OpenLDAP

How to create a small OpenLDAP server in a container

In some cases where you need to spin up a small LDAP server for testing or 'temporary production' environments, the following docker-compose stack should fit the bill. This stack will utilize a bootstrap.ldif file to populate the LDAP directory. You may choose to keep this LDAP server without any state (useful for testing) by simply not mounting the data volumes. In such cases, a restart of the container will re-create all users and groups based on the bootstrap.ldif.

This docker-compose stack also includes an instance of PHPLdapAdmin, a web tool that lets you view and manage users and groups. You may remove this if desired by commenting out the lines in the docker-compose.yml file.

Create a docker-compose.yml file with the following contents. Adjust as necessary. Notice the admin LDAP account password is given as an environment variable.

version: '3.3'
services:
  ldap:
    image: osixia/openldap
    restart: always
    volumes:
      - ./config:/container/service/slapd/assets/config/bootstrap/ldif/custom
     # For persistent states, you may also want tot add these volumes
     # - ./data:/var/lib/ldap
     # - ./config:/etc/ldap/slapd.d
    environment:
      - "TZ=MST7MDT,M3.2.0,M11.1.0"
      - LDAP_ORGANISATION=Home
      - LDAP_DOMAIN=home.steamr.com
      - LDAP_ADMIN_PASSWORD=super-secret-password
      - LDAP_TLS="false"
      - LDAP_RFC2307BIS_SCHEMA="true"
    expose:
      - "389"
    ports:
      - "10.1.1.1:389:389"
    networks:
      - internal
    command: --copy-service

  phpldapadmin:
    image: osixia/phpldapadmin:latest
    container_name: phpldapadmin
    environment:
      PHPLDAPADMIN_LDAP_HOSTS: "ldap"
      PHPLDAPADMIN_HTTPS: "false"
    # If you are using traefik as a reverse proxy service...
    #labels:
    #  - traefik.enable=true ... etc
    #expose:
    #  - "80"
    # Otherwise, expose port 80.
    ports:
      - "10.1.1.1:80:80"
    depends_on:
      - ldap
    networks:
      - internal

networks:
  internal:

Next, create your bootstrap.ldif file. This file contains all the users and groups that should be set up when the container starts up. It does not take effect if there are existing data in the /var/lib/ldap location. The admin account can be left out from this file since it will be set up by the container entrypoint script based on the environment variables.

Here's an example file where I create my account in addition to one group.

dn: cn=leo,dc=home,dc=steamr,dc=com
changetype: add
objectClass: top
objectClass: person
objectClass: organizationalPerson
objectclass: inetOrgPerson
objectClass: posixAccount
cn: Leo
givenname: leo
sn: Leung
displayname: Leo Leung
mail: leo@example.com
userpassword: pass
loginShell: /bin/bash
gidNumber: 1000
uidNumber: 1000


dn: cn=leo,ou=Groups,dc=home,dc=steamr,dc=com
changetype: add
cn: leo
objectclass: groupOfUniqueNames
uniqueMember: cn=leo,dc=home,dc=steamr,dc=com

Bring everything up with docker-compose up -d.

You can login to phpldapadmin by authenticating as user 'cn=admin,dc=home,dc=steamr,dc=com' using the password that you passed via the environment variables.

Samba

Edit smb.conf. Under [global], add

1. 1. LDAP Settings

       ldap suffix = dc=domain,dc=tld
       ldap admin dn = cn=Manager,dc=domain,dc=tld

1. ldap ssl = no

       passdb backend = ldapsam:ldaps://dit.domain.tld

https://7thzero.com/blog/configure-centos-7-samba-server-use-secure-ldap-authentication