given as an environment variable.

version: '3.3'
services:
  ldap:
    image: osixia/openldap
    restart: always
    volumes:
      - ./config:/container/service/slapd/assets/config/bootstrap/ldif/custom
     # For persistent states, you may also want tot add these volumes
     # - ./data:/var/lib/ldap
     # - ./config:/etc/ldap/slapd.d
    environment:
      - "TZ=MST7MDT,M3.2.0,M11.1.0"
      - LDAP_ORGANISATION=Home
      - LDAP_DOMAIN=home.steamr.com
      - LDAP_ADMIN_PASSWORD=super-secret-password
      - LDAP_TLS="false"
      - LDAP_RFC2307BIS_SCHEMA="true"
    expose:
      - "389"
    ports:
      - "10.1.1.1:389:389"
    networks:
      - internal
    command: --copy-service

  phpldapadmin:
    image: osixia/phpldapadmin:latest
    container_name: phpldapadmin
    environment:
      PHPLDAPADMIN_LDAP_HOSTS: "ldap"
      PHPLDAPADMIN_HTTPS: "false"
    # If you are using traefik as a reverse proxy service...
    #labels:
    #  - traefik.enable=true ... etc
    #expose:
    #  - "80"
    # Otherwise, expose port 80.
    ports:
      - "10.1.1.1:80:80"
    depends_on:
      - ldap
    networks:
      - internal

networks:
  internal:

Next, create your bootstrap.ldif file. This file contains all the users and groups that should be set up when the container starts up. It does not take effect if there are existing data in the /var/lib/ldap location. The admin account can be left out from this file since it will be set up by the container entrypoint script based on the environment variables.

Here's an example file where I create my account in addition to one group.

dn: ou=groups,dc=home,dc=steamr,dc=com
objectclass: organizationalUnit
objectclass: top
ou: groups

dn: cn=downloaders,ou=groups,dc=home,dc=steamr,dc=com
cn: downloaders
gidnumber: 250
objectclass: posixGroup
objectclass: top

ou=users,dc=home,dc=steamr,dc=com
dn: ou=users,dc=home,dc=steamr,dc=com
objectclass: organizationalUnit
objectclass: top
ou: users


dn: cn=leo,ou=users,dc=home,dc=steamr,dc=com
cn: leo
displayname: Leo Leung
gidnumber: 500
givenname: leo
homedirectory: /home/leo
loginshell: /bin/bash
mail: leo@example.com
objectclass: top
objectclass: inetOrgPerson
objectclass: posixAccount
sn: Leung
uid: leo
uidnumber: 500
userpassword: asdfasdf

Bring everything up with docker-compose up -d.

The container will set up an admin account directly in the root of the directory. Once everything is running, you can login to PHPLdapAdmin as cn=admin,dc=example,dc=com using the password set by the LDAP_ADMIN_PASSWORD environment variable.

Anonymous binds are not enabled by default, but you can create a readonly account using the LDAP_READONLY_USER environment variable, which will create a cn=readonly account.

Samba

Edit smb.conf. Under [global], add

1. 1. LDAP Settings

       ldap suffix = dc=domain,dc=tld
       ldap admin dn = cn=Manager,dc=domain,dc=tld

1. ldap ssl = no

       passdb backend = ldapsam:ldaps://dit.domain.tld

https://7thzero.com/blog/configure-centos-7-samba-server-use-secure-ldap-authentication